Privacy Policy - Australia

Privacy Policy - Australia

Table of Contents
1.

Introduction

3

2.

Scope

3

3.

Personal Information

33.1

Sensitive Information

44.

Collection of Personal Information

45.

Storage of Personal Information

5

6.

Accessing your Information

5

7.

Retention of Personal Information

58.

Disclosure, Sharing and Transfer of Personal Information Overseas

59.

Security of Personal Information

6

10.

Consent6

11.

Updates to the Data Protection Policy

6

12.

Third Party Websites

7

13.

Complaints

7

14.

ANNEXURE A – Notifiable Data Breaches (‘NDB’) Policy

8

14.1 What is an Eligible Data Breach (EDB)?

814.2 What is a Data Breach?

814.3 Serious Harm

914.4 Types of Personal Data and Serious Harm

9

14.5 Reporting a Data Breach9

14.6 The OAIC Form for lodging Statements to the Commissioner

914.7 Notifying AUSTRAC or the ACSC of an EDB

9

CLSA Australia Pty Ltd (Nov 2023)

2

Privacy Policy - Australia
1. Introduction
CLSA Australia Pty Ltd (”CLSA APL”) recognises the importance of the personal information (as defined inAustralian Privacy Act 1988) we hold about you or any natural persons’ personal information provided byyou and the trust they place in us.
By explaining our Privacy Policy (“Policy”) to you, we hope that you will better understand how we keep
personal information private and secure while using it to provide services and products.
We are committed to safeguarding your personal information in accordance with the requirements of theAustralian Privacy Act 1988, Privacy Regulation 2013, Australian Privacy Principles contained in the AustralianPrivacy Act 1988 and the Australian Notifiable Data Breaches scheme and any other applicable personal
information protection rules or laws, which all regulate the way individual’s personal information is handled(“personal information protection laws”).
In general, we will not use or disclose such information collected about you otherwise than for the purposes
set out in this Policy, for a purpose you would reasonably expect, a purpose required or permitted by law,or a purpose otherwise disclosed to, or authorised by you.
2. Scope
This Policy applies to the Australian operations of the CLSA group unless specifically stated otherwise andcaptures all employees, contractors and other authorised third parties who have access to any personal
information held by or on behalf of the CLSA APL.
3. Personal Information
CLSA APL collects relevant data that is essential to provide financial services or products to its clients.
Most of the personal information collected and outlined in this Policy are regulatory requirements, forexample, CLSA APL must evidence we have confirmed the identify of our clients in accordance with theAustralian Anti-Money Laundering and Counter Terrorism Financing Act (“AML/CFT Act”).
To ensure financial services are effectively provided, the following types of standard Personal Information
may be collected from you:






name;address;
date of birth;
gender;nationality;
residency status;
telephone number;e-mail address;
financial information;
tax file number;
employment history;
education history;
information contained in identity document, such as a passport number and drivers licence number;
information necessary to make or receive payments to or from you or necessary to effect security
transactions on your behalf; and/orCLSA Australia Pty Ltd (Nov 2023)

3

Privacy Policy - Australia

any other information as required to comply with the applicable regulations or laws or required toprovide the services.
3.1 Sensitive Information

In certain circumstances, we may also need to collect Personal Information that is sensitive. This may include
information about your:






racial or ethnic origin;political opinion or membership of political association;
religious or philosophical beliefs;
health;membership of professional or trade associations or trade union; andcriminal record.

4. Collection of Personal Information
Authorised employees from CLSAP APL or any of our related entities within the CLSA group are authorisedto collect personal information. No department or individual within CLSAP APL may process personal
information for any reason other than for the lawful purposes for which it was collected and is being
processed.
Generally, the CLSA Group collects, uses and discloses Personal Information for the following purposes:














Processing applications for account opening purposes
Account maintenance and operational duties relating to your account(s)Processing of transactions
Managing your relationship with CLSA
Carrying out our client’s instructions or responding to our clients
Preventing, detecting and investigating any misconduct or unlawful activities
Complying with all applicable laws, regulations, rules etc.
Addressing or investigating a complaint, claims or disputes;
Provision of financial services;Managing our infrastructure and business operations and employees and complying with ourpolicies and procedures that may be required by applicable laws and regulations including thoserelating to risk control, compliance, security, audit, finance and accounting, human resources,
systems and business continuity;
Carrying out research, planning and statistical analysis;organising promotional events;
Enforcing our legal and/or contractual rights against you including, but not limited to, recovering any
and all amounts owed to us or any members of the CLSA group.

CLSA Australia Pty Ltd (Nov 2023)

4

Privacy Policy - Australia
5. Storage of Personal Information
Your personal information may be held within our (or our service providers):

premises in paper records;
computer systems including email, servers, hard drives and applications;data storage systems; andin certain circumstances, in sound recordings of your telephone discussions with CLSA APL.
6. Accessing your Information

If at any time you would like to request access and/or make corrections, you are welcome to ask us in a formor manner which identifies the nature of the personal information requested.
Requests can be made to your CLSA APL business contact or the Privacy Officer for the Australian operationof CLSA APL as follows:
Email: Compliance.Australia@clsa.com
Mail:

The Privacy Officer
CLSA Australia Pty Ltd
Level 35, Grosvenor Place
Sydney NSW 2000

Tel:

+61 2 8571 4200

Generally, we will provide you with access to the personal information we hold about you within areasonable time. Under certain circumstances however, we may not be able to provide you with access tothe personal information we hold about you. This includes where:

it would have an unreasonable impact on the privacy of another individual;
the request is frivolous or vexatious;
information relates to legal proceedings;
the information would reveal a commercially sensitive decision-making process; or
we are prevented by law from disclosing the information, or providing access would prejudice certain
investigations.

Unless we are unable to do so, we will inform you of the reason(s) for refusing access.
We may charge a fee for providing access to your personal information
7. Retention of Personal Information
Personal information will be held for as long as it is necessary to fulfil the purpose for which is was collectedor as required by applicable laws. The maximum retention period for personal information is seven years.
8. Disclosure, Sharing and Transfer of Personal Information Overseas
Subject to the provisions of applicable laws in each region the CLSA group operates in your personal
information may be disclosed or transferred to or shared with or retained by the following:

CLSA Australia Pty Ltd (Nov 2023)

5

Privacy Policy - Australia


Related entity of the CLSA group;
Any third party service provider;
Our professional advisors (including our lawyers) and agents or third parties necessary for us
performing/providing services to you (including our executing brokers, clearing houses andsettlement agents);
Our auditors;
Any person to whom disclosure is permitted or required by law or any court order;
Any local or foreign government agency, regulatory authority who have jurisdiction over CLSA APL;
and/orAny successors and assigns, whether located in or outside the relevant jurisdiction

To the extent that we may need to transfer personal data outside our jurisdiction, we shall do so inaccordance with the Personal Data legislation of that jurisdiction.
9. Security of Personal Information
CLSA APL will take reasonable steps to protect the Personal Information it holds from interference, misuseand loss and from unauthorised access, modification or disclosure. In line with our internal authorisation andaccess policies, employees only have access to information on a need to know basis.
To the extent permitted by law, CLSA APL will take reasonable steps to destroy or permanently de-identify
personal information if it is no longer needed for any purpose for which the information may be used anddisclosed under this Policy except in circumstances where CLSA APL is required or authorised to retain such
Personal Information (including as a result of the operation of tax, financial services or other applicable laws).
10. Consent
By interacting with CLSA APL and submitting information to us or signing up for any financial services forfinancial products offered by us you agree and consent to:

CLSA APL collecting, using, disclosing and sharing your personal information as stated under thisPolicy;
Disclosing and sharing such personal information to the CLSA group’s authorised service providers
and relevant third parties.

If you do not wish for us to continue to use your Personal Data or the Personal Data provided by you to us
for any of the Purposes at any time in the future, you must notify us in writing addressed to the Data
Protection Officer to withdraw your consent. Depending on the circumstances, your withdrawal of consent
may result in CLSA’s inability to provide you with the services and/or products that we have been offering
to you, and consequently, may result in the termination of your relationship and/or accounts with us.
Under relevant circumstances where the personal information protection laws permits us to collect, use,
process, transfer or disclose the personal information of you without your consent, such permission or rights
granted by the law shall continue to apply notwithstanding anything herein to the contrary.
11. Updates to the Data Protection Policy
CLSA APL may from time to time update this Policy to ensure that it is consistent with our future
developments, industry trends and/or any changes in legal or regulatory requirements. Such changes will beposted on our web-site.

CLSA Australia Pty Ltd (Nov 2023)

6

Privacy Policy - AustraliaYour continued use of our service will be taken as acceptance of the updated Policy.
12. Third Party Websites
Our corporate web site may contain links to other web-sites. Please note that we are not responsible for theprivacy practices of such other web sites and you are advised to read the privacy statement of each web siteyou visit which may collect your Personal Information.
13. Complaints
If you wish to make a complaint about our collection, use or disclosure of your personal information, youshould contact your CLSA APL contact or our Privacy Officer in writing (see section 6 above).
We will make every effort to resolve your complaint internally within a reasonable time.
If we do not resolve your complaint to your satisfaction, you may contact the Office of the Information
Commissioner (OAIC) by calling them on 1300 363 992; writing to them at GPO Box 5218 Sydney NSW 2001;
emailing them at enquiries@oaic.gov.au or visiting their website at www.oaic.gov.au.

CLSA Australia Pty Ltd (Nov 2023)

7Privacy Policy - Australia
14.

ANNEXURE A – Notifiable Data Breaches (‘NDB’) Policy

In 2017 the Notifiable Data Breaches (‘NDB’) scheme in Australia was established under Part IIIC of thePrivacy Act 1988. The scheme was implemented on 22 February 2018. Under the scheme, a data breachmust be reported if there has been an unauthorised disclosure or unauthorised access to PersonalInformation and the breach is likely to result in harm to one or more individuals. This is known as an Eligible
Data Breach (EDB).
The NDB scheme outlines requirements for Australian entities such as CLSA APL in its response to databreaches. Should a data breach occur and is likely to result in ‘serious harm’ CLSA APL must notify the Officeof the Australian Information Commissioner (‘OAIC’) within 72 hours.
14.1 What is an Eligible Data Breach (EDB)?
An EDB arises when the following three criteria are satisfied:

Data Breach – this occurs when there is unauthorised access to or unauthorised disclosure ofpersonal data, or a loss of personal data that CLSA APL holds.
Serious Harm – the data breach is likely to result in serious harm to one or more individuals.
Remedial Action – CLSA APL has not been able to prevent the likely risk of serious harm with remedialaction.
14.2 What is a Data Breach?

The first step to determine if an EDB has occurred involves considering whether there has been a Data Breachbeing:


Unauthorised access to; orUnauthorised disclosure of personal data, or a loss of personal data.

The main categories of Data Breaches under the NDB scheme are described below:
Unauthorised accessThis is where someone who is not permitted to have access has accessed Personal Information that CLSA
APL holds on your behalf. This includes unauthorised access by an employee of the CLSA Group, or aContractor as well as unauthorised access by an external third party (such as by hacking). The CLSA Group
have specific I.T. Security teams and controls to monitor this.
Unauthorised disclosureThis occurs when CLSA APL, (whether intentionally or unintentionally) makes your personal data accessibleor visible to others outside of the CLSA Group (e.g. an employee of CLSA APL accidentally publishes aconfidential data file containing personal data of clients on the internet).
Loss of personal data
This refers to the accidental or inadvertent loss of your personal data held by CLSA APL. (E.g. an employeeof CLSA APL leaves personal data, unsecured computer equipment, or portable storage devices containing
our client’s personal data on public transport).

CLSA Australia Pty Ltd (Nov 2023)

8

Privacy Policy - Australia
14.3 Serious HarmWhereas ‘serious harm’ is not defined in the Privacy Act 1988 in the context of a data breach, the OAIC havedescribed it as any of the following:Serious physical, psychological, emotional, financial or reputational harm.
14.4 Types of Personal Data and Serious Harm

Some types of Personal Information may be more likely to cause an individual serious harm if compromised.
Examples of the types of information that may increase the risk of serious harm if there is a data breach
include:‘Sensitive information’ such as details about an individual’s health;
Documents commonly used for fraud (e.g. Medicare card, driver licence, passport details);
Financial information.
14.5 Reporting a Data Breach

If CLSA APL has reasonable grounds to believe it has experienced an EDB, it must promptly notify affected
persons and the OIAC about the breach by submitting an Eligible Data Breach Statement within 72 hours.
The statement must include the following information:The date, or date range of the unauthorised access or disclosure
The date CLSA APL detected the data breach
The circumstances of the data breachWho has obtained or is likely to have obtained access to the information
Relevant information about the steps CLSA APL has taken to contain or remediate the personal databreach
14.6 The OAIC Form for lodging Statements to the Commissioner

The OAIC has an on-line form for entities to lodge EDB statements under section 26WK of the Privacy Act
1988. The form is located at:https://forms.uat.business.gov.au/smartforms/servlet/SmartForm.html?formCode=OAIC-NDB

14.7 Notifying AUSTRAC or the ACSC of an EDB
The Australian Transaction Reports and Analysis Centre (“AUSTRAC”) recommends that Reporting Entities(such as CLSA APL) that encounter an EDB should, as a matter of good practice, inform AUSTRAC of the EDBor, if the breach involves a cyber-related incident, the Australian Cyber Security Centre (“ACSC”).

CLSA Australia Pty Ltd (Nov 2023)

9