Information Handling Operational Guideline - Collection of information

7. Collection of information

The collection of information includes obtaining personal information and the recording and storage of that information. However, there are separate requirements which apply to recording information (see recording and storing information).

The unauthorised collection of information is an offence under the NDIS Act (section 61), and may also be a breach of the APS Code of Conduct (see criminal sanctions).

7.1 General power to collect information for the purposes of the NDIS Act

A person may collect protected information for the purposes of the NDIS Act (section 60(1)).

Collection of information will be for the purposes of the NDIS Act if:

  • it is authorised by the NDIS Act; or
  • it is required by the NDIS Act.

The collection of information is also taken to be for the purposes of the NDIS Act if the NDIA believes, on reasonable grounds, that it is reasonably necessary for one or more of the following purposes:

  • research into matters relevant to the National Disability Insurance Scheme (NDIS) (section 60(3)(a);
  • actuarial analysis of matters relevant to the NDIS (section 60(3)(b); or
  • policy development (section 60(3)(c)).

Therefore, the NDIS Act expressly allows the NDIA to properly perform its functions, and a person does not commit an offence where they collect information, in the performance of their duties, which is for the purposes of the NDIS Act.

NDIA staff must consult with the Privacy Contact Officer where there is any doubt in relation to whether collecting information would be for the purposes of the NDIS Act.

7.2 General principles applicable to collecting information

When collecting personal information, the NDIA will seek to advise the person giving the information:

  • who is collecting the information;
  • the purpose for which the NDIA is collecting the information, as long as this does not unlawfully disclose information about another individual;
  • whether the information is likely to be passed onto others and, if so, who those other persons are;
  • the consequences to the person for not providing the NDIA with the information;
  • that the NDIA's Privacy Policy contains information about how the person can complain about a breach of the APPs (External website) by the NDIA, and how the NDIA deals with complaints; and
  • whether the NDIA is likely to pass on the information to overseas recipients, and if practical, the countries in which those recipients are likely to be located.

If information is not relevant or useful, the NDIA should not retain the information in its records. For example, if the NDIA asks to see a passport to confirm a person's identity it will only keep the photographic page in its records as there is no need to keep a copy of the entire passport.

Instead of keeping a full copy of documents the NDIA will consider:

  • noting the information needed from a document then returning the document;
  • blanking out irrelevant parts of the document when copying it; or
  • if using a document to identify a person, make a note that the document has been sighted, including the date it was sighted, rather than keeping a copy.

7.3 Powers to request information

The NDIS Act contains a number of information gathering powers which the NDIA can use to request or obtain information in certain circumstances.

7.3.1 Requesting information for the purposes of determining access

Once a prospective participant has made a valid access request, the NDIA may request:

  • that the prospective participant, or another person, provide information that is reasonably necessary for deciding whether or not the prospective participant meets the access criteria (section 26(1)(a)); or
  • that the prospective participant do either or both of the following:
    1. undergo an assessment and provide to the NDIA the report of the person who conducts the assessment (section 26(1)(b)(i)); or
    2. undergo, a medical, psychiatric, psychological or other examination, conducted by an appropriately qualified person, and provide to the NDIA the report of the person who conducts the examination (section 26(1)(b)(ii)).

For further information see timeframes for deciding access requests and requesting further information or reports to inform the access decision.

7.3.2 Requesting information for the purposes of preparing and approving a participant's plan

For the purposes of preparing, or deciding whether to approve the statement of participant supports, the NDIA may request:

  • that the participant, or another person, provide information that is reasonably necessary for the purposes of preparing, or deciding whether to approve the statement of participant supports (section 36(2)(a)); or
  • that the participant do either or both of the following:
    1. undergo an assessment and provide to the NDIA the report of the person who conducts the assessment (section 36(2)(b)(i)); or
    2. undergo a medical, psychiatric, psychological or other examination, conducted by an appropriately qualified person, and provide to the NDIA the report of the person who conducts the examination (section 36(2)(b(ii)).

See also requesting further information or reports to inform a participant's plan.

7.3.3 Requesting information for the purposes of reviewing a participant's plan

For the purposes of reviewing a participant's plan, the NDIA may request:

  • that the participant, or another person, provide information that is reasonably necessary for the purposes of reviewing the participant's plan (section 50(2)(a)); or
  • that the participant do either or both of the following:
    1. undergo an assessment and provide to the NDIA the report of the person who conducts the assessment (section 50(2)(b)(i); or
    2. undergo a medical, psychiatric, psychological or other examination, conducted by an appropriately qualified person, and provide to the NDIA the report of the person who conducts the examination (section 50(2)(b(ii))).

See also requesting further information or reports for the purposes for reviewing a participant's plan.

7.4 Authority to obtain information

The NDIA is authorised to obtain information for a number of purposes. These powers operate to compel (rather than request) that certain persons provide information to ensure the integrity of the NDIS, or to provide information from a person, or about a person who owes a debt to the NDIA.

7.4.1 Power to obtain information from participants and prospective participants to ensure the integrity of the NDIS

If the NDIA has reasonable grounds to believe that a participant or a prospective participant has information, or has custody or control of a document, that may be relevant to one or more of the matters below, the NDIA may require the participant or prospective participant to give the information, or produce the document to the NDIA (section 53(1)).

The matters are as follows:

  • the monitoring of supports funded for, or provided to, a participant (section 53(2)(a));
  • whether NDIS amounts paid to the participant or to another person have been spent in accordance with the participant's plan (section 53(2)(b));
  • determining whether the participant was not entitled to be paid NDIS amounts because of the misleading statements or fraud of any person (section 53(2)(c));
  • whether the participant or other person has complied with the requirement to acquit NDIS amounts (see obligations in relation to NDIS amounts) (section 53(2)(d)); and
  • whether the participant or prospective participant receives:
    1. supports or funding through a statutory compensation scheme or a statutory care or support scheme (section 53(2)(iii)); or
    2. any other disability or early intervention supports (section 53(2)(e)(ii)).

7.4.2 Power to obtain information from persons other than prospective participants and participants to ensure the integrity of the NDIS

If the NDIA has reasonable grounds to believe that a person other than a participant or a prospective participant has information, or has custody or control of a document, that may be relevant to one or more of the matters mentioned below, the NDIA may require the person to give the information, or produce the document to the NDIA (section 55(1)).

The matters are as follows:

  • whether a prospective participant meets the access criteria (section 55(2)(a));
  • whether a participant continues to meet the access criteria (section 55(2)(b));
  • whether a person purporting to act on a person's behalf for the purposes of the NDIS Act has the authority to do so (section 55(2)(c));
  • the preparation or review of a participant's plan (section 55(2)(d));
  • the monitoring of supports funded for, or provided to, a participant (section 55(2)(e));
  • whether NDIS amounts paid to the participant or to another person have been spent in accordance with the participant's plan (section 55(2)(f));
  • whether a participant or other person has complied with the acquittal of NDIS amounts (section 55(2)(g));
  • whether a participant receives:
    1. supports or funding through a statutory compensation scheme or a statutory care or support scheme section 55(2)(h)(i); or
    2. any other disability support (section 55(2)(h)(ii));
    3. whether an applicant for approval as a registered provider of supports meets the criteria for approval (section 55(2)(i));
    4. whether a registered provider of supports continues to meet the criteria for approval (section 55(2)(j)); or
    5. for the functions of the NDIA (section 55(2)(k)).

If the NDIA requires a person other than participant or a prospective participant to provide information to confirm the above matters, it must issue a written notice under section 55 of the NDIS Act (section 56(1)).

The notice issued to the person must specify:

  • the nature of the information or document that is required to be given or produced (section 56(2)(a));
  • how the person is to give the information or produce the document (section 56(2)(b));
  • the period within which the person is to give the information or produce the document to the NDIA (section 56(2)(c));
  • the NDIA staff member to whom the information is to be given or the document is to be produced (section 56(2)(d)); and
  • that the notice is given under section 56 of the NDIS Act (section 56(2)(e)).

The period specified in the notice must be at least 14 days from the day on which the notice is given (section 56(3)).

The notice may require the person to give the information by appearing before a specified officer to answer questions (section 56(4)).

If the notice requires the person to appear before an officer, the notice must specify a time and place at which the person is to appear. The time must be at least 14 days after the notice is given (section 56(5)).

It is an offence to refuse or fail to comply with a requirement to give information or produce a document under section 55 of the NDIS Act (section 57(1)).

However, a person will not commit an offence if they have a reasonable excuse (section 57(2)).

For example, it is a reasonable excuse for an individual to refuse or fail to give information or produce a document on the grounds that to do so might incriminate the individual or expose the individual to a penalty (section 57(3)).

7.4.3 Power to obtain information from a person, or about a person, who owes a debt to the NDIA

Where a person owes a debt to the NDIA, the NDIA can make a decision to require the person to:

  • give the NDIA information that is relevant to the person's financial situation (section 186(a));
  • produce to the NDIA a document that the NDIA has reasonable grounds to believe is in the person's custody, or under the person's control, and is relevant to the person's financial situation (section 186(b)); or
  • if the person's address changes, inform the NDIA of the new address within 14 days after the change (section 186(c))

The NDIA can also require any person, other than the person who owes the debt, to give information or produce a document, if the NDIA has reasonable grounds to believe that the person has information, or has custody or control of a document:

  • that would help the NDIA locate another person (the debtor) who owes a debt to the NDIA under the NDIS Act (section 187(a)); or
  • that is relevant to the debtor's financial situation (section 187(b)).

If the NDIA requires a person who owes a debt to provide information, or requires a person to provide information about a person who owes a debt to the, the NDIA must issue a written notice to the person from which the information is sought (section 188(1)).

The notice issued to the person must specify:

  • the nature of the information or document that is required to be given or produced (section 188(2)(a));
  • how the person is to give the information or produce the document (section 188(2)(b));
  • the period within which the person is to give the information or produce the document to the NDIA (section 188(2)(c));
  • the officer to whom the information is to be given or the document is to be produced (section 188(2)(d)); and
  • that the notice is given under section 188 of the NDIS Act (section 188(2)(e)).

The period specified in the notice must be at least 14 days from the day on which the notice is given (section 188(3)).

The notice may require the person to give the information by appearing before a specified NDIA staff member to answer questions (section 188(4)).

If the notice requires the person to appear before an officer, the notice must specify a time and place at which the person is to appear. The time must be at least 14 days after the notice is given (section 188(5)).

It is an offence to refuse or fail to comply with a requirement to give information or produce a document under sections 186 and 187 of the NDIS Act (section 189(1)).

However, a person will not commit an offence if they have a reasonable excuse (section 188(2)).

For example, it is a reasonable excuse for an individual to refuse or fail to give information or produce a document on the grounds that to do so might incriminate the individual or expose the individual to a penalty (section 188(3)).

7.5 Effect of State, Territory and Commonwealth laws on collecting information

Generally, a requirement under the NDIS Act to give information or evidence, or to produce documents, to the NDIA is not affected by State or Territory laws (section 58(1)).

However, a person is not required to give information, produce a document or give evidence to the NDIA for the purposes of the NDIS Act if:

  • the person would be prevented from doing so under a law of a State or Territory (section 58(2)(a)); and
  • the law of the State or Territory is prescribed by the Protection and Disclosure of Information Rules (section 58(2)(b)).

Also, the NDIS Act does not require a person to give information or produce a document to the extent that doing so would contravene law of the Commonwealth (section 59(2)(b)).

7.6 Unsolicited information

Sometimes, the NDIA may receive personal information that is not necessary for, or related to, a purpose of the NDIA. This includes:

  • when people send information to the NDIA without being requested; or
  • when the NDIA requests information but a person provides more information than is required.

If this occurs, the NDIA must assess whether the NDIA could have collected the personal information under APP 3 (External website) had it requested such information.

7.7 Recording and storing information

NDIA staff who collect personal information from a participant, prospective participant, carer, nominee, provider of supports or other person are to make a record of the information.

NDIA staff should ensure:

  • information is recorded promptly;
  • information is accurate, up to date and complete;
  • a record of the information is made either by way of scanning (if in document form) or by summary (if in oral form); and
  • the record is made without unnecessary or misleading comment on the information.

An NDIA staff member who has possession or control of a record that contains personal information must ensure:

  • that the record is protected by reasonable security safeguards (such as use of strong passwords and not sharing the password with others), against misuse, interference, loss, unauthorised access, modification or disclosure; and
  • that if it is necessary for the record to be given to a person in connection with the provision of a service, everything is done to prevent unauthorised use or disclosure of the protected information contained in the record.

7.8 Deleting information collected under, or for the purposes of the NDIS Act

Under Archives Act, the NDIA is not authorised to delete a Commonwealth record which details the business functions, activities and transactions of the NDIA.

This is particularly important where an NDIS decision is being reviewed as it is important that all information relating to that decision is retained by the NDIA for the purposes of the review process.

If, for example, a person asks for the deletion of information relating to their access request, the NDIA must advise that it is not permitted to delete any information, including material provided in support of the access request, because of the operation of the Archives Act.

In giving this advice, the NDIA should reassure the person that the NDIA adheres to strict obligations to protect information from misuse, interference, loss and from unauthorised access, modification and disclosure under both the Privacy Act and the NDIS Act.

The inappropriate or unlawful disposal of a Commonwealth record is an offence under the Archives Act.

This page current as of
18 July 2019