Privacy Statement - ID Support NSW

About this statement

Your information is being collected by ID Support NSW, part of the Department of Customer Service. This Statement provides an overview of how we handle your personal information in line with our obligations under the Privacy and Personal Information Protection Act 1998 and the Health Records and Information Privacy Act 2002.

This statement should be read in conjunction with the NSW Department of Customer Service Privacy Statement and the ID Support Privacy Code of Practice.

We may review and update this Statement from time to time to take account of new laws, technology, and changes to our operations.

Personal information

We refer to information or an opinion about a person whose identity is obvious or reasonably ascertained as personal information.

Why we collect personal information

We may collect your personal information to provide you with:

• Identity support services.
• Personalised guidance to assist you in managing potential risks associated with a data breach or identity compromise.
• Ensuring the safety and protection of your personal information and identity credential documents.

There are no laws that require you to provide us with this information. Information is provided by you on a voluntary basis. However, you may limit our ability to assist you if you choose not to provide some or all the requested information.

Types of information we collect

When you use our services, we will generally ask you for your:

• Name.
• Contact information, such as your address, phone number, and email address.
• Date of birth.
• Information from your identity documents, such as your driver licence, birth certificate, passport number, marriage certificate, or change of name certificate.
• Information relating to data breaches or identity compromise that you’ve been affected by.
• Other relevant information.

ID Support NSW will never ask for your sensitive information such as banking information, passwords or include a links to login screens.

How we use the information we collect

We use the information we collect to:

• Offer personalised advice and support to help you mitigate risks arising from a data breach or identity compromise.
• Verify your identity, including by referencing the identity documents you provide and consent to us using through the Australian Government’s Document Verification Service (DVS): www.idmatch.gov.au
• Help you restore your compromised government-issued identity documents and credentials.
• Conduct harm assessments and create risk profiles to determine potential harm from data breaches or identity compromises. This information helps in identifying necessary measures to minimise risks to individuals.
• Create a “single view of the customer” that enables us to provide you with tailored services, including with reference to your particular risk profile.
• Provide identity support services to a government agency that has requested our assistance. This includes providing a recommended response to a specific data breach that involves your personal information.  
• Validate and update your details to ensure the accuracy of the information we hold about you, considering any relevant information held by DCS or another government agency.
• Request feedback about the service we provide, including by sending you surveys or asking you about your experience as a customer of ID Support
• Maintain a record of the information we collect through our interactions with you to provide risk assessments and offer personalised advice to minimise harm and impact following a data breach or identity compromise.

How we collect your information

You will know when we collect your information because we will ask for it directly and specifically, generally in a form, over the phone, by email or through an online contact request, and, in some cases, a survey. At all collection points you are provided with a privacy collection notice or a link to this Statement to ensure you have access and transparency on the handling of your personal information.

There are situations where we will automatically collect information:

• When you call the ID Support call centre, the system will capture your telephone number, date, time, and duration of the call.
• When you visit our website, we collect usage data that doesn't identify who you are. We use this information to better understand the site's usage and improve our service. Please refer to the Web Analytics Collection Notice for more information on the data we collect at nsw.gov.au.

During our interactions with you, we may request additional information from you, including the specifics of how a data breach or identity compromise has affected you, and other relevant information.

For quality control and training purposes, ID Support may also record telephone calls. You can, however, opt out of having your telephone conversation recorded at the start of the call.  

In some instances, we may contact you to provide support and identity remediation services when:

• An organisation that has experienced a data breach and asks for our help in notifying and assisting individuals affected by the breach.
• We have found your identity information in an unsecured data set on the internet.
• Law enforcement has alerted us to possible identity theft or a cybercrime that could impact your identity or documents.

We will only keep information for as long as we need it to fulfil the purposes for which we collected it. Following this, we will securely dispose of the information in compliance with the State Records Act 1998 and any other relevant legislation.

Disclosing your personal information

We sometimes share your information with other government bodies and database owners for the purposes outlined in this Privacy Statement.

Your personal information may be disclosed to:

• verify your identity and ensure that the information you provide matches the data held by the government or the issuing agency records,
• ensure that you are promptly informed and notified in the event of any data breach or identity compromise concerning your personal information,
• assist you in safeguarding your government-issued documents or credentials in the event of a data breach or identity compromise,
• assist law enforcement agencies in preventing and disrupting identity crime and minimising harm to victims in NSW,
• offer counselling and specialised support services through a government-contracted service known as IDCARE.

In most cases, we will only disclose your personal information with your consent. We will only share your personal information without your consent if there is a legal basis to do so or if it’s necessary to prevent a serious or imminent threat to someone's life or health.

During the development and delivery of our services, we may engage contracted service providers that assist us in maintaining or improving our services and systems. In such cases, these providers may have access to your personal information. All contracted service providers are required to adhere to privacy and security legislation.

Protecting personal information

We take reasonable security measures to protect personal information from loss, unauthorised access, use, modification, disclosure, or other misuse.

For example, we use:

• Multi-factor authentication to authenticate employees before they can access our systems.
• Physical measures, such as building and equipment security.
• Digital technology, such as data encryption and firewalls, to minimise unauthorised access to information.

We will only keep information for as long as we need it to fulfil the purposes, we collected it for. After which, the information will be disposed of securely in accordance with the State Records Act 1998, and any other applicable legislation.

Health information

References to personal information in this Statement may include health information. Health information is a specific type of personal information and includes information about your health and any disability.

We generally do not collect health information from individuals. However, if you provide us with your health information voluntarily (for example, if you tell us how a data breach has affected you, and you include details about any health impacts, or if you ask us to help you in relation to a data breach that involves your health information), we will keep a record of this information to the extent that it is relevant to the identity services that we provide to you.

By law, if we collect your health information from someone other than you, we are required to ensure that you are generally aware of the purposes for which we collect it and other specified matters. We generally do not collect health information from third parties. However, we might receive an unsecured data set containing your health information. In that case, we would only use the health information to provide identity remediation services. If we do collect your health information from someone other than you, we will only do so in accordance with any applicable law.

Accessing your personal information

ID Support NSW holds your personal information, and you have the right to access it without excessive delay or expense. You also have the right to update your personal information.

If your personal information in a proof of identity document requires updating, you must correct it with the issuing agency in accordance with applicable laws.

If there are discrepancies in the personal information and proof of identity document details that you provide to us, we may require that you correct any errors with the issuing agency before we can process an application.

If you would like more guidance on how to correct or update the personal information you have provided to ID Support, please contact:

ID Support NSW

Post: Department of Customer Service, 2-24 Rawson Place, Sydney, NSW 2000

Phone: 1800 001 040

Call back request: For a return phone call, please fill out our contact form.

Privacy requests and complaints

You can make an enquiry or complaint relating to the handling of your personal information, including if you are having difficulty accessing or correcting your information. During the investigative process, we may request additional information to resolve your enquiry or complaint.

To enquire about our privacy practices or to make a privacy complaint, please contact:

ID Support NSW, Privacy Coordinator

Post: Department of Customer Service, 2-24 Rawson Place, Sydney, NSW 2000

Phone: 1800 001 040

Call back request: For a return phone call, please fill out our contact form.

To make an enquiry or privacy complaint relating to the handling of your personal information by an NSW agency other than the Department of Customer Service, we recommend that you contact that relevant agency directly.

The NSW Information and Privacy Commission’s website contains additional information and advice on privacy complaint processes.