DOCUMENT 34 FOI 24/25-1473

OFFICIAL

Knowledge Article

For Internal Use Only

The contents of this document are OFFICIAL.

Consider a request for personal information

Guidance in this document is not approved for use unless you view it in PACE.

This article provides guidance for all NDIA staff and partners to understand:

how to complete a security check
what to do if a person doesn’t have the correct roles or authorities.

Recent updates

14 October 2024

Guidance updated to help NDIA staff and partners check that the person they’re wanting to contact has an active relationship with a participant.

Before you start

You have:

received a request from a person asking you to share the participant’s, applicant’s or person with disability’s personal information
checked if the person has authority to access the personal information using article Check consent, nominee, child representative or self-representation authorities
read and understood the NDIA privacy policy (external) and Australian Privacy Act 1988 (external).

How to complete a security check

To comply with Australian privacy laws, you must take all reasonable steps to make sure the caller can prove their identity.

This is done by asking the caller to give 3 pieces of personal or unique information about themselves over the phone. Unique means only a limited number of people would be able to provide that information.

We can then match this with the information we have recorded. This is called a security check.

You must perform a security check on every caller before disclosing any information.

V3.0 2024-09-26 Consider a request for personal information 229724050 Page 1 of 3

This document is uncontrolled when printed

OFFICIAL

Page 366 of 729

OFFICIAL

Knowledge Article

For Internal Use Only

What to do if a person doesn’t have the correct roles or authorities

If the participant or plan nominee hasn’t given authority to contact a person, the enquiry can’t continue.

To check if the person has an active relationship with the participant, go to section Check that the relationship is active in article Add or cancel a relationship.

The NDIA is bound by the Privacy Act 1988 and the National Disability Insurance Scheme Act 2013.

Under these Acts, we aren’t authorised to discuss whether the person is or isn’t known to the NDIA or disclose any personal information without consent.

You must record the interaction and confirm that the person doesn’t have authority by completing the following PACE steps:

Select Authorised Representatives or Supporters from the Who is enquiring? drop down.
Select No at Does this person have the authority or consent to discuss information about the participant?
Advise the person that you can’t discuss participant matters with them. To progress the enquiry, the participant will need to give them authority. To understand the different authorities go to article Check consent, nominee, child representative or self-representation authorities.

Article labels

PACE user role names

Delete: dc_users_localareacoordinator, dc_users_earlychildhoodpartner

Topics

Add: t_privacyandinformation

Case names

No change.

V3.0 2024-09-26 Consider a request for personal information 229724050 Page 2 of 3

This document is uncontrolled when printed

OFFICIAL

Page 367 of 729

OFFICIAL

Knowledge Article

For Internal Use Only

Ownership

No change.

Version control

Version	Amended by	Brief Description of Change	Status	Date
2.0	EMN960	Class 1 approval	APPROVED	2023-09-26
2.1	ADN217	Guidance updated to help users check that the person they’re wanting to contact has an active relationship with a participant.	DRAFT	2024-09-23
2.2	CNP536	AD Review	DRAFT	2024-09-23
2.3	ADN217	Actioned AD review	DRAFT	2024-09-24
3.0	IIW664	Class 1 approval	APPROVED	2024-09-26

V3.0 2024-09-26 Consider a request for personal information 229724050

This document is uncontrolled when printed

OFFICIAL

Page 368 of 729

Page 3 of 3