PRIVACY

Overview

As a Commonwealth agency, CrimTrac operates in accordance with the Commonwealth Privacy Act 1988. Section 14 of the Privacy Act specifies eleven Information Privacy Principles (IPPs) that govern how Commonwealth agencies may collect, store, use and disclose personal information.

Personal Information held by CrimTrac

What is personal information?

The Privacy Act defines personal information as:

"information or an opinion (including information or an opinion forming part of a database), whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion."

CrimTrac policing operational information systems contain personal information (e.g. fingerprints, criminal histories, firearms registrations).

The role of CrimTrac

The primary role of CrimTrac is to provide Australia's police services with enhanced access to high quality operational policing information, much of which is personal information. In performing this role, CrimTrac acts as an information clearing house for the police services.

The CrimTrac Agency does not collect personal information from individuals. Rather, it undertakes what are referred to as 'third party collections' from police agencies, or accredited agencies in the case of National Police Checking Service, which may in turn have collected the information directly from the individuals concerned.

When information is provided through the CrimTrac Agency to the police it is for the purpose of criminal investigation and law enforcement. Criminal History Checking is undertaken with the consent of the individual, except where mandated by legislation.

The privacy regime for personal information

The CrimTrac Agency is required to ensure that personal information within its possession or control is handled in accordance with the IPPs.

Amongst other things, the agency along with its contractors, is required to:

• ensure the safe storage and security of information within CrimTrac (IPP 4);
• provide details of the nature of personal information held within CrimTrac in an annual report to the Commonwealth Privacy Commissioner (IPP 5);
• where relevant, provide individuals with access to their personal information held within CrimTrac (IPP 6);
• where relevant, allow for the updating of personal information held within CrimTrac (IPP 7);
• limit use and disclosure of personal information (IPPs 10 & 11); and
• generally assist in the promotion and implementation of privacy safeguards.

To meet its privacy obligations, CrimTrac:

• actively involve the Privacy Commissioner in the development of its information privacy policies and procedures, including the role of the Commissioner in auditing its activities;
• has put in place stringent security measures to protect the security of the personal information in its systems and to guard against unauthorised access, use, modification or disclosure. CrimTrac's systems use sophisticated hardware, software and communications technology to combat attempted unauthorised access or interference with data. Access to operational data is on a need to know basis, and audit logs are maintained of who has accessed what information;
• includes privacy requirements in its contracts with outsourced service providers;
• provides privacy training to its staff and contractors so that they are aware of their obligations;
• works with its police partners to reinforce best practice in how information on operational systems is accessed; and
• develops policies for handling requests to access personal information and complaints.

Good privacy is good policing

Police agencies need to be confident that:

• the information held on CrimTrac systems is secure and not open to unauthorised access, use or tampering;
• the information that they are accessing is accurate and up to date;
• their officers are using the information provided through the CrimTrac Agency for the purpose of law enforcement; and 
• the systems, policies and procedures that the CrimTrac Agency is implementing will assist in achieving the twin goals of personal information privacy and good policing.

Federal Personal Information Digest

Each year CrimTrac provides the following information to the Privacy Commissioner:

• the nature of the various types of personal information kept by CrimTrac;
• the purpose for which these records are kept;
• the class of individuals to which the records apply;
• the period for which the records are kept; and
• details of how individuals can get access to records about themselves.

This information is published in the Privacy Commissioner's Personal Information Digest. The latest version of this digest is available at The Office of the Privacy Commissioner - Personal Information Digest

Website privacy statement

Agencies are required to provide a privacy statement explaining what information is collected about individuals when they visit the agency’s website, how that information is used and if it is disclosed to another party. 

Click on the link below to view CrimTrac’s privacy statement:

Website Privacy Statement

CrimTrac Privacy Contact Officer

Further information on privacy and personal information as it relates to CrimTrac is available from CrimTrac's Privacy Contact Officer on 02 6268 7614 or by email (privacy@crimtrac.gov.au).