What are the NDIA’s privacy obligations?
The Privacy Act allows the NDIA to collect and hold personal information to enable people with disability to access the NDIS and for the NDIA to exercise their broad ranging responsibilities. The type of information the NDIA collect and hold includes a person's name, gender, D.O.B, contact details, disability, limited medical history, ethnic background and other information where this relates to a person’s eligibility to access reasonable and necessary supports and services under the scheme.
The NDIA collect and hold personal information in relation to participants of the scheme after they have gained consent from the individual and/or their guardian or decision-maker. This information can be collected from the individual and their family or carer or from third parties where consent has been provided. Third parties may include specialist disability service providers or healthcare providers who are involved in the person’s care.
Can the NDIA discuss a participant with third parties?
In relation to the personal information of participants of the scheme the NDIA are ordinarily not able to disclose this information to third parties without the consent of the participant. If a participant of the scheme or their nominee would like the NDIA to share information with other parties, they will first have to nominate what information can be shared and to whom this information can be provided too. Otherwise, the NDIA must protect people’s personal information from misuse, loss, unauthorized access, modification or disclosure.
A participant of the scheme will have a plan developed which provides details on reasonable and necessary supports the person is eligible for in relation to their needs and goals. The plan belongs to the participant and who they share their plan with (or parts of their plan) is the participant’s choice. Specialist disability service providers and other stakeholders, including specialist healthcare providers cannot access a participant’s plan unless the person (or their nominee) has provided their consent for this to occur.
Under what circumstances can the NDIA disclose a participant’s personal information?