What are the NDIA’s privacy obligations?

The National Disability Insurance Agency (NDIA) operates under specific privacy obligations to respect and protect the privacy of participants of the scheme. These obligations are detailed in the NDIA's Privacy Policy which adheres to the obligations outlined in the Privacy Act 1988 (Cth) (Privacy Act) and any applicable state or territory privacy laws.

The Privacy Act allows the NDIA to collect and hold personal information to enable people with disability to access the NDIS and for the NDIA to exercise their broad ranging responsibilities. The type of information the NDIA collect and hold includes a person's name, gender, D.O.B, contact details, disability, limited medical history, ethnic background and other information where this relates to a person’s eligibility to access reasonable and necessary supports and services under the scheme.

The NDIA collect and hold personal information in relation to participants of the scheme after they have gained consent from the individual and/or their guardian or decision-maker. This information can be collected from the individual and their family or carer or from third parties where consent has been provided. Third parties may include specialist disability service providers or healthcare providers who are involved in the person’s care.

Can the NDIA discuss a participant with third parties?

In relation to the personal information of participants of the scheme the NDIA are ordinarily not able to disclose this information to third parties without the consent of the participant. If a participant of the scheme or their nominee would like the NDIA to share information with other parties, they will first have to nominate what information can be shared and to whom this information can be provided too. Otherwise, the NDIA must protect people’s personal information from misuse, loss, unauthorized access, modification or disclosure.

A participant of the scheme will have a plan developed which provides details on reasonable and necessary supports the person is eligible for in relation to their needs and goals. The plan belongs to the participant and who they share their plan with (or parts of their plan) is the participant’s choice. Specialist disability service providers and other stakeholders, including specialist healthcare providers cannot access a participant’s plan unless the person (or their nominee) has provided their consent for this to occur.

Under what circumstances can the NDIA disclose a participant’s personal information?

The NDIA ordinarily will not disclose a participant’s information however this can occur under specified circumstances. The NDIA Privacy Policy outlines the conditions under which disclosures can be made. Under the Bilateral Agreements between State or Territory governments there are provisions for state or territory government officials to access a participant’s information. These provisions are in place due to the specific role of states and territories in the implementation of the NDIS.[1]

[1] Source - Information about NDIA privacy obligations has been adapted from the NDIA Privacy Policy

Close overlay