Privacy Policy

Purpose

The Information Privacy Act 2009 (Qld) (IP Act) and its Queensland Privacy Principles (QPPs) set the rules for how Queensland government agencies handle personal information. 

This policy outlines how the Queensland Reconstruction Agency (QRA) manages personal information. It includes details about:

• the types of personal information collected and held by the agency 
• how personal information is collected and securely stored
• the purposes for which personal information is collected, held, used and disclosed
• the process for submitting complaints about the agency’s handling of personal information, and how the agency will address and resolve the complaint.

Scope

This policy applies to all individuals employed or engaged by QRA, including but not limited to, permanent, temporary, casual and part-time employees, contractors, agency staff, volunteers and consultants.

This policy covers the personal information QRA collects, stores, manages, uses and discloses in the course of performing duties for or on behalf of QRA, regardless of location. This includes activities conducted on QRA premises, during remote work, at off-site locations, and while using QRA resources or representing QRA in any capacity.

Policy statement

QRA is committed to ensuring all personal information is managed in accordance with the QPPs.

QRA collects, uses, stores and discloses a range of personal information required to exercise its statutory functions and meet its legal obligations. 

The definition of ‘personal information’ and ‘sensitive information’ is set out in the Definitions section of this policy.

For the purposes of this policy, all references to ‘personal information’ include both personal information and sensitive information as defined in the IP Act.

Collection of personal information

QRA collects personal information to carry out its functions as detailed in the Queensland Reconstruction Act 2011.

Personal information is collected directly from individuals who access QRA’s services and indirectly from third parties as part of carrying out its functions. When individuals are required to provide personal and/or sensitive information, they are informed about what information is being collected, the purpose for its use, how it will be stored, and the circumstances under which it may be disclosed.

QRA may also collect sensitive information, typically directly from the individual to whom it relates, or as permitted under our obligations under the IP Act.

Personal and sensitive information collected and held by QRA includes:

Personal details

• identity and contact details for individuals (eg name, address, phone number email, postal and physical addresses)
• information relating to individuals’ personal circumstances (eg conflicts of interest)
• photographs of employees, contractors and members of the public
• information relating to individuals’ financial affairs (eg bank account details)

Employment and recruitment

• information about employment (eg employment status, date of birth, tax file number, qualifications, salary work history, required reasonable accommodations, entitlements, next of kin and/or emergency contacts, and conduct and performance information).
• Information gathered during recruitment (eg application documentation, identification information, assessments for suitability, pre-employment interviews, reference checks and testing)

Complaints and applications

• information received as part of, or collected as a result of, complaints made to the agency
• information provided in an application under the Right to Information Act 2009

Disaster and funding-related

• information relating to the collection of damage data during and after a disaster event
• information provided as part of QRA administered funding applications and submission claims

Use and disclosure of personal information

QRA uses and discloses personal information for the purpose for which the personal information was collected, including:

• exercising its powers or performing its statutory functions and duties
• managing associated business processes, such as recruitment and human resources administration.

QRA may also use or disclose personal information for secondary or alternative purposes as permitted under the IP Act. This may include where QRA is authorised or required under Australian law (including to meet the agency’s procedural fairness obligations), with an individual’s your consent, or where an individual would reasonably expect QRA to use or disclose for a related – or in the case of sensitive information, directly related – secondary purpose. This may include disclosure to a court or tribunal.

Access and correction of personal information

Access and correction rights are contained in the Right to Information Act 2009 (Qld) (RTI Act). 

The Right to Information Policy sets out how QRA complies with its obligations under the RTI Act, and how individuals may exercise their rights to access or amend their personal information.

Disclosure of personal information outside Australia

QRA would generally disclose personal information overseas only when necessary to fulfill its statutory functions and provide its services.

However, when individuals communicate with QRA via a social media platform, the social media providers and their partners may collect and hold your personal information overseas. 

Dealing with QRA anonymously or using a pseudonym

Individuals have the option of engaging with QRA anonymously or pseudonymously unless:

• QRA are required or authorised under Australian law, or a court or tribunal order, to deal with individuals who have identified themselves, or
• It is impracticable to deal with an individual who has not identified themselves or is using a pseudonym.

QRA will inform individuals if they are unable to remain anonymous or use a pseudonym. However, if the individual does not provide contact details, QRA may not be able to respond.

Security of personal information

QRA holds personal information securely and takes reasonable steps to protect it from misuse, interference, loss, unauthorised access, modification or disclosure. 

QRA complies with relevant Queensland Government Information Standards and security protocols protect personal information and ensure it can be accessed by authorised employees only.

Where permitted by the Public Records Act 2023 (Qld), QRA will take reasonable steps to destroy or de-identify unsolicited personal information or personal information no longer required for any of its functions in accordance with our obligations under the QPPs if it is lawful and reasonable to do so.

Contractors

QRA is committed to taking steps to ensure that contracts entered into will: 

• require contractors to comply with the IP Act to the extent that they perform functions or provide services on behalf of QRA 
• ensure that any subcontractors engaged by them are also aware of and comply with these obligations.

Privacy complaints

If an individual believes that QRA has not handled an individual’s personal information in accordance with the IP Act, a privacy complaint can be made. 

A complaint must:

• Be in writing
• Include the individual’s contact details
• Provide a description of the privacy issue or concern
• Be made within 12 months of the privacy issue occurring.

Privacy complaints can be sent to:

Email:     complaints@qra.qld.gov.au

Post:      Privacy Officer
              Queensland Reconstruction Authority
              PO Box 15428 
              Brisbane City East Qld 4002

The complaint will be assessed and any necessary action taken. A written response advising the outcome of the complaint, including any remedies, will be provided to the complainant within 45 business days. 

If the complainant is not satisfied with the response, a privacy complaint can be made to the Office of the Information Commissioner (OIC). Further information can be found at the OIC’s webpage www.oic.qld.gov.au.

Authority

• Information Privacy Act 2009 (Qld)
• Right to Information Act 2009 (Qld)
• Public Records Act 2023 (Qld)
• Queensland Reconstruction Authority Act 2011 (Qld)

Delegations

Nil.

Roles and responsibilities

Related documents

The following related documents should be read in conjunction with this policy: 

QRA Policies and Procedures

• Data Breach Policy
• Complaints Management Policy
• Information Security Policy 
• Information Privacy Complaints Procedure 

Other References / Resources

• Queensland Government Information Security Policy IS18

Definitions

Review

The Chief Executive Officer will review this policy within twelve months of the initial approval date, then at least once every three years, and as required to consider changes to relevant legislation, government policy and practices, changing trends, and feedback.

Document control

Contact

For further information, please contact:

Corporate Services – Governance & Performance
Email: governance@qra.qld.gov.au

Download Privacy Policy pdf

Last updated 24 June 2026. CM Reference: DOC/26/40866