Privacy policy

About this Privacy Policy

The Privacy Act 1988 (the Privacy Act) requires entities bound by the Australian Privacy Principles (APPs) to have a Privacy Policy. This Privacy Policy outlines the personal information ^[1]  handling practices of DHA (we, us, our). Any individual who provides personal information or sensitive information^[2] to DHA (you, your) is responsible for being aware of the contents of this policy.

DHA may revise or update this Privacy Policy from time to time by publishing a revised version on our website. Revised versions take effect from the time published.

While we make every effort to identify all circumstances of personal information handling, it is not practicable to provide an exhaustive list of all the ways we collect and use personal information. Instead, some instances may be covered in broad terms.

This Privacy Policy covers personal information relating to:

• individuals whose personal information is, has been, or will be handled by DHA including:
  • current or previously serving members of the Australian Defence Force (ADF) 
  • current or previously serving members of a military organisation of a foreign country 
  • current or previously serving official or employee of a government body of a foreign country 
  • contractors engaged by military organisations or government bodies of a foreign country and their families
  • accredited representatives of registered charities and their families
• family members or dependants of a current or previously serving ADF member, a current or previously serving member of a military organisation of a foreign country, and a current or previously serving official or employee of a government body of a foreign country, who engages with DHA
• current and potential investors and landlords of DHA-managed housing and developments
• civilian tenants of DHA-managed housing
• an agent or representative of a person whose personal information may be given to or held by DHA
• current, former, or prospective employees of DHA, including employees engaged through a third-party
• our contracted service providers and their employees (who may be known or referred to as contractors, consultants, sub-contractors, suppliers, third-party providers, vendors, or other such terms)
• attendees or registrants for DHA events or seminars
• persons who interact with DHA employees, contractors, website, or social media
• any other individuals whose personal information may be given to or held by us in connection with our business functions and activities either directly or indirectly related to providing adequate and suitable housing to members of the Defence Force and their families.

Overview

DHA values your privacy and takes its obligations under the Privacy Act, including the APPs, and Privacy (Australian Government Agencies – Governance) APP Code 2017 seriously. DHA is committed to promoting a culture of privacy that values and protects the personal information we hold to build trust.

In order to meet the operational needs of the ADF and the requirements of the Department of Defence, DHA collects, uses, and discloses personal information to perform its functions, exercise its powers, and discharge its duties under the Defence Housing Australia Act 1987(Opens in a new tab/window) (DHA Act). The main function of DHA is to provide adequate and suitable housing for, and housing related services to:

• members of the Defence Force and their families
• officers and employees of the Department of Defence and their families
• persons contracted to provide goods or services to the Defence Force and their families
• members of a military organisation of a foreign country and their families
• officials and employees of a government body of a foreign country and their families
• contractors engaged by military organisations or government bodies of a foreign country and their families
• accredited representatives of registered charities and their families.

Collection

We may collect and hold the following types of personal information about you, depending on the purpose for which we are collecting information from you:

• title or rank
• name
• date of birth
• sex
• gender
• contact details such as your email address, postal and/or home address and phone numbers
• signature
• country of citizenship
• ethnicity
• criminal history
• relationship status and date of any marriage
• identification numbers including PMKeys
• opinions and preferences, including for types and features of housing 
• financial information, including banking details, details of shareholdings or other financial or beneficial interests, proof of payment of rent, and insurance claims
• education information including school attendance
• employment information including profession, qualifications, licenses or certificates, occupation or job title, work location, posting location, service, service dates, and pay grade
• familial information, including any spouse, partner and/or dependents
• health information including special housing needs and service animals
• property information including features, condition, utilities, appliances, warranties, lease terms, rent, and valuations
• relocation information including departure and arrival dates
• pet information
• information about your interactions with DHA including inquiries, maintenance requests, complaints and feedback Policy
• staff information including biographical details, tax file number, next of kin, information related to security clearance, staff development, training details, medical information, compensation details, salary/payment details, details of accounts with financial institutions, actions performed within DHA systems and biometric information related to facial characteristics for the purposes of multi-factor authentication to use DHA systems
• information relating to DHA website access such as IP or server address, the date and time of the visit to the site, pages accessed, operating system, web browser version and type, time taken to transmit information to the person, previous internet address from which the person came directly to this website and location data in limited circumstances
• information provided in comments or enquiries on DHA profiles or on individuals’ publicly available personal profiles on social media platforms
• responses to survey questions about your use and satisfaction with our services for research purposes
• audio or visual recordings of your face, person, voice, or likeness captured by CCTV in offices and other worksites, drone, or vehicle dashcams on DHA fleet vehicles
• any other personal information provided to us verbally, electronically or in a document by an individual about themselves or another individual for purposes related to our business functions.

DHA collects some sensitive information, for example health information that may be relevant to your requirements for adequate housing, and we ensure this is collected and handled in accordance with the Privacy Act.

How we collect your personal information

We will generally collect your personal information directly from you unless it is unreasonable or impracticable to do so. When collecting personal information from you directly, it will generally be:

• through your registered access and use of our DHA online portals or third-party platforms, for example when requesting relocation or housing maintenance or lodging a job application
• when you make an enquiry or complete an application form (hard or soft copy)
• during conversations between you and our employees or contractors
• via telephone, online or paper-based surveys conducted by us or a representative or service provider of DHA
• when you enter into a contract with us (for example, to purchase or lease a property or provide a service to us or on our behalf)
• when you attend one of our locations such as an office or construction site where we may have security cameras in operation, this may include cameras on fleet vehicles or drones in limited circumstances
• when you use one of our vehicles or use a personal safety device when undertaking work for us for your safety
• when you use a computer or other electronic device to perform work for us.

We often also collect personal information from other sources. These include third parties or publicly available sources, such as:

• other Australian government agencies, including the Department of Defence
• other State and Territory government agencies
• contracted services providers
• law enforcement agencies
• credit reporting agencies
• military organisations and government bodies of foreign countries and their contracted services providers
• from a Defence member in relation to their dependents
• from marketing representatives in relation to investment opportunities that you have enquired about
• individuals authorised to act or provide personal information on your behalf, such as a legal representative, financial adviser, insurance company or medical practitioner
• from past employers or referees.

Privacy Collection Notices

We will take reasonable steps to ensure you are informed in a Privacy Collection Notice about why we are collecting your personal information, and any other relevant matters in relation to the circumstances of that collection, such as who we plan on disclosing the information to (where relevant). We will provide this information at the time of collection where practical.

Use of our website, online portals, and social media

When you use our website and online portals, information about your activity may be collected using cookies^[3], Google Analytics^[4] and ‘retargeting’ (tailoring content based on your activity) to optimise the content you see and improve user experience^[5]. This information does not personally identify you^.

While we take all reasonable steps to secure personal information transmitted to our online platforms, you should be aware that there are inherent risks associated with the transmission of personal information over the internet.

Our website may contain links to other websites operated by third parties. We make no representations or warranties in relation to the privacy practices of any third-party website.

The social networking platforms we use, such as Twitter, Facebook and LinkedIn may also collect your personal information for its own purposes during your interactions with us via these platforms. These sites have their own privacy policies.

Use of personal information

We will only collect, hold, use, and disclose personal information for purposes that are directly related to, or reasonably necessary to enable us to perform our functions as prescribed in the Defence Housing Australia Act 1987 (DHA Act).

To perform these functions, we collect personal information for various purposes depending on the nature of your relationship with DHA, including but not limited to:

• verifying your identity
• performing our business activities and functions
• meeting our obligations under the Defence Services Agreement (DSA) with the Department of Defence, including for the purposes of reporting requirements, performance measurement, assisting authorised Defence personnel to verify individual member compliance with housing entitlements, resolving escalated complaints, and any other purpose covered under the DSA
• meeting Australia’s obligations under agreements with military organisations and government bodies of foreign countries
• acquiring and disposing properties to meet our housing provisioning requirements
• contacting you in an emergency, such as during a severe weather event or natural disaster
• contacting you in response to an enquiry by you about our products or services
• providing you with access to any protected areas of our website
• presenting you with personalised housing options that meet your requirements Policy
• recruitment and personnel management purposes (in relation to DHA employees and potential DHA employees)
• marketing (including direct marketing), planning, product or service development, quality control or research purposes
• facilitating community engagement, including forums, surveys, and the promotion of upcoming projects
• handling and resolving a complaint to the extent that is necessary for us to investigate your complaint
• responding to any communications from you, including via social media
• to facilitate requests for tender and to engage with third parties to deliver services for DHA
• work health and safety purposes
• complying with any law, regulation, or binding decision of a regulator.

In most cases we will only use your personal information for the primary purpose for which it was collected. In certain circumstances, we may use or disclose your information for a different purpose (the secondary purpose), such as where you have consented or would reasonably expect us to use or disclose the information for a secondary purpose, or the secondary purpose is one or more of the following:

• related to the primary purpose for which the information was collected (or in the case of sensitive information, directly related to the primary purpose)
• required or authorised under Australian law or has been ordered by a court or tribunal
• reasonably necessary for enforcement-related activities.

In most instances we will be unable to provide services or engage with a person who is not prepared or is otherwise unable to provide their personal information. Where possible we will provide you with the opportunity to interact with us anonymously or pseudonymously.

In some circumstances we may use your personal information with an Artificial Intelligence (AI) system to enhance our services and operations. DHA is committed to the ethical use of AI while ensuring transparency, accountability, and the protection of privacy. More information is available in our AI Transparency Policy.

Direct marketing

We may send you direct marketing communications and information about our products and services when we consider that you would reasonably expect us to use your personal information for the purpose of direct marketing, for example when you have provided your consent, or we have notified you that you may receive direct marketing upon collection of your personal information. 

Marketing communications may be sent in various forms including mail, phone calls, SMS and email, in accordance with applicable marketing laws, such as the Spam Act 2003 (Cth), and may be sent via a representative or service provider of DHA. If you indicate a preference for a method of communication, we will endeavour to use that method whenever practicable to do so. 

You may opt-out of receiving marketing materials from us by using the opt-out facilities provided in the marketing communications or contacting the Privacy Officer. We will then remove your name from our mailing list. 

We do not provide your personal information to other organisations for the purposes of their direct marketing.

Disclosure

We disclose personal information to other organisations or individuals when:

• you give your consent
• it is reasonably necessary to conduct DHA’s functions, or
• it is required or authorised by law, including in emergency situations or to assist law enforcement in accordance with the Privacy Act.

We may disclose your personal information to:

• the ADF or Department of Defence to meet the requirements of our Defence Services Agreement or other agreements
• related bodies corporate or owners’ corporations for DHA properties that are subject to Strata Titles
• contractors or service providers who perform services on our behalf in connection with our business and functions
• utilities providers, such as water or electricity companies
• other Commonwealth or State government agencies or other entities as required or authorised by or under applicable laws or rules, such as the Privacy Act, the DHA Act and the Public Governance, Performance and Accountability Act 2013 (PGPA Act)
• law enforcement bodies, as defined in the Privacy Act
• your nominated representative, or Policy
• other individuals or entities where there is a legal basis to do so.

We will not disclose any sensitive information about you unless you have provided your express consent for us to do so, or where we are required or permitted to do so by law.

Contracted service providers

We use contracted service providers to undertake certain business functions and activities for us or on our behalf, for example housing maintenance, marketing, data analysis, legal services, consultancy, and research activities. This may involve disclosing your personal information to, or collecting your personal information from, those providers for the purposes of performing our business functions.

To protect the personal information we provide to contracted service providers, we take contractual measures to ensure the contractor and its employees comply with the Privacy Act and the APPs, and only handle the personal information for the purposes of the contract.

Overseas disclosure

We may need to provide your personal information to an overseas recipient as part of our work.

We may engage contracted service providers that are based overseas, or that use subcontractors based overseas, for the purposes of personal information collection and storage. For example, cloud storage or other data or web-based services and in limited circumstances, contracted service providers who operate an overseas contact centre. Contracted service providers are required to obtain DHA’s permission prior to overseas disclosure. Wherever possible, we engage providers that collect and store data in Australia. 

In some circumstances, personal information is disclosed to recipients outside Australia. Often the recipient will be a military organisation or government body in the individual’s usual country of residence or a nominated representative in the individual’s usual country of residence. For example, DHA may disclose personal information about a current serving member of a military organisation of a foreign country to recipients in that foreign country.

Security and storage

We securely store personal information we collect electronically on our IT systems, backup servers and on third-party provided cloud storage. We undertake Security Risk Assessments before engaging third-party software and application providers to ensure compliance with relevant data protection legislation. We also undertake regular security testing of our information management systems. In some limited cases, we may also hold your personal information on securely stored paper files.

We use software and applications provided by third parties, or IT providers, to store and manage personal information to deliver our services, such as Microsoft 365. We act as the sole data owner (or data controller) in all instances, with IT providers accessing personal information only in the event such access is necessary, for example for technical support.

Contracted service providers use DHA systems and may also store personal information on their own systems to carry out the required services. Providers are required to comply with the Privacy Act to keep your personal information secure, and to destroy personal information once it is no longer required. 

We take reasonable steps to ensure your personal information is protected from misuse, interference, loss, unauthorised access, modification, or disclosure. These steps include both:

• technical measures, such as compliance with the Australian Signals Directorate’s Essential Eight Security Controls, and the Australian Government Information Security Manual, to support compliance with DHA’s Protective Security Policy Framework obligations, and 
• organisational measures, such as staff Privacy training, conducting Privacy Threshold Assessments and (where necessary) Privacy Impact Assessments for new projects, having a Data Breach Response Plan, and holding regular cyber incident drills.

Retention and disposal

We aim to keep personal information only for as long as we need for business purposes and to comply with the Archives Act 1983 (the Archives Act). When we no longer need personal information and are lawfully able to do so, we take reasonable steps to destroy or de-identify it. Personal information we collect may become part of a Commonwealth record. We must retain your personal information held within Commonwealth records in accordance with the Archives Act. For more information about how the APPs intersect with the Archives Act, please visit the relevant page on the National Archives of Australia website(Opens in a new tab/window).

Access and correction

To request access or correction of your personal information, please email privacy@dha.gov.au with the specific details of your request.

You have a right to access your personal information unless we are entitled to refuse access on grounds permitted under the Privacy Act.

You may also request us to correct any personal information that you believe is inaccurate, out of date, incomplete, irrelevant, or misleading. We will take reasonable steps to make that correction upon being satisfied that the information is inaccurate, out of date, incomplete, irrelevant, or misleading. It is useful if you provide information and details to support your request.

If we do not give you access to your personal information or decide that we will not correct your personal information, we will provide you with written reasons for our decision. We will endeavour to respond to your request within 30 days of receiving it. If there may be a delay in responding to your request, we will contact you.

Please go to our How to access information about you page for more information.

Privacy complaints

We recognise the importance of protecting your personal information and take all privacy complaints seriously. If you believe that we have breached our obligations under the Privacy Act in handling your personal information, you can make a privacy complaint to the Privacy Officer.

To lodge a privacy complaint, please email privacy@dha.gov.au with all relevant details so that we can accurately understand, assess, and investigate your complaint. It is our preference that privacy complaints are made in writing to ensure we have accurate records of your complaint.

On receiving your complaint, a Privacy Officer will investigate the matter and respond to you regarding the outcome, generally within 30 days unless your complaint is particularly complex.

If you believe that the Privacy Officer’s decision or response is not correct or appropriate, you may seek further clarification or request the Privacy Officer escalate the matter to DHA’s Chief Governance Officer.

• ^{[1] The term ‘personal information’ has the meaning given to it in the Privacy Act when used in this Privacy Policy and on our website. In general terms, personal information is any information that can be used to personally identify you. For example, your name, address, telephone number, email address and profession or occupation.}
• ^{[2] ‘Sensitive information’ is a subset of personal information, as defined in the Privacy Act, and includes certain categories of personal information, for example health information, political opinions or associations, information about racial or ethnic origin and sexual orientation. There are additional rules in the Privacy Act about how sensitive information must be handled, including that we must obtain your consent to collect and use your sensitive information in certain circumstances.}
• ^{[3] If you do not wish to receive cookies, you can set your browser so that your computer does not accept them. However, our website may not offer optimal performance if you choose to disable cookies.}
• ^{[4] Users may opt out of Google’s use of cookies by visiting the Google advertising opt-out page}(Opens in a new tab/window)^.
• ^{[5] No attempt will be made to identify you based on this information, except in the unlikely event of an investigation by a law enforcement agency or where we are required to do so by court/tribunal order.}