Personal and Sensitive Information about Users may also be disclosed to Third Parties with the User’s or their Authorised Person's consent, or as set out in clauses 6.3.1 to 6.3.8 where the disclosure is made in accordance with this Policy and the Transport Canberra Privacy Policy.
- Research organisations
De-identified information may be disclosed to Research Organisations and Associated Parties for the purpose of analysing data about the Service to assist in improving the delivery of the Territory’s functions and activities.
The information and data from the Service and System may be used to generate anonymised and aggregated statistical and analytical data to be used by the Territory and Associated Parties for internal research and product development purposes, to conduct statistical analysis, drive improvement and identify trends and insights. Additionally, the Associated Parties may supply the aggregated statistical and analytical data to third parties following the Territory’s written consent.
- Law enforcement
The Territory may disclose your Personal and Sensitive Information, including travel data, to law enforcement agencies or other authorised bodies where such disclosure is:
- required or authorised by law; or
- reasonably necessary for enforcement-related activities (such as the prevention, detection, investigation, prosecution, or punishment of criminal offences or breaches of law), in accordance with TPP 6.2(e) of the Information Privacy Act 2014; or
- necessary to prevent or lessen a serious threat to the life, health, or safety of any individual or to public health or safety.
Where such disclosures occur, the Territory will make a written record of the disclosure as required under TPP 6.3 and will take reasonable steps to ensure that any receiving party handles your information in accordance with applicable privacy obligations.
- Requirement by law
The Territory may disclose your Personal and Sensitive Information to Third Parties when permitted or required to do so by law. This includes, for example, responding to a court order, warrant, subpoena, or other legal process. Such disclosures are made in accordance with TPP 6 of the Information Privacy Act 2014, and only to the extent necessary to comply with the Territory’s legal obligations.
- Threat to life, health or safety
The Territory may disclose a User’s or an Authorised Person’s Personal and Sensitive Information to Third Parties where the Territory reasonably believes that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life, health, or safety of any individual, or to public health or safety. This is in accordance with TPP 6.2(c) of the Information Privacy Act 2014.
- Accident or claim
In the event of an accident, incident, or claim, the Territory may collect, use, and disclose a User’s or an Authorised Person’s Personal and Sensitive Information to relevant Third Parties—including insurers, legal representatives, regulatory bodies, and emergency services—for purposes such as investigation, claims management, legal proceedings, or compliance with statutory obligations.
Such disclosures will be made in accordance with the Information Privacy Act 2014, including the TPPs, and only where:
- a User or their Authorised Person has consented, or
- the disclosure is required or authorised by law, or
- it is reasonably necessary for a permitted health or safety purpose, or
- it is otherwise permitted under the TPPs.
The Territory will take reasonable steps to ensure that any Third Party receiving a User’s or an Authorised Person’s Personal and Sensitive Information handles it in accordance with applicable privacy obligations.
- Record of Disclosure
Where the Territory discloses Personal and Sensitive Information under specific exceptions permitted by the Information Privacy Act 2014, it will make a written record of the disclosure in accordance with TPP 6.3.
This record will include details such as:
- the date of the disclosure,
- the nature of the information disclosed,
- the purpose of the disclosure,
- the identity of the recipient, and
- the legal basis or exception under which the disclosure was made.
The Territory will also take reasonable steps to ensure that any Third Party receiving the information handles it in accordance with applicable privacy obligations.
- Nominated Contact
When a User or their Authorised Person provides details of a Nominated Contact, the User or their Authorised Person is giving explicit consent for the Territory to share the User’s Personal and Sensitive Information with the Nominated Contact, as necessary, to support the User to use of the Service and ensure the User’s safety and wellbeing.
Your consent enables the User’s Nominated Contact to:
- Access, view, or update the User’s Personal and Sensitive Information on the User’s behalf;
- Make or modify bookings for the User;
- Be contacted and/or notified about the User’s bookings, eligibility, or other matters relating to the User’s use of the Service.
The Territory will seek a User’s consent at the time they nominate a Nominated Contact, or when establishing a TC FlexiBus Account. The Territory will only use and disclose a User’s Personal and Sensitive Information to their Nominated Contact in accordance with the User’s consent and as permitted by the Information Privacy Act 2014.
- Withdrawing or Updating Consent by a User
A User may withdraw or update their nomination of a Nominated Person at any time. To do so, the User must contact the Territory using the contact details provided in this Policy (see clause 1.3). Upon receiving the request, the Territory will promptly update its records and remove or amend the Nominated Person’s access as instructed by the User.
Please note: In accordance with the Terms and Conditions of the Service, withdrawing consent of an Emergency Contact without a nominated replacement may affect a User’s ability to access the Service.
- Authorised Person Removing Themselves or Updating Their Information
An Authorised Person may request to remove themselves from being an Authorised Person for a User or update their Personal and Sensitive Information at any time. To initiate this request, the Authorised Person must contact the Territory using the contact details provided in this Policy (see clause 1.3). Once the request is received, the Territory will promptly update its records and take appropriate action to reflect the change.