Privacy notice
This Privacy Notice applies to your use of the Queensland Digital Identity (QDI), including your use of the system and services that provide your QDI (the QDI System). QDI and the QDI System are provided by the State of Queensland acting through the Department of Transport and Main Roads (TMR).
Setting up and using your QDI involves the collection of personal information by TMR.
Any personal information collected by or provided to TMR via use of your QDI will be managed in accordance with this Privacy Notice, the Information Privacy Act 2009 (Qld) (IP Act), as well as the Transport Planning and Coordination Act 1994, the Photo Identification Card Act 2008, the Transport Operations (Maritime Safety) Act 1994, the Transport Operations (Road Use Management) Act 1995 and other transport portfolio legislation (Portfolio Legislation).
In addition to the specific handing of personal information in relation to your QDI, TMR may collect and use your personal information in accordance with its general Privacy Statement when interacting with or providing other services to you.
What we collect
1.1 When you use or set up your QDI, we collect your personal information.
1.2 Where relevant, we may collect information about you in relation to your use of your QDI. This information may include, but is not limited to:
- your name and date of birth
- your mobile number, email address and a password; and
- details about any documents you submit to us to help prove who you are, such as your driver licence, driver licence number, Australian passport, birth certificate and other eligible documents (Identity Documents).
1.3 The QDI System may request your specific permission to access other applications and functions on your mobile device, including;
- the camera application; or
- biometric and other device security features which may be required for verification, onboarding, reporting, analytics, support, security purpose. Access may also be required to other applications or functions on your mobile device from time-to-time. If you do not wish to grant these permissions, you may not be able to use your QDI, or may find that some parts of your QDI do not function.
2. Purposes of collection
We collect details about your Identity Documents and the other information referred to above, which may include your personal information, for the purposes of verification to set up your QDI to the required level; making your QDI available for use; administration of the QDI System and your QDI; providing support for and improving the QDI System and your QDI; and for other purposes under TMR's Portfolio Legislation.
We may also use the information to contact you and invite you to participate in surveys and to otherwise improve QDI and TMR services more generally.
We may also use information we currently hold to verify your identity as part of setting up your QDI.
3. Consequences of non-disclosure
If you do not provide your personal information and Identity Documents, we will not be able to verify your identity and you will not be able to set up or use a QDI. Our records about you may not be kept up to date, or will have to be kept up to date in another way.
4. How we handle and disclose your personal information
4.1 We will disclose your personal information (including details you provide us about your Identity Documents) to the service provided by the Australian Government known as the Document Verification Service where necessary to verify any non-TMR issued Identity Documents you submit to the QDI System.
4.2 The first time you use your QDI to verify your identity to any third party (Relying Party), you will be asked to give your specific consent to share the relevant information with that Relying Party, which may include your name, date of birth, email address, a unique identifier that links your identity with the Relying Party, and other personal information. You may withdraw your consent at any time. To withdraw your consent to sharing your information with a Relying Party or all Relying Parties, please contact us by using the contact details in clause 10 of this Privacy Notice. Upon receipt of your request to withdraw your consent, we will cease to share your personal information with the relevant Relying Party or Relying Parties, except where we are authorised or required by law to do so.
4.3 We will retain a securely encrypted record of each use of your QDI for 7 years for audit purposes.
4.4 Your QDI and/or personal information will not be disclosed without your permission, except as notified in this QDI Privacy Notice or where otherwise required or authorised by law, including to police for the purpose of law enforcement functions where specific legislative authority exists.
4.5 In order for us to provide the QDI services, your personal information may be hosted securely by our third party ICT service providers. Your personal information will be managed by those third party ICT service providers to the same or substantially similar information management standards as our standards in order to maintain the confidentiality, authenticity and integrity of that information.
4.6 We will not disclose your personal information to other third parties except as authorised or permitted by law.
5. Consents
5.1 By applying for a QDI, you consent to us using your personal information as set out in this Privacy Notice.
5.2 By using your QDI to verify your identity with a Relying Party, including on a Relying Party website, you consent to your personal information being disclosed to the Relying Party.
5.3 By using QDI you consent to us delivering push notifications to your device that are directly relevant to your QDI.
5.4 You also consent to your personal information being sent out of Australia when you use your QDI to verify your identity to access a website that it is managed or operated overseas, or where a Relying Part is located overseas, and where our third party ICT service providers have servers located overseas.
6. Authorisation
6.1 We hold the personal information referred to in this Privacy Notice both under our Portfolio Legislation and under a whole-of-government policy to be a digital identity provider on behalf of the Queensland Government.
6.2 You authorise the provision of information held under the Portfolio Legislation to be used for the purpose of QDI.
7. Use of de-identified information
7.1 Verification information captured using QDI will be reported to us in a de-identified state for our business purposes, including administration of QDI services, and for maintaining and improving QDI.
7.2 QDI may be configured to report de-identified information back to us relating to ICT errors arising in connection with the use of QDI services, without notice to you.
8. Access to, amendment and deletion of your personal information
8.1 You may deactivate and delete your QDI account by following the process on the Queensland Digital Identity page.
Please note: Deleting your QDI account will not remove your credentials from the Digital Licence App. In order to do that, you will also need to securely reset your Digital Licence App. You may also need to reset or otherwise remove your credentials from other third party apps or services in relation to which you have used your QDI.
8.2 You may also request:
- access to and amendment of personal information held by us; and
- deletion of information held associated with your QDI, by using the contact details below.
8.3 We may decline to provide access to, or amend or delete personal or other information where it is legally permitted to refuse to do so. We will explain the basis for its decision when responding to your request or otherwise within a reasonable time.
8.4 Reasons for refusal may include, but are not limited to, where access, amendment or deletion would be:
- inconsistent with our obligations to maintain records under legislation including the Public Records Act 2002 and TMR's Portfolio Legislation; or
- contrary to the public interest under the IP Act or the Right to Information Act 2009.
9. Scope of this Privacy Notice
9.1 This Privacy Notice only applies to the handling of personal information to the extent that it is collected by or provided to us in connection with setting up or using your QDI.
9.2 Your personal information may also be collected by, provided to or held by us or other agencies or persons in connection with use of your QDI to establish your identity with TMR, other government agencies, online retailers or other service providers (Relying Parties). The handling of personal information in that context will be subject to any laws, privacy notices and policies applicable to such uses.
9.3 We will cease to have control over your personal information once you disclose it to a Relying Party. Relying Parties may manage the personal information in accordance with their own privacy policies and practices, and we are not responsible for use, disclosure or other dealings with personal information by Relying Parties.
10. Contact details
Privacy complaints and requests for access to, amendment or deletion of personal information should be directed as follows:
Post:Right to Information, Privacy and Complaints Management
Department of Transport and Main Roads
GPO Box 1549
BRISBANE QLD 4001
Email:
privacy@tmr.qld.gov.au
Telephone:
13 23 80
Or you may lodge your complaint or enquiry online through the Department of Transport and Main Roads Contact Us form.