Privacy Policy

Policy statement

The Energy and Water Ombudsman (SA) Limited (“the Company”) follows the Australian Privacy Principles (“APPs”) set out in the Privacy Act 1988 (“Privacy Act”).

Policy intent

The Company is committed to protecting the personal information it holds about individuals, including consumers, Member representatives, employees, former employees, job applicants, contractors and other persons who interact with the Company. This Privacy Policy explains how the Company collects, holds, uses and discloses personal information in carrying out its activities.

Application

This Policy applies to personal information relating to consumers and other individuals who use the Company’s services, representatives of Members, employees and former employees, job applicants, contractors and consultants, and other persons engaged to work with or on behalf of the Company.

Collection of personal and sensitive information

The Company collects personal information where it is reasonably necessary for its functions or activities, or where it is required or authorised by law. For its complaint resolution service, the Company asks complainants lodging complaints to give us the following details:

• full name and address
• contact details
• details of the service the complaint is about, which may include an account number with an energy or water service provider
• name of the energy or water service provider
• Authority to Act from the account holder if a third party lodges the complaint on behalf of the account holder
• other relevant information that may help us resolve the enquiry or complaint.

Complainants have the right to contact us anonymously. However, if they do, it may be impracticable for us to help with their complaint.

We generally do not actively collect or request any sensitive information. However, where the receipt of sensitive information may be required to assist with the resolution of the complaint, being “Customer Vulnerability” matters such as health issues (life-support customers), domestic and family violence victim/survivor issues or consumers experiencing financial difficulties – we will accept sensitive information volunteered by the complainant.

We may also, from time to time, collect additional information for statistical reporting purposes (such as gender, age group). Such information will only be collected with the consent of the individuals and if it is published, published in a de-identified format.

Employees, job applicants and other workers

The company collects, holds and uses personal information in relation to employees, job applicants and other workers for the purposes of the general management of its employees and other workers, and in order to consider the employment of job applicants.

Depending on the circumstances, the Company may collect:

• contact, identification and emergency contact details
• recruitment, employment, qualification and right-to-work information
• position, remuneration, payroll, taxation, banking and superannuation information
• leave, attendance, training, performance and workplace conduct records
• relevant health, safety, injury or illness information
• records of access to and use of Company systems, equipment and facilities where reasonably necessary.

The Company may collect this information from the individual or appropriate third parties, including referees, service providers, advisers and government agencies.

Use and disclosure of personal and sensitive information

Personal information may be collected directly from the complainant, or it may be obtained from their energy or water service provider.

The Company treats all complaints as confidential between the complainant, the Member (energy or water service providers) and the Company. At times, we may need to disclose a complainant’s personal information to agencies such as the Technical Regulator, the Essential Services Commission (of South Australia), the Australian Energy Regulator, or to a third party who may be able to assist in the investigation.

We will ensure that personal information will not be used or disclosed to other State institutions or authorities except if required by law.

Sensitive information will be removed from the Case Management System no more than 60 days after the relevant complaint has been resolved. The 60 days’ timeframe is to account for the possibility of a return case and to remove the need for the same sensitive information being provided again in relation to an ongoing complaint.

EWOSA may use approved computer programs, including Artificial Intelligence (AI) tools, to support routine tasks, staff training and knowledge support, customer service and operational efficiency. These tools may process relevant personal information in accordance with EWOSA's privacy and security requirements. AI does not make final complaint determinations, and employees remain responsible for substantive decisions about complaints. Further information about EWOSA's use of AI is available in our Artificial Intelligence Transparency Statement.

Employment and workplace information

Employee, applicant and worker information may be used or disclosed for:

• recruitment and employment administration, including pay, benefits, leave and attendance
• performance, development, conduct, safety and workplace matters
• IT, security, legal compliance and other legitimate business purposes.

Information may be disclosed to relevant service providers, advisers, insurers, funds and government agencies.

The employee records exemption under the Privacy Act may apply to information about current and former employees.

Cross-border disclosure

From time to time, we may engage an overseas recipient to provide services to us, such as cloud-based storage solutions. Please note that the use of overseas service providers to store personal information will not always involve a disclosure of personal information.

We will take all reasonable steps to ensure that any disclosure to overseas recipients is in compliance with the requirements of the Privacy Act by taking such steps as are reasonable in the circumstances to ensure those organisations are either subject to applicable privacy laws that, overall, provide comparable safeguards to those under the Privacy Act, or are otherwise required to protect the information in a way that, overall, provides comparable safeguards to those under the Privacy Act.

Security of personal information

The Company takes reasonable steps to protect personal information from misuse, interference, loss or unauthorised use, modification or disclosure. We hold personal information as either physical records or records on our servers and in some cases records on third party servers, which may be located overseas.

The Company uses a range of security measures to protect personal information, including locked and alarmed offices, locked files and cabinets, passwords on all our computers and a firewall on our computer network, which is monitored by virus protection software.

To protect EWOSA's systems, information and electronic communications, and to ensure the general security of those systems and the protection of personal information provided to EWOSA, email communications sent to or from EWOSA are subject to automated processing by contracted third-party cybersecurity service providers.

This processing may include personal information contained in or associated with an email, such as sender and recipient details, subject lines, attachment information and other message-related information where necessary to identify and respond to phishing, malicious email, misdirected communications, potential data loss and other cybersecurity threats.

These service providers process information on EWOSA's behalf and are subject to appropriate contractual, privacy and security requirements, including compliance with all relevant applicable privacy laws.

We will keep personal information for as long as we need it for the purposes set out in this Policy and the Company’s Charter, or for as long as we are required by law to retain it (usually seven years). After this time, we will destroy or de-identify the personal information, in line with the Company’s Document Retention/Destruction Policy.

Website and portal

Our website can be accessed without disclosing personal information. However, access to our portal by external users requires the provision of certain personal information as part of the registration process. We collect this information to issue and manage login credentials and to administer user access. Additional personal information may also be collected through our portal in connection with a complaint, dispute, or another matter we are involved in. We will only have a record of any personal information if it is provided to us. 

We use cookies, tracking pixels and analytics tools to help us understand how our website and portal are used, and to improve our services. These tools may collect non-personal information such as the pages a user visits on our site or portal, the device type used, and general location information. This information does not identify the user. We use third-party tools, including Google Analytics, which may process or store data on servers located outside Australia. A web browser can be configured to refuse or disable cookies. More information about how cookies are used on our website is available in our Cookie Policy.

Our website or portal may contain links to other websites. We are not responsible for the privacy practices or the use and protection of personal information on those other websites. We cannot warrant the privacy or security of personal information during transmission to other websites.

Managing a data breach

Should personal information be lost or subjected to unauthorised access, modification, use or disclosure or other misuse, the Company will, in line with our Data Breach Response Plan:

• contain the breach and make a preliminary assessment
• evaluate the risks for individuals associated with the breach
• make any necessary breach notifications to affected parties and the Office of the Australian Information Commissioner.

The Company has also developed a Cybersecurity Policy and Cybersecurity Incident Response Plan Directive to minimise threats of and respond accordingly to any personal information disclosure that may occur as a result of a cybersecurity incident.

Privacy complaints

Any questions, concerns or complaints about our management of personal information should be addressed to the Privacy Officer in writing. We will confirm receipt of a complaint and investigate the dispute or complaint and respond to the individual within a reasonable time.

Any individual who is dissatisfied with the handling of the complaint may contact the Office of the Australian Information Commissioner, with further details available at Making a Privacy Complaint.