Privacy Governance: Five Practical Questions for Club Directors

Poor privacy practices can affect a club’s reputation, member trust, regulatory compliance and can result in substantial penalties impacting the club’s financial position. 

Clubs hold significant amounts of personal information, including membership details, CCTV footage, employment records, marketing data and, in some cases, sensitive information such as health records or information relating to self-exclusion programs that may require additional protection.

Directors strengthen privacy governance by asking the right questions and seeking clear assurance. The Privacy Act 1988 (Cth) and Australian Privacy Principles apply to clubs with an annual turnover of more than $3 million and to some smaller clubs in particular circumstances, such as where they opt in. Even where the Act does not apply, the matters outlined below provide a useful framework for protecting personal information and managing privacy risk.

The following five questions can help directors oversee privacy risk effectively.

1. Know What Personal Information Your Club Holds

Directors should seek assurance that management understands what personal information the club collects, why it is collected, where it is stored, who can access it and when it should be securely destroyed. 

A practical way for management to maintain this visibility is through a current personal information register that records: 

• The type of personal information collected
• Why it is collected
• Where it is stored
• The applicable collection notice provided to the individual 
• Who has access to it
• How long it is kept
• When and how it is securely disposed of.

Bringing this information together can help the club respond effectively to access requests, privacy enquiries or complaints, accidental disclosures and data breaches.

Director question: Could management quickly identify all relevant personal information records if the club received an access request or experienced a data breach?

2. Ensure Privacy Documents Stay Current

Directors should seek assurance that management has a regular process for reviewing privacy documentation and updating it when the club’s practices, systems or service-provider arrangements change. Relevant documents may include privacy policies, collection notices, consent forms, data breach response plans and third-party service agreements or data-sharing arrangements. 

Collection notices are particularly important. They should clearly explain, in plain language:

• What personal information is being collected
• Why it is needed
• How it will be used
• Who it may be shared with.

Collection notices should be tailored to the activity and generally provided at or before the time of collection, or as soon as practicable afterwards. For example, a membership application may require a different notice from an event registration or competition entry. 

Director question: When were the club’s privacy documents last reviewed and what changes trigger an update?

3. Set Clear Accountability Through a Privacy Management Plan

A Privacy Management Plan gives management a structured way to coordinate:

• Responsibilities
• Privacy documentation reviews
• Staff training
• Privacy risk management
• Complaint handling
• Access and correction processes 
• Data breach response processes.

The OAIC describes a Privacy Management Plan as a key tool that can support an organisation’s ongoing compliance obligations with Australian Privacy Principle 1.2.

Directors should confirm that responsibility for privacy is clearly assigned and receive regular reporting on privacy risks, complaints, incidents, training completion and compliance activities.

Director question: Who is accountable for privacy and does the board receive enough information to oversee privacy risk effectively?

4. Seek Assurance That Staff Are Trained

Many privacy incidents arise from human error, such as sending information to the wrong person, discussing personal information inappropriately or failing to escalate a concern. 

Management should provide regular, practical training based on scenarios relevant to club operations, such as membership enquiries, CCTV access, complaints, self-exclusion matters, promotions and email communications. Directors should seek reporting on training completion and any recurring areas of risk.

Director question: Are staff trained to recognise, report and appropriately escalate privacy risks and is privacy training completion monitored?

5. Oversee Readiness for Privacy Enquiries, Incidents and Data Breaches

Even clubs with strong controls can experience privacy incidents. Directors should seek assurance that clear processes are in place for handling privacy enquiries, complaints, access requests and data breaches.  A data breach may involve unauthorised access to, unauthorised disclosure of, or loss of personal information. 

The OAIC identifies four key response steps to a data breach: contain, assess, notify and review. Where a breach is eligible, affected individuals and the OAIC must be notified. 

A current data breach response plan helps staff act quickly, minimise harm and reduce regulatory, financial and reputational impacts on the club, since data breaches can attract significant regulatory penalties and corrective action requirements under the Privacy Act.

Director question: Is the club’s data breach response plan clear, current and understood by those responsible for acting on it?

Director Action Checklist

Directors should ask whether club management:

• Understands what personal information it holds and why;
• Keeps its privacy documentation (privacy policy, collection notice, data breach response plan) and third-party arrangements current;
• Has prepared a Privacy Management Plan;
• Provides practical privacy training and monitors completion;
• Has clear incident-response arrangements; and
• Regularly reports privacy risks and incidents to the Board.