Information Privacy

Introduction

On this page you can find information about how South Bank Corporation (SBC) manages your personal information.

1. About South Bank Corporation

SBC is the development and management authority for the Brisbane South Bank precinct. The precinct includes the South Bank Plaza, restaurants, beach, carpark, parklands and Brisbane Convention and Exhibition Centre. SBC has day-to-day responsibility for overseeing the precinct’s operations, maintenance, security, events and commercial assets.

2. Our commitment to your information privacy

SBC is committed to protecting your privacy and manages your personal information in accordance with the Queensland Privacy Principles (QPPs) and the other obligations contained in the Information Privacy Act 2009 (the IP Act).

QPP 1 Open and transparent management of personal information

QPP 2 Anonymity and pseudonymity

QPP 3 Collection of solicited information

QPP 4 Dealing with unsolicited information

QPP 5 Notification of collection of personal information

QPP 6 Use and disclosure of personal information

QPP 10 Quality of personal information

QPP 11 Security of personal information

QPP 12 Access to personal information

QPP 13 Amendment of personal information

- Overseas disclosure
- Contract Service Providers
- Mandatory Data Breach Scheme

Fact Sheet – Queensland Privacy Principles

3. Collection of personal information

SBC collects personal information by various methods including through face-to-face meetings, telephone calls, hard copy forms, web-based forms, emails, CCTV, photographs, web analytics, social media, subscription services, mailing lists and surveys.

Personal information must be collected by lawful and fair means, so when we collect personal information directly from a person, we will usually take steps to make them aware of the circumstances of the collection. Where practicable, we will ask the person for their consent before collecting their personal information from a third party.

4. Types of personal information collected by SBC

We collect personal information in relation to a range of our functions and activities including for:

- Car parking
- Retail lease management
- Precinct maintenance and management
- Infrastructure planning and construction
- Liquor licensing
- Health and safety
- Incident management
- Community consultation and communication
- Events management
- Precinct security
- Marketing
- Commercial operations
- Contract management
- Corporate administration including financial, procurement and human resources.

The types of personal information we collect will depend on the function or activity performed, but may include:

- Contact details including name, phone number, business, residential and email address
- Car registration
- Health and medical information
- Occupational and employment information including recruitment and selection information
- Unique identifiers including TFN, driver licence, birth certificate and passport details
- Images in CCTV and photographs
- Internet protocol and other IT information.

We only collect sensitive information in accordance with the IP Act.

5. Use and disclosure of personal information

We use and disclose personal information for the purpose it was collected unless otherwise authorised.

There are a range of functions and activities that require us to use or disclose personal information including for:

- Events planning, hosting and promotional activities
- Responding to or investigating an incident
- Security purposes and monitoring precinct activities
- Conducting research for events planning and infrastructure development
- Generating reports from data for business intelligence functions
- Undertaking corporate administrative functions
- Communicating about events and activities, issuing alerts about precinct infrastructure availability, disaster management and health and safety concerns.

6. Disclosure out of Australia

We understand our obligations in relation to the disclosure of personal information out of Australia. Ordinarily, we will not disclose personal information overseas unless authorised under the IP Act. We also take steps to be satisfied that our service providers have appropriate controls to protect your personal information and that they only use personal information for purposes we authorise.

However, if people communicate with us through services such as Facebook or Twitter or through email marketing or ticketing platforms, the provider and its partners may collect and hold the personal information overseas. In those cases, the privacy policies of those providers regulate how the personal information is managed.

7. Anonymity & pseudonymity

There may be times when people prefer to interact with SBC without using their real identity. In most cases, we will need a name and other personal information to properly deal with a matter or to provide a service. However, where practicable, we will give people the option to interact with us anonymously or by using a pseudonym.

8. Storage, security and destruction

SBC holds personal information securely and takes reasonable steps to protect it from misuse, interference, loss, unauthorised access, modification or disclosure.

Personal information contained in our records is subject to the requirements of the Public Records Act 2023, the General Retention and Disposal Schedule, and any other applicable Record Keeping Standards issued by the Queensland State Archivist.

Physical documents are held on site on secure floors or at secure offsite storage. Personal information held in electronic format is held on servers that are either on-premises or in tenancies in the cloud, usually located in Australia. SBC retains effective control over personal information held on cloud tenancies, and the information is managed in accordance with legislative obligations and relevant contractual terms and conditions.

If we do hold personal information that we no longer need, and we are not required to retain it, we will take reasonable steps to destroy the information or to ensure the information is de-identified.

9. CCTV at South Bank Corporation

The SBC collects information using our camera surveillance systems operating in the South Bank precinct and public car parks. Our camera surveillance system is an essential part of providing for the safety of the public and for the security of the precinct generally. The information captured may include personal information which is retained for approximately 90 days. Requests from the public for access to CCTV are managed through the RTI process.

10. Access and correction

People have the right to ask for access to personal information the SBC holds about them. Certain types of information may be available administratively or where that is not appropriate, by formal RTI application.

People also have a right to ask us to correct personal information we hold about them if they believe the information is inaccurate, out of date, incomplete, irrelevant or misleading. They may ask for it to be amended administratively, or where that is not appropriate, by formal application under the RTI Act.

11. Privacy breaches

SBC has policies and procedures designed to protect your personal information. However, if a privacy breach does occur, we will respond quickly to minimise the impact on affected individuals. Our Fact Sheets explain how information privacy breaches are managed and what to do if your information privacy is compromised.

Fact Sheet - Privacy Data Breach Management

Fact Sheet - What to do if your information privacy has been compromised

12. Privacy complaints

SBC has a privacy complaints process to deal with complaints about the personal information management. See our Fact Sheet and Privacy Complaint Form.

Fact Sheet - How to make a privacy complaint

Fact Sheet - Privacy Complaint Form

13. Privacy and RTI contracts

Email: privacy@south-bank.net.au

Postal Address

South Bank Corporation

PO Box 2001

South Bank QLD 4101

Australia

Street address

Visitor Information Centre