Privacy policy

Central Highlands Water is committed to providing customers and employees with exceptional customer service - this includes protecting privacy. Central Highlands Water is bound by the Victorian Privacy and Data Protection Act 2014 and by the Health Records Act 2001.

The Victorian Privacy and Data Protection Act and the Health Records Act both address the wariness of people regarding the privacy of their personal information by enshrining enforceable standards in law and committing Victorian government agencies, statutory bodies, local councils and various other organisations to follow them.

This statement is an outline of certain matters relating to the collection and handling of customer and employee personal information by Central Highlands Region Water Corporation. A further explanation of our privacy practices is set out in our Privacy Policy, which is available upon request.

All references to “we”, “us”, and “our” are to Central Highlands Region Water Corporation.


What is personal information?

‘Personal information’ means recorded information or opinion, whether true or not, about an individual whose identity can reasonably be ascertained.

Personal information may include an individual’s name, address, sex, age, financial details, marital status, education or employment history. Some personal information is called “sensitive information” and given special treatment. It includes data about, health ethnic origin, religious belief, sexual practices and criminal record.


What is health information?

‘Health information’ includes information or opinion about the physical, mental or psychological health or a disability (at any time) of an individual; an individual’s expressed wishes about the future provisions of health services; information collected in regards to a health service provided, or to be provided; information about an individual collected in connection with the donation or intended donation of body parts.



We only collect personal information that is necessary to perform our functions or if it is necessary by law. The types of personal information that may be held by us includes, without limitation:

  • Name, address and contact details;

  • Date of birth;

  • Drivers licence details;

  • Pension card numbers;

  • Bank account details;

  • Trade and union membership details;

  • Employment history;

  • Credit information; and

  • Health information.

We may also be required to collect some personal information as required by occupational health and safety laws.

Personal information is collected in a number of ways including, without limitation:

Over the counter;

  • Using forms;

  • Correspondence;

  • From third parties;

  • From publicly available sources

  • Telephone; and

  • Internet.

If information is not supplied that is requested then we may not supply the services or products that are requested.


Use and Disclosure

We recognise that any personal information is very important to our customers and employees, and our customers and employees should have a right to control the use and dissemination of that information.

We may use personal information for the purpose of providing water and sewerage related services and products, promoting such services and products, market research and maintaining employee records.  We may disclose personal information to our contractors and other third parties under the Privacy and Data Protection Act for these purposes.

With limited exceptions we may use and disclose personal information for the purpose specified at the time of collection or for another purpose if:

  • It would reasonably be expected for us to disclose it for that purpose;

  • The purpose is related to the purpose specified to the customer or employee at the time of collection; and

  • If the use or disclosure is required or authorised by or under law.

If we wish to disclose any of the personal information collected other than as set out above, we will not do so unless we have a customer’s or employee’s express consent.



Where practicable and lawful individuals are able to interact with us anonymously.



We will take all reasonable precautions to ensure that the personal information that we collect, use and disclose is accurate, complete and up to date.  However, the accuracy of that information depends to a large extent on the information that is provided to us.  If we are notified that the information that we have is not accurate, complete or up-to-date then we will take action to correct the information.



We will take reasonable steps to ensure that all information that is collected, used or disclosed is accurate, complete, up-to-date and stored in a secure environment accessed only by authorised personnel.


Access to personal information

With limited exceptions our customers and employees have the right to access their personal information that is held by us.  If a copy of personal information is requested from us there may be a charge to cover the administrative costs of providing the information.


Information Privacy Principles and Health Privacy Principles

The Privacy Policy is based on principles as stated in the Victorian Privacy and Data Protection Act 2014 and the Health Records Act 2001.

In short this is a summary of the principles incorporating the Information Privacy Principles and the Health Privacy Principles:

  1. Collection Collect only personal information that is necessary for performance of functions. Advise individuals of the purpose of collection and that they can gain access to their personal information.
  2. Use and disclosure Use and disclose personal information only for the primary purpose for which it was collected or a secondary purpose the person would reasonably expect.  The law allows some uses without consent, such as protect safety.
  3. Data quality Make sure personal information is accurate, complete and up to date.
  4. Data security Take reasonable steps to protect personal information from misuse, loss unauthorised access, modification or disclosure.
  5. Openness Document clearly expressed policies on management of personal information and provide the policies to anyone who asks.
  6. Access and correction Individuals have a right to seek access to their personal information and make corrections. Access and correction will be handled mostly under the Victorian Freedom of Information Act.
  7. Unique identifiers A unique identifier is usually a number assigned to an individual in order to identify a person for the purpose of an organization’s operations.  As data matching can diminish privacy this limits the adoption and sharing of unique identifiers.
  8. Anonymity Give individuals the option of not identifying themselves when entering transactions with organizations, if that would be lawful and feasible.
  9. Transborder data flows If personal information travels, privacy protection should travel with it. Transfer of information outside Victoria is restricted. Personal information may be transferred only if the recipient protects the privacy under similar standards to Victoria’s Information Privacy Principles.
  10. Sensitive information The law restricts the collection of sensitive information like an individual’s racial or ethnic origin, political views, religious beliefs, sexual preferences, membership of groups or criminal record.

We acknowledge our obligations to adhere to the principles and will take all reasonable steps to comply. The privacy of personal information is protected by legislation; therefore we will be accountable under law if this commitment is not demonstrated in practice.


How to contact us

If you have any questions in relation to our privacy practices, or you wish to review or make corrections to your personal information held by us, please contact:

Privacy Officer


PO Box 152


Phone: 5320 3100

Fax: 03 5320 3299          

All complaints will be dealt with in accordance with our complaints handling guidelines.

For more information about privacy in general, you can visit the Privacy Victoria website at or the Office of the Health Services Commissioner at