• Section 1 - Purpose
• Scope
• Section 2 - Policy
• Section 3 - Procedures
• Responsibilities and Required Actions
• Records and Information Access and Security Control
• Records and Information Access for Research Purposes
• Individuals’ Access to Their Personal Information
• Freedom of Information Requests
• Section 4 - Guidelines
• Section 5 - Definitions

Section 1 - Purpose

(1) The purpose of this Procedure is to outline the responsibilities and actions associated with access and security of Records and information at Macquarie University.

Scope

(2) This Procedure applies to all Macquarie University staff and all University Records.

Section 2 - Policy

(3) Refer to the Records and Information Management Policy.

Section 3 - Procedures

Responsibilities and Required Actions

Records and Information Access and Security Control

(4) Executive Deans / Heads of Offices / business system owners must ensure that enterprise business information systems and local recordkeeping systems for which they are responsible have access-control protocols and procedures that ensure:

1. Records and information are stored with an appropriate level of security;
2. Records and information can only be accessed by staff for legitimate work purposes;
3. Record and archival integrity is maintained; and
4. staff who access University Records and information are aware of their responsibilities for protecting privacy and confidentiality where relevant.

Records and Information Access for Research Purposes

(5) This section applies to access to University Records and information by external parties, and by University staff for research purposes not directly related to their work.

(6) A person wishing to access University Records and information for research purposes must submit an access request to ask.memory@mq.edu.au. Access to Records and information held in enterprise business systems will be redirected to the Records and Archives Manager.

(7) Requests for Records and information held by a budget division must be made in writing to the relevant Executive Dean / Dean / Head of Office and must detail the specific Records being requested.

(8) Before approval of access, the relevant Executive Dean / Dean / Head of Office / business system owner holding the Records and information must ensure that advice is sought from:

1. General Counsel if the requested Records and information contain content that may be commercially sensitive for the University or for a third party business that it engages with, or legal advice or opinion; or
2. Privacy Officer (privacyofficer@mq.edu.au) in relation to any personal information contained in the Records.

(9) Before approval of access to Records and information held by Archives and Records, staff of that area must consult with the area from which the Records and information originated if there is any doubt about releasing the Records and information.

(10) Where permission is given to access Records for research purposes, the area controlling the Records and information will provide access to them with appropriate security and protection of archival integrity.

Individuals’ Access to Their Personal Information

(11) An individual who wishes to view or amend their own personal information held in University business systems must submit a written request to the relevant Executive Dean / Dean / Head of Office holding the Record or information (e.g. relevant Faculty for student files, Human Resources for employee files).

(12) The head of the area holding the Record or information, or their nominee, must contact the Privacy Officer for advice about the appropriate procedure.

Freedom of Information Requests

(13) Individuals may apply for access to University Records and information under the provisions of the Government Information (Public Access) Act 2009.

(14) All formal requests for access to University Records and information under the provisions of the Government Information (Public Access) Act 2009 must be made in writing to the University’s Right to Information Officer (see Right to Information (GIPA)).

(15) The Records and Archives Manager is responsible for managing responses to Right to Information requests.

(16) If a staff member receives a request to access Records and information under the provisions of the Government Information (Public Access) Act 2009, they must immediately forward the request to the Records and Archives Manager.

Section 4 - Guidelines

(17) Nil.

Section 5 - Definitions

(18) Definitions specific to this Procedure are contained in the Records and Information Management Policy.