Institutional Abuse Privacy Policy

This Institutional Abuse Privacy Policy ("Policy") applies to Ryan Carlisle Thomas (which includes Stringer Clark) ABN 42 645 656 527 and our related entity RCNT Administrative Services Pty Ltd as trustee for Ryan Carlisle Thomas Service Trust ABN 12 072 858 013 ("we", "our" and "us").

The importance of your privacy

We understand the importance of the privacy of your personal information in the context of institutional abuse.

Please read this policy carefully as it sets out important information regarding how, in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles ("APPs"), we collect, hold, use, disclose and protect your personal information (including your sensitive and health information) collected, held, used or disclosed by us for or in relation to institutional abuse allegations, claims, actions or representations of yours and/or our clients.

You do not have to provide any of your personal information to us. However, if you do not provide us with your personal information that we request we may not be able to provide our services or assistance to you and/or our clients.

Application of this Policy and revisions to this Policy

By engaging our services, seeking our assistance, providing your personal information to us or authorising another person to provide us with your personal information you consent to your personal information (including any sensitive and health information) being collected, held, used and disclosed by us in accordance with this Policy.

We may update this Policy from time to time so please review it periodically for changes. If the changes are significant or substantive we will notify you of them and/or post them on our website here.

Your continued use of our website or services, requesting our assistance or provision of further personal information to us (directly or via an authorised person) after this Policy has been revised constitutes your acceptance of and consent to the revised Policy.

What personal information do we collect?

If you are a client we generally collect the following personal information about you:

your name (including any other names by which you were known in an institution);
your gender or gender-neutral description;
your contact details (e.g. mailing address, email address, phone number, fax number);
your date or birth;
details about your occupation (including any past occupations);
details about your early childhood;
details about an institution (or multiple institutions) in which you were a resident or had contact;
details of the abuse suffered and/or witnessed;
details of, information and opinions about your health, injuries or effects of the abuse;
information (including corroboration) from witnesses;
details regarding civil and/or criminal proceedings or other complaints arising from abuse;
administrative information including your Medicare number and bank details for resolution of your matter;
information about your dealings and/or relationship with us or with our clients or witnesses;
other information relevant to the performance of our services for you or our other clients where such is required; and/or
other information permitted or required by law or a Court or Tribunal order.

If you are a witness we generally collect the following personal information about you:

your name;
your gender or gender-neutral description;
your contact details (e.g. mailing address, email address, phone number, fax number);
your date or birth;
details about your occupation (including any past occupations);
details about any abuse which you witnessed;
details of and information and opinions about any abuse you may have suffered and/or its effects on you;
information about your dealings, relationships or associations with us or with our clients;
other information relevant to the performance of our services for you or our clients where such is required; and/or
other information permitted or required by law or a Court or Tribunal order.

Cookies and web beacons

We may use cookies or web beacons to collect data for aggregation in order to analyse the use of our website. These may collect personal information. You can disable cookies or web beacons on your internet browser.

How do we collect your personal information?

We endeavour to collect your personal information directly from you. However, when necessary and appropriate, we may also collect your personal information from third parties including:

witnesses to your abuse or its effects;
any treating doctors and/or any hospital or clinic where you were treated;
your employer or past employer;
Government agencies including law enforcement agencies;
your family members, legal guardian and/or anyone you have authorised to deal with us on your behalf;
anyone seeking our services in relation to their dealings with you; and/or
from publicly available sources.

If you provide to us the personal information of another person (other than information specifically related to a claim or alleged abuse) you warrant that the person or persons to which the personal information relates have consented to such disclosure and to our collection, holding, use and disclosure of their personal information in accordance with this Policy.

What do we use your personal information for?

We collect, hold, use and disclose your personal information for the purposes for which it was provided to us or as permitted or required by law ("Purposes"). These Purposes may include to:

assess, prosecute and/or settle your and/or our clients' claims, including to corroborate allegations made by you and/or our clients;
provide you and/or our clients with the services requested (generally legal services) and communicate about the same, including in relation to billing;
maintain a database of clients and key contacts;
respond to your and/or our clients' enquiries or provide you and/or our clients with assistance as requested;
process application forms you have completed either in hardcopy or in electronic form or on our website;
provide you with journals, newsletters and publications relevant to institutional abuse matters which we believe will be of interest to you (we note you may unsubscribe from receiving such information at any time);
perform quality assurance, IT security and training;
manage personnel (including the recruitment of personnel); and/or
comply with our legal and professional obligations (including checking for conflicts of interest, undertaking anti-money laundering checks and other client take-on procedures).

In certain circumstances we may also collect, hold, use and disclose your personal information as permitted or required by law or a Court or Tribunal order. For example, to take you on as a client we need to collect your name, residential address, date of birth, business name (if any) and directorship appointments (if any) in order to comply with Australian anti-money laundering, counter terrorism, anti-bribery and corruption legislation and relevant professional conduct and practice rules and legislation.

Corroboration database

In cases of historical abuse corroboration from other people can be essential to achieving a successful outcome for our clients. As the abuse experienced by many of our clients occurred years ago, it is often difficult to obtain such corroborative evidence.

In order for us to access as much corroborative evidence as possible, if you have signed and returned to us our "Witness Authorisation to Exchange Information" authorisation form if (you are a witness) or our "Client Authorisation to Obtain Exchange Information" authorisation form (if you are a client), we include your personal information (including your sensitive and health information) and your statements in a secure database ("Corroboration Database") for the purposes of corroboration and to assist us to assess and make claims and progress settlement negotiations on behalf of our clients on a confidential basis.

In addition to the other security measures set out below (please refer to the "How do we protect your personal information" section below), we implement the following additional security measures in relation to the Corroboration Database:

storing the Corroboration Database on a server inside a secure part of our premises and limiting access to that server and the secured part of our premises; and
restricting the persons who have access to the Corroboration Database to only relevant employees who work on institutional abuse matters.

We note that your personal information on the Corroboration Database (as described above) will be maintained after the settlement or finalisation of your specific or the relevant client's specific claim and the closing and/or destruction of our legal file(s) in respect of such for the stated purpose of assisting us, on the confidential basis noted above, to corroborate and make claims and/or progress settlement negotiations on behalf of our other clients.

Who do we disclose your personal information to?

In no case will we will disclose your personal information to any person who is not:

directly dealing with institutional abuse matters on our behalf (such as a limited number of our employees and barristers engaged by us to appear in court in respect of institutional abuse);
the defendant or institution against which an allegation or claim is being made;
your representatives (including any financial advisors) but only if you have provided consent for such disclosure;
in respect of personal information we collect through our website, our United States based website hosting provider;
Government bodies, regulators, law enforcement agencies and any other parties where permitted or required by law; and/or
any other third parties identified at the time of collecting your personal information or to which we are legally permitted or required to disclose your personal information.

No marketing

In no circumstances will we disclose your personal information to any person for marketing purposes.

How do we protect your personal information?

We take reasonable steps to protect your personal information that we hold from misuse, interference and loss and from unauthorised access, alteration and disclosure. For example, we implement the following security measures:

physical security procedures for access to our business premises;
physical security procedures within our offices;
IT security procedures including password protection, firewalls, intrusion detection and site monitoring;
mandatory confidentiality guidelines and privacy training for all staff within the business; and
ensuring all completed files are maintained in a secure facility which can only be accessed by our authorised personnel.

Data protection measures are never completely secure and despite the measures we put in place we cannot guarantee the security of your personal information. You must take care to protect your personal information (e.g. by protecting usernames and passwords). You should notify us as soon as possible if you become aware of any security breaches.

How can you access your personal information?

You may access your personal information that we hold subject to a small number of legal restrictions or exemptions. Where such restrictions or exemptions exist we will advise you of those reasons if we deny your request for access.

If you wish to access your personal information that we hold you should contact us at the details below (see the "Our contact information" section below) and provide us with proof (satisfactory to us) of your identity.

While we do not charge you for a request for accessing your personal information, please be aware that we may charge a reasonable fee (which will be notified to you once you make a request) for our time and costs in complying with your request in the following circumstances:

if an extended amount of time is required to collate and prepare the material for you; and/or
if you wish to have your personal information photocopied by us.

How can you correct your personal information?

We take reasonable steps to ensure that your personal information is accurate, complete and up-to-date. However, we rely on you to advise us of any changes to your personal information.

Please contact us at the details below (see the "Our contact information" section below) as soon as possible if there are any changes to your personal information or if you believe the personal information we hold about you is not accurate, complete or up-to-date so that we can update our records accordingly.

How can you make a complaint?

If you wish to make a complaint about our handling of your personal information or if you believe we have breached the APPs please contact us at the details below (see the "Our contact information" section below). You will need to provide us with sufficient details regarding your complaint together with any supporting evidence.

We will investigate your complaint and determine the steps (if any) that we will undertake to resolve your complaint. We will contact you if we require any additional information from you and will notify you in writing of the outcome of our investigation.

If you are not satisfied with our determination, at any time you can complain to the Australian Privacy Commissioner (see www.oaic.gov.au for contact details).

Our contact information

The Privacy Officer
Ryan Carlisle Thomas
41 Robinson Street
Dandenong Vic 3175
Phone: 03 9238 7878
Email: privacyofficer@rctlaw.com.au
Last updated: May 2019