Issue Date September 2023

Total Risk Management Pty Limited (TRM) is the trustee of the Russell Investments Master Trust (Fund) and the Russell Investments PST.

TRM is committed to maintaining the privacy of individuals whose personal information it collects, in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (‘Privacy Principles’)  as set out in Schedule 1 of the Privacy Act.

TRM:

(a)        manages personal information in an open and transparent way; and

(b)        ensures that its service providers have appropriate practices, procedures and systems that will promote compliance with the Privacy Act, including the Australian Privacy Principles.

 

This Policy provides an overview of TRM’s management of personal information and covers the following matters:

·       the personal information TRM collects and holds;

·       how TRM collects and holds personal information;

·       the purposes for which TRM collects, holds, uses and discloses personal information; and

·       how an individual may complain about a breach of the Privacy Principles and how TRM will deal with such a complaint.

 

As a trustee, TRM regularly collects personal information about members and potential (non-member) beneficiaries of the Fund. This includes information obtained for:

 

·       admitting members into the fund;

·       maintenance of member records;

·       determining entitlement to benefits;

·       calculation and payment of benefits;

·       handling member inquiries and complaints;

·       provision of financial advice;

·       handling insurance claims;

·       for regulatory requirements, such as member communication, reporting to members, committees, boards and regulators; and

·       overall governance, risk and compliance obligations (including, meeting the requirements of the Anti-Money Laundering & Counter-Terrorism Financing Act 2006) where applicable.

 

What Information is Collected and How is it Used?

The Information we collect:

What is Personal Information?

Any information or an opinion that identifies an individual or enables an individual to be reasonably identified is considered personal information. Personal information may also include sensitive information.

TRM may collect the following personal information about their members:

·       name

·       residential address

·       postal address (if applicable)

·       email and IP address

·       telephone numbers

·       date of birth

·       gender

·       tax file number

·       bank details

·       details relating to citizenship, residency or visa

·       occupation

·       employment details including name of employer, salary & superannuation contributions

·       insurance cover and health status

·       insurance claims history

·       name, address, and relationship of person nominated as a beneficiary; and

·       any other personal information required by legislative requirements.

 

Personal information may be collected by an employer and then submitted into the custody of TRM when a member interest is admitted into the Fund.

What is Sensitive Information?

personal information that is information or an opinion about an individual’s racial or ethnic origin, political opinions, membership of a political organisation, religious beliefs or affiliations, philosophical beliefs, membership of a professional or trade association, membership of a trade union, sexual orientation or practices or criminal record;

(b)        health information about an individual;

(c)        genetic information about an individual that is not otherwise health information;

(d)        biometric templates & visual image information that is to be used for the purpose of unique identification & automated biometric verification. 

TRM will collect sensitive information about an individual in the following situations only, where:

·       the information is reasonably necessary for, or directly related to, one or more of TRM’s functions or activities and the individual consents to the collection of the information; or

·       the collection of the information is required or authorised by an Australian law or an order of a court or tribunal; or

·       a permitted general situation exists in relation to the collection of information by TRM.

 

TRM will collect personal information only by lawful and fair means. Consent is requested and the individual is properly informed of what they are consenting to. Generally, TRM will not rely on an individual’s implied consent and will only do so if it considers it to be appropriate in the particular circumstances. An example of implied consent is where a member does not opt out of the specific proposed use of personal information.

The nature of the provision of financial services does not lend itself to treating individuals anonymously as personal information from individuals is required for transactions. However, there may be some instances where TRM can give the member/beneficiary an option of not identifying themselves, or of using a pseudonym, in relation to a particular matter, for example an enquiry about a product or service.

 

Purpose

This information is collected for the primary purpose of the management of the Fund, including the provision of products and services to members. It is used to provide all relevant administration services, including:

·            issuing of a new interest and admitting a member into the Fund;

·            recording contributions;

·            maintaining member records;

·            the determination and payment of benefits from each Fund;

·            handling insurance claims; and

·            provision of financial advice

The information may be used for a range of related secondary purposes by TRM (or its service providers), including the provision of general education about superannuation and retirement issues. It may also be used for research and surveys and to gain an understanding of your information and communication needs so that TRM can provide improved products, services, and benefits. 

Unsolicited Personal Information

If TRM receives personal information about an individual that it did not solicit, it will, within a reasonable period of receipt, determine whether or not it could have collected the information  had it solicited the information.

If so, then the Privacy Principles and this Policy will apply to the information as if TRM had solicited it.

If TRM determines that it could not have collected the information under the Privacy Principles, it will, as soon as practicable destroy or de-identify the information if it is lawful and reasonable to do so.

 

Method of Collection

TRM collects information from a variety of sources. This may either be directly from you or via a third party such as:

 

·       employers;

·       financial advisers;

·       medical practitioners;

·       the ATO;

·       other superannuation entities and insurance providers;

·       identity verification services; and

·       service providers such as administration and contact centres.

 

Personal information collected by TRM from third parties will be handled in accordance with this Policy . 

 

Information is collected from members and potential beneficiaries in a number of ways, including:

·       in written form (usually signed by the individual);

·       electronically (via email); and

·       verbally or electronically via the Interactive Voice Response (IVR), a service representative or the Fund websites (i.e., the Russell Investment Master Trust website and the Nationwide Super website).

Telephone calls to the Fund’s helpline are recorded and stored.  Information collected from employers is generally provided to TRM (or its service providers) electronically via the employer’s payroll system.

TRM has appointed a number of service providers to assist with the management of the Fund.  These currently include Russell Investments Employee Benefits Pty Ltd (RIEB) for administration and consulting services for the Fund; State Street Australia Limited as the custodian of the Fund and for investment administration and custodial services for the Russell Investments PST; Russell Investment Management Limited for investment management and asset consulting services;  Russell Investments Financial Solutions (RIFS) for personal financial product advice services and various other service providers such as auditors, insurers, claims assessors and legal advisers.

RIEB has outsourced the provision of most administration services to Link Super Pty Ltd (Link Super). Link Super has IT operations based in India and uses Mindtree Limited, also based in India, to perform IT services (Link service provider).  Both companies are entitled to access the administration records maintained by Link, in order to provide the IT services to Link Super.

In most cases, personal information is collected or received by Link Super, as part of the administration services that it provides. References to “administrator” in this Policy means RIEB and/or Link Super (as appropriate).

TRM obtains:

·            assurance that each service provider complies with the privacy legislation and the Privacy Principles; and

·            annual confirmation from RIEB that Link Super and the Link service providers have maintained and implemented policies and procedures designed to ensure compliance with the Privacy Act.

 

Insurance Cover and Benefits

Sensitive personal information is collected and used to process applications for insurance cover and process claims for disablement benefits (relating to the member’s health) and death claims (relating to the individual’s sexual orientation, if relevant to the establishment of dependency).

When sensitive information is solicited by TRM from a health service provider, in relation to a disablement or permanent incapacity claim by a member or former member, this is done with the express consent of the individual.

The administrator collects information about potential beneficiaries (who are not members of the Fund) in order to determine the appropriate distribution and recipient(s) of a deceased member’s benefit.  This information includes:

·            name;

·            address;

·            date of birth;

·            details of relationship with the deceased member; and

·            other relevant details in any particular case, including financial information and information about the individual’s sexual orientation, if relevant to the establishment of dependency.

 

The administrator may need to disclose this information to another individual, for verification purposes.

For disablement benefits, the administrator collects information such as details of the member’s medical condition (including medical reports), work experience and qualifications. 

The administrator will generally need to disclose personal and sensitive information to a third party for verification purposes – for example, to a medical practitioner, in order to assess the member’s medical condition. When a member lodges a claim for a disablement benefit, the member is required to complete a privacy consent form, agreeing to the provision of personal and sensitive information to other parties, such as doctors and the insurer.

Fund Websites

When a member visits the Fund websites, hosted by Russell Investments or Link Super, TRM collects data including the IP address, which may be used to help TRM determine which pages are most popular, peak usage times and other information to help TRM make the Fund websites more efficient and easier to use. 

Unless a member has set their web browser to “not accept” cookies, the website will automatically set a 'cookie' on the member’s machine.  The cookie is used by the member’s machine the next time the member visits the Fund website and will automatically link to personal information that is stored on our system. 

The Fund websites may contain links to other sites. TRM is not responsible for the privacy practices or the content of these websites.

Holding Your Personal Information

TRM may retain the information it collects for many years given the purpose of the Fund is to provide superannuation benefits and (say) in case any legal dispute arises.  If legal proceedings are commenced, TRM may be required to disclose the information to the relevant court or tribunal.

 

TRM has adopted the Russell Investments Group Records Retention Policy put in place to ensure member records are maintained for any statutory periods.

 

TRM restricts access to documents and records it holds to only authorised personnel. 

 

Notification of Collection of Personal Information

At or before the time it collects personal information (or as soon as practicable after) TRM is required to take such steps (if any) as are reasonable in the circumstances to either:

·       notify an individual about whom TRM has collected personal information of specified matters; or

·       otherwise ensure that the individual is aware of any such matters.

TRM has adopted the second approach. TRM ensures individuals are aware of such matters through tailored information on a number of the forms that a Fund member may complete for a specific purpose (such as an insurance request form), through other documentation (e.g., disclosure documentation) and through the Fund websites.

In relation to members of the Fund, TRM provides the following information in the Product Disclosure Statements and/or in this Policy as relevant:

·       the identity and contact details of the Fund/TRM;

·       that TRM collects personal information about members in order to manage the Fund and to comply with legislative requirements. That this information is often collected from the member’s employer and may also be collected from a medical practitioner or other person if the member has made a claim for a disablement benefit;

·       that the collection of certain personal information is authorised or required by the Superannuation Industry (Supervision) Act 1993 and the Anti-Money Laundering & Counter-Terrorism Financing Act 2006 and that Australian courts and the Australian Financial Complaints Authority (AFCA) may require TRM to collect personal information for provision to the court or AFCA if proceedings are brought against TRM or a complaint is made about TRM;

·       the main consequences for the member if all or part of the personal information is not collected;

·       that TRM may disclose the information to Regulators, other superannuation funds, to service providers such as insurers, the auditor, actuary, administrator and the tax adviser and to a court or the Australian Financial Complaints Authority;

·       that TRM’s privacy policy contains information about how a member may access personal information held by TRM and seek the correction thereof;

·       that TRM’s privacy policy contains information about how a member may complain about an interference with the member’s privacy and how TRM will deal with such a complaint;

·       whether TRM is likely to disclose personal information to overseas recipients and, if so, the countries in which they are located.

 

Access to Personal Information

Members have access to their personal information collected by TRM and are able to advise of any corrections that need to be made to this information. A member is also entitled to request reasonable access to personal information held by an insurer about that member. The insurer may reserve the right to charge an administration fee for collating requested information. A member is able to contact the Fund’s insurer to obtain a copy of the insurer’s privacy policy.

There are circumstances in which TRM is not required to give access. Also refer to Australian Privacy Principle 12 Access to Personal Information.

For example, TRM is not required to give access to the extent that:

·       giving access would pose a serious threat to the life, health or safety of any individual, or to public health or public safety;

·       giving access would have an unreasonable impact on the privacy of other individuals;

·       the request for access is frivolous or vexatious;

·       the information relates to existing or anticipated legal proceedings between TRM and the individual and wouldn’t be accessible by discovery in those proceedings;

·       giving access would reveal the intentions of TRM in relation to negotiations with the individual in such a way as to prejudice those negotiations;

·       giving access would be unlawful;

·       denying access is required or authorised by an Australian law or an order of a court or tribunal;

·       TRM has reason to suspect that unlawful activity, or misconduct of a serious nature, that relates to TRM’s functions or activities has been, is being or may be engaged in and giving access would be likely to prejudice the taking of appropriate action in relation to the matter;

·       giving access would be likely to prejudice enforcement related activities by or on behalf of an enforcement body; or

·       giving access would reveal evaluative information generated by TRM in connection with a commercially sensitive decision-making process.

TRM will grant access to personal information only where the individual has given appropriate verification of identification, and this may be required to be in writing. TRM will respond to a request for access within a reasonable period and will give access in the manner requested if it is reasonable and practicable to do so. 

TRM will take such steps (if any) as are reasonable in the circumstances to give access in a way that meets the needs of TRM and the individual. This may involve giving access through the use of a mutually agreed intermediary.

If TRM refuses access to personal information or has not given access in the manner requested by the individual it will provide written reasons for the refusal (except to the extent that, having regard to the grounds for the refusal, it would be unreasonable to do so) and advise of the mechanisms available to complain about the refusal.

TRM reserves the right to impose a fee for providing access to information, to cover any reasonable costs it incurs.

 

Use or disclosure of personal information for a secondary purpose

Personal information about an individual, collected by TRM for a particular purpose (primary purpose), will not be used or disclosed for another purpose (secondary purpose) unless the individual has consented, or the following conditions are satisfied:

·          the individual would reasonably expect TRM to use or disclose the information for the secondary purpose and that purpose is related to the primary purpose (if the information is sensitive information, it must be directly related to the primary purpose);

·          the use or disclosure is required or authorised by or under an Australian law or order of a court or tribunal;

·          TRM reasonably believes that the use or disclosure of the information is reasonably necessary for one or more enforcement related activities by, or on behalf of, an enforcement body (in which case, TRM will make a written note of the use or disclosure);

·          TRM has reason to suspect that unlawful activity, or misconduct of a serious nature, that relates to its functions or activities has been or is being engaged in and TRM reasonably believes that the use or disclosure is necessary for TRM to take appropriate action in relation to the matter;

·          the use or disclosure is reasonably necessary for the establishment, exercise or defence of a legal or equitable claim; or

·          another “permitted general situation” exists.

 

Examples of third-party external organisations with whom TRM might share your personal information with:

 

·       the regulators (the ATO, APRA, AUSTRAC or ASIC)

·       a member’s employer

·       TRM Delegates, (Insurers, administrators, actuaries, tax advisers and custodians)

·       mailing houses

·       your authorised representative

·       a former spouse (Family Law superannuation matters)

·       your beneficiaries, employer or legal adviser in the event of death; and

·       other superannuation funds if you transfer your benefit.

 

Direct Marketing

TRM will use or disclose personal information (other than sensitive information) for the purpose of direct marketing only as permitted by the Privacy Principles. This direct marketing will generally be information members would reasonably expect to receive about products, services and benefits available to current and former members of the Fund.,

Members can elect by simple means, not to receive further direct marketing information from TRM.

 

Overseas Disclosure of Personal Information

TRM must not disclose personal information to an overseas recipient unless it has taken such steps as are reasonable to ensure that the recipient does not breach the Privacy Principles in relation to the information.

TRM does not disclose information to an overseas recipient directly. TRM has put in place a Vendor Governance Framework and an Outsourcing Policy for material service providers with offshoring arrangements to ensure appropriate procedures are in place for the management of personal information. This also places controls on shared cloud-computing services.

Authorized overseas recipients such as State Street Australia Limited (SSAL) and Link Services Pty Ltd  are able to access certain personal information from overseas in certain circumstances.

Use of Tax File Numbers

The administrator stores each member’s tax file number (TFN), if the member chooses to provide that information or where it is provided by the member’s employer, pursuant to the Superannuation Industry (Supervision) Act 1993.

TRM uses a member’s PIN/password or other personal information including the unique member number to identify a member who wishes to transact with the Fund.

TRM is permitted to request a member’s tax file number and whenever it does so, it will provide information in accordance with the Guidelines issued pursuant to the Privacy Act. TRM only uses a member’s tax file number in accordance with law (most importantly, consistently with Part 25A of the Superannuation Industry (Supervision) Act 1993).

Security and Quality of Personal Information

TRM takes reasonable steps to ensure that the personal information that it collects, uses, or discloses is accurate, up-to date, complete and relevant and to protect information that it holds from misuse, interference, loss, unauthorized access, modification or disclosure.

At all times the personal information collected remains, and is treated as, confidential.

Most of the personal information collected by TRM is held by the administrator on the administration system. This system is password protected to minimise the risk of unauthorised access.  Personal information in written form is held in appropriately secure locations to minimise unauthorised access.

Access to each member’s information via the Fund websites is protected by the use of a member number and a PIN or password.  Records are kept of visits to various parts of each website, to enable TRM to observe trends and to improve the sites.

Where TRM no longer needs personal information that it holds and it is not required to retain the information, it will destroy the information or ensure that it is de-identified in accordance with the Record Retention procedures currently in place.

Correction of Personal Information

If TRM holds personal information about an individual and either:

·       it is satisfied that it is inaccurate, out-of-date, incomplete, irrelevant or misleading; or

·       the individual requests TRM to correct the information,

TRM will take such steps (if any) as are reasonable in the circumstances to correct that information.

TRM will respond to a request from an individual to correct his or her personal information as soon as possible and within a reasonable period and will not charge for making the request or correcting the information.

If the information was disclosed to another entity, then TRM will notify that other entity of the correction, if the individual requests this (unless it is impracticable or unlawful to do so).

If TRM refuses a request to correct personal information, it will provide reasons for the refusal (except to the extent that it would be unreasonable to do so) and notify the individual of the mechanisms available to complain about the refusal. If the individual then requests TRM to associate with the information a statement that the information is inaccurate, out-of-date, incomplete, irrelevant or misleading, TRM will take such steps as are reasonable in the circumstances to associate the statement in such a way that will make the statement apparent to users of the information (including by ensuring that the records held by the administrator include such an associated statement).

Enquiries

Members can access information about their superannuation fund from the Fund websites or by calling the telephone number advised to members in the Product Disclosure Statement.

Alternatively, questions or complaints about TRM’s privacy policy and practices may be directed to TRM’s designated Privacy Officer:

 

The Privacy Officer

Total Risk Management Pty Ltd

GPO Box 3279

Sydney NSW 2001

Email: aus-compliance@russellinvestments.com

Phone: 02 9229 511

 

Complaints

Complaints made to the Privacy Officer will be investigated and responded to within a reasonable timeframe in accordance with the Enquiries & Complaints Policy. If you are not satisfied with the way your complaint has been handled by TRM you may contact the Office of the Australian Information Commissioner (OAIC) at:

 

Office of the Australian Information Commissioner

GPO Box 5218

SYDNEY NSW 2001

Phone: 1300 363 992

Email: enquiries@oaic.gov.au

 

Reporting Data Breaches to the Australian Information Commissioner (OAIC)

Where there has been a serious breach of a member’s privacy (i.e. a personal data breach), the Trustee may report the breach to OAIC.  

TRM is required to notify OAIC and the affected members as soon as practicable where TRM has reasonable grounds to believe that an Eligible Data Breach has occurred.

 

Eligible Data Breach

An Eligible Data Breach happens where:

       (a)     there is unauthorised access to, unauthorised disclosure of, or loss of, personal information held by an entity; and

       (b)     the access, disclosure or loss is likely to result in serious harm to any of the individuals to whom the information relates.¹

 

“Likely” means that a reasonable person would be satisfied that the risk of serious harm occurring is more probable than not (rather than possible). ²

 

“Serious harm” could include serious physical, psychological, emotional, economic and financial harm, as well as serious harm to reputation.  It can also include other forms of serious harm that a reasonable person in the Trustee’s position would identify as a possible outcome of the data breach. 

Note, while individuals may be distressed at an unauthorised access/loss of their personal information, this may not be sufficient in itself to be considered as resulting in serious harm. 

 

Notification to Members

Where an Eligible Data Breach has occurred, TRM will write to the affected member(s) (where appropriate in the circumstances) and advise at a minimum:

·       a description of the data breach,

·       the kinds of information concerned,

·       recommendations about the steps that individuals should take in response to the data breach, and

·       contact details should the member(s) require any further information.

Depending on the circumstances, TRM may issue a publication in lieu of, or in addition to, writing to the affected members.

 

Review of the Privacy Policy

As part of the periodic review of the Privacy Policy, incidents, breaches, and complaints reviewed during the year will be assessed to determine whether enhancements of the Privacy Policy might be considered.