ARBV privacy

This policy sets out how the ARBV handles personal and/or sensitive information obtained in the course of performing its functions under the Architects Act. We are committed to the protection and fair handling of personal and sensitive information in accordance with the Privacy and Data Protection Act 2014 (Vic) (PDP Act) and the Information Privacy Principles (IPPs) contained in Schedule 1 of the PDP Act.

This policy also explains how you can access and correct the personal and/or sensitive information that is held by the ARBV about you, and how you can make a privacy complaint.

This policy relates to all of your contact with us, whether in person, by telephone, email or online. Any personal information collected by the ARBV, whether obtained directly from you or from other sources, will be handled in accordance with this policy and the PDP Act.

The ARBV has a separate policy that applies to all personal, sensitive and health information collected, stored, used and disclosed about people working for the ARBV, including agency workers, suppliers and contractors. Contact the ARBV for more information about the ARBV Employee, Supplier and Contractor Privacy Policy.

We may collect, use and/or disclose the personal and/or sensitive information in the course of carrying out our regulatory and enforcement functions under the Architects Act:

‘Personal information’ means any information or an opinion, that is recorded in any form and whether true or not, about an individual whose identity is apparent, or can reasonably be ascertained, but does not include health information.

The types of personal information that we may collect includes:

• name, address and other contact details;
• date of birth;
• gender;
• qualification and employment information;
• complaint details that may identify an individual; and
• professional indemnity insurance details.

The ARBV may collect personal information only when it is necessary to do so to perform its functions under the Act. ‘Sensitive information’ is a type of personal information. It is information or an opinion about an individual’s race or ethnicity, political opinions, membership of a political association, religious beliefs or affiliations, philosophical beliefs, membership of a professional or trade association, membership of a trade union, sexual orientation or practices, or criminal record, that is also personal information.

Some of our work requires us to collect sensitive information. For example, where a person discloses their criminal history in their registration application, we may seek to obtain a criminal record check from Victoria Police.

The ARBV must not collect sensitive information unless:

• the individual has consented to the collection
• the collection is required or authorised under law
• the collection is necessary to prevent or lessen a serious threat to the life or health of any individual, where the individual whom the information concerns is physically or legally incapable of giving consent to the collection or physically cannot communicate consent to the collection
• the collection is necessary for the establishment, exercise or defence of a legal or equitable claim.

Health information
The ARBV generally does not collect health information in performing our functions. ‘Health information’ means information or an opinion about an individual’s physical, mental or psychological health, disability, expressed views about the future provision of health services, or a health service provided or to be provided to the individual, that is also personal information. It also includes personal information that is genetic information about an individual, or that is collected in relation to the provision of a health service or in connection with the donation of body parts, organs or body substances.

Although we do not generally collect health information and will only collect it when it is explicitly necessary for our core functions or activities, any health information collected by us will be handled consistently with the Health Records Act 2001 (Vic) and the Health Privacy Principles located in Schedule 1 of that Act.

There are many ways in which we may collect your personal and/or sensitive information, including when you:

• submit a form to the ARBV via email or online (e.g. a registration application, complaint or enquiry form)
• update your personal details via the ARBV Portal
• make a payment to us
• make a freedom of information request
• write to us
• email us
• telephone us
• respond to a survey or sign up for newsletters/information bulletins
• visit the ARBV’s website using automated data collection software and systems (see below for more information).

In most cases, we will tell you when we collect, or intend to collect, your personal and/or sensitive information and will provide you with a collection statement. This collection statement will identify the ARBV, explain why we are collecting the information and how we intend to hold, use and disclose it, amongst other things.

Sometimes we may collect personal, and/or sensitive information about you from a third party, including in circumstances where we have not requested personal and/or sensitive information.

For example:

• if a complaint is made about you, we record this information;
• if an enquiry is received, we may record the terms of the enquiry and related details; or
• we may receive information from other agencies about offences or professional conduct issues concerning architects.

It is not always practical for us to advise people when we receive information about them from a third party. We will only use personal information received from third parties to carry out our statutory functions under the Architects Act and the Architects Regulations.

Any collection of personal and/or sensitive information will be done in accordance with the Architects Act, the Architects Regulations, the PDP Act and/or any other relevant laws (as applicable).

Where we receive unsolicited personal and/or sensitive information, we handle such information consistently with the PDP Act.

Visitors to the ARBV’s website

The ARBV’s website is built using the Victorian Government’s Single Digital Presence (SDP) platform. Because it operates on this shared state infrastructure, it relies on a standardized suite of third-party software and digital tools to automatically collect visitor data. For more information about the automatic collection of information and data through our website, including its use and disclosure, visit vic.gov.au master privacy framework.

We collect personal and/or sensitive information so that we can carry out our regulatory and enforcement functions under the Architects Act and the Architects Regulations. This may include (but is not limited to) any of the following functions:

• determining the qualifications and experience required for the registration of architects
• regulating the examination of persons applying for registration
• assessing and accrediting courses in architecture, in association with approved schools of architecture
• holding examinations and appointing examiners
• issuing or cancelling certificates of registration or approval
• suspending or cancelling the registration of persons, or revoking the suspension of a person
• publishing information relating to the operation of the Board and the Architects Act
• maintaining the Register of Architects and the Architects Disciplinary Register
  compliance and enforcement activities, including responding to complaints, carrying out investigations and prosecutions, and facilitating Architects Tribunal inquiries
• receiving or processing enquiries, including requests for access to information under the Freedom of Information Act 1982 (Vic) (FOI Act)
• providing industry updates and collecting responses to surveys
  carrying out any other functions or powers under the Architects Act.

Consequences of failing to provide requested information

We receive applications, complaints and enquiries from persons including architects, students, clients of architects and members of the public.

To investigate or progress a complaint, enquiry, or application, we may request information from you, including personal and/or sensitive information.

If the personal and/or sensitive information that we request is not provided, we may not be able to process your application or progress or investigate your complaint or enquiry.

We may use and/or disclose personal and/or sensitive information for the primary purpose for which it was collected. This may include for the purposes of assessing an application for registration, investigating or progressing a complaint, enquiry, or suspected breach of the law and regulating or holding examinations (amongst other things).

We may disclose your personal and/or sensitive information to third parties including, but not limited to, the Architects Accreditation Council of Australia, the Architects Tribunal, other national architect registration boards or regulators and/or third parties. Disclosures may be made to entities and/or persons outside Australia if, for example, we receive a complaint that relates to an architect who has practised outside of Australia.

We may also use and/or disclose this information for a permitted secondary purpose in specified situations, such as where:

• the use and/or disclosure is for a related secondary purpose, and you would reasonably expect the information to be used and/or disclosure for the secondary purpose
• you have consented to the use and/or disclosure
• the use and/or disclosure is required or authorised by or under law
• the use and/or disclosure is necessary for an investigation into suspected unlawful activity
• the use and/or disclosure is necessary to enforce law, prevent, detect, investigate or sanction breaches of law, to prepare for, or conduct, proceedings before a court or tribunal, or implement orders of a court or tribunal
• the use and/or disclosure is necessary to prevent or lessen a serious threat to an individual’s life, health, safety or welfare, or to public health, public safety or public welfare
• the use and/or disclosure is permitted under a data or information sharing arrangement, for instance with national and international architecture regulators, or other related regulators such as the Building and Plumbing Commission
• where we engage a third-party contractor to provide specified services. For example, processing online payments or the dissemination and/or collection of information to and/or from registered architects, partnerships or companies through newsletters or surveys (e.g. through Campaign Monitor or Survey Monkey).

Any use and/or disclosure of personal and/or sensitive information will be done in accordance with the Architects Act, the Architects Regulations, the PDP Act and/or any other relevant laws (as applicable).

Registers of Architects
In accordance with our obligations under Part 3, Division 4 the Architects Act, we maintain a Register of Architects which informs the public about who is registered or approved to carry out work as an architect. It also assists us in regulating the architectural profession in Victoria.

The publicly available Register of Architects contains information about the registration of architects and the approval of companies and partnerships, including the names, preferred names, business names, registration number and geographic location of every architect, approved partnership and approved company. A certified extract of the Register of Architects (Certified Extract) contains this information as well as additional information including the date of registration, qualifications and, for architects, required insurance information.

Members of the public can search the Register of Architects and any person may apply in writing to the Registrar for a Certified Extract from the Register.

The ARBV also maintains a register of practitioners working in Victoria under Automatic Mutual Recognition (AMR). Information about the registration of these practitioners is available to the public via the Automatic Mutual Recognition (AMR) Register published on the ARBV website.

If you are an architect or work in Victoria under AMR, we may use your personal information to inform and update the Register of Architect and the Automatic Mutual Recognition (AMR) Register.

We take reasonable steps to ensure that the personal and/or sensitive information that we collect, use and/or disclose is accurate, complete and up-to-date.

In accordance with the Architects Act, accurate information should be provided to us at all times. For example, partnerships and companies are required to notify us within 14 days if they no longer comply with the registration criteria. Generally, we rely on individuals to provide up to date information and advise us if the information collected has recently changed.

We take reasonable steps to protect your personal and sensitive information contained in our files from outside or unauthorised access.

Our information technology arrangements incorporate a range of data security measures. For example, we require staff to use passwords to enter our computer system and our databases can only be accessed by staff using an additional password. Different levels of access are granted to staff depending on their role. Only staff with authority to access your personal and/or sensitive information, and who need to use your personal and/or sensitive information to perform their functions, will have access to it.

Personal and/or sensitive information that is collected by us is stored within Australia. Our data storage system is subject to regular audits.

Where your personal and/or sensitive information is transferred outside Victoria or Australia, for example, to an international body in accordance with a data or information sharing arrangement, we take steps to ensure that the information sharing is consistent with the IPPs and the PDP Act and that the information is protected from unauthorised use and disclosure.

Where personal and/or sensitive information is disclosed or made available to a contracted service provider, we will ensure that the contract requires confidentiality, restricts the use of the information to the purposes of the contract and clarifies what happens to the personal and/or sensitive information when the contract finishes. Wherever possible, arrangements are also made to enable us to monitor the contractor's compliance. Where contractors are involved in the delivery of core services, we ask them to comply with the IPPs and/or that they act consistently with the IPPs when handling the personal and/or sensitive information. Complaints or questions about personal and/or sensitive information disclosed or made available to a contracted service provider should be directed to the ARBV.

Our online payment services are managed in conjunction with Windcave, a third-party IT service provider. Windcave may access the personal information entered into our forms in order to process electronic transactions or to resolve a technical problem. Windcave’s Privacy Policy sets out how it collects, safeguards and discloses personal data that results from use of its services.

If you make a payment using our website, we will process your payment with the assistance of Windcave and present you with an online receipt for your records.

The ARBV is covered for its core regulatory and accreditation functions by the specific Public Record Office Victoria (PROV) retention and disposal authority PROS 19 02 Retention and Disposal Authority for Records of the Professional Registration and Accreditation Function. Like all Victorian public offices, the ARBV is also covered by PROS 07/01 – RDA for Records of Common Administrative Functions for standard administrative, financial, and housekeeping records.

Registrants can view and update some personal and/or sensitive information directly through the ARBV Portal.

If you believe that the personal and/or sensitive information we hold about you is not accurate, complete, or up to date, you can ask us to correct it by contacting us using the details provided below.

You can also request access to the personal and/or sensitive information that we hold about you by submitting a freedom of information request (FOI Request) under the FOI Act. We will try to give you access with as little formality as possible however in some cases, including where the request involves personal and/or sensitive information about other people, we may have to use the process under the FOI Act to assess your FOI Request.

Any request to access or correct personal and/or sensitive information held by us should be made in writing and addressed to:

Email: registrar@arbv.vic.gov.au (Attention FOI Officer)

Post: Attention FOI Officer
Architects Registration Board of Victoria
Level 10, 533 Little Lonsdale Street
Melbourne VIC 3000

Alternatively, a request to access or correct personal and/or sensitive information held by us can be made by completing the online enquiry form on our website (Contact the ARBV | arbv.vic.gov.au).

Where verifying a person’s identity is not required by us to properly carry out a regulatory function, it may be possible to remain anonymous (i.e. you may not need to identify yourself to us). Examples include where you may be seeking general advice from us or making a complaint to us about an architect or notifying us of a potential offence under the Architects Act when those matters can be reasonably investigated without knowing and/or disclosing your identity. The ARBV’s complaint and notification forms can be submitted without the complainant or notifier providing their name. Where it is not possible for us to investigate or otherwise progress a matter without disclosing your identity, we will inform you of this and seek your consent to do so.

We assign registered architects and approved companies and partnerships, or those applying for registration as an architect or for approval for their company or partnership, a unique registration number upon registration. This is a publicly available number.

We also assign individuals and entities with a unique 8-digit invoice number for online payments to assist us in tracking payments for fees and/or other charges prescribed by the Architects Act or the Architects Regulations.

If you are unhappy about the way we have handled your personal and/or sensitive information, or if you seek further information about our privacy policy, you may wish to discuss your concerns or queries with our Privacy Officer. You may contact us in person (by attending our office) or by telephone or in writing, using the following details:

Email: registrar@arbv.vic.gov.au (Attention Privacy Officer)
Post: Attention Privacy Officer
ARBV
Level 10, 533 Little Lonsdale Street
Melbourne VIC 3000
Phone: 03 9417 4444

Alternatively, you can make a complaint by completing an online complaint form on our website (Complaints | arbv.vic.gov.au).

You may also discuss your concerns directly with the Office of the Victorian Information Commissioner (OVIC) - see www.ovic.vic.gov.au. Amongst other things, OVIC’s role is to receive and resolve privacy complaints, including through a conciliation process.

We may amend this policy from time to time. The current version of this policy will be posted on our website, and a copy may be obtained at any time by contacting us via the details provided above in this policy.

You can complain if you believe there has been a breach of your privacy by ARBV, concerning the personal information we hold about you.

ARBV holds personal information about architects and exam candidates. Registered practising architects appear on the register, which is publicly available on our website through the search function. Some personal information is published in the register according to the requirements in the legislation (Architects Act 1991 (Vic) and Architects Regulations 2026 (Vic)).

A complaint must be about an individual because information regarding companies and partnerships is not subject to the requirements in the Privacy and Data Protection Act 2014 (VIC).

If you are unhappy about the way we have handled your personal and/or sensitive information, you may wish to discuss your concerns with the ARBV’s Privacy Officer. You may contact us in person, by telephone or in writing, using the following details:

Email: registrar@arbv.vic.gov.au (Attention Privacy Officer)

Post: Attention Privacy Officer
ARBV
Level 10, 533 Little Lonsdale Street
Melbourne VIC 3000

Phone: 03 9417 4444

Alternatively, you can make a complaint by completing an online enquiry form.

You may also discuss your concerns directly with the Office of the Victorian Information Commissioner.

If you want to identify yourself, please include the following information in your complaint, to help us with our investigation of the matter:

• your name
• your registration number (if relevant)
• your email address
• the reason why you think your privacy has been breached
• any evidence or relevant information supporting your complaint
• how the breach has affected you
• what outcome are you seeking

You may remain anonymous if you wish and we will endeavour to deal with your complaint as best we can, but please be aware that this could affect our ability to adequately deal with the issue.

ARBV takes any privacy complaint seriously. If your complaint is legitimate and valid, we will endeavour to resolve the issue with you as quickly as possible. We want to find a solution as much as you.

We will assess your complaint to determine how and why the privacy breach occurred and take every action to ensure it is rectified and will not happen again.

We will work to resolve the issue with you in accordance with the Victorian Ombudsman Good Practice Guide to Complaint Handling for Victorian Public Sector Agencies. This means we will deal with your complaint in an efficient and timely manner and will allow the complainant and respondent (ARBV) time to respond to any matters raised during the course of the investigation.