WA Museum Privacy Statement

The Western Australian Museum is committed to protecting the privacy of our visitors, members, donors, researchers and community partners. This Privacy Statement explains how we collect, use, store and safeguard personal information in line with our legislative obligations. Our aim is to be transparent, respectful and responsible in how we handle individual’s information.

1. Purpose

The purpose of this Statement is to explain how the Western Australian Museum (“the Museum”) collects, uses, stores and protects personal information as part of its functions and legislative responsibilities. It ensures personal information is handled in line with relevant privacy requirements.

2. Scope

This Statement applies to all personal information the Museum collects, uses, holds or discloses in connection with our programs, services, research, exhibitions and operations. It includes personal information relating to individuals who engage with the Museum in any capacity. This Statement applies across all the Museum sites.

3. Objectives

This Privacy Statement aims to: 

• communicate the Museum’s information handling practices
• enhance the transparency of the Museum operations
• give individuals a better and more complete understanding of the personal and sensitive information the Museum holds and how the Museum deals with that information.

4. Definition of Terms

Personal Information

Personal Information means information or an opinion, whether true or not, and whether recorded in a material form or not, that relates to an individual, whether living or dead, whose identity is apparent or can reasonably be ascertained from the information or opinion. Personal information includes a person's name, date of birth, address, contact details, location information, unique identifiers (such as a driver's licence number or IP address), information relating to physical, genetic, cultural or behavioural characteristics, and inferences made about an individual. This list is not exhaustive.

Sensitive Personal Information

Sensitive Personal Information means personal information:

• relating to an individual's:
  • racial or ethnic origin;
  • gender identity, where the individual's gender identity does not correspond with their designated sex at birth;
  • sexual orientation or practices;
  • political opinions;
  • membership of a political association;
  • religious beliefs or affiliations;
  • political opinions;
  • membership of a political association;
  • religious beliefs or affiliations;
  • philosophical beliefs;
  • membership of a professional or trade association;
  • membership of a trade union; or
  • criminal record;
• that is health information;
• that is genetic or genomic information (other than health information);
• that is biometric information; or
• from which any of the above information can reasonably be inferred.

Sensitive Aboriginal Family History Information

Sensitive Aboriginal Family History Information means information, including family history information, that:

• relates to Aboriginal people and their ancestors; and 
• was collected during the period 1898 to 1972 for the purpose of implementing laws, government policies, or practices applying specifically to Aboriginal people

Sensitive Aboriginal Traditional Information

Sensitive Aboriginal Traditional Information means information that, according to Aboriginal tradition, should not be disclosed to individuals who are not the knowledge holders of that information.

Responsible Information Sharing

Responsible Information Sharing means the authorised exchange of information between public sector entities and other persons or organisations for a lawful purpose in accordance with the Privacy and Responsible Information Sharing Act 2024 (WA).

Automated Decision-Making (ADM)

Automated Decision-Making (ADM) means a process in which a computer system, algorithm, artificial intelligence system, or similar technology makes, or materially assists in making, decisions about individuals.

5. Our Functions

The Museum carries out a range of public, cultural, scientific and educational functions, including:

• collecting, preserving and interpreting Western Australia’s natural and cultural heritage 
• delivering exhibitions, education programs and public events 
• conducting scientific, cultural and historical research 
• managing collections, archives and heritage materials 
• providing digital collections, publications and public information 
• engaging with communities, including Aboriginal and Torres Strait Islander communities 
• supporting tourism, learning and public engagement across Western Australia. 

We only collect the personal information necessary to support these functions.

6. Legal Authority for Collection

We collect personal information where authorised or permitted by:

• the Privacy and Responsible Information Sharing Act 2024 (WA) 
• the State Records Act 2000 (WA) 
• other laws that apply to Museum operations, research, education, safety, and recordkeeping.

7. Statement Requirement

7.1 What privacy law does the Museum comply with?

The Museum must comply with the Privacy and Responsible Information Sharing Act 2024 (WA), which establishes Western Australia’s legislated privacy and information sharing framework for public sector entities, including binding Information Privacy Principles (IPPs) and responsible information sharing requirements. The Museum will ensure that all personal and sensitive information is collected, used, stored, disclosed, and shared in accordance with these legislative obligations, as well as any other applicable statutory confidentiality or information handling requirements.

7.2 What personal information we collect

The Museum may collect:

• name and contact details 
• date of birth
• ticketing, membership and donation information 
• demographic information (e.g., gender or cultural background, where relevant) 
• participation information (events, programs, volunteering)
• images and recordings, including CCTV
•  online activity (IP addresses, browser type, analytics) 
• information relating to accessibility, health or safety
• research related information submitted for Museum projects.

We may also collect sensitive personal information and, where relevant, sensitive Aboriginal family history information, traditional knowledge, cultural information and other forms of Indigenous Cultural and Intellectual Property where authorised by law and supported by appropriate consent, authority, cultural protocols, or collection management requirements. The Museum recognises that some Aboriginal cultural information may be subject to cultural protocols and community expectations, access restrictions, Indigenous Cultural and Intellectual Property rights, and Aboriginal Data Governance arrangements that influence how the information is collected, accessed, used, disclosed, and preserved.

7.3 How we collect Information

We collect personal information when individuals interact with the Museum, including when they:

• visit the Museum site or attend exhibitions, programs or events 
• purchase tickets or memberships 
• make purchases through our retail systems (including online and in-store platforms supported by third-party providers) 
• make donations or participate in fundraising 
• complete forms, surveys or research documents or online registrations 
• use our websites, mobile applications or other digital services 
• are recorded through security systems, including CCTV 
• contact us via phone, email, social media or post
• volunteer, seek employment, act as a contractor or collaborate with us. 

We may also collect personal information from third parties, including government agencies, booking systems, event partners, research collaborators, cultural or community partners, service providers (such as payment or IT providers), and public sources, where this is lawful and appropriate.

Individuals may choose not to identify themselves, or to use a pseudonym, unless we require certain information to deliver a service, ensure safety, or meet legal obligations.

7.4 Why we use and disclose personal Information

We use personal information to: 

• process bookings, ticketing, memberships, and donations 
• manage volunteering, internships, loans (incoming and outgoing), program participation, and collection-related activities 
• deliver exhibitions, events, education programs, and research activities 
• support cultural, scientific, historical research and research collaboration 
• communicate Museum news, events, and opportunities (where permitted) 
• meet legal, reporting, archival, and record-keeping obligations 
• improve our services, facilities, and digital platform. 

Disclosure of personal information 

We may disclose personal information to external parties where lawful and appropriate. These may include:

• the Foundation for the WA Museum 
• service providers, including IT hosting, cloud services, ticketing, payment, communication, security and facilities contractors 
• research, education, cultural and community partners 
• WA Government agencies, courts, tribunals or entities exercising lawful powers 
• cultural partners, community representatives or knowledge holders, where relevant and in accordance with applicable cultural protocols, agreements, or other lawful authority. 

Any disclosure will only occur where the Museum has a lawful basis to collect, use, disclose or share the information. This may include situations where the disclosure: 

• is for the purpose for which the information was collected 
• has been consented to by the individual, where required • is authorised or required by law 
• is permitted under the Privacy and Responsible Information Sharing Act 2024 (WA) 
• is supported by an approved information-sharing arrangement, contract, cultural protocol or other lawful authority. 

Where sensitive personal information, sensitive Aboriginal family history information, traditional knowledge, cultural information, or other forms of Indigenous Cultural and Intellectual Property are involved, additional legal, cultural governance, contractual, or access restrictions may apply before disclosure occurs. 

We do not sell or rent personal information.

7.5 Automated Decision Making

The Museum does not currently use automated decision-making processes that significantly affect individuals. 

If this changes, we will update this Statement and explain the purpose and impact of any automated decisions.

7.6 How we protect personal information

The Museum uses a range of measures to protect personal information, including: 

• secure physical and digital environments 
• authentication and role-based access controls 
• cybersecurity monitoring 
• privacy impact assessments for new systems 
• staff training on privacy and information handling 
• contractual privacy and security requirements for suppliers 
• additional access, security, cultural governance and Aboriginal Data Governance controls for sensitive Aboriginal family history information, traditional knowledge, cultural information, and other forms of Indigenous Cultural and Intellectual Property, including restrictions on access, use, disclosure, publication and sharing where required by legislation, cultural protocols, knowledge holders, Traditional Owners, donor agreements or community representatives.

8. Retention and Destruction

The retention and destruction of personal information held by the Museum is governed by legislation, including the State Records Act 2000 (WA), and the Museum’s supporting policies and procedures. 

The Museum will not keep personal or sensitive information for longer than is needed. In most cases, this means we retain personal information only for as long as it is required for the purpose for which it was collected.

We may be required to retain certain records for longer periods to meet legal, archival, cultural, research, historical, or administrative requirements. Where information is no longer required, it is securely destroyed, deleted, de-identified, or otherwise managed in accordance with approved disposal authorities, applicable legislation, and relevant cultural protocols. Additional legal, cultural, governance, and access requirements may apply to sensitive Aboriginal family history information, traditional knowledge, cultural information, and other forms of Indigenous Cultural and Intellectual Property.

9. Access and Correction

Individuals can request access to, or correction of, their personal information by contacting the Museum or by lodging a request under the Freedom of Information Act. Our FOI statement is available at [link].

10. Enquiries, Feedback and Complaints

Individuals who have an enquiry, concern or feedback about how the Museum manages personal information, including a complaint or a potential privacy breach, are encouraged to contact the Museum. Individuals can submit enquiries, feedback, or complaints by: 

• completing the Museum’s online Customer Feedback form 
• contacting the Museum via contact details available on our website: https://visit.museum.wa.gov.au/about/contact-us 
• writing to us by post (details available on the website). 

We will acknowledge and respond to privacy-related enquiries and complaints within a reasonable timeframe and will handle them in accordance with applicable privacy laws and internal procedures. If an individual is not satisfied with the Museum’s response, they may have the right to escalate their complaint to the relevant oversight authority in Western Australia.

11. Changes to this Statement

We may update this Statement from time to time. The latest version will always be available on our website.

Privacy Statement (Public Version) PDF [365 KB]

Personal information collection notice