What is the Permission Access Agreement (PAA)?


The Permission Access Agreement (PAA) serves a number of purposes, including informing Rail Industry Workers and other system users entering and accessing personal information into the system about:

  • the purposes of the RIW Program and why information is collected;
  • the types of information collected for the RIW Program;
  • the way personal information is stored, used, managed and deleted;
  • who may access the information and the circumstances they can do that under


The PAA provides assurance to RIW cardholders that their personal information is used, stored, handled and disclosed for the RIW Program in a controlled manner. Acceptance of the terms of the PAA ensures:

  • that users enter complete, accurate and up to date information into the system;
  • compliance with MTA’s Privacy Policy (which is accessible via the PAA) and other applicable employer policies;
  • responsible use of RIW cards


Metro Trains Australia (MTA), as the provider of RIW Program Services, is obligated to comply with all applicable laws, including data privacy and security requirements. All RIW participants must provide consent for MTA to store their data – this consent must be given by the cardholder in order to maintain their RIW card. If a cardholder does not accept the terms of the PAA, they will not be able to access or use the RIW System as their profile will be deleted.


The PAA is accepted by a cardholder when creating their myRIW account.  Please refer to How does a cardholder create a myRIW account?



Article Link:

https://support.riw.net.au/support/solutions/articles/51000077517


Did you find it helpful? Yes No

Send feedback
Sorry we couldn't be helpful. Help us improve this article with your feedback.

What are the Company Registration - Terms and Conditions?


The Company Registration - Terms and Conditions contains important information regarding a companies legal rights, remedies and obligations when using the RIW System. The terms and conditions must be accepted when a company first registers to become an RIW Participant. By proceeding to use the RIW System or MTA Services, a participant is deemed to have read and accepted the terms of the agreement.


The Company Registration - Terms and Conditions can be accessed at https://www.riw.net.au/company-registration-terms  



RIW Knowledge Centre Article Link:

https://support.riw.net.au/support/solutions/articles/51000174569




Did you find it helpful? Yes No

Send feedback
Sorry we couldn't be helpful. Help us improve this article with your feedback.

How does Metro Trains Australia comply with Privacy Laws?


The protection of personal information in the private sector is required by the Privacy Act 1988 (Cth) and, where applicable, State and Territory privacy laws (collectively the “Privacy Laws“) and Metro Trains Australia (MTA) are bound to comply with these Privacy Laws as they apply to our business. All of our employees and officers are expected to comply with the Privacy Laws and our policies and procedures concerning the protection of personal information.


MTA manages personal information for the purposes of the Rail Industry Worker Program (RIW Program). The RIW Program provides an online competency and safety management system for Australian rail workers. It is owned and endorsed by the Australasian Railway Association (ARA) and operated by MTA.


You can view the Privacy Policy at https://www.riw.net.au/privacy-policy/.



RIW Knowledge Centre Article Link:

https://support.riw.net.au/support/solutions/articles/51000030108


Did you find it helpful? Yes No

Send feedback
Sorry we couldn't be helpful. Help us improve this article with your feedback.

How can a cardholder get their personal data in future?


Subject to certain exemptions provided for under the Privacy Laws, Rail Industry Workers have the right to access personal information that Metro Trains Australia (MTA), on behalf of the Australasian Railway Association, holds about them.  MTA will also take reasonable steps to keep accurate and up to date personal information which they hold about Rail Industry Workers. If a Rail Industry Worker believes that the personal information that MTA holds about them is inaccurate, incomplete, out of date or no longer relevant, please notify MTA via the contact details below.


If you would like to seek access to personal information that MTA may have about you, or update that information, then please contact the RIW Service Desk on 1300 101 682 or info@riw.net.au in the first instance, or write to Metro Trains Australia’s Privacy Officer via the details below:


Privacy Officer

Metro Trains Australia Pty. Ltd.

Level 16, 700 Collins Street

Docklands VIC 3008


For further information, please refer to the Privacy Policy at https://www.riw.net.au/privacy-policy/




Article Link:

https://support.riw.net.au/support/solutions/articles/51000030109



Did you find it helpful? Yes No

Send feedback
Sorry we couldn't be helpful. Help us improve this article with your feedback.

How does Metro Trains Australia manage cyber security?


Metro Trains Australia (MTA) strives to ensure the security, integrity and privacy of information we collect. MTA has established reasonable security measures to protect Personal Information from misuse, interference, loss, unauthorised access, modification or disclosure in contravention of MTA’s Privacy Policy for the RIW Program. MTA’s employees, contractors, agents and service providers who provide services related to our information systems, are obliged to respect the confidentiality of any Personal Information held by us. MTA reviews and updates their security measures in light of current technologies, working in an accredited ISO 27001 Information Security Management System framework.



RIW Knowledge Centre Article Link:

https://support.riw.net.au/support/solutions/articles/51000030111



Did you find it helpful? Yes No

Send feedback
Sorry we couldn't be helpful. Help us improve this article with your feedback.

What personal information does the RIW Program collect?


For the RIW Program, MTA may collect a workers name, gender, photo, date of birth, address, contact details, identification information (e.g. signatures, driver’s licence), health information (e.g. fitness for work assessments, medical records, and results of drug and alcohol tests), competency information (e.g. skills, credentials, registrations and qualifications), right to work details (e.g. visas and passports), work roles, site attendance timestamps, employment history, emergency contact and other personal information as required for the RIW Program.


Please refer to the Privacy Policy for more information about how your personal information is managed.



RIW Knowledge Centre Article Link:

https://support.riw.net.au/support/solutions/articles/51000030112



Did you find it helpful? Yes No

Send feedback
Sorry we couldn't be helpful. Help us improve this article with your feedback.

Why does the RIW Program collect and how does it use personal information?

MTA collects and uses Personal Information in order to manage and provide services in relation to the RIW Program.


MTA will only disclose Personal Information that they collect for the RIW Program to:

  • The Australasian Railway Association;
  • Rail Transport Operators and other organisations that wish to access and use the RIW Program;
  • MTA’s contractors, agents and advisors helping us to manage and provide services in relation to the RIW Program;
  • Authorised Health Practitioners;
  • Other entities as required or permitted by law.


Personal Information will only be disclosed to these entities to the extent that those entities are entitled to access that information under the RIW Program.


For more information about collection of personal information, please refer to the Privacy Policy and RIW Privacy Protocol. For cardholders, please also refer to the Permission Access Agreement, which is acknowledged when first creating a myRIW account.



RIW Knowledge Centre Article Link:

https://support.riw.net.au/support/solutions/articles/51000030113



Did you find it helpful? Yes No

Send feedback
Sorry we couldn't be helpful. Help us improve this article with your feedback.

Can Employers view a cardholders details after the cardholder has ended their employment?


No. A company has no visibility of a cardholders details once the cardholder elects to end their employment or association with them.



RIW Knowledge Centre Article Link:

https://support.riw.net.au/support/solutions/articles/51000030122


Did you find it helpful? Yes No

Send feedback
Sorry we couldn't be helpful. Help us improve this article with your feedback.

How does MTA ensure overseas Third Party Service Providers comply with Australian Privacy Law?


Metro Trains Australia (MTA) has taken steps to ensure that overseas Third Party Service Providers will comply in accordance with Australian Privacy Law.  MTA has enacted this by ensuring that MTA has contractual arrangements in place with these Service Providers that require them to comply with Australian Privacy Law.  If MTA’s Third Party Service Providers fail to adhere to contractual or privacy requirements, then MTA will exercise its rights under the contract depending on the circumstances of the case. Material and severe breaches may lead to termination of the contract.



RIW Knowledge Centre Article Link:

https://support.riw.net.au/support/solutions/articles/51000059696


Did you find it helpful? Yes No

Send feedback
Sorry we couldn't be helpful. Help us improve this article with your feedback.

How is personal information stored in the RIW System?


No personal information on the RIW System is stored overseas.  It is all hosted on secure government approved servers located in Australia.

 

MTA only has one overseas Service Provider who has access to the RIW System to undertake Level 3 support and upgrades. 

 

This Service Provider is located in the UK and is therefore subject to the General Data Protection Regulation (GDPR), which imposes stringent privacy and security requirements on organisations who have exposure to personal information.

 

In addition, MTA has taken steps to ensure that this overseas Service Provider will comply in accordance with Australian Privacy Law in respect of the RIW System.  MTA has enacted this by ensuring that MTA has contractual arrangements in place that require the overseas service provider to comply with Australian Privacy Law.  If MTA’s service provider fail to adhere to contractual or privacy requirements, then MTA will exercise its rights under the contract depending on the circumstances of the case.  

 

Material and severe breaches may lead to termination of the Service Provider.



RIW Knowledge Centre Article Link:

https://support.riw.net.au/support/solutions/articles/51000059698



Did you find it helpful? Yes No

Send feedback
Sorry we couldn't be helpful. Help us improve this article with your feedback.

What are the System Access Rules for using the RIW System?


When logging into the RIW System the first time, users will be presented with the System Access Rules below, which must be acknowledged and understood before proceeding to use the RIW System.



You must agree to these rules to use this software.


The Rail Industry Worker (RIW) System is operated by Metro Trains Australia Pty Ltd (MTA). Your access to the RIW System is subject to the following system access rules:


1. You must keep your access credentials (including your username and password) secret and not share those credentials with any other person.

2. You must only access and use information on the RIW System for properly authorised purposes as part of the RIW Program. For rail operators and other organisations that are authorised participants in the RIW Program, this includes using information accessed on the RIW System for safety, workforce and worksite planning, procuring resources, training, and reporting purposes. For authorised health professionals, this includes using information accessed on the RIW System for conducting health and fitness for work assessments.

3. You must keep all information you access on the RIW System strictly confidential and must not use that information for any purpose other than as set out above or in accordance with the System Access Rules referred to below.

4. You must take reasonable steps to ensure that any information you enter or upload to the RIW System is accurate, complete, up-to-date, relevant and is not false or misleading.

5. You must promptly notify the RIW Service Desk on becoming aware of any error in the RIW System or any breach of these system access rules.

6. You must comply with any additional instruction or direction given by MTA, as the RIW Service Provider, in relation to your access to or use of the RIW System.

7. Where applicable to the activities you are carrying out on behalf of your employer, you must comply with the RIW Privacy Protocol at https://www.riw.net.au/riw-privacy-protocol.


Information contributed to the RIW System will be managed in accordance with MTA's Privacy Policy for the RIW Program (a copy of which is available at https://www.riw.net.au/privacy-policy) and other applicable privacy and security requirements.


I acknowledge these rules.



RIW Knowledge Centre Article Link:

https://support.riw.net.au/support/solutions/articles/51000122512



Did you find it helpful? Yes No

Send feedback
Sorry we couldn't be helpful. Help us improve this article with your feedback.

How can a company opt out of the RIW Program?


As per item 5.3 in the Company Registration – Terms and Conditions, if a company chooses not to accept the terms of their Agreement with the RIW Program, they can opt out by confirming with the RIW Service Desk via email at termination@riw.net.au


If a company elects to opt out, the company will be suspended in the RIW System, and any related cardholders will be released from their employment.  Note that any released cardholders will no longer have authority to work (as detailed in our RIW Knowledge Centre article What are the minimum requirements to use a RIW card? where a cardholder must have a primary employer to have an active RIW card).



RIW Knowledge Centre Article Link:

https://support.riw.net.au/support/solutions/articles/51000176526



Did you find it helpful? Yes No

Send feedback
Sorry we couldn't be helpful. Help us improve this article with your feedback.

SCAM ALERT - Job offers, RIW cards and training


We have noticed an increase in scams involving the Rail Industry Worker (RIW) Program, often starting with an email from a potential employer claiming to offer you a job in rail, and request payment to undertake training for an RIW card or RISI card.


The identified scams involve the following companies:

  • NuGroup Rail Solutions
  • Heritage Railways Co. Pty Ltd
  • Vic Rails Pty Ltd
  • Dywer Rail
  • Alme Group Pty Ltd
  • ACRUXS Rail Services
  • ANX Cleaning Services
  • Prime Rail Pty Ltd
  • R&L Services Victoria Pty Ltd
  • JL Rail Services Pty Ltd
  • AXS Melbourne Limited
  • SP. Transit Limited
  • FX Service
  • PW Rail Services


We have provided examples of the types of emails, conversations and invoices that may be used as part of this scam at the end of this article.




How the scam typically works: 

  • An email is sent by a company claiming a job has become available in rail, and a valid RIW card is required. 
  • An invoice with bank details to pay a training provider is issued to you for an RIW or RISI card training course, and directions to undertake the course via Zoom or face-to-face.
  • The email and conversation you have with the scammer may appear professional and legitimate and ask you to provide personal and financial information. 
  • Often the scammer has sourced your contact information through a job-seeking website, where you may have marked yourself as available or looking for work.

 

If you receive an email offering work in rail and requesting payment for an RIW/RISI card or training, we recommend you contact the RIW Service Desk on info@riw.net.au to verify whether the company is registered with the RIW Program.


The only way to get a Rail Industry Worker card without an employer is by directly applying for an RIW card on the RIW website, and using our payment gateway to process this payment. A tax invoice will be provided after payment. 

 

The best way to protect yourself from being caught out by this scam is to:

  • Stop and think twice if you’re being asked to act urgently or respond to an offer that seems too good to be true. 
  • Notice poor spelling and grammar and inconsistent spacing between sentences and paragraphs. 
  • Be suspicious of any email from someone asking for your personal or financial information.
  • Never click on links or attachments in suspicious emails. 
  • Do your research about the company and/or training provider. Look for legitimate websites or offices, talk to other people in the industry, check their ABN etc.  We have a list of approved Registered Training Providers on our website to reference as well.
  • Contact the RIW Service Desk to check whether a training provider or employer is with the RIW Program. 


If you have been contacted in relation to a suspected scam attempt, please provide us with as much evidence as you can, such as invoices and email conversations. This will help us to report the matter to the relevant financial institution and authorities.  


If you have already paid a suspected fraudulent invoice:

  • Contact your financial institution.
  • Report the matter immediately to the Police in your jurisdiction. 
  • Report the matter to Scamwatch at scamwatch.gov.au
  • Contact IDCare at https://www.idcare.org/ if you have provided personal details.



Article link: 

https://support.riw.net.au/support/solutions/articles/51000331273


pdf
pdf
pdf
pdf
pdf
pdf

Did you find it helpful? Yes No

Send feedback
Sorry we couldn't be helpful. Help us improve this article with your feedback.