The Permission Access Agreement (PAA) serves a number of purposes, including informing Rail Industry Workers and other system users entering and accessing personal information into the system about:

• the purposes of the RIW Program and why information is collected;
• the types of information collected for the RIW Program;
• the way personal information is stored, used, managed and deleted;
• who may access the information and the circumstances they can do that under

The PAA provides assurance to RIW cardholders that their personal information is used, stored, handled and disclosed for the RIW Program in a controlled manner. Acceptance of the terms of the PAA ensures:

• that users enter complete, accurate and up to date information into the system;
• compliance with MTA’s Privacy Policy (which is accessible via the PAA) and other applicable employer policies;
• responsible use of RIW cards

Metro Trains Australia (MTA), as the provider of RIW Program Services, is obligated to comply with all applicable laws, including data privacy and security requirements. All RIW participants must provide consent for MTA to store their data – this consent must be given by the cardholder in order to maintain their RIW card. If a cardholder does not accept the terms of the PAA, they will not be able to access or use the RIW System as their profile will be deleted.

The PAA is accepted by a cardholder when creating their myRIW account.  Please refer to How does a cardholder create a myRIW account?

Article Link:

https://support.riw.net.au/support/solutions/articles/51000077517

The Company Registration - Terms and Conditions contains important information regarding a companies legal rights, remedies and obligations when using the RIW System. The terms and conditions must be accepted when a company first registers to become an RIW Participant. By proceeding to use the RIW System or MTA Services, a participant is deemed to have read and accepted the terms of the agreement.

The Company Registration - Terms and Conditions can be accessed at https://www.riw.net.au/company-registration-terms  

RIW Knowledge Centre Article Link:

https://support.riw.net.au/support/solutions/articles/51000174569

The protection of personal information in the private sector is required by the Privacy Act 1988 (Cth) and, where applicable, State and Territory privacy laws (collectively the “Privacy Laws“) and Metro Trains Australia (MTA) are bound to comply with these Privacy Laws as they apply to our business. All of our employees and officers are expected to comply with the Privacy Laws and our policies and procedures concerning the protection of personal information.

MTA manages personal information for the purposes of the Rail Industry Worker Program (RIW Program). The RIW Program provides an online competency and safety management system for Australian rail workers. It is owned and endorsed by the Australasian Railway Association (ARA) and operated by MTA.

You can view the Privacy Policy at https://www.riw.net.au/privacy-policy/.

RIW Knowledge Centre Article Link:

https://support.riw.net.au/support/solutions/articles/51000030108

Subject to certain exemptions provided for under the Privacy Laws, Rail Industry Workers have the right to access personal information that Metro Trains Australia (MTA), on behalf of the Australasian Railway Association, holds about them.  MTA will also take reasonable steps to keep accurate and up to date personal information which they hold about Rail Industry Workers. If a Rail Industry Worker believes that the personal information that MTA holds about them is inaccurate, incomplete, out of date or no longer relevant, please notify MTA via the contact details below.

If you would like to seek access to personal information that MTA may have about you, or update that information, then please contact the RIW Service Desk on 1300 101 682 or info@riw.net.au in the first instance, or write to Metro Trains Australia’s Privacy Officer via the details below:

Privacy Officer

Metro Trains Australia Pty. Ltd.

Level 16, 700 Collins Street

Docklands VIC 3008

For further information, please refer to the Privacy Policy at https://www.riw.net.au/privacy-policy/. 

Article Link:

https://support.riw.net.au/support/solutions/articles/51000030109

Metro Trains Australia (MTA) strives to ensure the security, integrity and privacy of information we collect. MTA has established reasonable security measures to protect Personal Information from misuse, interference, loss, unauthorised access, modification or disclosure in contravention of MTA’s Privacy Policy for the RIW Program. MTA’s employees, contractors, agents and service providers who provide services related to our information systems, are obliged to respect the confidentiality of any Personal Information held by us. MTA reviews and updates their security measures in light of current technologies, working in an accredited ISO 27001 Information Security Management System framework.

RIW Knowledge Centre Article Link:

https://support.riw.net.au/support/solutions/articles/51000030111

For the RIW Program, MTA may collect a workers name, gender, photo, date of birth, address, contact details, identification information (e.g. signatures, driver’s licence), health information (e.g. fitness for work assessments, medical records, and results of drug and alcohol tests), competency information (e.g. skills, credentials, registrations and qualifications), right to work details (e.g. visas and passports), work roles, site attendance timestamps, employment history, emergency contact and other personal information as required for the RIW Program.

Please refer to the Privacy Policy for more information about how your personal information is managed.

RIW Knowledge Centre Article Link:

https://support.riw.net.au/support/solutions/articles/51000030112

MTA collects and uses Personal Information in order to manage and provide services in relation to the RIW Program.

MTA will only disclose Personal Information that they collect for the RIW Program to:

• The Australasian Railway Association;
• Rail Transport Operators and other organisations that wish to access and use the RIW Program;
• MTA’s contractors, agents and advisors helping us to manage and provide services in relation to the RIW Program;
• Authorised Health Practitioners;
• Other entities as required or permitted by law.

Personal Information will only be disclosed to these entities to the extent that those entities are entitled to access that information under the RIW Program.

For more information about collection of personal information, please refer to the Privacy Policy and RIW Privacy Protocol. For cardholders, please also refer to the Permission Access Agreement, which is acknowledged when first creating a myRIW account.

RIW Knowledge Centre Article Link:

https://support.riw.net.au/support/solutions/articles/51000030113

No. A company has no visibility of a cardholders details once the cardholder elects to end their employment or association with them.

RIW Knowledge Centre Article Link:

https://support.riw.net.au/support/solutions/articles/51000030122

Metro Trains Australia (MTA) has taken steps to ensure that overseas Third Party Service Providers will comply in accordance with Australian Privacy Law.  MTA has enacted this by ensuring that MTA has contractual arrangements in place with these Service Providers that require them to comply with Australian Privacy Law.  If MTA’s Third Party Service Providers fail to adhere to contractual or privacy requirements, then MTA will exercise its rights under the contract depending on the circumstances of the case. Material and severe breaches may lead to termination of the contract.

RIW Knowledge Centre Article Link:

https://support.riw.net.au/support/solutions/articles/51000059696

No personal information on the RIW System is stored overseas.  It is all hosted on secure government approved servers located in Australia.

MTA only has one overseas Service Provider who has access to the RIW System to undertake Level 3 support and upgrades. 

This Service Provider is located in the UK and is therefore subject to the General Data Protection Regulation (GDPR), which imposes stringent privacy and security requirements on organisations who have exposure to personal information.

In addition, MTA has taken steps to ensure that this overseas Service Provider will comply in accordance with Australian Privacy Law in respect of the RIW System.  MTA has enacted this by ensuring that MTA has contractual arrangements in place that require the overseas service provider to comply with Australian Privacy Law.  If MTA’s service provider fail to adhere to contractual or privacy requirements, then MTA will exercise its rights under the contract depending on the circumstances of the case.  

Material and severe breaches may lead to termination of the Service Provider.

RIW Knowledge Centre Article Link:

https://support.riw.net.au/support/solutions/articles/51000059698

When logging into the RIW System the first time, users will be presented with the System Access Rules below, which must be acknowledged and understood before proceeding to use the RIW System.

RIW Knowledge Centre Article Link:

https://support.riw.net.au/support/solutions/articles/51000122512

As per item 5.3 in the Company Registration – Terms and Conditions, if a company chooses not to accept the terms of their Agreement with the RIW Program, they can opt out by confirming with the RIW Service Desk via email at termination@riw.net.au. 

If a company elects to opt out, the company will be suspended in the RIW System, and any related cardholders will be released from their employment.  Note that any released cardholders will no longer have authority to work (as detailed in our RIW Knowledge Centre article What are the minimum requirements to use a RIW card? where a cardholder must have a primary employer to have an active RIW card).

RIW Knowledge Centre Article Link:

https://support.riw.net.au/support/solutions/articles/51000176526

We have noticed an increase in scams involving the Rail Industry Worker (RIW) Program, often starting with an email from a potential employer claiming to offer you a job in rail, and request payment to undertake training for an RIW card or RISI card.

The identified scams involve the following companies:

• GPAS HOLDINGS PTY LTD
• INDUSTRIAL COMPANY PTY LTD
• DS RAIL PTY LTD
• AATSCO QLD PTY LTD
• Ready Rail Pty Ltd
• NuGroup Rail Solutions
• Heritage Railways Co. Pty Ltd
• Vic Rails Pty Ltd
• Dywer Rail
• Alme Group Pty Ltd
• ACRUXS Rail Services
• ANX Cleaning Services
• Prime Rail Pty Ltd
• R&L Services Victoria Pty Ltd
• JL Rail Services Pty Ltd
• AXS Melbourne Limited
• SP. Transit Limited
• FX Service
• PW Rail Services

We have provided examples of the types of emails, conversations and invoices that may be used as part of this scam at the end of this article.

How the scam typically works: 

• An email is sent by a company claiming a job has become available in rail, and a valid RIW card is required. 
• An invoice with bank details to pay a training provider is issued to you for an RIW or RISI card training course, and directions to undertake the course via Zoom or face-to-face.
• The email and conversation you have with the scammer may appear professional and legitimate and ask you to provide personal and financial information. 
• Often the scammer has sourced your contact information through a job-seeking website, where you may have marked yourself as available or looking for work.

If you receive an email offering work in rail and requesting payment for an RIW/RISI card or training, we recommend you contact the RIW Service Desk on info@riw.net.au to verify whether the company is registered with the RIW Program.

The only way to get a Rail Industry Worker card without an employer is by directly applying for an RIW card on the RIW website, and using our payment gateway to process this payment. A tax invoice will be provided after payment. 

The best way to protect yourself from being caught out by this scam is to:

• Stop and think twice if you’re being asked to act urgently or respond to an offer that seems too good to be true. 
• Notice poor spelling and grammar and inconsistent spacing between sentences and paragraphs. 
• Be suspicious of any email from someone asking for your personal or financial information.
• Never click on links or attachments in suspicious emails. 
• Do your research about the company and/or training provider. Look for legitimate websites or offices, talk to other people in the industry, check their ABN etc.  We have a list of approved Registered Training Providers on our website to reference as well.
• Contact the RIW Service Desk to check whether a training provider or employer is with the RIW Program. 

If you have been contacted in relation to a suspected scam attempt, please provide us with as much evidence as you can, such as invoices and email conversations. This will help us to report the matter to the relevant financial institution and authorities.  

If you have already paid a suspected fraudulent invoice:

• Contact your financial institution.
• Report the matter immediately to the Police in your jurisdiction. 
• Report the matter to Scamwatch at scamwatch.gov.au. 
• Contact IDCare at https://www.idcare.org/ if you have provided personal details.

Article link: 

https://support.riw.net.au/support/solutions/articles/51000331273