1. Preamble
1.1. Purpose
This policy outlines Gippsland Grammar’s (“the School”) policy in how the School uses and manages personal information provided to or collected by it.
1.2. Scope
This policy applies across the School
1.3. Related policies /protocols
N/A
2. Definitions
Privacy Act: This term refers to the Privacy Act 1988 and the Amending Act (2012) which incorporates the Australian Privacy Principles.
Australian Privacy Principles: The APPs set minimum standards which relate to the collection, security, storage, use, correction and disclosure of personal information and access to that information.
Personal information: this term refers to information or an opinion about an identified individual or an individual who is reasonably identifiable whether the information is true or not, and whether the information is recorded in a material form or not. It includes all personal information regardless of its source.
Sensitive information: refers to personal information that is given extra protection and must be treated with additional care. It includes any information or opinion about an individual's racial or ethnic origin, political opinions, membership of a political association, religious beliefs or affiliations, philosophical beliefs, membership of a professional or trade association, membership of a trade union, sexual orientation or practices, or criminal record. It also includes health information.
Health information: this term refers to a subset of sensitive information. It is any information or opinion about the health or disability of an individual, the individual's expressed wishes about the future provision of health services and a health service provided, currently or in the future, to an individual that is also personal information. Health information also includes personal information collected in the course of providing a health service.
Document: this is defined to include anything on which there is writing, anything from which sounds, images or writings can be reproduced, drawings or photographs.
3. Policy statement
The School will meet its obligations as required in the Privacy Act 1988, and the Australian Privacy Principles contained the Privacy Amendment (Enhancing Privacy Protection) Act 2012. In regard to Health records the School will meet its obligations under the Health Records Act 2001 (Vic). The School may, from time to time, review and update this Privacy Policy to take account of new laws and technology, changes to the School’s operations and practices and to make sure it remains appropriate to the changing school environment.
4. Procedures
4.1. Collection of personal information
i) The type of information the School collects and holds includes (but is not limited to) personal information, and sensitive information including health information as outlined in Appendix 1, about:
- students and parents and/or guardians ('Parents') before, during and after the course of a pupil's enrolment at the School;
- job applicants, staff members, volunteers and contractors; and
- other people who come into contact with the School such as alumni
ii) The School will generally collect personal information held about an individual by way of forms filled out by Parents or students, face-to-face meetings and interviews, emails and telephone calls.
iii) In some circumstances, the School may be provided with personal information about an individual from a third party, for example, a report provided by a medical professional or a reference from another school.
iv) Under the Privacy Act and the Health Records Act 2001 (Vic) the Australian Privacy Principles [and Health Privacy Principles] do not apply to an employee record. As a result, this Privacy Policy does not apply to the School's treatment of an employee record, where the treatment is directly related to a current or former employment relationship between the School and employee.
v) The School will advise people interacting with the School or using any systems of any surveillance systems, including monitoring of computer systems, networks and facilities.
4.2. Use of Information and documents
The School will use personal information it collects for the primary purpose of collection, and for such other secondary purposes that are related to the primary purpose of collection and reasonably expected, or to which consent has been given. A standard collection notice (Appendix 2) will accompany request for permission for collection of information.
i) Students and Parents
In relation to personal information of students and parents, the School’s primary purpose of collection is to enable the School to provide schooling for the student. This includes satisfying both the needs of parents and the needs of the student throughout the whole period the student is enrolled at the School. The purposes for which the School uses personal information of students and parents include:
- Keeping parents informed about matters related to their child’s schooling, through correspondence, newsletters and magazines;
- Day-to-day administration;
- Looking after students’ educational, social and medical wellbeing;
- Seeking donations and marketing for the School;
- Satisfying the School’s legal obligations and allowing the School to discharge its duty of care.
In some cases where the School requests personal information about a student or parent, if the information requested is not obtained, the School may not be able to enrol or continue the enrolment of the student or permit the student to take part in a particular activity.
ii) Job applicants, staff members and contractors
In relation to personal information of job applicants, staff members and contractors, the School’s primary purpose of collection is to assess and (if successful) to engage the applicant, staff member or contractor, as the case may be. The purposes for which the School uses personal information of job applicants, staff members and contractors include:
- In administering the individual’s employment or contract, as the case may be;
- For insurance purposes;
- Seeking donations and marketing the School; and
- To satisfy the School’s legal requirements, for example in relation to child protection legislation.
iii) Volunteers
The School also obtains personal information about volunteers who assist the School in its functions or conduct associated activities, such as (alumni associations), to enable the School and the volunteers to work together.
iv) Marketing and Fundraising
The School treats marketing and seeking donations for the future growth and development of the Schools as an important part of ensuring the School continues to be a quality learning environment in which both students and staff thrive. Personal information held by the School may be disclosed to an organisation that assists in the School’s fundraising, for example, the School’s Foundation or alumni organisations. Parents, staff, contractors and other members of the wider School community may from time to time receive fundraising information. School publications, like newsletters and magazines, which include personal information, may be used for marketing purposes.
4.3. Disclosure of information and documents
The School may disclose personal information, held about an individual to:
i) Government departments where required for School Registration, Qualification or Funding purposes;
ii) Medical practitioners on written request or in an emergency where that disclosure is necessary;
iii) People providing services to the School, including visiting specialist teachers and sports coaches where those individuals have completed Gippsland Grammar’s Privacy and Child Protection training and where that disclosure is necessary to fulfil the service that Gippsland Grammar commissioned;
iv) Parent Groups involved in social or fund-raising activities (except where permission to release such information is expressly withheld);
v) anyone you authorise the School to disclose information to; or
vi) anyone to whom we are required to disclose the information to by law.
In addition to this the School may disclose sensitive information, held about an individual to:
i) Government departments where required for School Registration, Qualification or Funding purposes;
ii) Medical practitioners on written request or in an emergency where that disclosure is necessary;
iii) anyone you authorise the School to disclose information to; or
iv) anyone to whom we are required to disclose the information to by law.
In referring to 'sensitive information', the School means: information relating to a person's racial or ethnic origin, political opinions, religion, trade union or other professional or trade association membership, philosophical beliefs, sexual orientation or practices or criminal record, that is also personal information; health information and biometric information about an individual. Sensitive information will be used and disclosed only for the purpose for which it was collected or a directly related secondary purpose, unless permission is given or the use or disclosure of the sensitive information is allowed by law.
The School may disclose personal information about an individual to overseas recipients to facilitate a school exchange.
The School will not send personal information about an individual outside Australia without obtaining the consent of the individual (in some cases this consent will be implied); or otherwise complying with the Australian Privacy Principles or other applicable privacy legislation.
Parent contact information will only be provided to other parents with written consent from parents and for the purpose of:
- seeking support for fundraising or
- a class directory
4.4. Management and security of personal information
i) The School has in place steps to protect the personal information the School holds from misuse, interference and loss, unauthorised access, modification or disclosure by use of various methods including locked storage of paper records and password access rights to computerised records.
ii) The School's staff are required to respect the confidentiality of students’ and Parents' personal information and the privacy of individuals.
iii) The School endeavours to ensure that the personal information it holds is accurate, complete and up-to-date. A person may seek to update their personal information held by the School by contacting the Registrar of the School at any time.
iv) The Australian Privacy Principles require the School not to store personal information longer than necessary. Other regulations govern the amount of time for which certain records must be held. Increasingly, the School is moving towards holding its records electronically. This does not, however, change our obligations with regard to the time for which records will be held.
v) The School may use externally hosted educational services, such as e-mail, calendar, document creation and collaborative solutions, via internationally recognised providers. The providers of these service may be resident within the Commonwealth of Australia or at an overseas location. (Cross border)
vi) The School will undertake all reasonable steps in selecting and using service providers that comply with, or exceed, the relevant requirements of the Australian Privacy Principles 2014.
vii) The School will take all reasonable steps to ensure that these providers do not collect or use student data for advertising purposes or create ads or profiles nor will the data be disclosed to any third party without the express permission of the School and in accordance with requirement covered under Australian Law.
viii) Scanning of e-mail to keep staff and students secure and to improve their usage experience includes virus and spam protection for relevant search results. Scanning to provide product features is done on all incoming emails and is 100% automated. We do not allow the scanning of cloud based Education services for advertising or marketing purposes.
ix) Use of cloud based services may mean that student personal information and data will be collected by the service provider for the purposes of providing the services to students. This personal information will include the student’s school username and School email address and all personal information that is contained within the individual functions of the service; such as information or data contained in a student’s calendar or email (including text, images, photographs, sound, documents and multimedia).
x) The School will use all reasonable endeavours to maintain the security of personal information from unauthorised access, modification, or disclosure and to make our data storage systems as secure as possible against unauthorised access of your personal information.
4.5. Consent and rights of access to the personal information of students
Under the Commonwealth Privacy Act and the Health Records Act 2001 (Vic) an individual has the right to obtain access to any personal information which the School holds about them and to advise the School of any perceived inaccuracy.
The School respects every Parent’s right to make decisions concerning their child’s education. Generally, the School will refer any request for consent and notices in relation to the personal information of a student to the student’s Parents. The School will treat consent given by Parents as consent given on behalf of the student, and notice to Parents will act as notice given to the student.
The School may, at its discretion, on the request of a student grant that student access to information held by the School about them, or allow a student to give or withhold consent to the use of their personal information, independently of their Parents. This would normally be done only when the student involved had reached 18 years of age, but the School could do so in other circumstances when the maturity of the student and/or the student’s personal circumstances so warranted.
To make a request to access or update any personal information the School holds, please contact the School Principal in writing. The School may require you to verify your identity and specify what information you require. The School may charge a fee to cover the cost of verifying your application and locating, retrieving, reviewing and copying any material requested. If the information sought is extensive, the School will advise the likely cost in advance. If we cannot provide you with access to that information, we will provide you with written notice explaining the reasons for refusal.
4.6. Enquiries
If a person would like further information about the way the School manages the personal information it holds, please contact the School Registrar, Business Manager or Head of Campus.
If a person wishes to complain that you believe that the School has breached the Australian Privacy Principles please contact the School Principal. The School will investigate any complaint and will notify you of the making of a decision in relation to your complaint as soon as is practicable after it has been made.
4 Review
This policy will be reviewed every three years or if legislation requires changes.
5. Acknowledgments
National Catholic Education Commission and Independent Schools Council of Australia Privacy Compliance Manual September 2013
Appendix A: History
The authorisation and amendment history for this document must be listed in the following table.
| Version | Authorised By | Approval Date | Effective Date | Sections Modified |
| 1 | M. G. Clapper | 17 August 2012 | 8 October 2012 | |
| 2 | J. L. Henry | All section format, 3.7, | ||
| 3 | C Beckman | Tagged all sections with standardized styles. Separated disclosure of sensitive information with personal information and reduced possible disclosure audience for sensitive information. Reviewed document for grammar and readability. |
APPENDIX 1: TYPES OF INFORMATION COLLECTED AND USED
| Person | Personal Information | Sensitive Information | Health Information |
| Students | name, address, phone number, date of birth (and age), birth certificate, conduct reports, next of kin details, emergency contact numbers, names of doctors, school reports, assessments, referrals (eg. government welfare agencies/departments), correspondence with parents, photos, current/previous school, health fund details and Medicare number. Photographs and Images | religion, birth certificate, language spoken at home, religious records, whether Aboriginal, nationality, country of birth, Sacrament/Parish (current Parish, name of referring Priest, date and place of Baptism, Confirmation, Eucharist and Reconciliation), and Baptism Certificate. | medical background, immunisation records, medical records, medical treatments, accident reports, absentee notes, medical certificates, height and weight, nutrition and dietary requirements, assessment results for vision, hearing and speech, reports of physical disabilities, illnesses, operations, paediatric medical, psychological, psychiatric and psychometric information, developmental history, diagnosis of disorders, learning details (recipient of special procedures, assessment for speech, occupational, hearing, sight, ADD, Educational Cognitive (IQ)). |
| Parents | name, address, email address, phone number, date of birth, vehicle registration details, occupation, marital status, custody details, doctor's name and contact information, Medicare number, other children's details, donation history, maiden name of ex-pupils, alumni year, whether alumni had further education, professional experience and personal news. | religion, country of birth, nationality. Also parental education, parental occupation and other like personal/ family socio – economic information required for purposes such as, but not limited to, school funding ICSEA calculations. | history of genetic and familial disorders (including learning disabilities), miscellaneous sensitive information contained in a doctor or hospital report. |
| Employees: Applicants Staff Contractors | name, company name and ABN, phone number, email address, TFN, date of birth and age, contact details of next of kin, emergency contact numbers, including doctor, residency status/work visa status, qualifications, education, academic transcript, work permit, Passport, details of previous salary, salary being sought and other salary details, details of referees, bank account number, superannuation details, marital status, letters of appointment/complaint/warning/resignation, record of interview, leave applications, discipline issues, professional development appraisals, performance review, photograph, applications for promotions, references, commencement date, employment agency details, former employers, teacher registration number, blue cards, registration cards and the like. | place of birth, religion, religious education, criminal record check, relevant child protection law information, member of professional associations, trade union membership, country of birth and nationality. | medical condition affecting ability to perform work, health information, compensation claims and doctor's certificates. |
APPENDIX 2: Standard Collection Notice
1. Gippsland Grammar collects personal information, including sensitive information about students and parents or guardians before and during the course of a student's enrolment at the School. This may be in writing or in the course of conversations. The primary purpose of collecting this information is to enable the School to provide schooling to the student and to enable them to take part in all the activities of the School.
2. Some of the information we collect is to satisfy the School's legal obligations, particularly to enable the School to discharge its duty of care.
3. Laws governing or relating to the operation of a school require certain information to be collected and disclosed. These include relevant Education Acts, Public Health and Child Protection laws.
4. Health information about students is sensitive information within the terms of the Australian Privacy Principles under the Privacy Act. We may ask you to provide medical reports about students from time to time.
5. The School from time to time discloses personal and sensitive information to others for administrative and educational purposes, including to facilitate the transfer of a student to another school. This includes to other schools, government departments, medical practitioners, and people providing services to the School, including specialist visiting teachers, sports coaches, volunteers and counsellors.
6. Personal information collected from students is regularly disclosed to their parents or guardians.
7. The School may store personal information in the 'cloud' which may mean that it resides on servers which are situated outside Australia.
8. The School's Privacy Policy sets out how parents or students may seek access to personal information collected about them. However, there will be occasions when access is denied. Such occasions would include where access would have an unreasonable impact on the privacy of others, where access may result in a breach of the School's duty of care to the student, or where students have provided information in confidence.
9. The School Privacy Policy also sets out how you may complain about a breach of privacy and how the School will deal with such a complaint.
10. As you may know the School from time to time engages in fundraising activities. Information received from you may be used to make an appeal to you. It may also be disclosed to organisations that assist in the School's fundraising activities solely for that purpose. We will not disclose your personal information to third parties for their own marketing purposes without your consent.
11. On occasions information such as academic and sporting achievements, student activities and similar news is published in School newsletters and magazines [and on our website]. Photographs of student activities such as sporting events, school camps and school excursions may be taken for publication in School newsletters and magazines and on our website. The School will obtain separate permissions from the students’' parent or guardian prior to publication of any images used in marketing publications.
12. We may include students’' and students’' parents' contact details in a class list and School directory.
13. If you provide the School with the personal information of others, such as doctors or emergency contacts, we encourage you to inform them that you are disclosing that information to the School and why, that they can access that information if they wish and that the School does not usually disclose this information to third parties.