Privacy and Information Management Policy
Approved by: |
School Board |
Date Approved: |
October2021 |
Last Reviewed: |
January 2026 |
Next Review: |
January 2028 |
Implementation |
Principal |
Purpose
The purpose of this document is to inform the school community about our legal requirements to collect information about staff, students and others with a role in the school, to ensure their safety and wellbeing. This policy outlines the school’s systems for collecting, using, managing and storing personal information as legislated.
Scope
Information collected
The School only collects information required to perform its functions and fulfil its legal obligations, including a duty of care. This information is collected and managed in accordance with relevant privacy legislation.
The type of information the School collects and holds includes (but is not limited to) personal information, including sensitive information about:
-
Students and parents and or guardians before, during and after the course of a student’s enrolment at the School;
-
Job applicants, staff members, volunteers and contractors; and
-
Other people who come into contact with the School such as Board members.
Personal Information
The School will generally collect personal information about an individual by way of forms filled out by parents or students, face-to-face meetings and interviews, emails and telephone calls.
Personal Information Generated at School
Personal information is generated throughout a student’s time at the School, including academic reports, student class work and assessment documentation.
Personal Information Provided by Other People
In some circumstances, the School may be provided with personal information about an individual from a third party, for example a report provided by a medical professional or a reference from another school.
Exception in Relation to Employee Records
Under the Privacy Act, the Australian Privacy Principles do not apply to an employee record. As a result, this Privacy Policy does not apply to the School’s treatment of an employee record, where the treatment is directly related to a current or former employment relationship between the School and employee.
Use of Personal Information
Taqwa School will not use personal information or disclose information it collects other than in specified circumstances including:
-
for the primary purpose for which it is collected
-
with the individual’s consent
-
for such other secondary purposes that are related to the primary purpose and are reasonably expected
-
where required under law
-
where the school believes there is threat to life, health or public safety
-
where the school believes an unlawful activity has taken place
-
supporting the activities of School associations, if any
-
where the school believes the use of the information is reasonably necessary to assist with locating a person reported as missing
Storage and Security Personal Information
Radford School stores personal information in database, hard copy files, personal devices and through third party storage providers. The School takes all reasonable steps to protect the security of the personal information we hold from both internal and external threats. This includes restricting access, ensuring password protection, ensuring hard copy files are stored in lockable filing cabinets in lockable rooms with restricted staff access, ensuring IT and cyber security is implemented and is up to date, staff compliance with School information policies and procedures, ensuring third party service providers are compliant with the APPs, regular audits, and the destruction, deletion or de-identification of personal information that is no longer needed or required to be retained by any other laws.
Students and Parents
In relation to students and parents’ personal information, the School’s primary purpose of collection is to enable it to provide schooling to, and a duty of care for, the student. This includes satisfying both the needs of parents and the needs of the student throughout the whole period the student is enrolled at the School. The purposes for which personal information of students and parents is used include:
-
keeping parents informed about matters related to their child’s schooling, through correspondence
-
newsletters and magazines
-
day-to-day administration
-
looking after students’ educational, social, spiritual and medical wellbeing
-
seeking donations and marketing for the School
-
satisfying the School’s legal obligations and allowing the School to discharge its duty of care.
-
Where the School requests personal information about a student or parent, and the information requested is not
-
obtained, the School may not be able to enrol or continue the enrolment of the student or permit the student to take part in a particular activity.
Job Applicants, Staff Members and Contractors
In relation to personal information of job applicants, staff members and contractors, the School's primary purpose of collection is to assess and (if successful) to engage the applicant, staff member or contractor. The purposes for which the School uses personal information of job applicants, staff members and contractors include:
-
administering the individual’s employment or contract, as the case may be
-
for insurance purposes
-
seeking funds and marketing for the School
-
satisfying Taqwa School's legal obligations, for example, in relation to child protection legislation.
The School complies with the Tax File Number Guidelines 2011 issued under s17 of the Privacy Act 2988 (Privacy Act) which regulate the collection, storage, use, disclosure, security and disposal of individuals’ TFN information.
Volunteers
Radford School also obtains personal information about volunteers who assist the School in its functions or conduct associated activities, such as the P & F Association and the Collegians Association, to enable the School and the volunteers to work together.
Marketing and Fundraising
Taqwa School treats marketing and seeking donations for the future growth and development of the School as an important part of ensuring that the School continues to be a quality learning environment in which both students and staff thrive. Personal information held by the School may be disclosed to an organisation that assists in the School's fundraising, for example the Parents and Friends Association.
Parents, staff, contractors and other members of the wider School community may from time to time receive fundraising information. School publications, like newsletters and magazines, which include personal information, may be used for marketing purposes.
The School retains limited personal information about past students and staff in the School’s archives, which may be used for the purposes described above and historical purposes, including future reference, study or exhibition.
Disclosure of Personal Information
Taqwa School may disclose personal information, including sensitive information, held about an individual, to:
-
another school
-
government departments
-
medical practitioners
-
people providing services to the School, including specialist visiting teachers and sport coaches
-
recipients of School publications, like newsletters and magazines
-
parents
-
anyone, in addition to the above, to whom you authorise the School to disclose information
-
anyone to whom we are required to disclose the information by law.
Such information would only be shared where it is legal to do so and only if necessary for the School to fulfil its functions or its legal obligations, including those of duty of care. Where personal information is shared with a third party, only the information that needs to be disclosed is shared, not necessarily all information relating to that person.
Upon enrolment at the School, permission will be sought from parents/carers for information and related photographs regarding academic and sporting achievements, student activities, excursions and events to be published in newsletters, the annual report, prospectus, and Taqwa Schools website.
Sending Information Overseas
The School may disclose personal information about an individual to overseas recipients, for instance, when storing personal information with ‘cloud’ service providers which are situated outside Australia or to facilitate a school exchange. However, the School will not send personal information about an individual outside Australia without:
-
obtaining the consent of the individual (in some cases consent will be implied) or
-
otherwise complying with the Australian Privacy Principles or other privacy legislation.
The School may also store personal information in the ‘cloud’ which may mean that it resides on servers situated outside Australia.
Management of Sensitive Information
Sensitive information will be used and disclosed only for the purpose for which it was provided or a directly related secondary purpose, unless agreed by the individual, or the use or disclosure of the sensitive information is allowed by law.
School and its staff respect the confidentiality of students’ and parents’ personal information and the privacy of individuals.
The School has in place steps to protect the personal information the School holds from misuse, loss, unauthorised access, modification or disclosure by use of various methods including locked storage of paper records and security protected access rights to computerised records.
Updating Personal Information
The School endeavours to ensure that the personal information it holds is accurate, complete and up to date.
A person may seek to update their personal information held by the School by contacting Main Reception staff.
The Australian Privacy Principles require the School not to store personal information longer than necessary.
Access and Correction of Personal Information
Under the Commonwealth Privacy Act, an individual has the right to obtain access to any personal information which Taqwa School holds about them and to advise the School of any perceived inaccuracy. There are some exceptions to this right set out in the Act. Students will generally have access to their personal information through their parents, but older students may seek access themselves.
To access personal information that the School holds, an individual should contact the Principal in writing.
Social Networking Services
We use social networking services such as Facebook, YouTube and Instagram to communicate with the public about our work. When you communicate with us using these services we may collect your personal information, but we only use it to help us to communicate with you and the public. The social networking service will also handle your personal information for its own purposes. These services have their own privacy policies, which you can access on their websites.
Responding to data breaches
Taqwa School will take appropriate, prompt action if we have reasonable grounds to believe that a data breach may have or is suspected to have occurred. Depending on the type of data breach, this may include a review of our internal security procedures, taking remedial internal action, notifying affected individuals and the Office of the Australian Information Commissioner (OAIC).
If we are unable to notify individuals, we will publish a statement on our website and take reasonable steps to publicise the contents of this statement.
Security Cameras
The School’s premises are protected by security cameras. The School uses security cameras for 24-hour video surveillance, which monitors and records activity around the School including inside the High School and the Administrative Office buildings.
The purpose of this monitoring and recording is to provide a safe and secure work environment for School staff and visitors. Security cameras are only used in the areas specified in this privacy notice.
Video surveillance is being used to deter any form of aggressive, harmful or unlawful behaviour and to assist in identifying offenders. Should an incident occur, the recordings may be provided as evidence to law enforcement authorities such as the police to assist with investigations or enquiries. The cameras are not used to monitor the actions of students and staff. However, it may be used to investigate allegations of serious misconduct by staff.
The images recorded by the cameras are securely stored as digital files within the security software, which is only accessible to the Information Technology Manager and the Principal. The digital files are stored for a maximum of four weeks after which they are programmed to be automatically erased unless required by law enforcement authorities. Images are viewed only by authorised staff. Controlled access to the secured footage is strictly maintained. Copies of recordings will not be made for other purposes unless they are relevant to the purpose of surveillance or are required by law. Any copies made are stored in a securely lockable area.
Circumstances under which recordings will be shown to a third party include:
-
unlawful acts (police)
-
occupational health and safety complaints (eg Workplace Health & Safety Officer and QLS’ Insurer)
-
when otherwise required by law (e.g. court order).
Consent and Rights of Access to the Personal Information of Students
The School respects every parent’s right to make decisions concerning their child’s education.
Generally, the School will refer any requests for consent and collection notices in relation to the personal information of a student to the student’s parents. The School will treat consent given by parents as consent given on behalf of the student and notice to parents will act as notice given to the student.
Parents may seek access to personal information held by the School about them or their child by contacting the Principal. However, there will be occasions when access is denied. Such occasions would include where release of the information would have an unreasonable impact on the privacy of others, or where the release may result in a breach of the School’s duty of care to the student.
The School may, at its discretion, on the request of a student grant that student access to information held by the School about them or allow a student to give or withhold consent to the use of their personal information, independently of the parents. This would normally be done only when the maturity of the student and/or the student’s personal circumstances so warranted.
The School will provide school reports to non-custodial parents in most circumstances. However, there may be exceptions, such as where court protection orders against a parent are in operation and do not permit the School to provide reports to that parent.
To access personal information that the School holds, an individual should contact the Principal in writing, including verification of identity and outline the specific information required. The School may charge a fee to cover the cost verifying the application and locating, retrieving, reviewing and copying any material requested. If the School is unable to provide access to the information sought, it will provide the applicant with written notice explaining the reasons for refusal.
Enquiries and Complaints
If you would like further information about the way the School manages the personal information it holds or wish to complain that you believe that the School has breached the Australian Privacy Principles, please contact the Chief Operating Officer. The School will investigate any complaint and will notify you of the decision in relation to the complaint as soon as practicable. The School may seek further information to provide a full and complete response. The School does not charge a fee for the handling of complaints.
If you are not satisfied with the School response, you may refer the complaint to the OAIC using the OAIC online Privacy Complaint form or by mail, fax or email. A referral to the OAIC should be used as a last resort once all other avenues of resolution have been exhausted.
If the School rejects a request to change personal information, the individual may make a statement about the requested change, and this will be attached to their record.
Privacy Standard Collection Notice
The School collects personal information, including sensitive information about students and parents or guardians before and during the course of a student’s enrolment at the School. This may be in writing or during conversations. The primary purpose of collecting this information is to enable the School to provide schooling to the student and to enable them to take part in all the activities of the School.
Some of the information we collect is to satisfy the School’s legal obligations, particularly to enable the School to discharge its duty of care.
Laws governing or relating to the operation of a school require certain information to be collected and disclosed.
These include relevant Education Acts, and Public Health and Child Protection laws.
Health information about students is sensitive information within the terms of the Australian Privacy Principles under the Privacy Act. We may ask you to provide medical reports about students from time to time.
The School, from time to time, discloses personal and sensitive information to others for administrative and educational purposes, including facilitating the transfer of a student to another school. This includes other schools, government departments, medical practitioners, and people providing services to the School, including specialist visiting teachers, coaches, service providers, volunteers and counsellors.
Personal information collected from students is regularly disclosed to their parents or guardians.
The School may store personal information in the ‘cloud’, which may mean that it resides on servers situated outside Australia.
The School’s Privacy Policy sets out how parents or students may seek access to personal information collected about them. However, there will be occasions when access is denied. Such occasions would include where access would have an unreasonable impact on the privacy of others, where access may result in a breach of the School’s duty of care to the student, or where students have provided information in confidence.
The School’s Privacy Policy also sets out how you may complain about a breach of privacy and how the School will deal with such a complaint.
The School from time to time engages in fundraising activities. Information received from you may be used to make an appeal to you. We will not disclose your personal information to third parties for their own marketing purposes without your consent.
On occasion information such as academic and sporting achievements, student activities and similar news is published in School newsletters and magazines and in online services. Photographs of student activities such as sporting events, school camps and school excursions may be taken for publication in School newsletters and magazines and on our online systems. The School will obtain separate permissions from the students’ parents or guardian prior to publication if we would like to include photographs or other identifying material in promotional material for the school or otherwise make it available to the public such as on the Internet.
We will seek parents’ permission to include student and parent contact details in class / year group directory. If you provide the School with the personal information of others, such as doctors or emergency contacts, we encourage you to inform them that you are disclosing that information to the School and why, that they can access that information if they wish and that the School does not usually disclose this information to third parties.
Legislative & Standards Framework
-
Privacy Act 1988
-
Privacy Amendment (Enhancing Privacy Protection) Act 2012
-
Children and Young People Act 2008 (ACT)
-
Health Records (Privacy and Access) Act 1997 (ACT)
-
Workplace Privacy Act 2011
-
Working with Children and Young People – Volunteering – ACT Government Policy
Definitions
APP: Australian Privacy Principles
OAIC: Office of the Australian Information Commissioner
Personal Information: Information or an opinion about an identified individual, or an individual who is reasonably identifiable:
-
whether the information or opinion is true or not; and
-
whether the information or opinion is recorded in a material form or not.
Sensitive information: Information relating to a person’s racial or ethnic origin, political opinions, religion, trade union or other professional or trade association membership, sexual preferences or criminal record; and health information about an individual.
Guiding Principles
-
Only collect personal information necessary to perform School functions and meet legal obligations.
-
Handle personal information in accordance with applicable privacy legislation and Australian Privacy Principles (APPs).
-
Use and disclose personal information only for the primary purpose, with consent, or as required/permitted by law.
-
Maintain security of personal information and take reasonable steps to prevent misuse, loss, unauthorised access, modification or disclosure.
-
Enable individuals to access and correct their personal information, subject to lawful exceptions.
-
Respond promptly to data breaches, including notifying affected individuals and the OAIC when required.
Roles & Responsibilities
Principal
-
Receives and responds to requests for access to personal information (as referenced in the Access and Correction section).
-
Oversees compliance with this Policy and applicable legislation.
Business Manager
-
Receives privacy enquiries and complaints and coordinates investigation and responses.
All Staff, Contractors and Volunteers
-
Collect, handle, store and disclose personal information in accordance with this Policy and applicable procedures.
-
Report suspected data breaches in line with the Data Breach Response procedure.
