Menu
The Department of Education (the department) values your privacy and is committed to protecting information that schools collect.
All staff including contractors, service providers and volunteers of the department, and all Victorian government schools (schools), must comply with Victorian privacy law and this policy.
In Victorian government schools, the management of personal information and health information is governed by Privacy and Data Protection Act 2014 (Vic) and Health Records Act 2001 (Vic) (collectively, Victorian privacy law). In addition, the Department and Victorian government schools must comply with the Victorian Data Sharing Act 2017.
This policy explains how Victorian government schools collect and manage personal and health information, consistent with Victorian privacy law and other associated legislation.
In addition to its obligations described in this policy, the department has limited and specific obligations under national applied law schemes which are set out in the department’s Privacy Policy (National Law). These additional obligations relate to our role as early childhood services regulator in Victoria, and also in relation to health practitioners who are governed by the Health Practitioner Regulation National Law (Victoria). However, health information collected and managed in Victorian government schools is primarily handled in accordance with the Health Records Act 2001 (Vic) and obligations are, in practice, consistent. Where clarification is required, contact the Privacy team.
Personal information is recorded information or opinion, whether true or not, about a person whose identity is apparent, or can reasonably be ascertained, from the information. The information or opinion can be recorded in any form. A person’s name, address, phone number and date of birth (age) are all examples of personal information.
Sensitive information is a type of personal information with stronger legal protections due to the risk of discrimination. It includes information or opinion about an identifiable person’s racial or ethnic origin, political opinions or affiliations, religious beliefs or affiliations, philosophical beliefs, sexual orientation or practices, criminal record, or membership of a trade union.
Personal and sensitive information is regulated in Victoria under the Privacy and Data Protection Act 2014 (Vic).
Health information is information or opinion about an identifiable person’s physical, mental or psychological health or disability. Health information is a type of personal information which, because of its sensitivity, also has different and stronger legal protections.
Health information is regulated in Victoria under the Health Records Act 2001 (Vic).
Note: De-identified information about individuals can become personal information if it is re-identified or if it is at high risk of being re-identified, for example, if it is released to the public or is a small sample size.
Schools collect the following types of information.
Consent is when someone voluntarily agrees for their information to be collected, used and/or shared within or outside the school or the department.
Consent, when required, is sought in different ways and can be verbal, online or in writing, depending on the circumstances. There are many consent processes that may be applied during the school year.
Some consents are annual, for example the yearly photography consent process, while some will be for a specific purpose such as to collect information for a school event or use of a new software application.
When seeking consent for photographing students, schools apply the Photographing, Filming and Recording Students Policy.
Health services conducted in schools use specific consent forms, which include consent for use and disclosure of health information. For example, schools use the Student Support Services consent form (pdf – 314.5kb) to access these services for students.
Schools may receive information about you that they have taken no active steps to collect. If permitted or required by law, schools may keep records of this information. If not, they will destroy or de-identify the information when practicable, lawful and reasonable to do so.
Schools collect information about students and their families when necessary to:
Schools collect information about staff, volunteers and job applicants:
Using and/or disclosing information refers to how it is utilised for a specific purpose, and how it is shared and/or made available to other individuals or organisations.
Schools use or disclose information consistent with Victorian privacy law and other associated legislation, including as follows:
The department assigns a unique identifier to every Victorian government school student in its student records system to enable schools to carry out their functions effectively. In addition, the department uses a unique Victorian Student Number (VSN) assigned to each student by the Victorian Curriculum and Assessment Authority (VCAA) when they enrol in a Victorian government school, independent or Catholic school. The use of the VSN is regulated and can only be used as stipulated by legislation.
The department also assigns international students a unique international student identifier number.
Other unique identifiers may be applied by schools.
Students undertaking vocational or university education can also register for a Federal Government issued and managed unique identifier, Unique Student Identifier (USI). The USI is used to create an online record of a student’s recognised Australian training and qualifications. Students are required to have a USI before they can receive their qualification or statement of attainment.
When a student has been accepted at, and is transferring to, another Victorian government school, the current school transfers information about the student to that school. This may include copies of the student’s school records, including any health information. Parental consent is not required for this.
This enables the new school to continue to provide for the education of the student, to support the student’s social and emotional wellbeing and health, and to fulfil legal requirements.
When a student has been accepted at, and is transferring to or from a non-government school in Victoria, the current school provides a transfer note from the student records system to the new school, with parental consent.
Additionally, the current school may share information with the new school to promote the wellbeing or safety of the student or to assess or manage family violence risk pursuant to the Information Sharing Schemes.
When a student has been accepted at and is transferring to or from a school outside Victoria, the current school provides a transfer note to the new school, with parental consent.
Further direction on information transfers between schools is available in the guidance under Enrolment – Student transfers between schools.
NAPLAN is the national assessment for students in years 3, 5, 7 and 9, in reading, writing, language and numeracy.
Schools use NAPLAN data to evaluate their educational programs by analysing results for students who attended their school.
Victorian government schools can access student NAPLAN results from the student records system. When a student transfers to or from an independent, Catholic or interstate school, with parental consent, the school where the assessment was undertaken can provide a student’s NAPLAN results to the new school.
NAPLAN is the national assessment for students in years 3, 5, 7 and 9, in reading, writing, language and numeracy.
Schools use NAPLAN data to evaluate their educational programs by analysing results for students who attended their school.
Victorian government schools can access student NAPLAN results from the student records system. When a student transfers to or from an independent, Catholic or interstate school, with parental consent, the school where the assessment was undertaken can provide a student’s NAPLAN results to the new school.
All individuals, or their authorised representative(s), have a right to access, update and correct information that a school holds about them, providing access to information or records doesn’t increase a risk to the safety of a child or children.
Schools only provide school reports and ordinary school communications to students, parents, carers or others who have a legal right to that information. Requests for access to other student information or by others must be made by lodging a Freedom of Information (FOI) application through the department’s Freedom of Information Unit.
In some circumstances, an authorised representative may not be entitled to information about the student. These circumstances include when granting access would not be in the student’s best interests or would breach our duty of care to the student, would be contrary to a mature minor student’s wishes or would unreasonably impact on the privacy of another person.
Additionally, the Child and Family Violence Information Sharing Schemes allow prescribed organisations to share confidential information with each other to promote the wellbeing or safety of children, or to assess or manage family violence risk. Victorian schools and a range of other Victorian services fall under these schemes. For more information, refer to: Information sharing and MARAM reforms.
School staff may first seek access to their personnel file by contacting the principal. Guidance on access to staff health information is available at: Access to health information – Employees. If direct access is not granted, the staff member may request access through the department’s Freedom of Information Unit.
Refer to Freedom of information requests for further information.
Victorian government schools take reasonable steps to protect information from misuse and loss, and from unauthorised access, modification and disclosure. They store all paper and electronic records securely, consistent with the department’s records management policy and information security standards. All school records are formally disposed of, or transferred to the State Archives (Public Record Office Victoria), as required by the relevant Public Record Office Victoria record Retention and Disposal Authorities. Refer to the Records Management Policy for Schools for further information.
Victorian government schools are provided with tools and information to help them assess software and contracted service providers for privacy and information handling risk. Privacy Impact Assessments (PIAs) help schools to assess third party software used in a school that handles personal, sensitive or health information. Conducting PIAs helps schools to identify privacy and security risks, evaluate compliance with Victorian privacy laws and document actions required to manage any identified risks.
The European Union’s (EU’s) General Data Protection Regulation (GDPR) applies to international students from the EU.For queries, contact [email protected].
It is important that the information we hold about students, families and staff is accurate, complete and up to date. Please contact your school’s general office when information you have provided to them has changed.
To make a FOI application contact:
Freedom of Information Unit
Department of Education
2 Treasury Place, East Melbourne VIC 3002
(03) 7022 0078
[email protected]
For more information about FOI, see Freedom of information requests.
If you have a query or complaint about privacy, please contact:
Knowledge, Privacy and Records Branch
Department of Education
2 Treasury Place, East Melbourne VIC 3002
(03) 8688 7967
[email protected]
