Reviewed: Next Review:
Yarra Valley Grammar (the School) is committed to protecting the privacy of individuals. The School supports and endorses the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth) (Privacy Act) and will only collect, use, disclose, and store personal information in accordance with these principles. The School will also comply with the requirements of the Health Records Act 2001 (Vic) (Health Records Act).
Australian Privacy Principles under the Privacy Act 1988 (Cth)
Health Records Act 2001
ISV Privacy Manual
YVG Complaints and Grievances Policy YVG Child Protection Policy
Media means photography, video or audio footage
Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable:
Sensitive information is a special category of personal information. Sensitive information means:
The type of information that the School collects and holds will depend on the nature of a person’s involvement with the School.
Depending on the reason for collecting the personal information, the personal information collected by the School may include (but is not limited to) name, residential address, email address, fax number, phone number, current employment information, Medicare and private health insurance details, superannuation fund details, personal relationships with others, next of kin details, images (including digital images for internal identification purposes), date of birth, bank account details, academic results, qualifications and Media footage of students.
The School may also collect sensitive information from a person including health information, working with children checks and police record checks.
A person is not required to provide the personal information and/or sensitive information requested by the School, however if a person chooses not to provide information as requested, it may not be practicable for the School to service the person’s needs. For instance, it will not be possible for the School to enrol a person, provide education to a person, or employ a person, if they want to remain anonymous or use a pseudonym.
In circumstances where the School receives unsolicited personal information (meaning, personal information received where the School has taken no active steps to collect the information), the School will usually destroy or de‐identify the information as soon as practicable if it is lawful and reasonable to do so unless the unsolicited personal information is reasonably necessary for, or directly related to, the School’s functions or activities.
Administration staff, health centre staff, and contracted third parties (e.g. camp staff) will usually be responsible for collecting personal information from a person.
The School will wherever practicable collect personal information directly from the individual including from hard copy forms, scanned copies of documents and certificates, on‐line applications and uploading of documents, face‐to‐face meetings, email correspondence, social media and other online portals, telephone calls, donations, fee payments, and hard copy mail.
The School may collect personal information from individuals such as staff members, current parents and/or guardians and students, future parents and/or guardians and students, visitors, contractors, volunteers and suppliers.
On occasion, the School may collect personal information from a third party. For example, personal information may be provided to the School by a medical professional.
The School will generally obtain consent from the owner of personal information to collect their personal information. Consent will usually be provided in writing however sometimes it may be provided orally or may be implied through a person’s conduct.
Where consent is required in relation to Media footage obtained of students, parents/guardians consent with be required in some circumstances, students’ consent will also be required.
The School will endeavour to only ask a person for personal information that is reasonably necessary for the activities that the person is seeking to be involved in.
In relation to the collection and disclosure of sensitive information, the School is bound by the APPs, which provide for the circumstances in which disclosure is permitted, or required by law. The School also has a specific consent process which includes a sign off system and permission forms.
The School may collect, hold, use or disclose a person’s personal information for the following general purposes:
More specifically, the School may collect, hold, use or disclose a person’s personal information for the following purposes.
In relation to the personal information of students and parents and/or guardians, the School’s primary purpose of collecting the personal information is to enable the School to provide education to the student and fulfil its duty of care owed to the student.
The purpose for which the School uses personal information of students and parents and/or guardians include:
e) looking after a student’s educational, social and medical wellbeing;
The School may publish the contact details of parents and/or guardians in a class list and publish images of students and parents and/or guardians in publications, on social media, or in public advertisements. This content will not be provided or published where consent has not been provided. Parents/guardians and/or students can withdraw consent at any time.
In relation to the personal information of prospective and current staff members, contractors and volunteers, the School uses the personal information for purposes including:
The School may publish the images of staff, contractors and volunteers in publications, on social media, or in public advertisements.
If a person has any concerns about their personal information being used by the School in any of these ways, the person must notify the School.
The School may disclose personal information to a recipient overseas (for example where the School has outsourced a business activity to an overseas provider) in accordance with the Privacy Act. In such circumstances, the School will take reasonable steps to ensure that the overseas recipient does not breach the APPs in relation to the information.
Otherwise, the School may disclose personal information to a recipient overseas in accordance with the Privacy Act where:
From time to time, and in support of the School’s future development and growth, the School will send information to parents, prospective parents on waitlists and other people who have consented to receive School communications.
The School will use a person’s personal information to send marketing information including:
Personal information held by the School may be disclosed to an organisation that assists the School with its marketing.
If a person does not want to receive any such information, the person can contact the School by email.
Once the School receives a request to “opt out” from receiving marketing information, the School will cease sending such information.
The School takes all reasonable steps to protect personal information under its control from misuse, interference and loss and from unauthorised access, modification or disclosure.
The School protects personal information in a number of ways including:
In order to be able to respond in the unlikely event of a data breach, the School also has procedures in place for complying with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act. This scheme was introduced by the Privacy Amendment (Notifiable Data Breaches) Act 2017, and required compliance since February 2018. As required by the scheme, the School is able to undertake a reasonable and expeditious assessment of any suspected data breach.
Under our destruction and de‐identification processes, if a person’s personal information is no longer required, the personal information will be de‐identified or destroyed.
The School is committed to holding accurate and up‐to‐date personal information. To ensure the quality and accuracy of the personal information held by the School, parents and/or guardians are asked to confirm their personal details and the personal details of their child on an annual basis and prior to school camps and excursions.
A person may contact the School at any time to update their personal information held by the School.
The School will destroy or de‐identify any personal information which is no longer required by the School for any purpose for which the School may use or disclose it, unless the School is required by law or under an Australian law or a court order to retain it.