Information Privacy Policy

Policy Name	Information Privacy Policy
Reviewed/Endorsed by:	Executive/Board
Reviewed: Next Review:	July 2022 July 2023

Statement of Context

Yarra Valley Grammar (the School) is committed to protecting the privacy of individuals. The School supports and endorses the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth) (Privacy Act) and will only collect, use, disclose, and store personal information in accordance with these principles. The School will also comply with the requirements of the Health Records Act 2001 (Vic) (Health Records Act).

The School is required under the Privacy Act to have a clearly expressed and up‐to‐ date privacy policy about how the School manages personal information. This policy outlines how the School will comply with its obligations under the Privacy Act and the Health Records Act. The School will ensure that this policy is made available on the School's website.

Related policies, documents and legislation

Australian Privacy Principles under the Privacy Act 1988 (Cth)

Health Records Act 2001

ISV Privacy Manual

YVG Complaints and Grievances Policy YVG Child Protection Policy

Definitions

Media means photography, video or audio footage

Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable:

• a) whether the information or opinion is true or not; and
• b) whether the information or opinion is recorded in a material form or not.

Sensitive information is a special category of personal information. Sensitive information means:

• information or an opinion about an individual’s (i) racial or ethnic origin, (ii) political opinions, (iii) membership of a political association, (iv) religious beliefs or affiliations, (v) philosophical beliefs, (vi) membership of a professional or trade association, (vii) membership of a trade union, (viii) sexual orientation or practices, (ix) criminal record, that is also personal information;
• health information about an individual,
• genetic information about an individual that is not otherwise health information;
• biometric information that is to be used for the purpose of automated biometric verification or biometric identification, or
• e) biometric templates.

What type of personal information does the School collect?

The type of information that the School collects and holds will depend on the nature of a person’s involvement with the School.

Depending on the reason for collecting the personal information, the personal information collected by the School may include (but is not limited to) name, residential address, email address, fax number, phone number, current employment information, Medicare and private health insurance details, superannuation fund details, personal relationships with others, next of kin details, images (including digital images for internal identification purposes), date of birth, bank account details, academic results, qualifications and Media footage of students.

The School may also collect sensitive information from a person including health information, working with children checks and police record checks.

A person is not required to provide the personal information and/or sensitive information requested by the School, however if a person chooses not to provide information as requested, it may not be practicable for the School to service the person’s needs. For instance, it will not be possible for the School to enrol a person, provide education to a person, or employ a person, if they want to remain anonymous or use a pseudonym.

In circumstances where the School receives unsolicited personal information (meaning, personal information received where the School has taken no active steps to collect the information), the School will usually destroy or de‐identify the information as soon as practicable if it is lawful and reasonable to do so unless the unsolicited personal information is reasonably necessary for, or directly related to, the School’s functions or activities.

How does the School collect personal information?

Administration staff, health centre staff, and contracted third parties (e.g. camp staff) will usually be responsible for collecting personal information from a person.

The School will wherever practicable collect personal information directly from the individual including from hard copy forms, scanned copies of documents and certificates, on‐line applications and uploading of documents, face‐to‐face meetings, email correspondence, social media and other online portals, telephone calls, donations, fee payments, and hard copy mail.

The School may collect personal information from individuals such as staff members, current parents and/or guardians and students, future parents and/or guardians and students, visitors, contractors, volunteers and suppliers.

On occasion, the School may collect personal information from a third party. For example, personal information may be provided to the School by a medical professional.

The School will generally obtain consent from the owner of personal information to collect their personal information. Consent will usually be provided in writing however sometimes it may be provided orally or may be implied through a person’s conduct.

Where consent is required in relation to Media footage obtained of students, parents/guardians consent with be required in some circumstances, students’ consent will also be required.

The School will endeavour to only ask a person for personal information that is reasonably necessary for the activities that the person is seeking to be involved in.

In relation to the collection and disclosure of sensitive information, the School is bound by the APPs, which provide for the circumstances in which disclosure is permitted, or required by law. The School also has a specific consent process which includes a sign off system and permission forms.

How will the School use personal information?

The School may collect, hold, use or disclose a person’s personal information for the following general purposes:

• a) to identify a person;
• b) for the purpose for which the personal information was originally collected;
• c) for a purpose for which a person has consented;
• d) for any other purpose authorised or required by an Australian law; and
• e) for any other purpose authorised or required by a court or tribunal.

More specifically, the School may collect, hold, use or disclose a person’s personal information for the following purposes.

Students and Parents/Guardians

In relation to the personal information of students and parents and/or guardians, the School’s primary purpose of collecting the personal information is to enable the School to provide education to the student and fulfil its duty of care owed to the student.

The purpose for which the School uses personal information of students and parents and/or guardians include:

• providing schooling to students;
• correspondence with parents and/or guardians to keep parents and/or guardians informed about matters related to their child’s performance at school;
• publication of newsletters and articles on our website;
• day to day administration;

e) looking after a student’s educational, social and medical wellbeing;

• fulfilling its duty of care obligations;
• g) the collection of debts owed to the School; and
• h) seeking donations and other fundraising activities for the School.

The School may publish the contact details of parents and/or guardians in a class list and publish images of students and parents and/or guardians in publications, on social media, or in public advertisements. This content will not be provided or published where consent has not been provided. Parents/guardians and/or students can withdraw consent at any time.

Staff members, contractors and Volunteers

In relation to the personal information of prospective and current staff members, contractors and volunteers, the School uses the personal information for purposes including:

• a) to enable the School to carry out its recruitment functions;
• b) correspond with the person, provide training and professional development;
• fulfil the terms of any contractual relationship; and
• ensure that the person can perform their duties to facilitate the education of the students.

The School may publish the images of staff, contractors and volunteers in publications, on social media, or in public advertisements.

If a person has any concerns about their personal information being used by the School in any of these ways, the person must notify the School.

Disclosure of personal information overseas

The School may disclose personal information to a recipient overseas (for example where the School has outsourced a business activity to an overseas provider) in accordance with the Privacy Act. In such circumstances, the School will take reasonable steps to ensure that the overseas recipient does not breach the APPs in relation to the information.

Otherwise, the School may disclose personal information to a recipient overseas in accordance with the Privacy Act where:

• the person has consented to the disclosure;
• the School reasonably believes that the overseas recipient is subject to a law or binding scheme that protects the information in a way that is substantially similar to the way the information is protected under the Privacy Act and the APPs; or
• the disclosure is required or authorised by an Australian law or a court order.

Direct marketing

From time to time, and in support of the School’s future development and growth, the School will send information to parents, prospective parents on waitlists and other people who have consented to receive School communications.

The School will use a person’s personal information to send marketing information including:

• the School magazine and newsletters; and
• information regarding philanthropic and fundraising activities.

Personal information held by the School may be disclosed to an organisation that assists the School with its marketing.

If a person does not want to receive any such information, the person can contact the School by email.

Once the School receives a request to “opt out” from receiving marketing information, the School will cease sending such information.

How does the School store personal information?

The School takes all reasonable steps to protect personal information under its control from misuse, interference and loss and from unauthorised access, modification or disclosure.

The School protects personal information in a number of ways including:

• a) securely storing paper records;
• b) firewalls;
• c) password restricted access to computerised records;
• d) routine security risk assessments; and
• e) internal policies in relation to access to personal information.

In order to be able to respond in the unlikely event of a data breach, the School also has procedures in place for complying with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act. This scheme was introduced by the Privacy Amendment (Notifiable Data Breaches) Act 2017, and required compliance since February 2018. As required by the scheme, the School is able to undertake a reasonable and expeditious assessment of any suspected data breach.

How long will the School keep personal information?

Under our destruction and de‐identification processes, if a person’s personal information is no longer required, the personal information will be de‐identified or destroyed.

How a person can update their personal information?

The School is committed to holding accurate and up‐to‐date personal information. To ensure the quality and accuracy of the personal information held by the School, parents and/or guardians are asked to confirm their personal details and the personal details of their child on an annual basis and prior to school camps and excursions.

A person may contact the School at any time to update their personal information held by the School.

The School will destroy or de‐identify any personal information which is no longer required by the School for any purpose for which the School may use or disclose it, unless the School is required by law or under an Australian law or a court order to retain it.