Privacy Policy

1. Purpose

This policy sets out how Fintona Girls’ School (the School) manages personal information it collects and your rights in relation to your personal information, including how to raise concerns and how we deal with complaints.

Privacy laws regulate how the School can collect, use, hold and disclose personal information. The School is bound by the Australian Privacy Principles contained in the Privacy Act 1988 (Cth) (Privacy Act), the Privacy and Data Protection Act 2014 (Vic), and in relation to health records the Health Privacy Principles which are contained in the Health Records Act 2001 (Vic) (Health Records Act).

The information the School collects enables it to provide educational services and discharge its duty of care. Any data breaches may be reported by the School to the Office of the Australian Information Commissioner where required in accordance with the Privacy Act.

The School may, from time to time, review and update this policy to take into account new laws and technology changes to the School’s operations and practices and to make sure it remains appropriate to the changing school environment. The current version of this policy is published on our website.

2. Scope

This policy applies to all employees, students, parents/guardians, staff, Board members, volunteers, contractors, visitors and other people who are associated, or come in contact with the School.

3. Types of Personal Information Collected

The School collects personal information, including sensitive information about:

• Students;
• Parents/guardians;
• Employees and prospective employees;
• Contractors and prospective contractors;
• Volunteers;
• Visitors; and
• Any other person who comes in contact with the School.

The types of personal information that the School collects and holds depends on the circumstances of collection. For students, the School collects information such as name, date of birth, contact details, images, academic record and history, and may collect sensitive information (such as information about a student’s health and welfare, gender, language, background, religion or ethnic origin).

For parents/guardians, the School collects information such as name, address, phone number, email, emergency contacts and information required by Commonwealth or State governments such as, education, occupation, language spoken at home, nationality and country of birth.

For persons who deal with the School in some other capacity (for example, as a current or perspective employee, former student, volunteer, contractor or visitor), the School may collect the relevant individual’s name, contact details, image, qualifications, licences, references, and any other information they choose to provide to the School.

4. Collection and Storage of Personal Information

The information collected by the School about students and parents/guardians may be collected before, during or after the student is enrolled at the School. Information about students and parents/guardians may be collected in a number of ways including:

• Directly from students and parents/guardians by telephone, in enrolment, excursion or medical forms or in person;
• From other parties (such as medical practitioners or other schools);
• From surveillance activities (such as CCTV, network filtering and student email monitoring); and
• From publicly available sources.

The primary purpose of collecting the information is to enable the School to provide schooling and educational services for the student or prospective student. If the School is unable to obtain the required information in relation to prospective students, an enrolment may not proceed.

The information the School collects about job applicants and employees may be collected in a number of ways including:

• Directly from job applicants and employees during the recruitment phase and during the course of employment;
• From other parties (such as job applicants’ representatives or referees, or social media sites);
• From publicly available sources; and
• From medical forms, incident reports, occupational health and safety requirements (including capacity to work certificates), and Victorian Institute of Teaching or Working with Children Check requirements provided by the applicant, the employee, or any other third party authorised by the applicant or employee.

The School may store personal information in physical hard copy or electronically.

The School will take reasonable measures, both technical and organisational, to protect personal information such as secure storage in locked rooms or filing cabinets with access only by authorised personnel, records management procedures, staff education, database user access controls with password protection and/or multi factor authentication.

The School may use online or ‘Cloud’ service providers to store personal information and to provide services to the School that involve use of personal information. Refer to ‘Sending and Storing Information Overseas’ for further information.

4.1 Anonymity or use of a Pseudonym

Under the Privacy Act, individuals have the option of not identifying themselves or using a pseudonym when dealing with the School unless:

(a) the School is required or authorised by law to deal with individuals who have identified themselves; or

(b) it is impractical to deal with individuals who have not identified themselves.

4.2 Collection and Use of Student Imagery

The School and its agents (such as the School’s nominated photo company and associated sporting organisations) may collect and use images, still or moving, of students for internal use to fulfil their primary purposes.

The School will seek permission from parents/guardians in relation to the use of their child’s image in any external promotional, print or online publication.

5. Collection of Personal Information through CCTV

The School may install, use and maintain CCTV cameras on both campuses in accordance with relevant surveillance laws. Where installed, CCTV cameras will be appropriately sign-posted at building entrances and exits, as well as in other open areas.

The School will only use or disclose CCTV footage in accordance with applicable legislation which includes the Surveillance Devices Act 1999 (Vic) and Privacy Act as necessary to:

• Ensure the care, safety and welfare of staff and students;
• Manage relationships between members of the school community (including staff, students, parents/guardians and alumni); and
• To protect the School’s lawful interests in a legal or disciplinary proceeding.

The School will exercise discretion and will not disclose CCTV footage unless compelled by the relevant laws.

6. Use and Disclosure of Information

The School collects personal information for a range of purposes to enable it to fulfil the primary purpose of providing schooling and educational services for its students, including to:

• Manage relationships and the safety and welfare of students and parents/guardians;
• Assess job applicants or volunteers for current and future employment or volunteer opportunities; and
• Promote the School through marketing and school publications.

The School only uses personal information for the purposes for which the information was collected.

The School may use or disclose personal information for a secondary purpose for which the information was collected if the secondary purpose is related to the primary purpose and where the individual to whom the information relates could reasonably expect the School to use the information for that purpose.

The School may also use or disclose personal information for any other purposes for which the School has received consent from the person to whom the personal information relates or otherwise as permitted by legislation.

In relation to personal information which is ‘sensitive information’, the School will not use or disclose that information for a purpose other than the primary purpose for which it has been collected unless:

• The School has the consent of the individual to whom the information relates to disclose or use the information for some other purpose;
• The secondary purpose is directly related to the primary purpose of collection and the individual would reasonably expect the School to use or disclose that information for the secondary purpose; or
• Otherwise as permitted by legislation.

6.1 Students and Parents/Guardians

The School may use personal information collected about students and parents/guardians for the following purposes:

• Providing schooling for its students;
• To make contact with parents/guardians in relation to their child’s schooling;
• Internal accounting;
• Day-to-day administration;
• Looking after the students’ educational, social and medical wellbeing and safety;
• Marketing purposes and seeking donations for the School;
• For reporting to assessment, education and government authorities;
• To satisfy regulatory and legal obligations; or
• For any other purposes that would be reasonably expected.

6.2 Current and Prospective Employees, Volunteers and Contractors

The School may use personal information collected about current and prospective employees, volunteers and contractors in accordance with the Australian Privacy Principles including for the following purposes:

• To assess whether an individual is suitable for employment or work, including child-connected work;
• Administering the individual’s employment or contract;
• To ensure that information the School has collected is accurate and up-to-date;
• Internal accounting and administration;
• Insurance;
• Seeking funds and marketing for the School;
• For reporting to educational and government authorities;
• To satisfy legal obligations including with respect to child safety and child abuse; or
• For any other purposes that would be reasonably expected.

6.3 Use in automated decision-making

Currently the School does not use personal information it collects in any internal automated decision-making process. Some education assessment and testing authorities (ie ACER, VCAA, NAPLAN etc), may use students’ exam or test results in their automated decision-making processes. Please refer to these organisations’ privacy policies on their websites.

6.4 Disclosure

The School may disclose personal information, including sensitive information for administrative and educational purposes and to ensure child safety and welfare. This may include disclosing information to:

• Provide schooling for its students;
• Other schools;
• Government departments or authorities;
• Medical practitioners;
• People providing services to the School;
• Recipients of school publications;
• Parents/guardians; and
• Anyone else that the School is authorised to disclose information to.

Personal information may be disclosed to organisations that assist in the School’s fundraising. Parents/guardians, employees, volunteers, contractors and other members of the wider school community may from time to time receive fundraising information. School publications which include personal information may be used for marketing purposes.

If you do not want to receive fundraising or marketing communications from us, please contact our Development and Community Engagement Manager fgs@fintona.vic.edu.au

6.5 Sending and Storing Information Overseas

The School may disclose personal information about an individual to overseas recipients in certain circumstances, for instance to facilitate an overseas trip, tour or exchange.

The School may use online or Cloud service providers to store personal information and provide services to the School that involve the use of personal information such as services relating to email, instant messaging, administration and education and assessment applications. Some limited personal information may also be provided to these service providers to enable them to authenticate users that access their services and provide technical support. The personal information may be stored in the Cloud which means that it may reside on a Cloud service provider server which may be situated outside of Australia. An example of a Cloud service provider includes Microsoft which provides Microsoft 365 group of productivity applications such as Outlook email, OneDrive, Word, Excel, SharePoint and Teams.

7. Information quality

The School will take reasonable steps to ensure that the personal information that is collected, used and disclosed is accurate and up-to-date. The School will immediately update its records when an individual provides any new information or information that has changed.

8. Integrity of Information

The School will take such steps that are reasonable to protect personal information from:

• Misuse, interference and loss, and
• Unauthorised access, modification or disclosure.

This includes taking appropriate security measures to protect electronic materials and material stored and generated in hard copy.

The School will take reasonable steps to ensure that information is destroyed or de-identified when it is no longer required by law or for a reasonable operating purpose.

9. Access to Information

The School will, on request by an individual, give that individual access to any personal information held by the School about that individual. In particular:

• Parents/guardians may seek access to personal information collected about their child. It is the responsibility of the School to ensure that they do not disclose information which would have an unreasonable impact on the privacy of others or where access may result in a breach of the School’s duty of care to the student and legal obligations.
• On the request of a student the School may, at its discretion, grant that student access to information held by the School about them, or allow a student to give or withhold consent to the use of their personal information, independently of their parents/guardians. This would normally be done only when the student involved had reached 18 years of age, but the School could do so in other circumstances when the maturity of the student or the student’s personal circumstances so warranted.
• Any request for access should be made to the Business Manager via email fgs@fintona.vic.edu.au or by mail to 79 Balwyn Road, Balwyn Victoria 3103. The School may charge an access fee to cover the cost of retrieving and supplying the information.

10. Consent

The School will treat consent given by parents/guardians as consent given on behalf of the student, and notice given to parents/guardians will act as notice given to the student.

11. Enquiries and Complaints

Any person may contact the Business Manager via email fgs@fintona.vic.edu.au or by mail to 79 Balwyn Road, Balwyn Victoria 3103 to:

• Request information about the way the School manages the personal information it holds, or
• Make a complaint about the School’s compliance with the Australian Privacy Principles, in which case the School will investigate the matter and notify the person who made the complaint as soon as practicable.

If you are not satisfied with the School’s response, you may make a complaint to the Office of the Australian Information Commissioner (OAIC) via the OAIC website, www.oaic.gov.au

12. Consequences of a Breach of this Policy

The School emphasises the need to comply with the requirements of this policy. Any employee found to be in breach of the requirements of this policy may be subject to disciplinary action in accordance with the School’s Performance Management, Misconduct and Disciplinary Action Policy, in addition to the consequences under the Privacy Act.

13. Implications for Practice

13.1     At Board/Principal Level

To properly implement this policy the Board/Principal must ensure that:

• This policy is reviewed and endorsed on a regular basis;
• Copies of this policy are made available to the public on the school website;
• Copies of this policy are made available to employees on the school intranet;
• This policy is incorporated into the Board’s record of current policies;
• This policy is incorporated into the School’s induction program, to ensure that all employees are aware of the policy, have read and understood the policy; and
• Parents/guardians are informed that if certain information is not obtained, their child may not be able to enrol.

13.2 At other levels

To properly implement this policy, all employees, prospective employees, parents/guardians, students, contractors, volunteers or other individuals the School holds information about, must ensure that they will abide by this policy and assist the School in the implementation of this policy.

14. Definitions

Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable:

• Whether the information or opinion is true or not, and/or
• Whether the information or opinion is recorded in a material form or not.

Examples include an individual’s name, address, contact number and email address.

Sensitive information is a special category of personal information and means:

• Health information about an individual;
• Genetic information about an individual that is not otherwise health information;
• Biometric information that is to be used for the purpose of automated biometric verification or biometric identification or biometric templates;
• Information or an opinion about an individual’s:
• racial or ethnic origin;
• political opinions;
• membership of a political association;
• religious beliefs or affiliations;
• philosophical beliefs;
• membership of a professional or trade association;
• membership of a trade union;
• sexual preferences or practices; and/or
• criminal record.

The School will only collect sensitive information with the consent of the individual to whom the information relates or as otherwise permitted by the Privacy Act or other applicable law.

If a third party provides sensitive information to the School without a request, the School will take steps to verify the individual’s consent to collect that information.

15. Related School Policies/Documents

• SE03.00 Staff Code of Conduct
• SE07.00 Performance Management, Misconduct and Disciplinary Action Policy
• SE31.00 Information Technology Staff Acceptable Use Policy
• SE32.00 Social Media and Networking Policy
• SG03.00 Parent Code of Conduct
• SG15.00 Grievances Policy
• SI03.00 Data Breach Policy

16.   Reference Points/Background Papers

• Children’s Services Act 1996 (Vic)
• Children’s Services Regulations 2009 (Vic)
• Health Records Act 2001 (Vic)
• Privacy Act 1988 (Cth)
• Surveillance Devices Act 1999 (Vic)
• ISA & NCEC Privacy Compliance Manual – April 2023
• Privacy and Other Legislation Amendment Bill 2024