Privacy

Policy Name - Privacy Policy Policy Area Legal & Regulatory Compliance

Date Approved August 2022

Author Principal Review Date August 2023

1. Objective St Aidan’s Anglican Girls’ School (the School), is committed to protecting the privacy of its employees, students and parents. The School is bound by the Australian Privacy Principles (APPs) and the Privacy Act 1988 (Cth) (the Act).

2. Scope This policy applies to students, parents, board members, employees and volunteers. This policy outlines how the School collects, uses and discloses personal information.

3. Definitions

3.1 Employee means all employees employed by the School, including applicants and prospective Employees.

3.2 Employee Record means a record as defined in the Act.

3.3 Parent is the parent/guardian/carer of a Student.

3.4 Student means prospective, current or past student of the School.

3.5 Personal information is information or an opinion, whether true or not, and whether recorded in material form or not, about an identified individual or an individual whose identity is reasonably apparent, or can be determined, from the relevant information or opinion. Photos or videos are treated as personal information under the Privacy Act 1988.

3.6 Sensitive information is a type of personal information. It includes information or opinion about an individual’s racial or ethnic origin, political opinions, membership of a political association, religious beliefs or affiliations, philosophical beliefs, membership of a professional or trade association, membership of a trade union, sexual preference or practice, or criminal record. Sensitive information also includes biometric information that is used for the purpose of automated biometric verification, biometric identification or biometric templates.

3.7 Health information is a subset of sensitive information. It is information or an opinion about the health or disability of an individual and information collected to provide, or in providing a health service. Policy Name Privacy Policy Policy Area Legal & Regulatory Compliance Date Approved August 2022 Author Principal Review Date August 2023 Page 2 of 4 Privacy Policy v8

3.8 Health service includes an activity performed to assess, record, maintain or improve an individual’s health, to diagnose an illness or disability, to treat an individual, or the dispensing on prescription of a drug or medicinal preparation by a pharmacist.

4. Purpose The School collects, holds, uses and discloses personal information so that is can exercise its function and activities and fulfil relevant duties and obligations. That may include (but is not limited to):

a) informing Parents about the Student’s education;

b) School administrative purposes, including for the provision of such services to the School;

c) supporting a Student’s educational, social and medical wellbeing;

d) seeking donations and/or marketing for the School; and

e) satisfying the legal obligations of the School. The School collects and holds personal information, sensitive information and health information about Students, Parents and Employees. The School generally deals with personal and sensitive information regarding:

f) Students and Parents relating to the enrolment of the Student at the School;

g) job applicants, staff members, volunteers and contractors; and

h) persons who are involved with the School. The School collects personal information about individuals to satisfy legal obligations and to fulfil its educational purpose. If the School requests information to be provided and the request is not complied with, the School may be unable to enrol a prospective Student or continue enrolment of a current Student.

5. Collection

5.1 Personal Information The School collects personal information about an individual by way of forms, face-to-face meetings, interviews and telephone calls. Other individuals may provide personal information about a person in dealings with the School. The School may collect personal information about an individual from a third party, for example, a medical practitioner providing a report. Collection of personal information from a third party will be undertaken where it is reasonably necessary to do so. Any personal information that is unsolicited will be dealt with in accordance with the APPs.

5.2 Sensitive Information Sensitive information will be collected by the School where it is reasonably necessary for one or more of the School’s functions or activities. It will only be collected with consent, unless one of the exceptions under the APPs applies.

5.3 Employee Records Under the Act, the APPs do not apply to Employee records. This means that the Act does not apply to how the school deals with an Employee record that concerns current and former Employees of the school. Use and Disclosure The School will only use and disclose personal information for the primary purpose of collection or as otherwise specified in this Privacy Policy. The School may disclose personal information to the Corporation of Synod of the Diocese of Brisbane for administrative and management purposes including insurance, child protection and professional standards. Personal information will only be used for a secondary purpose if consent has been obtained, where it is reasonably expected or if such use or disclosure falls within a permitted exception. Sensitive information will be used and disclosed for the primary purpose of collection, unless the School is advised otherwise, or the use or disclosure is required / permitted by law.

7. Quality of Information and Security The School endeavours to ensure that the personal information it holds is accurate, complete and up to date. The School will take all reasonable steps to:

a) protect personal information from misuse, interference, loss, unauthorised access, modification or unauthorised disclosure; and

b) destroy or de-identify information that is no longer needed.

8. Access to Personal Information Access to records of personal information that the School holds or concerns about the accuracy of information held by the School should be directed to the Deputy Principal at the School. Under the Act, an individual has the right to obtain access to personal information which the School holds about them; there are exceptions to this, for example, where access may impact the privacy of others or pose as a threat to the individual. To make a request to access personal information the School requires a request in writing. The School will respond to this request within a reasonable period of time. Where it is reasonable, the School will provide access in the manner requested. The School may charge a fee to provide access to the personal information, however, will not charge for the request for access. If a request for access is refused the School will provide written reasons on why the request was refused; details on how to make a complaint will also be included in this response.  Overseas Disclosure and Cloud The School may disclose personal information about an individual overseas; this is likely to occur if the School uses “cloud” service providers. When disclosing personal information, the School will take all steps reasonable to ensure that the overseas recipient complies with the APPs.

10. Marketing and Fundraising The School engages in marketing and fundraising as a means to promote future growth and sustain and improve the educational environment for Students. Personal information collected may be used to make a marketing or fundraising appeal. The School will abide by any direction from an individual not to disclose personal information to third parties for marketing purposes. The School also allows individuals to “opt out” through selection on the Standard Collection Notice.

11. Complaints If an individual believes that the School has breached the APPs a complaint can be made to the School. All complaints should be in writing and directed to the Principal. The School will investigate complaints in a timely manner and respond in writing. If an individual is not satisfied with the School’s response, a complaint can be lodged with the Office of the Australian Information Commissioner on the following website http://www.oaic.gov.au/privacy/making-a-privacy-complaint.