Privacy at school – who has rights?
Posted on February 01, 2022
Who can be given access to school records of student information? It is a common question that falls “inconveniently” into a significant grey area! The issue continues to cause uncertainty for schools, parents and guardians, including the important distinction of those who are party to enrollment contracts and those who are not.
Non-government schools are regulated by the Commonwealth Privacy Act (1988) which regulates the storage, collection, use, and disclosure of personal information. However, the Act does not prescribe a black-and-white answer to the many privacy related issues faced by schools.
The Act is a framework which outlines the need to comply with the 13 Australian Privacy Principles (APPs), which form the cornerstone of the privacy protection framework. The APPs outline the manner and conditions on which a school may disclose a child’s information.
If the APPs are complied with, schools are permitted to create their own privacy policies without strict limitation. These policies ought be included or at least referred to, in the “enrollment contract” and can then govern what will be provided by way of information. Effectively the parties can “contract” as to their entitlements to request information.
Non-Enrollment parents
As the Privacy Act does not address the unique relationship between parents and guardians, students, and schools, there is often confusion in particular where a non-enrollment parent/guardian requests information.
This situation often arises in family splits, where only one parent signed the “enrollment contract” with the school. The non-enrollment parent will not have any binding legal relationship with the school. This creates confusion as to their rights to information about their child. Schools will face situations where they are confronted and told “I am a parent, so give me the information, reports, accounts…”.
Given that the APPs do not prescribe an obligation for schools to disclose personal information to any party, a school can lawfully withhold information. A non-enrollment parent’s biological relationship with a child does not in itself give a parent the right to access a school’s information about that child.
The Privacy Act does not make a definitive statement one way or the other. This ambiguity leaves schools in grey legal territory. So legally, a school may choose to disclose, or not to disclose, certain information to non-enrollment parents. It may be that such flexibility assists your school.
It is recommended that a school should speak to the enrollment parent before disclosing any information to a non-enrollment parent. It is important to make all the proper enquiries to assist in determining a reasonable course of action before any disclosure is made.
Enrollment Parents
The mere fact of signing an enrollment contract does not automatically guarantee a parent the right to access all information held by a school in relation to their child. An enrollment contract does not override the school’s privacy obligations in line with the APPs.
There are circumstances where a school may lawfully withhold information from not only a non-enrollment parent, but also from the parent that signed the enrollment contract.
One such circumstance is where disclosure may pose a serious threat to the welfare of the child. For instance, a student may confide the matter of their sexuality to a teacher; if the school suspects that a parent’s reaction to that information may pose a threat to the student’s wellbeing, the school can legally refuse disclosure regardless of any contractual relationship.
Schools can also refuse to provide information to a parent if that information relates to a possible unlawful activity, and providing information may prejudice any investigation.
In the event of an issue where multiple students are involved, a school may only disclose information to a parent pertaining to their child; should be cautious about a school providing a parent with information relating to another child – even if the information relates to a mutual incident.
A school’s power to refuse disclosure of information to parents is not strictly limited by the specific circumstances outlined in the APPs. The APPs do not draw any distinction between adults and children, and so the matter becomes more complicated as students have the right to request that certain of their information remains private and confidential.
A school can adhere to this request if the child demonstrates sufficient maturity. The child must demonstrate a proper understanding of the circumstances relating to the access request, and have formed a reasonable expectation that certain information would or would not be disclosed.
Whist parents may be in a contractual relationship with the school, the school also shares a unique relationship and responsibility with its students. This means that a parent’s consent to receive information will not always be taken as student’s consent to disclose that information – and vice versa – student’s consent may not trump parent’s rights to keep something private.
Recommendation
There is clearly a great responsibility for schools in managing student private information. There is complexity in managing relationships with those students, and both enrollment and non-enrollment parents/guardians.
Schools should clearly state their own position and outline their processes about collection, storage and access to information, all as part of the enrollment contract and privacy policy document.
A school may only use information for the purpose for which it was collected. Predominantly, this relates to education and wellbeing; so any potential disclosure to parents must be on that basis.
Assessing any specific request, needs to take into account the concerns of the student and that can be fraught with difficulty given age and maturity issues. The Privacy Commissioner has specifically considered the application of the APPs in the context of children and schools. The key points are as follows:
A student is able to give or withhold consent when he or she has sufficient understanding of, and the maturity to understand, what is being proposed. Therefore, a mature student withholding consent over “sensitive material” would override even an enrollment parent’s right to disclosure of that information.
A parent or guardian can give consent on behalf of a student in some circumstances – for instance, if the child is very young and/or lacks the understanding to do so themselves.
An individual assessment of a child is the most appropriate way to determine his or her maturity and decision-making capacity (generally 15 is the age which it is assumed a child has the capacity to make decisions).
In most cases, a student would reasonably expect disclosure of information to parents (regardless of enrollment/contractual relationship). However, for older students these expectations may differ in relation to some records containing “sensitive or health information” both of which terms are not defined in the APPs.
Schools are best advised to focus on these issues directly. A school’s privacy policy is an important document that must cover the way information will or will not be disclosed, and the child’s rights in the matter. So far as it is in line with the APPs, the school is not limited in how it implements policies in this area.
The privacy policy should clearly describe what information will be collected, the purpose of collection, and situations where that information will be disclosed to parents/guardians.
A school’s privacy policy will be the document to provide guidance over these issues (so far as it is consistent with the Privacy Act and APPs).
To avoid confusion and to make the process as simple as possible, schools should outline their position on privacy in the original enrollment documentation.
With clear, consistent paperwork completed, a school can manage the expectations of parents, so that any potential refusal to provide information will not come as a shock. All parties should have a clear understanding of what information may be disclosed or withheld, and what may be disclosed to other parties.
The Privacy Act does not provide a definitive answer on all issues. Schools should form their privacy policies in line with the APPs. They need to be clear and transparent to ensure that all parties understand each other’s obligations in relation to privacy.
