Mount St. Joseph Girls' College PRIVACY POLICY Purpose Mount St. Joseph Girls College (the College) is committed to complying with the Privacy Act and 13 Australian Privacy Principles (APPs), and Health Records Act (Vic). The College collects and holds personal information necessary to carry out its functions and is committed to safeguarding the privacy of the personal information gathered. This Privacy Policy sets out: How the College manages personal information that it gathers; Types of information collected and held; The purpose for which your personal information is collected, held, used and disclosed; How you can gain access to your personal information and seek its correction; How you may complain or inquire about our collection, handling, use or disclosure of your personal information; Information and how that complaint or inquiry will be handled; and Whether we are likely to disclose your personal information to any overseas recipients. The College may, from time to time, review and update this Privacy Policy to take account of new laws and technology, changes to the College s operations and practices and to make sure it remains appropriate to the changing College environment. Who do we collect information from? students and parents and/or guardians ('Parents') before, during and after the course of a student's enrolment at the College; job applicants, staff members, volunteers and contractors; and visitors or other people who come into contact with the College. Exception in relation to employee records: Under the Privacy Act, the Australian Privacy Principles do not apply to an employee record where they relate to current or former employment relations between the school and the employee. In certain circumstances, an individual may prefer to deal anonymously or pseudonymously with the College. Examples of instances where this may be appropriate include: Where individuals contact the College for the purpose of making an inquiry; To facilitate the provision of feedback to the College; or To facilitate the provision of complaints to the College. In appropriate cases, the College will respect the individual s wishes and not record or retain personal details. Page 1 of 6
What Kinds of Personal Information Do We Collect? Personal Information: The College will generally collect personal information held about an individual by way of forms filled out by parents or students, face-to-face meetings and interviews, emails and telephone calls. On occasions people other than parents and students provide personal information. This may include names, addresses and other contact details, dates of birth, next of kin details, financial information, photographic images and attendance records. Health Information: This may include information provided by third parties and includes medical records, information about disabilities, immunisation details, individual health care, counselling reports, nutrition and dietary requirements. For example, a report provided by a medical professional. Sensitive information: This may include religious beliefs, government identifiers, nationality, country of birth, languages spoken at home, professional or union memberships, family court orders and criminal records. The College needs to collect identifiable information to facilitate the delivery of educational and support services, the job application process and fulfil other obligations and processes. If it is reasonable and practical to do so, we collect personal information directly from you. However, we may also collect personal information from other people (for example a personal reference) or independent sources (for example a telephone directory). How will the College use the personal information provided? The College will use personal information it collects from you for one or more of our primary functions or activities (the primary purpose) or for a related secondary purposes that would be reasonably expected, or to which has been consented. Students and Parents: In relation to personal information of students and Parents, the College's primary purpose of collection is to enable the College to provide educational and support services for students. This includes satisfying the needs of Parents, students and the needs of the College throughout the enrolment period at the College. The purposes for which we use personal information include: to keep parents informed about matters related to their daughter's schooling, through correspondence, newsletters and magazines; day-to-day administration of the College; looking after students' educational, social and medical wellbeing; seeking donations and marketing for the College; and to satisfy our legal obligations and allow us to discharge our duty of care. In some cases, where we request personal information about a student or Parent, if the information requested is not provided, we may not be able to enrol or continue the enrolment of the student or allow the student to take part in a activity. Page 2 of 6
Job applicants and contractors: In relation to personal information of job applicants and contractors, our primary purpose of collection is to assess and (if successful) to engage the applicant or contractor. The purposes for which we use personal information of job applicants and contractors include: administering the individual's employment contract; for insurance and health purposes; seeking donations and marketing; and satisfying our legal obligations. Volunteers: The College obtains personal information for the purpose of engaging volunteers to assist in functions or conduct associated activities, such as alumni associations, to enable the College and the volunteers to work together and support the college s functions or activities. Information may be obtained during this process to satisfy our legal obligations including our duty of care and child protection obligations. Marketing and fundraising: The College undertakes marketing and seeks donations for its future growth and development to provide a quality learning environment in which both students and staff thrive. Personal information held may be disclosed to organisations that assist in fundraising. Parents, staff, contractors and other members of the College community may, from time to time, receive fundraising information. Publications (e.g. newsletters and magazines) that include personal information, may be used for marketing purposes. Who do we disclose personal information to? We only use personal information for the purposes for which it was given to us, or for purposes which are related (or directly related in the case of sensitive information) to one or more of our functions or activities. The College may disclose personal information, including sensitive information to: College service providers, including the Catholic Education Commission of Victoria, (CECV), Catholic Education Offices, specialist visiting teachers, counsellors, sports coaches and other dioceses; third party service providers that provide educational support services to Colleges and College systems such as the Integrated Catholic Online Network system (ICON); another College to facilitate a transfer for a student; government departments; medical practitioners; recipients of College publications, such as newsletters and magazines; students parents or guardians; anyone authorised by you to disclose information to; and anyone to whom we are required or authorised to disclose the information to by law. Page 3 of 6
When we disclose person information We may disclose your personal information to other parties listed above if one or more of the following apply: you have consented; you would reasonably expect us to use or disclose your personal information in this way; we are authorised or required to do so by law; disclosure will lessen or prevent a serious threat to the life, health or safety of an individual or to public safety; where another permitted general situation or permitted health situation exception applies; disclosure is reasonably necessary for a law enforcement related activity. Sending and storing information overseas: The College may disclose personal information about an individual to overseas recipients, (e.g. to facilitate a College exchange). However, we will not send personal information outside Australia without: obtaining consent (in some cases this consent will be implied); or otherwise complying with the Australian Privacy Principles or other applicable privacy legislation. The College may also store personal information in the 'cloud' which may mean that it resides on servers which are situated outside Australia in the countries below: The United States, The European Union and Switzerland. These countries have adopted the Safe Harbour Privacy Policy Principles and offer similar privacy protection to Australia's APPs. Where personal and sensitive information is retained by the CECV by a cloud service provider to facilitate HR and staff administrative support, this information will be stored on servers located within Australia. This includes the Integrated Catholic Online Network (ICON) system. How does the College treat sensitive information? In referring to 'sensitive information', we mean information relating to a person's racial or ethnic origin, political opinions, religion, trade union or other professional or trade association membership, philosophical beliefs, sexual orientation or practices or criminal record, that is also personal information; health information and biometric information about an individual. Sensitive information will be used and disclosed only for the purpose for which it was provided or a directly related secondary purpose, unless you agree otherwise, or the use or disclosure of the sensitive information is allowed by law. Management and security of personal information Our staff is required to respect the confidentiality of students' and parents' personal information and the privacy of individuals. Page 4 of 6
We have in place steps to protect the personal information we hold from misuse, interference and loss, unauthorised access, modification or disclosure by use of various methods including locked storage of paper records and password access rights to computerised records. How we ensure the quality of your personal information We take all reasonable steps to ensure the personal information we hold, use and disclose is accurate, complete and up to date. These steps include ensuring that the personal information is accurate, complete and up to date at the time of collection and when using or disclosing the personal information. Access and correction of personal information Under the Commonwealth Privacy Act and the Health Records Act, an individual has the right to obtain access to any personal information and health records that the College holds about them and to advise of any perceived inaccuracy. Students will generally be able to access and update their personal information through their parents, but older students may seek access and correct themselves. There are some exceptions to these rights set out in the applicable legislation. To make a request to access or update any personal information the College holds about you or your daughter, please contact the College by telephone or in writing on the contact details listed below. We may require you to verify your identity and specify what information you require. We may charge a fee that is not excessive, to cover the cost of verifying your application and locating, retrieving, reviewing and copying any material requested. If the information sought is extensive, we will advise the likely cost in advance. If we cannot provide you with access to the requested information, we will provide you with written notice explaining the reasons for refusal within a reasonable period after the request is made. Consent and rights of access to the personal information of students The College respects every Parent's right to make decisions concerning their daughter's education. Generally, we will refer any requests for consent and notices in relation to the personal information of a student to the student's Parents. We will treat consent given by Parents as consent given on behalf of the student, and notice to Parents will act as notice given to the student. Parents may seek access to personal information held by the College about them or their daughter by contacting the College Administration by telephone or in writing. However, there may be occasions when access is denied. Such occasions would include where release of the information would have an unreasonable impact on the privacy of others, or where the release may result in a breach of duty of care to the student. At our discretion, and on the request of a student, we may grant that student access to information held by the College about them or allow a student to give or withhold consent to Page 5 of 6
the use of their personal information, independently of their parents. This would normally be done only when the maturity level of the student warrants it. Enquiries and complaints If you would like further information about the way we manage the personal information we hold, or wish to complain that you believe that we have breached the Australian Privacy Principles, please contact the College in writing by email, letter, or by personal delivery to any one of our contact details as noted below. We will investigate any complaint and will notify you of the decision in relation to your complaint as soon as is practicable after it has been made (usually no longer than 30 days) and we may seek further information from you in order to provide a full and complete response. If you are not satisfied with our response you may consider taking the complaint to the Australian Information Commissioner. How to Contact Us You can contact us about this Policy or about your personal information by: Emailing privacy@msj.vic.edu.au; Calling 03 8398 2000; or Writing to The Privacy Officer, Mount St. Joseph Girls College, 133 Maidstone St ALTONA VIC 3018 Page 6 of 6