Privacy is no longer a peripheral compliance issue for schools. With recent changes to the Privacy Act 2020 introducing new obligations around the indirect collection of personal information, PASL recommends boards and principals review their policies and procedures to ensure they are best placed to respond to information requirements.
Privacy and official information act requests
Decisions about how information is collected, stored, and shared are becoming more visible and more closely scrutinised by parents, staff, regulators, and, in some cases, the courts. Schools must balance their obligation to protect privacy and confidentiality with individuals’ entitlements to access information held by a school.
Requests for information are part of school administration, whether it be for personal information under the Privacy Act 2020 or official records held by the school under the Official Information Act 1982. Both Acts set out processes that schools must follow when responding to requests, including the required time frames. Schools need to identify the nature of the request and respond within the correct legal framework.
Requests are common in situations involving parent complaints, employment matters, student standdowns, media enquiries, and board-level investigations. Principals are often dealing with distressed or highly motivated individuals, as well as pressure to respond within a given time frame. It can feel overwhelming, particularly once documents start stacking up and deadlines near. You might need to find and review information, assess what can (and cannot) be released, consider redactions, and prepare a clear response.
It is absolutely essential you stick closely to the wording of the request and ensure the information you provide is firmly within scope. Information can be withheld where disclosure would compromise another person’s privacy, to protect legal privilege, and in circumstances where the information cannot be found or does not exist. However, this isn’t always straightforward and can invite further questions. In many cases, it will be appropriate to consider whether information can be released in part, for example through redaction, rather than withheld in full. Similarly, oversharing can invite unnecessary inquiry or make it difficult for the requester to identify the answers they are seeking. If the request is unclear, you can seek clarification before responding. And if you need more time, you can inform them that an extension is required.
If a requester is unhappy with your response, they may complain to the Privacy Commissioner or the Ombudsman. This does not mean you have done anything wrong. It is often just part of the process. Principals and boards should not feel pressured into making hasty decisions in an attempt to avoid a subsequent complaint.
Indirect collection of information and IPP3A
Privacy Act changes have introduced the Information Privacy Principle 3A for the indirect collection of personal information. Where a school collects personal information about an individual indirectly, it must take reasonable steps to notify that person of the collection and their right to access and correct their information, unless an exception applies. This means making the individual aware of key matters, including that the information has been collected, the purpose of the collection, who will receive the information, and who holds it. Notification must occur as soon as reasonably practicable after the information is collected. This also applies when information is collected from another individual or another agency unless these steps have already been taken by that party. There are some exceptions, for example where the individual is already aware of the collection, where notification is not reasonably practicable, or where notification would prejudice the interests of the individual or the enforcement of the law. However, these exceptions should be approached cautiously.
Training staff and building understanding
In most schools, the principal is also the privacy officer. This is an active role. Principals need to stay up-to-date with the law, understand how privacy obligations apply in practice, understand and implement policies and procedures, and make sure staff know what is expected of them. A key aspect of the privacy officer’s role is ensuring staff and the board are adequately trained. Management and governance notes, emails, and internal documents may later be requested and, for that reason, records should be accurate, factual, and professional. It is useful to approach record keeping on the basis that others may eventually see them.
PASL advises that schools are best placed when they treat information rights as part of good everyday administration, not as a separate compliance exercise. Clear policies, careful records, staff who understand their responsibilities, and early advice where needed will make it easier for principals and boards to respond properly when privacy or official information issues arise.