With all of the focus on the new privacy laws that commence in two weeks, a key issue for Non-Government Schools to consider is that the Privacy Act does not differentiate between adults and children.
The Privacy Act does not specify an age after which individuals can make their own decisions with respect to their personal information.
This concept is explained in a little more detail in the guidelines accompanying the 13 Australian Privacy Principles published by the Office of the Australian Information Commissioner (OAIC).
Chapter B of the guidelines notes:
“B.50 The Privacy Act does not specify an age after which individuals can make their own privacy decisions. An APP entity will need to determine on a case-by-case basis whether an individual under the age of 18 has the capacity to consent.
B.51 As a general principle, an individual under the age of 18 has capacity to consent when they have sufficient understanding and maturity to understand what is being proposed. In some circumstances, it may be appropriate for a parent or guardian to consent on behalf of a young person, for example, if the child is young or lacks the maturity or understanding to do so themselves.
B.52 If it is not practicable or reasonable for an APP entity to assess the capacity of individuals under the age of 18 on a case-by-case basis, the entity may presume that an individual aged 15 or over has capacity to consent, unless there is something to suggest otherwise. An individual aged under 15 is presumed not to have capacity to consent.”
This raises some interesting issues for schools surrounding the question of whether consents should be obtained from a student’s parents or directly from students themselves. It also potentially raises issues with respect to disclosure of personal information (particularly sensitive information).
Having regard to the fact that parents generally have the right to make decisions for their children until they reach 18 years of age, and the fact that Non-Government Schools have a direct contractual relationship with a student’s parents, it is expected that schools will generally take the view that notifications provided to parents will act as notifications to students, and consents received from parents will act as consents given by students.
That said, schools need to be cognisant of the fact that children do have rights under the Privacy Act and that, in certain circumstances (especially when dealing with older students and especially when dealing with sensitive information), it will be appropriate to seek and obtain consents directly from students. Situations where a student requests that personal information (particularly sensitive information) not be disclosed to parents should be dealt with on a case-by-case basis.