Mercy Education Privacy Policy

MERCY EDUCATION POLICY: 1.07 PRIVACY

Introduction:

Mercy Education Limited (Mercy Education) requires privacy principles to respect the rights of all those with whom it interacts and promote justice in its dealings with them. Mercy Education is bound by the Australian Privacy Principles (APPs) contained in the Commonwealth Privacy Act 1998. In relation to health records Mercy Education is also bound by legislation under the Health Records Act 2001 (Vic) relevant only to those schools operating in the State of Victoria.

Purpose:

To provide guidance on how Mercy Education and its schools manage personal information provided by or collected from its school communities and other individuals.

Definitions:

Parent: includes all forms of legal guardianship.

Mercy Education: refers to Mercy Education Limited – an Australian company limited by guarantee which operates thirteen schools across Australia.

Policy Coverage:

This Privacy Policy applies to schools governed by Mercy Education and describes how Mercy Education, through its Board of Directors, Principals and Staff manage personal information provided to, or collected by each school.

Mercy Education Limited is a legal entity under the Commonwealth Corporations Act (2001) and bound by the Australian Privacy Principles (APPs) contained in the Commonwealth Privacy Act 1988. Mercy Education is also bound by the Health Records Act 2001 (Vic) and the Health Privacy Principles in that Act. Mercy Education is responsible for the governance of thirteen Mercy ministry schools, namely:

Mercedes College, Perth WA
Academy of Mary Immaculate, Fitzroy VIC
Sacred Heart College, Geelong VIC
Emmanuel College, Warrnambool VIC
Catherine McAuley College, Bendigo VIC
St Aloysius College, Adelaide SA
St Aloysius College, North Melbourne VIC
Sacred Heart College, Kyneton VIC
Mount Lilydale Mercy College, Lilydale VIC
St Joseph’s College, Mildura VIC
Our Lady of Mercy College, Heidelberg VIC
St Brigid’s College, Lesmurdie WA
Santa Maria College, Attadale WA

Policy Statement:

Mercy Education may, from time to time, review and update this Privacy Policy to take account of new laws and technology, changes to schools' operations and practices and to make sure it remains appropriate to the changing school environment.
What kinds of personal information does a school collect and hold? Schools collect and hold personal information, including health and other sensitive information, about:
1. students before, during and after the course of a student's enrolment at the School including:
  1. name, contact details (including next of kin), date of birth, gender, language background, previous school, and religion.
  2. medical and welfare information (e.g., details of disability and/or allergies and details of any assistance the student receives in relation to those disabilities, medical reports, cognitive assessments, details of medical professionals);
  3. conduct or complaint records, other behaviour notes or observations, school attendance and school reports.
  4. information about referrals to government welfare agencies.
  5. information obtained during counselling sessions;
  6. Private health fund and Medicare details;
  7. any court orders.
  8. photos and videos of school events.
2. parents and/or guardians
  1. name, address and contact details
  2. education, occupation and language background
  3. Private health fund and Medicare details
  4. any court orders
  5. volunteer information (including Working With Children Check)
3. job applicants, staff members, volunteers and contractors, including:
  1. name, contact details (including next of kin), date of birth and religion. information requested from job applicants
  2. information provided by a former employer or referee
  3. professional development history
  4. salary and payment information, including superannuation details
  5. medical information (e.g., details of disability and/or allergies and medical certificates)
  6. complaint records and investigation reports
  7. employee records
  8. photos and videos at school events
  9. workplace surveillance information
  10. all emails, (both work and private) (when using work email address) and internet browsing history and
4. other people who come into contact with the School including name and contact details and other information necessary for the particular contact with the School.

Exception in relation to employee records
Under the Commonwealth Privacy Act 1998, the Australian Privacy Principles (APPS) do not apply to an employee record. As a result, this Privacy Policy does not apply to Mercy Education’s treatment of an employee record where the treatment is directly related to a current or former employment relationship between the School and employee. Mercy Education handles all staff health records in accordance with the Health Privacy Principles in the Health Records Act 2001 (Vic).

How will the School collect and hold personal information?
Personal Information you provide:
A school will generally, but not exclusively, collect personal information held about an individual by way of:

forms completed by parents, guardians, or students
meetings and interviews
emails and telephone calls
through the School’s online portal - [school to insert name/description of online management systems used by students/parents e.g., Operoo, Consent2Go].

On occasions people other than parents and students (such as job applicants and contractors) provide personal information to the School.

Personal Information provided by other people:
In some circumstances a school may be provided with personal information about an individual from a third party, for example a report provided by a medical professional or a reference from another school. The type of information a school may collect from another school may include:

academic records and/or achievement levels
information that may be relevant to assist the new school to meet the needs of the student which may include adjustments.

Anonymity:
The School needs to be able to identify individuals with whom it interacts and to collect identifiable information to facilitate the delivery of schooling to its students, and its educational and support services, conduct and complete any employment process and fulfil other obligations and processes. However, in some limited circumstances, some activities, and interactions with the School may be done anonymously. For example, this may include making an inquiry, complaint or providing feedback.

Holding your personal information:
The School's approach to holding personal information is to ensure that it is stored securely, and that access is provided only to persons who need such information. Depending on the nature of the personal information, it may be stored in lockable rooms or cabinets (in the case of paper records), or on digital devices with appropriate password protection.

3. How will a school use the personal information you provide?
A school will use personal information it collects from you for the primary purpose of collection, and for such other secondary purposes that are related to the primary purpose of collection and reasonably expected, or to which you have consented.

Students and Parents:
In relation to personal information of students and parents, a school's primary purpose of collection is to enable the School to provide schooling to students enrolled at the School (including educational and support services for the student), exercise its duty of care and perform necessary associated administrative activities which will enable students to take part in the activities offered at school. This includes satisfying the needs of parents, the student, Mercy Education and the School throughout the period the student is enrolled at the School.

In particular, the purposes for which Mercy Education and/or a school uses personal information of students and parents include:

to keep parents informed about matters related to their child's education, through correspondence, newsletters and magazines
day-to-day administration of a school
Caring fora students' educational, social, spiritual and medical wellbeing
Fundraising and marketing by the School
to satisfy a school’s legal obligations to discharge its duty of care
to satisfy the legal obligations of Mercy Education, relevant diocesan authorities, Catholic Education Commissions and Catholic Education Offices.

Where a school requests personal information about a student or parent that is not provided, the School may not be able to enrol or continue to enrol the student or permit the student to take part in particular activities.

Job applicants and contractors:
A School's primary purpose of collection of personal information for job applicants and contractors is to assess and (if successful) to engage the applicant or contractor, as the case may be.

The purpose for which a school may use the personal information of job applicants and contractors includes:

administering the employment process or contract, as applicable
for the purpose of insurance
Fundraising or marketing of the School and
satisfying all legal obligations of the School and Mercy Education. (e.g. child protection).

Volunteers:
A school also obtains personal information from volunteers who assist the School in its functions or associated activities., such as College Council members, committee representatives, alumni associations, etc.

The purpose for which a school may use the personal information of volunteers includes:

to manage the engagement and induction of volunteers
for the purpose of insurance
to satisfy the School’s legal obligations, e.g., child protection
to confirm their suitability and to manage their visits.

Counsellors:
The School may contract with external providers to provide counselling/psychology services for students. The Principal may require the Counsellor/Psychologist to share relevant information believed necessary for the School to know to ensure the well-being or development of the student who is being counselled or to other students at the School.

Parish:
The School will not disclose limited personal information to the School parish to facilitate religious and sacramental programs, and other activities such as fundraising, without consent.

Marketing and fundraising:
Schools treat marketing, fundraising and donations as an essential element of the future growth and development of a school. Personal information may be disclosed to an organisation that assists in the fundraising or marketing activities, for example, the school's Foundation or Alumni organisation or, on occasions, external fundraising organisations.

Parents, staff, contractors and other members of the wider school community may from time to time receive fundraising information. Social media, Websites, newsletters and magazines, may include personal information and images and used for marketing purposes.

Exception in relation to related schools:
The Privacy Act 1988 allows each school, being legally related to other schools governed by Mercy Education, to share personal (but not sensitive) information with those schools. Those schools may only use this personal information for the purpose for which it was originally collected by Mercy Education.

4. Who might a school disclose personal information to?
A school may disclose personal information, including sensitive information, held about an individual for educational, administrative and support service purposes. This may include:

school service providers offering educational, support and health services to a school, either on or off campus
persons providing educational support such as sports coaches, volunteers, counsellors and providers of learning and assessment tools
third party service providers that provide educational support services, document and data management services, training and support services, hosting services, and software-as-a-service applications to schools and school systems. e.g. Integrated Catholic Online Network (ICON - VIC), AOS (WA) and Google’s G Suite
authorised agencies and organisations to enable the School to discharge its responsibilities e.g., under the Australian Education Regulation 2013 (Regulation) and the Australian Education Act 2013 (Cth) (AE Act) relating to students with a disability, including Nationally Consistent Collection of Data (NCCD) quality assurance processes, participation in the Australian Early Development Census (AEDC), government audits etc.
authorised organisations and persons who support the School by providing consultative services or undertaking assessments for the purpose of educational programs or providers of health services such as counsellors, psychologists, school nurse services, dental van, etc. Specific consent is obtained to collect and disclose this type of sensitive and health information as part of a service request which may include release of relevant medical or allied health reports, educational planning and evaluation documents such as personalised learning/behaviour/medical management plans
other third parties which a school may use to support or enhance the educational or pastoral care services for its students or to facilitate communication with parents
support the training of selected staff in the use of the School database such as ICON/ROSAE
another school to facilitate the transfer of a student
State and Federal government departments and/or agencies
health service providers
recipients of school publications, such as newsletters and magazines
subscribers to school social media platforms
student’s parents or guardians and their emergency contacts
assessment and educational authorities including the Australian Curriculum, Assessment and Reporting Authority (ACARA)
anyone to whom you authorise the School to disclose information
those we are legally authorised to disclose the information to including, but not limited to child protection agencies and other relevant bodies.

Nationally Consistent Collection of Data (NCCD) on School Students with Disability
The School is required by the Australian Education Regulation (2013) and Australian Education Act 2013 (Cth) (AE Act) to collect and disclose certain information to inform the Students with a Disability (SwD) loading via the NCCD. The School provides the required information at an individual student level to the Catholic Education Offices and the CECs, as an approved authority. Approved authorities must comply with reporting, record keeping and data quality assurance obligations under the NCCD. Student information provided to the federal government for the purpose of the NCCD does not explicitly identify a student.

Sending and storing information overseas:
A school may disclose personal information about an individual to overseas recipients, for instance, to facilitate a school exchange or a student overseas tour. However, a school will not send personal information about an individual outside Australia without:

obtaining the consent of the individual or
otherwise complying with the Australian Privacy Principles or other applicable privacy legislation.

A school may from time to time use the services of third party online service providers (including for the delivery of services and third party online applications, or Apps relating to email, instant messaging and education and assessment, such as Office 365, Google’s G Suite, including Gmail which may be accessible by you. Some personal information, including sensitive information, may be collected and processed or stored by these providers in connection with these services. These online service providers may be located in or outside of Australia.

School personnel and a school’s service providers, Catholic Education Commissions and their service providers, may have the ability to access, monitor, use or disclose emails, communications (e.g. instant messaging), documents and associated administrative data for the purposes of administering the system and services ensuring their proper use.

Mercy Education schools make reasonable efforts to be satisfied about the security of any personal information that may be collected, processed and stored outside Australia, in connection with any cloud and third-party services and will endeavour to ensure the cloud are located in countries with similar protections as specified in the APPs.

The countries in which the servers of cloud service providers and other third-party service providers are located may include USA, UK, Singapore and Australia. [List countries or regions to the extent possible or provide a link (See full list @….) to the list which may be updated as required]

In Victoria, where personal and sensitive information is retained by a cloud service provider on behalf of CECV to facilitate HR and staff administrative support, this information may be stored on servers located in or outside Australia. Otherwise, it is not practicable to specify in this Policy the countries in which overseas recipients of personal information are likely to be located.

5. How does a school treat sensitive information?
‘Sensitive information' includes information relating to a person's racial or ethnic origin, political opinions, religion, trade union or other professional or trade association membership, philosophical beliefs, sexual orientation or practice or criminal record. Sensitive information forms part of the personal information, health information and biometric information about an individual.

Sensitive information will only be used and disclosed for the purpose for which it was provided or as allowed by law unless you agree otherwise.

6. Management and security of personal information
Mercy Education and school staff are required to respect the confidentiality of students' and parents' personal information and the privacy of individuals connected to the School community.

Each school has nominated procedures in place to protect the personal information the School collects from misuse, interference and loss, unauthorised access, modification or disclosure.
Various methods including lockable storage of paper records and password protected access to digital records. This includes responding to any breach affecting the security of the personal information held. If an individual school or Mercy Education assess that such a breach is likely to cause serious harm, the Office of the Australian Information Commissioner (OAIC) and the affected individuals will be notified of the breach.

7. Access and correction of personal information
Under the Privacy Act 1988 (Cth), Health Records Act 2002 (Vic), and the Health Services Act 2016 (WA), an individual has the right to access the personal information which a school or Mercy Education holds. The individual has the right to advise Mercy Education or the school of any perceived inaccuracy. Students will be able to access and update their personal information through their parents, but older students may seek access and correct the information held directly.

There are some exceptions to the rights of access as contained in the applicable legislation. To make a request to access or update any personal information Mercy Education or a school holds about you or your child, in the first instance, please contact the School's Principal by telephone or in writing.

The School may require you to verify your identity and specify what information you require. The School may charge a fee to cover the cost of verifying your application and locating, retrieving, reviewing and copying any material requested. If the information sought is extensive, the School will advise the estimated cost in advance. If Mercy Education or the School cannot provide you with access to the information requested, written advice with reasons for refusal will be provided.

8. Consent and rights of access to the personal information of students
Mercy Education respects every parent's right to make decisions concerning their child's education.

Generally, a school will refer all requests for consent and notices in relation to the personal information of a student, to the parents. A school will treat consent given by parents as consent given on behalf of the student and notice to parents will act as notice given to the student.

Individuals may seek access to personal information held by Mercy Education or the school concerned about them or their child by contacting the School Principal. However, there may be occasions when access is denied. Such occasions may include where release of the information would have an unreasonable impact on the privacy of others, or where the release may result in a breach of the School's duty of care to the student.

A school may, at its discretion, on the request of a student, grant access to information held by the School about the student or allow a student to give or withhold consent to the use of their personal information, independent of their parents. Consideration will be given to the maturity of the student and their personal circumstances

9. Enquiries and complaints
If you would like further information about the management of personal information by Mercy Education or its schools or wish to lodge a complaint regarding the treatment or security of your personal information, please contact the School Principal in the first instance. The School will investigate your complaint and will notify you of the making of a decision in relation to your complaint as soon as practicable after it has been made.

Contact details are:

Principal: Mary Farah
School: St Aloysius College
Address: 31 Curran Street, North Melbourne
Telephone: (03) 9325 9200
Email: principal@aloysius.vic.edu.au

Mercy Education or the School will acknowledge and investigate any complaint and will notify you of the outcome as soon as is practicable If you are not satisfied with the outcome you may refer your complaint to the Office of the Australian Information Commissioner (OAIC).

Contact details are:
Correspondence: GPO Box 5218, Sydney, NSW 2001
Telephone: 1300 363 992
www.oaic.gov.au

For further information about the way Mercy Education manages the personal information it holds, please contact:

Mercy Education Limited
Address: 720 Heidelberg Road, Alphington VIC 3078
Telephone (03) 9490 6600
Correspondence: PO Box 5067, Alphington VIC 3078 Email: contact@mercy.edu.au

Version	Date released	Next review	Author	Approved
1.0	Dec 2016	December 2018		MEL Board
2.0	Jan 2018	January 2020		MEL Board
3.0	May 2018			MEL Board
4.0	May 2019		Executive Officer	MEL Board
5.0	Mar 2020	March 2022	Head of People & Culture	MEL Board
6.0	Dec 2020	December 2023	Head of People & Culture	MEL Board
7.0	Aug 2021	Aug 2022	Head of People & Culture	MEL Board

MERCY EDUCATION POLICY: 1.07 PRIVACY

Explore further