Schools collect a variety of information from pupils and parents, teaching and non-teaching staff, businesses and other people who work in schools as volunteers or on a contractual basis.

When a child is enrolled in school, parents or guardians are asked to provide personal and health information about the child. This information may include the home address, contact details, relationship status, financial status, medical history, and family history including, custody and access arrangements of the child. The parents or guardians provide this information to the school on an express or implied understanding that it remains confidential and is not disclosed to others.

At the federal level, the Privacy Act 1988 (Cth), Privacy Amendment (Private Sector) Act 2000 (Cth) and the Privacy Amendment Act 2004 (Cth) deal with privacy protection issues by both government and non-government agencies.

In Victoria, two Acts cover how this information is handled. The Information Privacy Act 2000 (Vic) deals with collection and handling of personal information (except health information) in the public sector. The Act provides rights to individuals to access and correct their personal information, and applies to all Victorian state schools and their funded service providers.

The Health Records Act 2001 (Vic) came into effect from 1 July 2002 and deals with personal information relating to health in both the public and private sectors. Both government and non-government schools are obliged to abide by the provisions of the Act, which appears to protect all identifying information about the health and disability of staff and students, their medical conditions and treatment. (For general information on privacy issues, see: Chapter 21*5 Privacy Rights).

The common law does not specifically provide a right to "protection of personal information"; instead, it protects individual reputations under the general principles of defamation law (see: Chapter 24*2 Defamation). If a school, through its employees, discloses confidential information about any individual without reasonable defence, and the individual's reputation is damaged by such a disclosure, a case of defamation can be framed against the school. The Department of Education and Early Childhood Development can be vicariously liable for the negligent disclosure of the information by its employees if they acted within the scope of their employment.

Confidential information may be disclosed when specific legislation allows or requires it to be disclosed (see: Chapter 6*2 The Children's Court).

At this stage it is not clear whether a child under the age of 18, who provides information to his or her teachers in confidence, has the right either to have that information withheld from his or her parents or guardians, or to sue his or her school or teachers for damages if that information is disclosed. However, the case of MT v Director General, NSW Department of Education and Training [2004] NSWADT 194 shows how educational institutions unintentionally can breach privacy principles enshrined in state and Commonwealth legislation. In this case a teacher had wrongfully disclosed personal information regarding the medical condition of a student to the soccer club for which she was due to play a grand final match.

The Victorian Department of Education and Early Childhood Development has developed 11 "Privacy Bulletins" to cover the impact of privacy laws on government schools. The Bulletins are available at www.education.vic.gov.au/about/deptpolicies/.

For more information contact:

The Victorian Health Services Commissioner administers the Health Records Act. Complaints relating to interference with health privacy, including access to health information may be made to: