The Information Privacy Act (Vic) 2000 contains ten Information Privacy Principles (IPP) which regulate how personal information is handled throughout its life cycle, from collection to use and disclosure, storage, accessibility and disposal. Several of these IPP's impact on the distribution of student results and assignments and other information such as the distribution of information re practical placements. This document provides guidance on how to enhance compliance with the relevant IPP's when collecting the student information and distributing the student information.
In these guidelines:
Student Information includes (but is not limited to):
- Student results collated in a list with identification by student number only (The student ID number is likely to be considered personal information and therefore needs to be treated in accordance with the privacy laws)
- Practical Placement, Clinical Placement details
IPP 1 - Collection
The university has general practices that require students to complete an assignment cover sheet when submitting an assignment. Information on this assignment cover sheet is regarded in law as ‘personal information’. As a consequence, Monash has legal obligations to fulfil when collecting such information. For example, at or before the time of collecting personal information, Monash is required to inform individuals of the following matters:
- The fact that the individual is able to gain access to the information;
- The purposes for which the information is collected;
- To whom (or the types of individuals or organisation to which) Monash usually discloses information of that kind;
- Any law that requires the particular information to be collected; and
- The main consequences (if any) for the individual if all or part of the information is not provided.
- Privacy Officer details
- Who is the organisation collecting the information and how they can obtain access to it.
It is recommended that steps are taken to include notification of these matters on the assignment cover sheets. Below is an example of some standard wording which may be used.
The information on this form is collected for the primary purpose of assessing your assignment. Other purposes of collection include recording your plagiarism and collusion declaration, attending to administrative matters and statistical analyses. If you choose not to complete all the questions on this form, it may not be possible for Monash University to allow the submission of your assignment. You have a right to access personal information that Monash University holds about you, subject to any exceptions in relevant legislation. If you wish to seek access to your personal information or inquire about the handling of your personal information, please contact the University Privacy Officer on (03) 9902 9589.
The privacy collection statement above contains the necessary requirements to comply with the privacy laws. If you would like to use an amended version of the collection statement, it is recommended that you provide the amended version to the Privacy Officer for confirmation that it meets the requirements of the privacy laws.
When collecting other personal information from students (eg practical placement preferences), it is also important to include a privacy collection notice. The privacy collection notice will need to be modified depending on the required uses and disclosures. Below is the model collection notice used by Monash University.
The information on this form is collected for the primary purpose of [insert primary purpose]. Other purposes of collection include [insert secondary purposes]. If you choose not to complete all the questions on this form, it may not be possible for [insert name eg. the Faculty] to [insert consequence]. Personal information may also be disclosed to [list any 3rd parties personal information is disclosed to (do not include Monash staff)] You have a right to access personal information that Monash University holds about you, subject to any exceptions in relevant legislation. If you wish to seek access to your personal information or inquire about the handling of your personal information, please contact the University Privacy Officer on 9902 9589.
If you require assistance drafting an appropriate collection notice, depending on the type of information collected, please do not hesitate to contact the Privacy Officer on 9902 9589. or by email: email@example.com
IPP 4 - Data Security
Once you have received the personal information from the student eg. on the assignment cover sheet, there are further legal obligations which exist in relation to the protection of the information. IPP 4 requires Monash to take reasonable steps to protect the personal information it holds from misuse and loss and from unauthorised access, modification or disclosure.
There are currently several practices within Monash for the distribution of student information. It is possible that some of these methods may now require improvements to enhance compliance with the privacy laws. With the existing practices, there may be risk of the personal information being accessed or disclosed without authorisation. This is because we may be disclosing student's personal information to other students (or even other individuals) without consent by distributing their information in a public way.
The following recommendations could be implemented to allow students the option of giving consent for their information to be left in a public area. It provides further protection from breaching the privacy laws but also provides an efficient and effective means of distributing student information.
Preferred Method for Optimal Compliance
If the way in which we distribute student information does not disclose personal information to other students then we do not have to obtain consent from the student. Student information may be distributed in any of the following ways without obtaining consent:
- During lectures or tutorials without disclosing the personal information (other than name) of students eg a name call (1st name only if possible).
- Student information is left with an administrative staff member for collection. Students would need to present their student ID card for proof of identity
- Students collect the student information from the lecturer of tutor outside class time. The lecturer or tutor may nominate a time when the information could be collected.
These options may take valuable class time and the time of staff. The use of class time and resources should be considered when working out the best way for distributing student information. The options above would be most beneficial for small classes and may not be practical for large classes or subjects which have many students.
Seek consent from students for the student information to be distributed in the preferred way.
To obtain consent, a statement such as the following should be placed on the document collecting the information which will ultimately be distributed to students eg assignment cover sheet, practical placement/ clinical placement preference sheet:
If the student does not contact the lecturer/tutor to make alternative arrangements, then we have implied consent to return the student information in the nominated way. From a privacy perspective this is not the preferred option, however with very large classes it may be the most efficient way of obtaining consent.
Inform students verbally at the start of the semester of the proposed method of returning information to students. Let them know that they may speak to the lecturer / tutor if they would like to make alternative arrangements. This is another way which we can obtain implied consent. However, if we ever had a dispute about obtaining consent, it would be more difficult to prove that the information was given to the students if it is not in writing. For example, there may be difficulties proving that that the student was present when the information was provided. This option is not recommended, however as a last resort it may be utilised.
Group Assessment Activities
In many instances, it is necessary for students to participate in group assessment activities. This necessitates the collection of several students' information on the same document with disclosure to all other students involved in that assessment activity. In order to protect the privacy of the students' involved in the assessment activity it is preferable to collect as little information as possible about the student on the assignment cover sheet or other relevant documentation. For example, collection of the students name and ID number only is preferred. It is recommended that other personal information is not collected via group assessment activities. Distribution of the assignment results will mean that all participants of the group activity will be aware of other student results. This is not in breach of the privacy laws as it falls within the primary purpose of collecting the information.