Consent
Privacy laws refer to consent, which is when someone agrees for their information to be collected, used and/or shared outside of the school or Department. Consent must be informed, specific, current and voluntary, which is especially important when the subject matter or content is sensitive.
Under the relevant privacy laws, consent is required to collect, use and disclose any health information (with certain exceptions prescribed in the law such as when the collection, use or disclosure is necessary to lessen or prevent a serious threat to an individual’s life, health, safety or welfare).
In some instances, Department policy also requires schools to obtain consent to collect personal information (in addition to health information) where it is considered good practice to do so.
Both privacy laws and Department policy require consent to use or disclose any personal information that schools have collected, where that use or disclosure is not for the same purpose or a reasonably expected related purpose for which it was collected. However, there are some exceptions in privacy laws that allow schools to use or disclose information without consent in these circumstances, such as sharing personal information with a law enforcement agency to assist in an investigation or as otherwise required or authorised by law.
Refer to the chapter on Collection Statements for what must be communicated to parents/carers on the management of student personal and health information.
Refer to the chapter on Sharing Information for how the personal and health information of students, staff and others can be shared.
Refer to Child and Family Violence information Sharing Schemes for further information about how information can and must be shared to promote the wellbeing or safety of children, or to assess or manage family violence risk.
In cases where consent is required for the collection of information, if consent was granted at the time of collection, it is not necessary to re-seek consent if you plan to use the person’s information for the same purpose or a reasonably expected related purpose for which it was collected. However, it is good practice for schools to ensure they have communicated clearly what those purposes are, refer to Collection Statements.
In some circumstances, schools may need to ensure specific consent is obtained, with the most common being photographs and recordings of staff and students, and research in schools.
The following information sets out the Department’s policy on when consent must be obtained to collect, use and/or disclose personal and health information.
Photographing, filming or recording staff and students
Consent must always be considered when taking or publishing photographs and film of staff and students.
For more information on consent and other considerations when taking photographs or video, refer to the chapter on Photographs, filming and recording.
For the Department’s policies and template consent forms, refer to the:
- Photographing, Filming and Recording Students Policy
- Photographing, Filming and Recording Staff and other Adults Policy
A template school-level policy on photographing, filming and recording students is available on the School Policy Templates Portal at Photographing, filming and recording (login required).
Conducting research in schools
All research conducted in schools requires consent from participants whether staff or students and, for any student under the age of 18, consent from parents/caregivers. This applies to both research conducted by external researchers and research commissioned or conducted by the Department.
Where the proposed research involves photographing or filming, the researcher must obtain specific agreement from the participants (or their parents/caregivers, as required). This consent should be defined and included in the consent for participating in the research.
For the Department’s policy, refer to Research and Evaluation in Schools.
Cover letter and consent form templates for external research are available for schools, refer to:
- Cover letter for external research consent (login required)
- External research parent/carer consent (login required)
Using online services in schools
Online services and applications (online services) often handle student or parent information, for example, Compass or Mathletics. Schools can take different approaches to seeking parental consent when implementing these services, depending on local circumstances or expectations of their school community.
When implementing an online service, schools should consider whether consent for use of the service is required, and if so, whether opt in or opt out consent is most appropriate for the specific situation.
- Opt in consent can be used when the service is not for a standard school function (for example, a fundraising event with the local sporting club); and parents may not reasonably expect such use.
- Opt out consent can be used when the service is for a desirable, but not mandated, school function (for example for teaching and learning purposes).
- No consent is needed when the service is for a school function that is mandated by law (for example, same day notification of unexplained absences).
Privacy law also allows for student and parent information to be used and shared without consent for specific purposes, such as, when it is necessary to lessen or prevent a serious harm, or for law enforcement purposes.
In all cases, schools should ensure parents are adequately informed about the use of the online service so they are not taken by surprise. Refer to Notifications for online services.
Where an online service uses photographs or videos of a student, the Department’s Photographing and Filming Students Policy applies, and parental consent is required. If consent was granted previously for this use or you are using it for a reasonably expected related purpose, the school may decide that no further consent is necessary or use opt out consent.
The Privacy team can provide further advice on consent for use of online services.
Reviewed 19 April 2021