Privacy incidents
Defining privacy incidents
A privacy incident is any incident where there is a suspected or confirmed loss, inappropriate access, modification, use or disclosure of personal information.
Examples of privacy incidents include:
- emailing someone’s personal information to the wrong recipient
- misappropriation of staff login details to access a school administration system
- applying incorrect access controls to personal documents
- publishing sensitive documents online
- uploading student photos on social media without parental consent
- theft of a student file (electronic or hard copy)
- sharing information about a staff member’s health without consent.
If there is a data breach, loss or inappropriate sharing of information that doesn't include personal information, it is an information security incident, not a privacy incident.
For guidance on information security incidents, refer to Information Security.
When a privacy incident occurs
If a privacy incident has occurred, or may have occurred, schools must notify appropriate departmental teams so that they can assist. Schools can contact the Privacy team for advice at privacy@education.vic.gov.au
The school must also raise an eduSafe Plus report (staff login required)(opens in a new window) and ensure the school’s leadership team is informed.
If the incident involves a data breach, unauthorised access to systems or cyber-attack, schools must following the process outlined in Information security incidents guidance, including calling ISOC on 1800 126 126 or logging a ticket on the Services Portal (staff login required)(opens in a new window).
If an information security incident potentially exposes the personal details of staff or students who are subject to Family Violence Protection Orders or other protective court orders, they may be at a greater risk of harm if that personal information is released. In that case, schools are recommended to contact the staff or student’s parents/carers and suggest they speak to The Orange Door for support with safety planning, if needed.
The Privacy team will help schools evaluate and respond to the incident, and will ensure other key departmental areas are brought in for relevant support.
Updated