Schools often face difficult decisions about sharing a student’s personal information with parents. This can become particularly difficult in circumstances where there is some form of family conflict or estrangement. The Office of the Privacy Commissioner has recently released updated guidance which aims to provide greater clarity for schools and other agencies when navigating these situations.
Previously, the Commissioner’s position was that the Privacy Act generally allowed schools to provide information about students to their parents or guardians. This was on the basis that one of the core purposes for which a school collects personal information is to share it with a student’s family. However, the Commissioner’s latest guidance reflects a more nuanced view, placing greater emphasis on the interests of students.
Two-Step test
The Commissioner recommends a two-step test when assessing a parent’s request for their child’s personal information.
Schools should:
- Determine whether the requester is acting as the student’s representative; and
- If yes, assess whether any of the Privacy Act’s refusal grounds apply.
This means schools should not assume that parents automatically have a right to access their child’s personal information under the Privacy Act. Instead, the request must be considered carefully against a number of factors.
Who is a representative?
In considering whether someone is a “representative” of a student, schools should take into account:
- Age and maturity: Is the student old enough to understand and exercise their own rights under the Privacy Act?
- Court orders: Are there legal restrictions on parental access or decision-making authority?
- Best interests: Based on what the school knows, is it likely to be in the student’s best interests for the requester to exercise their rights on their behalf?
Where the interests of a parent and child no longer align, or if disclosure could harm the child, the school may determine that the requester is not acting as a representative. In those cases, the Privacy Act would not apply to the request.
Similarly, if a student has made it clear they do not want a parent to access their information, and they are capable of making that choice (considering their age and maturity), a parent or guardian cannot rely on “representative” status to obtain access to a student’s personal information under the Privacy Act. Where a student has strong views, we recommend erring in their favour given it is their own personal information in question.
Privacy Act refusal grounds
Even if a parent is found to be a representative, there are a range of refusal grounds under the Privacy Act that may nevertheless apply to allow a school to refuse access. The grounds that may apply in a school environment include:
· Where a student is under the age of 16 and the disclosure of the information would be contrary to their interests;
· After consultation with a health practitioner, the school is satisfied that disclosure would be likely to prejudice the health of the student; or
· Disclosure would pose a serious threat to the life, health or safety of any individual or create a significant likelihood of serious harassment.
Some of these considerations may apply when dealing with particularly sensitive student information, such as their counselling notes.
Practical implications for schools
Unfortunately, there is not always a clear answer when dealing with these requests and each one must be considered on its own facts. A blanket approach (such as always granting parents access) would not be appropriate. Instead, schools should weigh up the student’s rights, any legal or contractual obligations, and the best interests of the child.
Schools can reduce uncertainty by having clear contractual arrangements in place with parents and students from the outset, that confirm expectations around information sharing. For example, agreements could record the circumstances in which all parties agree that disclosure of information would be made to parents/guardians.
With the new guidance in mind, now is an ideal time for schools to review their enrolment/admission agreements, privacy policies, and consent processes to ensure they provide clarity and consistency in practice.
Key Takeaway
The new guidance represents a shift from a presumption of parental access to a more nuanced, child-centred test. Schools are expected to carefully assess whether parents or caregivers are truly acting as representatives, and whether disclosure is aligned with the child’s best interests.
.png)
