software privacy australia education school
Is it a breach of privacy law in Australia if schools track student device usage at home?
<p>Since I usually only use programming Stack Exchange sites, sorry if I do anything wrong in this post.</p>
<p>My school recently installed software on all student devices (owned by the school) which can track all activity on the device.</p>
<p>I understand the intent if this was limited to only the school's network, but tracking students at home seems a bit invasive. It was also done without without student or parent consent.</p>
<p>Is this a breach of privacy laws?</p>

<h2>Commonwealth</h2>
<p><strong>Public Schools</strong></p>
<p>The Commonwealth <a href="https://www.legislation.gov.au/Series/C2004A03712" rel="nofollow noreferrer"><em>Privacy Act</em></a> 1988 does not apply to state and territory governments including public education.</p>
<p><strong>Private Schools</strong></p>
<p>The Privacy Act applies if:</p>
<ol>
<li>they have an annual turnover of more than $3 million - this will capture all but the smallest schools. At a low-end fee of $10k per student per year, this means 300 students will cross the threshold.</li>
<li>they’re connected to a larger organisation (with an annual turnover of $3 million) - which captures most private education networks such as Catholic Education Australia.</li>
<li>they supply a health service and hold health information, although this isn’t their primary activity - which is unlikely to apply.</li>
</ol>
<p>Consent is required to collect <a href="https://www.oaic.gov.au/privacy/your-privacy-rights/your-personal-information/what-is-personal-information/#SensitiveInfo" rel="nofollow noreferrer">sensitive</a> information or to disclose non-sensitive <a href="https://www.oaic.gov.au/privacy/your-privacy-rights/your-personal-information/what-is-personal-information/" rel="nofollow noreferrer">personal</a> information for purposes other than for which it was collected. There is no age criterion on consent - an individual who can understand the concepts (as you clearly can) can give or withhold their own consent even if they are a child.</p>
<p>Given that they can monitor all activity, this may be sensitive information (e.g. political opinions or associations, religious or philosophical beliefs, trade union membership or associations, sexual orientation or practices) depending on what you use the computer for. If so, then consent is required. However, if the school prescribes the activities that you are allowed to use the computer for such that you are not <em>required</em> to disclose sensitive information; if you do so knowing that it was being collected this would be implied consent.</p>
<p><strong>State Law</strong></p>
<p><a href="/questions/tagged/new-south-wales" class="post-tag" title="show questions tagged &#39;new-south-wales&#39;" rel="tag">new-south-wales</a></p>
<p>NSW Education is subject to a specific <a href="https://www.ipc.nsw.gov.au/sites/default/files/file_manager/Privacy%20code%20of%20practice%20Dept%20Ed%20Training%20ggchild%2020121206_0.pdf" rel="nofollow noreferrer">Code of Practice</a> under the <a href="https://legislation.nsw.gov.au/view/html/inforce/current/act-1998-133" rel="nofollow noreferrer"><em>Privacy and Personal Information Protection Act</em></a>.</p>
<p>Consent may or not be required depending on the purpose for the collection of the information. For example, if its primary purpose is to &quot;control and regulate student discipline in government schools&quot; then consent is not required.</p>
