无码变态

Swan Christian Education Association Incorporated (无码变态) recognises and acknowledges that the protection of individuals鈥� privacy is important and required under the relevant legislation.

This Privacy Policy explains how 无码变态 manages information it collects; in particular, how:
鈥� 无码变态 collects information, throughout its usual course of business.
鈥� 无码变态 protects the privacy of personal information and health information which 无码变态 collects and uses.
鈥� 无码变态 uses such information and to whom such information may be disclosed.
鈥� 无码变态 reports data breaches.
鈥� Individuals can access their personal information, correct any personal information which 无码变态 holds, lodge complaints in relation to alleged breaches of privacy or make any related enquiry.

Scope
This Policy covers all sites (schools and the system office) owned and/or operated by 无码变态. All members of 无码变态 staff, contractors and volunteers must comply with this policy in relation to any personal information they handle.
Personal information may be collected from any individual with whom 无码变态 may have contact, including current and prospective students and their parents/guardians, alumni, job applicants, volunteers, contractors, past employees and other individuals who engage with 无码变态.
无码变态 may also collect, use and disclose health information in relation to the provision of health services to students while in the care of 无码变态.

Context
无码变态 is bound by the Australian Privacy Principles (APP鈥檚) contained in the Privacy Amendment (Enhancing Privacy Protection) Act 2012 . This amendment makes changes to the Privacy Act 1988 (鈥渢he Act鈥�). 无码变态 is also bound in WA by the Freedom of Information Act 1992 (WA). In relation to health records 无码变态 holds, 无码变态 is bound by the Health Privacy Principles under the Health Act 1911.
This policy should be read in conjunction with the 无码变态 Members鈥� Grievance Policy, 无码变态 Staff Complaints Management Policy, the 无码变态 Access Arrangements for Separated Parents/ Policy, and the 无码变态 Digital Privacy, Safety and Security Policy and Framework.
The Association may, from time to time, review and update this policy to take account of changes to the Association鈥檚 operations and practices and to make sure it remains appropriate to the changing legal and school environment.

Policy Statement
In carrying out its educational and welfare functions, Swan Christian Education Association collects personal information about students, parents/carers and staff. 无码变态 is committed to protecting the privacy of all information collected. All employees, Board members and volunteers are required by law to protect the personal information the school collects, including that of a sensitive nature. All members of the 无码变态 community have the right to understand how their personal information will be managed, stored, used and disposed of.
Types of information 无码变态 collects and holds

无码变态 collects a range of personal information about an individual, including:
鈥� name
鈥� address
鈥� contact number
鈥� email address
鈥� age
鈥� date of birth (DOB)
鈥� photographs or videos
鈥� academic results
鈥� other relevant personal details

In addition to this information, where 无码变态 provides health services during discharging its duty of care, 无码变态 may collect information about health services previously provided to an individual, an individual鈥檚 current health status and an individual鈥檚 expressed wishes in relation to the provision of health services.
无码变态 may also collect information about individuals when accessing electronic resources or communications of the Association, such as websites or social media channels of the Association and its schools. Information 无码变态 collects from visits to its website is generally not personally identifiable. However, due to the nature of internet protocols, information collected may individually or by aggregate, be able to identify information such as the IP address of the computer accessing 无码变态鈥檚 website, the internet service provider used by an individual, the web-page directing an individual to 无码变态鈥檚 website and the individual鈥檚 activity on 无码变态鈥檚 website.
Procedures

How 无码变态 collects personal information
无码变态 may collect personal information from an individual though a variety of sources, including but not limited to:
鈥� a form that is completed and submitted to 无码变态;
鈥� a telephone, email or in-person inquiry or discussion about 无码变态 and the services that 无码变态 provides;
鈥� mail correspondence, emails and other electronic means – including by accessing 无码变态鈥檚 website and use of the 鈥渃ontact us鈥� form;
鈥� electronic service providers, such as third-party cookies (Google Analytics), email distribution services or event management software;
鈥� publicly available sources of information;
鈥� reference from another school about an individual student; and
鈥� reports provided to 无码变态 by a medical professional in relation to health services previously provided or to be provided by 无码变态 to an individual.

无码变态 will usually collect personal information directly from an individual or their parent/guardian, unless it is unreasonable or impracticable to do so. Additionally, 无码变态 will usually only collect personally identifiable information when 无码变态 asks for that personal information or it is volunteered by the individual. 无码变态 may from time to time receive unsolicited personal information about an individual. 无码变态 will promptly destroy or de-identify any personal information found to have been collected in error.
Additionally, 无码变态 may collect data from users of its electronic platforms using various technologies and third-party service providers.
无码变态 may seek consent of parents/guardians to use their child鈥檚 name, image and likeness in materials produced or published by 无码变态 or third-parties, including newsletters, magazines, posters and other advertising materials. Where parents/guardians do not consent to their child鈥檚 name, image and likeness being used by 无码变态 in this manner, 无码变态 will refrain from using their child鈥檚 name, image and likeness. Parents/guardians may at any time withdraw their consent and 无码变态 will remove their child鈥檚 name, image and likeness from electronic materials produced or published as soon as is reasonably practicable, or in the case of printed material subsequent prints from the time of notification of consent being withdrawn.

How 无码变态 uses personal information it collects
无码变态 generally only uses personal information for the primary purpose for which it is collected or a secondary purpose, when it is permitted by the Act or if authorised or required by law.
无码变态 collects personal information for the purposes of:
鈥� facilitating its ability to function as an educational institution;
鈥� other administrative functions, including assessing job applicants and managing volunteers;
鈥� fulfilling its duty of care to its students;
鈥� complying with its legal obligations owed to the State and Commonwealth Governments in relation to the provision of education to students;
鈥� addressing queries or resolving complaints;
鈥� marketing 无码变态 and the education services 无码变态 provides;
鈥� keep individuals connected to the Association up to date with relevant information and promotion of future services and events;
鈥� keeping parents and guardians informed on matters relating to their child鈥檚 schooling at 无码变态 through correspondence, newsletters, magazines and reports;
鈥� assessing applications for scholarships to attend 无码变态 and awarding and administering scholarships to current students at 无码变态;
鈥� seeking and administering donations and bequests made to 无码变态, and
鈥� improving services.

无码变态 may also disclose personal information it collects from individuals to third-parties, such as 无码变态鈥檚 professional advisers, courts, tribunals, regulatory authorities, other companies and individuals for:
鈥� complying with its obligations owed to an individual under any contract between 无码变态 and the individual, or as required by law;
鈥� enabling those third-parties to perform services on behalf of 无码变态; and,
鈥� recovering debts where amounts owed to 无码变态 in consideration for services 无码变态 provides remain due and outstanding beyond the payment terms.

Third-parties 无码变态 engages from time to time may have access to personal information held by 无码变态 about individuals, but 无码变态 will not authorise them to use such information for any other purpose.

无码变态 may disclose personal information (including sensitive information) held about an individual to another school, government departments (where 无码变态 must disclose such information to comply with its legal obligations), medical practitioners, service providers (including specialist visiting teachers and sports coaches), recipients of 无码变态 publications (such as newsletters and magazines), and parents and guardians.

无码变态 may use health information collected about an individual to provide health services to that individual where required. 无码变态 may disclose health information to a medical professional or to a health service provider where that other health service provider is engaged in providing health services to that individual. 无码变态 will not use or disclose such health information for a purpose other than the primary purpose of collection unless:
鈥� the individual consents to the use or disclosure;
鈥� the secondary purpose is directly related to the primary purpose and the individual would reasonably expect 无码变态 to use or disclose the information for the secondary purpose;
鈥� the use or disclosure is required, authorised or permitted, whether expressly or impliedly by or under law; or,
鈥� as otherwise authorised, permitted or required under the State Records Act 2000 (WA).
Effect of non-provision of personal information; anonymity and pseudonymity
From time to time an individual may be able to deal with 无码变态 anonymously or by using a pseudonym. For example, without limitation, if an individual has a general inquiry about 无码变态, 无码变态 may be able to respond to the inquiry on an anonymous or pseudonymous basis.
However, if an individual does not provide the personal information 无码变态 requests, or the information is provided anonymously or pseudonymously, then 无码变态 may be unable to fulfil its functions as an educational institution or discharge its duty of care to the parents/guardians or children affected.
Further, in some situations, 无码变态 may need to verify an individual鈥檚 identity as part of 无码变态鈥檚 response to a request to access and/or correct personal information or health information 无码变态 holds about an individual, or as part of 无码变态鈥檚 complaints handling procedure. If 无码变态 cannot verify an individual鈥檚 identity, or they continue to engage with 无码变态 in an anonymous or pseudonymous basis, then 无码变态 may be unable to complete the request or pursue its complaints-handling procedure.

Direct marketing

无码变态 may directly market its services to individuals on the basis that they would reasonably expect 无码变态 to do so, where 无码变态 has already collected their personal information.
无码变态 will also comply with other laws relevant to marketing, including the Spam Act 2003 (Cth), the Do Not Call Register Act 2006 (Cth) and the Competition and Consumer Act 2010 (Cth).
Marketing email communications which 无码变态 send will include an opt-out procedure.

Cross-border transfer or disclosure of information

无码变态 may disclose an individual鈥檚 personal information to entities outside Australia from time to time. For example, 无码变态 may be required to disclose the personal information of students travelling to 无码变态鈥檚 outreach activities to Australian and overseas government authorities.
无码变态 may transfer health information about an individual to an entity other than 无码变态 or the individual which is outside Australia only when 无码变态 reasonably believes that the recipient is subject to a law binding scheme or contract which effectively upholds principles for fair handling of the information that are substantially similar to the requirements under the Freedom of Information Act 1992 (WA), if the individual consents to the transfer or otherwise as permitted under the Freedom of Information Act 1992 (WA).
无码变态 makes use of services hosted overseas where they are subject to a binding scheme or law that has the effect of protecting the information in a way that, overall is at least substantially similar to the way in which the Australian Privacy Principles protect the information; and there are mechanisms that allow the individual to take action to enforce that protection of the law or binding scheme. Where this isn鈥檛 possible, 无码变态 will seek appropriate consent.

Quality of information

Whilst it is the responsibility of the parent or guardian to provide updated or amended personal and health information, 无码变态 takes reasonable steps to ensure that, the personal information and the health information 无码变态 collects, uses, holds or discloses is accurate, complete, up-to-date and relevant to 无码变态鈥檚 functions or activities, having regard to the purpose for which the information is to be used or disclosed by 无码变态.
Additionally, 无码变态 will take reasonable steps to destroy or de-identify personal information it holds about an individual, if 无码变态 no longer requires that personal information.

Accessing and correcting information

Individuals are entitled at any time, upon request, to access the personal information held about them. 无码变态 will respond within a reasonable period after receiving the request. 无码变态 will give access to the information in the manner it is requested, unless it is impracticable for 无码变态 to do so. 无码变态 is entitled to charge a reasonable administrative fee for giving access to the information.
无码变态 may from time to time refuse an individual access to the information 无码变态 holds about that individual, in accordance with the relevant legislation. Where 无码变态 refuses access, 无码变态 will explain the reasons for refusal in writing and, if individuals wish to lodge a formal complaint about the refusal it should be made in accordance with the 无码变态鈥檚 grievance policies.
无码变态 reserves the right to verify an individual鈥檚 identity before granting access to the personal information 无码变态 holds about them.
Parents/guardians generally have a right to access information held concerning their child, but, in some cases information disclosed to health and psychological professionals may be withheld from parents/guardians, when requested by a child assessed as mature enough to make this choice.
The disclosure of information held to separated/divorced parents/guardians will be governed by Family Court Orders, if they exist.
If at any times individuals believe that personal information 无码变态 holds is incorrect, incomplete or inaccurate, they may request that 无码变态 amend such personal information. If 无码变态 refuses the correction request, then 无码变态 will provide written reasons and information about 无码变态鈥檚 complaints-handling process, should they not be satisfied with those reasons.
Where 无码变态 corrects personal information held about an individual, 无码变态 will take reasonable steps to notify third-parties of the correction.

Mandatory Notification of Data Breaches

On 22 February 2018, changes to the Act took effect and a new Notifiable Data Breach (NDB) Scheme is in force. The NDB Scheme requires 无码变态 to notify the Office of the Australian Information Commissioner (OAIC) and the affected individual(s), in the event of a notifiable data breach.
A data breach occurs when personal information is lost or subject to unauthorised access, modification, disclosure, or other misuse or interference. For 无码变态, data breaches are not limited to hackings or cyber-attacks on school systems. More commonly, data breaches occur due to internal human errors or a failure to follow information handling policies that result in personal information being inadvertently lost or disclosed to the wrong person. For example, leaving a school laptop on public transport.
Not all data breaches will be NDBs. Pursuant to section 26WE of the Act, an eligible data breach, which would require notification, occurs in circumstances where:
鈥� there is an unauthorised access or unauthorised disclosure of information and a reasonable person would conclude that access or disclosure would be likely to result in serious harm to any of the individuals to whom the information relates; or
鈥� information is lost in circumstances where such unauthorised access or disclosure is likely to occur and a reasonable person would conclude that, assuming such access or disclosure did occur, it would be likely to result in serious harm to any individuals to whom that information relates.
In short, for there to be an eligible data breach, the breach would have the likelihood of resulting in serious harm to any of the affected individuals. Serious harm could include serious physical, psychological, emotional, economic and financial harm, as well as serious harm to reputation and other forms of serious harm that a reasonable person in the school鈥檚 position would identify as a possible outcome of the data breach.

Examples of data breaches which may meet the definition of an eligible data breach, include when:
鈥� a device containing a member of the school community鈥檚 personal information is lost or stolen (e.g. a school laptop);
鈥� a database containing personal information is hacked;
鈥� personal information about students or staff is mistakenly provided to the wrong person;
鈥� records containing student information is stolen from unsecured recycling bins; or
鈥� disclosing personal information about students/staff for purposes other than what it was collected for and without the consent of the affected students/staff.

Once a 无码变态 employee forms the view, based on reasonable grounds, that there has been an eligible data breach, it must:
鈥� prepare a statement in accordance with the Act; and
鈥� provide this statement to the CEO of 无码变态; and
鈥� 无码变态 will give a copy of the statement to the OAIC as soon as practicable after becoming aware of the eligible data breach.

The statement must set out:
鈥� the identity and contact details of the school;
鈥� a description of the eligible data breach that the school has reasonable grounds to believe has happened;
鈥� the kind/s of information concerned; and
鈥� the recommendations about the steps that individuals should take in response to the eligible data breach that the entity has reasonable grounds to believe has happened.

无码变态 must notify the contents of that statement to the affected individuals (students, parents, staff etc.) as soon as practicable. What constitutes reasonable steps for notification will depend on the circumstances of every case. Practicable means of communication are more likely to be by phone, letter, email or in person, as they are the normal means of communication between the school and its students or staff.
If it is not practicable to notify the individuals directly, 无码变态 may publish its statement on its website and take reasonable steps to make the statement public.
Public notification (for example on a website or social media) may be required if an eligible data breach involves highly sensitive and personal information affecting both past and present students, such that it would be impracticable to contact each of the individuals directly and the information disclosed would likely result in serious harm to all the individuals affected. Some exceptions to notifying the OAIC and individuals exist, including where taking 鈥榬emedial action鈥� to avoid harm being suffered is possible. This exception may apply where, in the event of an eligible data breach, 无码变态 acts by requesting an unauthorised recipient of personal information to delete or destroy the information, such that there would unlikely be serious harm due to the breach.
Lodging a complaint

If individuals wish to complain about an alleged breach of the privacy of their personal information, the complaint should be made in accordance with the Members鈥� Grievance Policy, or 无码变态 Complaints Management Policy (for staff), as applicable.

If individuals are dissatisfied with the outcome of their complaint, they may escalate their complaint to the office of the Australian Information Commissioner.