Collecting personal information about students
Principle 4 of the Privacy Act 2020open_in_new states that personal information must not be collected by unlawful, unfair, or unreasonably intrusive means.
When an organisation collects information about a person, it must do so fairly and legally. This includes schools and kura.
Keep reading to learn more about collecting students' personal information.
What does the Privacy Act 2020 require schools to do?
The Privacy Act requires agencies (such as schools) to collect personal information fairly in the circumstances, particularly where children and young people are involved.
They must also ensure their collection systems and processes are designed with this in mind.
The Privacy Act does not specify the age at which someone is considered a child or a young person.
Schools and other agencies should consider the context when collecting information about students.
What might the context look like in a school?
Children and young people have the same rights as adults under the Privacy Act.
Collecting information from primary school-aged children, or from students who may have a limited understanding of what is happening, requires a different approach to collecting information from school leavers.
When designing the collection process, schools should consider the age of students and their level of vulnerability, along with the information systems, digital platforms, and software they use.
What does this mean for your board?
Your board needs to take an active governance role in the collection of students' personal information.
This means setting clear expectations in policy and seeking assurance from your principal that the systems and processes are effective and fit for purpose.
Here are some examples of where you could seek assurance.
- Enrolment forms – the start of the personal information collection pathway for students at school.
- School online student management systems – collecting students' personal information around learning progress and pastoral needs.
- CCTV – collecting students' personal information for security reasons.
- School engagement and communication channels – collecting personal information around student learning and wellbeing from parents and whānau.
- Financial decisions for purchasing new digital platforms and software – such as a new student management system.
The office of the Privacy Commissioner’s website has a lot of information to support your board.
Check out the 10 Poupou Matatapuopen_in_new (especially the governance pouopen_in_new) and the Children’s Privacy Guidance for the Education Sectoropen_in_new.
Questions your board could ask
- Do we understand our obligation to collect information in a fair and reasonable way?
- Do our policies set clear expectations for the principal?
- Does the school have systems and procedures in place for collecting personal information about students?
- Have we sought assurance from the principal that these are effective and fit for purpose?
- Are there any improvements we could make?
Templates, resources, and references
Click on the link(s) below to access the templates, resources, and references related to this topic.
These may download or open in a separate browser depending on your device.
Office of the Privacy Commissioner
- Poupou Matatapu – Doing Privacy Wellopen_in_new
- Children’s Privacy Guidance for the Education Sectoropen_in_new