The role of the privacy officer in schools
Did you know that every agency collecting and using personal information must have a privacy officer?
Yes, that includes your board.
Keep reading to learn more about what the privacy officer does and why it's essential your board understands and supports this role.
What is your board responsible for?
The requirement to have a privacy officer has been in place since the first Privacy Act was passed in 1993 and continues in the updated 2020 Act.
The requirements of the Privacy Act are something many school boards have traditionally spent little time considering.
This was often because principals take on this role as part of running the school, dealing with privacy issues without much (or any) board involvement.
There are more significant risks for your board under the new Privacy Act.
A key part of managing risk is for your board to take responsibility for making the privacy officer appointment (or it can also be delegated through board policy) and deciding how you can appropriately support the privacy officer at a governance level.
What does the privacy officer do?
The privacy officer does not have to be an expert. Instead, the role is a mixture of:
- Encouraging legally compliant and safe privacy practices at a board and school level.
- Dealing with privacy access requests.
- Alerting your board to privacy risks.
The privacy officer does not have to "fix" those risks or make sure they are fixed – that is the role of your board.
Section 201 of the Privacy Act 2020open_in_new sets out the main parts of the privacy officer's role.
There is also information available from the Office of the Privacy Commissioneropen_in_new.
Who can be the privacy officer?
Almost anyone can be a privacy officer.
Your board could appoint a staff member, or board member, or even someone from outside of the school.
For a staff member, depending on the size of the school, the role can sometimes be an "add-on."
How can your board support the privacy officer?
Your board must plan to ensure the privacy officer can access training.
Luckily, much of this training can be done online via the Office of the Privacy Commissioneropen_in_new.
It is also essential to make resourcing available to release the privacy officer from their other duties to access that training.
Here are some other ways to support the privacy officer:
- Request regular privacy officer reports to the board.
- Upskill as a board – one way is to take time to view the online modules on the Office of the Privacy Commissioner's website.
- Regularly put privacy on your board's agenda.
Questions your board could ask
- Do we have a privacy officer?
- Have we planned to allocate resources (time and money) to support the privacy officer's training and work?
- Do we have a privacy policy, and can the school recognise when a privacy breach may have occurred?
- Do we regularly receive and review a report from our privacy officer?
- Have we completed the online training available on the Office of the Privacy Commissioner's website?
Templates, resources, and references
Click on the link(s) below to access the templates, resources, and references related to this topic.
These may download or open in a separate browser depending on your device.