These procedures relate to the Social media policy.

To obtain consent from parents or carers to use student information, schools must:

• access and tailor the latest version of the Permission to Publish templates (refer to Permission to publish, which provides forms for download) as directed by the guidance on the template
• provide the Permission to Publish form to parents or carers
• save or retain all returned Permission to Publish forms
• record whether consent was provided (for example, on a register)
• inform relevant employees (for example, class teacher) whether consent was given.

The Permission to Publish (refer to Permission to publish, which provides forms for download) only allows the school to use student information on the specified social media account(s). It does not allow any individual or organisation to use student information on their social media accounts. This includes individuals and organisations outside the department:

• that the school engages with or has invited to the school (for example, parents and citizens (P&C) committee, outside of school hours care (OSHC) or sports program providers, politicians, guest speakers)
• specifically invited to the school (for example, for an event, to present to students or operate a program).

These individuals and organisations can share posts from the school account on a public platform.

The department should take reasonable steps to ensure individuals or organisations are aware they do not have consent to take (and use) photos, audio or video of students. Principals may need to remind individuals or organisations of this when they engage with them.

It is highly recommended that schools request legal services to review forms provided by individuals or organisations outside of the department to use student information. This is to ensure that student information is protected and used appropriately.

Parents or carers, extended family and community, and other casual visitors to the school (for example, for a school concert, sports carnival or fete) do not have consent to use student information collected, other than their own children, when attending events at the school.

Schools can take reasonable steps to remind parents or carers and visitors of this requirement. For example, include a reminder in event invitations that permission is required to publish photos of children that are not their own.

If there are any concerns for the safety or wellbeing of any students, the school must take steps such as asking visitors not to record or take photos of students other than their own children while on school grounds.

If this is not respected, the principal can ask visitors to leave the school. If visitors who act inappropriately refuse to leave the school, the principal can call the police and the school can limit or prevent their future access to the school site using the Inclosed Lands Protection Act 1901 (NSW). Refer to Legal Issues Bulletin 58: Unauthorised entry on department premises for information about taking further steps.

Communicate:

• what information is proposed to be used – for example, photos, video, name or other personal details
• where the information will be used – for example, department Instagram account, school Facebook page
• why the information will be used – for example, to promote a campaign or share details of an event.

Document the details provided and consent given (for example, through an exchange of emails or form) and retain a copy of the consent in records.

In line with the Code of conduct, employees must not:

• undermine the department’s reputation or values
• ·make any comment that may cast doubt on their ability to objectively implement department policies and decisions (refer to 1.3.3 Avoid conflicts of interest)
• participate in private political activities while on duty or on work premises
• deliberately or recklessly misrepresent the department’s position on any issue
• use the department’s resources to assist in their political, community or personal activities – this includes any department or school account, or department platform.

Even if the department (including a school) has the right to use third-party copyright material, there may be restrictions on using that material. For example, materials allowed for classroom use may not be allowed to be shared publicly in any content.

Anything employees develop, invent or create, either alone or in collaboration with others, in the course of their work with the department remains the department’s intellectual property. This may apply even if employees develop material in their own time or at home.

Any material students create must not be used on social media unless the school has consent from the student’s parent or carer. Refer to 1.1.1 Obtain consent to use student information above.

To avoid potentially infringing copyright laws:

• use material created by department employees in the course of their employment or released by the department
• only use any third-party copyright material with permission to use it in the way intended (including identifying the owner of the copyright material if required)
• use Creative Commons licensed material
• use images from the department’s Brand Image Library
• use copyright-free music (for example, music from Facebook’s sound collection)
• link or embed text or images wherever possible, rather than copying the works.

To determine the purpose of, and reason for, a school account on a public platform, consider and document:

• how the school may use the account to interact on the public platform, for example posting text, pictures or images, or video
• sharing posts or other content from other accounts or websites – for example, from the department’s Facebook or Instagram accounts or the school’s website
• interacting with visitors to the school account – for example, reacting or responding to comments
• who the school account’s audience or visitors may be – for example, parents or carers of current or prospective students, the local community
• what subjects will be posted or discussed on the school account – the social media team have some suggested key content pillars, as outlined on Creating Content.

When considering which public platform to use, it is important to:

• understand how the platform works – for example, functionality, ease of posting content, available settings. Refer to Social Media Toolkit for School Staff (staff only)and the eSafety Guide for information about public platforms
• review the platform’s terms of use/rules/community guidelines – refer to 2.1.4 setting up a school account on a public platform for more information
• determine if it is suitable for the proposed purpose and intended audience – for example, forms of content that may be uploaded, accessibility and translation options
• investigate and assess any identified risks and determine how risks can be mitigated – for example, limited privacy settings, data sharing, security. Social Media Toolkit for School Staff (staff only) and the eSafety Guide can provide more information about risks and ways to mitigate. Refer to Complete risk identification, assessment and management planning.

Each school must only have one school account per social media platform.

If a school has more than one social media account on a public platform, contact the social media team for assistance with accessing and deactivating or suspending additional school accounts. The social media team will give guidance in addition to instructions contained in 2.2.2 Manage activities when operating school accounts.

Having only one official account:

• minimises the potential for confusion for parents or carers or the community
• manages the risk of operating social media accounts
• reduces the burden on the school/preschool of complying with all requirements.

Creating ‘groups’ or ‘communities’ (such as Facebook groups) using an official social media account can be an appropriate way for a school to establish and operate a social media channel focused on a specific area of interest. See 2.1.5. Create or join social media groups and communities below for more information about groups.

When considering creating and operating a school account on a public platform, schools must identify and assess foreseeable risks, in line with the Enterprise Risk Management policy and Enterprise Risk Management Framework.

Risks include those:

• specific to the public platform chosen
• generally to the use of social media by the school on a public platform.

Schools must develop processes to manage the identified risks.

Schools have discretion to develop processes for their local context based on factors including:

• the frequency of posting
• the type of content to be posted
• the public platform being used
• the settings used
• the size of the audience and volume of comments.

These local processes must include:

• regular monitoring – the school account is accessed and checked regularly for any issues (for example, comments not compliant with Official School Social Media - Rules of Engagement) (refer to 2.2.2 Manage activities when operating school accounts)
• moderating and responding to issues – any issues identified from the monitoring (or at any other time) are addressed promptly through moderating (refer to 2.2.2 Manage activities when operating school accounts) or in line with the 3. Responding to issues section of this document; and approval of content or other interactions.

When setting up the school social media account, schools must provide the following:

• name or username of the school account – this should be the name of the school or a very close alternative. For example, Apple Tree Public School may become @AppleTreePublicSchool or @AppleTreePS. This is the name that appears in the URL of the page, so Apple Tree Public School would appear: https://www.facebook.com/AppleTreePS/
• administrators – provide at least 2 administrators (including one school executive). See 2.2.1 Assign roles within public platforms for details on administration requirements
• settings – refer to 2.2.2 Manage activities when operating school accounts for information about settings that can be applied when setting up a school account, including settings preferred by the social media team.

The social media team creates school accounts on Facebook on behalf of schools.

New Facebook school account setup

To arrange a new Facebook school account, schools must email the following information to the social media team:

• name/username of the school account
• details of at least 2 administrators (names, usernames of personal Facebook account, link to personal Facebook account, email address used to log into personal Facebook account, and department email address).

Facebook Business Manager tool

Facebook Business Manager (previously referred to as the NSW Facebook Schools Project) is a tool that helps the social media team organise and manage multiple Facebook pages.

All school accounts on Facebook must be linked to the department’s Business Manager. Contact the social media team to arrange this if the account was not set up by the social media team. Through Business Manager, the social media team can access a school's page to provide support and troubleshooting.

Schools and their administrators still maintain ownership of and responsibility for their school account and oversee monitoring and moderating the school account.

On all social media accounts, schools must link to the department’s Official School Social Media – Rules of Engagement on either the school account’s ‘About’ section or ‘Bio’.

It is also recommended to ‘pin’ a post or tweet about the rules of engagement to the top of the school account’s page (and to the pages of any groups or communities created from the school account).

The rules of engagement apply in addition to the rules or terms of service of the relevant social media platform.

They make it clear that certain conduct will not be tolerated and that the school can take action such as removing comments that are in violation.

The Social Media Toolkit includes instructions on how to add to the ‘About’ section or ‘Bio’ and to use pinned posts or tweets for Facebook and Instagram (refer to Moderation and Reporting (staff only)).

School accounts on public platforms must not restrict access or be set as ‘private’ or ‘closed.’

The main purpose for using a public platform is to reach a broader audience and build a stronger community, which includes extended family and friends of students and people in the local area.

Schools can create private or closed groups on public platforms, but the main channel for the school account on the public platform must be open.

This does not mean that a school cannot restrict access, set as private or closed, or suspend the school account from time to time if required to manage or address any risks or issues.

Administrators (admins)

This role may differ between social media platforms but can include:

• interacting with other accounts (for example, ‘likes’ or sharing)
• posting content and other interactions
• removing content
• accessing (and responding to) personal and/or direct messages
• responding to or removing comments from others
• banning others or restricting access.

Requirements for school public platforms:

• must have a minimum of 2 administrators
• at least 1 admin must be a principal or other school executive
• must understand and be able to implement the processes set up by the school under 2.1.3 Decide which public platform to use.
• must understand and be able to act in line with these procedures
• Facebook admins must have a personal Facebook account, as required by Facebook (admin names will only be visible to other admins so their personal Facebook profiles will remain private).

Editors

Some platforms have other roles available to assist with managing a school account. On Facebook this is known as an editor. This role can involve posting content, or responding to or removing comments from others. Editors must understand and be able to implement the processes set up by the school under 2.1.3 Decide which public platform to use. Editors must understand and be able to act in line with this document.

Approvers – role within public platform

Any interactions on a department account or school account on a public platform must be approved by the authorised delegate. For schools, this is the principal.

All content posted and other interactions on or through the school account must comply with the requirements in 1. Department use of social media on department and public platforms. Content can be sourced from any department employees or the department itself.

Schools are advised against using or sharing content sourced outside of the department.

Employees engaged in content creation do not need to have admin or editor access to the school account. They can provide the content to admins or editors for posting. It is recommended that content creators understand the requirements in these procedures.

Only administrators, editors and approvers (refer to section 2.2.1 Assign roles within public platforms for more information on these roles) are permitted to post, upload and share content or interact with others on behalf of the school.

Schools must regularly monitor the school account during school hours. At a minimum, it must be checked daily. How frequently the account needs to be checked will depend on the volume and type of posts and other interactions by the school.

Schools must advise employees who to notify in the school if they see anything concerning.

NSW Government record keeping obligations apply when creating and operating a school account on a public platform.

Digital records are created when a school interacts on its own page or channel (for example, its Facebook page), or where it has interacted on another page or channel. Schools should avoid interacting on any accounts that are not school or department accounts.

These digital records may also need to be produced in response to a request under the Government Information (Public Access) Act 2009 (GIPA Act).

To comply with record keeping and GIPA requirements, schools must:

• maintain digital records of social media interactions for at least 2 years after the date of publishing. If the posts or other interactions are publicly accessible on the public platform, they do not need to be separately saved in department or school records
• download and retain a copy of anything they delete from the school account on the public platform (including any posts or comments by the school or by any other users on the school account) if it is either
  • less than 2 years old
  • connected to a dispute or legal action (despite the date it was published).

Deleted posts can be saved:

• as screenshots or other captures of the content or other interaction (if dealing with individual posts)
• by downloading a copy of all data in the school account (if needing to download and retain a large volume of content and other interactions) – NSW State Records (refer to Recordkeeping and archiving social media) has further information and links to platform-specific guidance for the download of all data.

Items must be retained in the school records and be able to be accessed if required (for example, in response to a GIPA request).

For further information refer to Information Privacy Commissioner's Digital records and GIPA fact sheet and Service NSW’s Social media guidelines.

It is good practice to regularly review the school account to remove (or hide) any content that:

• is no longer relevant or accurate
• was posted more than 2 years ago
• includes information of students no longer at the school.

Maintaining only relevant and more recent content on the school account can reduce the burden on moderators as there are fewer posts to monitor for issues such as inappropriate comments, spam or bots.

It can be simple to remove or hide a large number of posts on platforms such as Facebook, which enables admins to filter posts based on dates and delete or hide up to 50 posts at once.

Schools must comply with record keeping obligations as set out in Record keeping and information access requests (GIPA) above before deleting any posts.

To mitigate the risks associated with using public platforms, school accounts or groups and/or communities within school accounts should be:

• deactivated when they are no longer in use or where there is no intention for further use (for example, groups made for one-off events)
• suspended when there is no intention to use for a certain amount of time, but there is reasonable intent to use it in the future.

Contact the social media team if considering suspending or deactivating a school account or groups and/or communities within a school account. The team will assist with the steps, including:

• posting notice on the account or group and/or community page advising that the account or group and/or community will no longer be active from a certain date and (if applicable) directing users to another account or group and/or community. It is best practice to post this notice at least 2 weeks before suspending or deactivating.
• meeting recordkeeping requirements – for example, downloading a copy of all data from the school account. See above Record keeping and information access requests (GIPA) for further information.

Schools must document and retain approvals as part of the school’s records.

Principals can develop processes to manage this approval requirement. For example, the principal can provide specific instructions to employees involved in operating the school account that they are permitted to undertake particular activities without requiring individual approval each time. For example, they can:

• share or like department posts
• post details of upcoming school events
• share links to the school newsletter.

To manage risk, principals should individually approve any content that includes student information (for example, student names or photos) or information about another person or organisation that the school has a relationship with.

Contact the police if there is a threat of harm to a person (for example, physical harm, blackmail) or possible criminal activity (for example, sexual exploitation of children, cyberstalking).

Matters reported to the police should also be reported to Incident Report and Support Hotline on 1800 811 523.

Report to NSW Police by:

• calling 000 (if it is an emergency)
• calling the Police Assistance Line on 131 444
• contacting the local police station.

Police can:

• investigate the conduct to determine if a criminal offence has been committed
• assist with seeking a protective order to prevent or limit contact from the person
• record the complaint in a report (to assist with later investigation).

For help to determine if the issue requires reporting to the eSafety Commissioner, see 'Responding to issues on a public platform not within a department account or school account' section below.

If suspected cybercrime is involved, report to Australian Cyber Security Centre through the ReportCyber website. The centre is a national policing initiative between the Australian Federal Police and all Australian state and territory police forces and targets cybercrime.

If there are concerns that a child or young person is at risk of harm:

• follow the Child Protection – responding to and reporting students at risk of harm policy
• check the Child protection policy guidelines: responding to and reporting students at risk of harm for more information about this policy
• check the Department of Communities and Justice Mandatory Reporter Guide.

The principal or workplace manager must contact the Child Protection Hotline (Department of Communities and Justice) when:

• there are current concerns about suspected risk of significant harm
• the Mandatory Reporter Guide indicates this should be done.

Refer to Reporting to Department of Communities and Justice for more information on what and how to report to the department.

If the risk of harm concerns do not meet the threshold of suspected risk of significant harm as determined by the Mandatory Reporter Guide, the principal or workplace manager must contact department’s Child Wellbeing Unit when:

• the concerns about risk of harm are not trivial
• the Mandatory Reporter Guide indicates this should be done
• there is an observable pattern of cumulative harm that does not meet the threshold of significant harm
• when a report has been made to the Child Protection Helpline but has been screened out as not reaching the threshold of risk of significant harm.

Refer to Contacting the Child Wellbeing Unit.

If the issue has the potential to significantly affect the health, safety or wellbeing of employees, students or other individuals at schools:

• employees must notify the department’s Health and Safety Directorate on 1800 811 523 in line with the Incident notification and response policy and procedures.
• employees must also notify their line manager.

Employees must report the following incidents, in line with the Incident notification and response procedures (PDF 216 KB). These potentially reportable incidents could occur on social media or come to the attention of employees through social media. If the issue involves the wellbeing or safety of a child or young person, see ‘Issues that involve children or young people at risk of harm‘ section above. These include:

• cyber incidents – these could be student- or staff-related incidents (the use of telecommunication devices to threaten, harass, stalk, bully, create offence or defame a specific person or group. Cyber incidents are threatening and can be shared with a wide audience using equipment or medium such as email, websites, phones and social media sites for negative purposes. They include hacking into a person's social media site, email or web pages to misrepresent or harass)
• an event, situation, suspicion, or threat that a child is at risk of harm, or significant harm from another person (including risk or threat from a student)
• sexting – the digital transmission of sexually explicit or sexually implied messages or images (e.g. photographs or videos).

To help address the conduct or prevent further conduct from occurring, use platform moderation tools or settings such as:

• removing, hiding, or filtering comments
• blocking
• turning off comments or direct messaging
• disabling tags.

If the conduct occurs on (or involves) a department account or school account on a public platform, see 2.2.2 Manage activities when operating school accounts.

The eSafety Commissioner’s eSafety Guide includes information about protecting information and security for many platforms.

Do not respond to the issue.

Report to the public platform (for example, Facebook, Instagram) if the content or conduct breaches the community guidelines or rules of the platform. These guidelines or rules vary from platform to platform but generally prohibit:

• hate speech
• threats of harm – including physical harm, vandalism, theft, or other financial harm
• content targeting an individual to degrade or shame them
• harassing behaviour, for example, repeated unwanted messages
• sharing personal information without permission
• spam or excessive repeated posts
• sers under 13 years old.

Employees can report to the public platform if:

• the content appears on a third-party account or profile (not the department account or school account)
• the content appears on a department account or school account but cannot be removed or hidden.

The eSafety Commissioner’s eSafety Guide includes links and other information about reporting directly to platforms.

If the public platform is TikTok, the social media team can assist with the reporting process. For all other platforms, employees should follow the steps for reporting as outlined in the eSafety Guide.

If the service or platform does not remove the content on request, report to the eSafety Commissioner via Report online harm. The commissioner can direct the service or platform to remove:

• content that involves cyberbullying of a child or young person – content targeting a specific child or young person that is likely to harm the physical or mental health of the child or young person because it is seriously threatening, seriously intimidating, seriously harassing or seriously humiliating
• content that fits its definition of adult cyber abuse – content targeting a person that is menacing, harassing or offensive in all circumstances AND intended to cause serious harm to mental or physical health. It can include content that makes realistic threats, places a person in physical danger, is excessively hurtful or repeatedly targets the same person
• illegal or restricted content – content that shows or encourages the sexual abuse or exploitation of children, terrorist acts or other types of violent crimes or extreme violence. The eSafety Commissioner can also direct online services to remove or age-restrict access to content that is inappropriate for children, including sexually explicit material and high impact violence.

If the issue occurs on a department platform, use platform or application moderation tools or settings to remove or hide the conduct and/or prevent further conduct from occurring.

If the affected user disputes a moderation decision, the administrator or moderator must provide reasoning to the affected user aligned with the Rules of Engagement, these procedures, or department policy that the interaction breaches. There is no further right of review.

For assistance with using tools or settings:

• for Brightcove – contact the Schools Video Team (staff only)
• for other platforms that are centrally managed, such as Microsoft Teams, Google Classroom, Viva Engage (Yammer) – contact EdConnect

Student conduct on social media must be in line with the Behaviour code for students, which expects students to:

• respect other students, their teachers and school staff and community members
• not bully, harass, intimidate or discriminate against anyone in our schools.

Parents or carers, or members of the public should report behaviour that is not in line with this to a school employee. School employees must report this to their principal or workplace manager.

Schools must address behaviour that is not in line with the Behaviour code for students through the school’s Behaviour Support and Management Plan and the Student behaviour policy. Schools may also need to manage particular incidents or types of behaviour with reference to other policies:

• online or cyber bullying – refer to the Student behaviour policy
• Incidents of racism in schools displayed by students towards other students – refer to the Anti-Racism Policy. The member of staff or Anti-Racism Contact Officer decides on the most appropriate response using the School behaviour support and management plan and works with the student/s to resolve the matter.

If the student conduct involves bullying, the parent or carer of student affected by the conduct:

• if concerns continue after the school has taken action, may contact a learning and wellbeing advisor or officer (refer to Finding a public school or principal network office) at the local department office
• if the matter is still unresolved, can contact the Director, Educational Leadership (refer to Finding a public school or principal network office), at the local department office, who must also follow the Complaints handling policy.

Where an employee is engaging in misconduct on social media, and/or there have been complaints about an employee from a colleague or from a parent/carer, community member or from another person with a connection to the department (or the school) ensure to:

• follow the Complaints handling policy, Staff complaint procedure and Community complaint procedures (if applicable)
• report to Professional and Ethical Standards (staff only) using the PES Reporter Guide.

Misconduct is unacceptable or improper behaviour by an employee and is further defined by the applicable legislation. This is explained in detail in the Guidance on misconduct (staff only), which, together with the PES Reporting Guide, provides information about the types of conduct that must be reported to PES. Specific guidance about social media (staff only) provides examples of incidents that require reporting to PES.

Complete the Data Breach Incident Notification Form (staff only) (PDF 242 KB) if there is a suspected data breach.

A data breach is an unauthorised access or disclosure of personal information, or loss or theft of personal information in circumstances where it is likely that unauthorised access or disclosure will occur. The data breach response plan (staff only) outlines employee responsibilities in reporting and managing a suspected breach.

See Reporting and managing data breaches (staff only) for more information.

Employees may not share any information about or including a student when engaging in personal use of social media.

Any images, video or audio that includes a student must not be used on personal social media even if the student is not identifiable.

Information about or including a student includes:

• still images or pictures, or video or audio recordings that include a student
• statements or references to a student’s name or other identifying details
• other information that may identify a student.

Examples of information about or including a student:

• a video of a school assembly
• a picture of new playground equipment that includes students in the background
• a picture of student science projects that have their names visible, or a post mentioning students by name.

Even where the school may have consent from the student’s parent or carer to use the student’s information (for example, images, name) on social media, employees are not permitted to use the student’s information when engaging in personal use.

Do not use any health or personal information (for example, images, video, audio or other information) including or about a colleague on a public platform without their consent. Consent may be given verbally as outlined in the information protection principles. as outlined in Privacy information and forms.

• the Administration Marketplace Panel for Schools
• the Online Learning Tools catalogue
• to find images from the department’s Brand Image Library
• for permission to publish forms – refer to Permission to publish
• for copyright information:
  • ­ Legal Service’s Copyright guidance
  • ­ the Smartcopying website
• or key content pillars – Creating Content
• the Social Media Toolkit for School Staff (staff only)
• the eSafety Commissioner’s eSafety Guide
• the Social media support group (staff only) on Viva Engage/Yammer
• Official School Social Media – Rules of Engagement
• The X Rules
• for information and guidance on record keeping:
  • Recordkeeping and archiving social media
  • Information Privacy Commissioner's Digital records and GIPA fact sheet
  • Service NSW’s Social media guidelines
• for child protection and online safety concerns:
  • refer to the eSafety Commissioner – How to collect evidence
  • report to Australian Cyber Security Centre through the ReportCyber website
  • refer to the Department of Communities and Justice (DCJ) Mandatory Reporter Guide
  • for more information on what and how to report to DCJ, refer to Reporting to Department of Communities and Justice
  • refer to Contacting the Child Wellbeing Unit
  • ­report to the eSafety Commissioner via Report online harm
• for reporting to Professional and Ethical Standards (PES):
  • report to Professional and Ethical Standards (staff only) using the PES Reporter Guide
  • the Guidance on misconduct (staff only)
  • for information about the types of conduct that must be reported to PES – PES Reporting Guide
  • ­examples of incidents that require reporting to PES – refer to social media (staff only)
• for Brightcove – contact the Schools Video Team (staff only)
• for suspected data breaches:
  • the Data Breach Incident Notification Form (staff only) (PDF 242 KB)
  • the data breach response plan (staff only)
  • refer to Reporting and managing data breaches (staff only)

• Children and Young Persons (Care and Protection) Act 1998)
• Copyright Act 1968
• Government Information (Public Access) Act 2009 (GIPA Act)
• Inclosed Lands Protection Act 1901 (NSW)
• Child protection – responding to and reporting students at risk of harm policy
• Child protection policy Guidelines: responding to and reporting students at risk of harm
• Code of conduct policy and Code of conduct procedures (DOCX 178 KB)
• Commercial arrangements, sponsorship and donations policy
• Complaints handling policy, Staff complaint procedures, and Community complaint procedures
• Enterprise Risk Management policy and Enterprise Risk Management Framework
• Incident notification and response policy and Incident notification and response procedures (PDF 216 KB)
• the Private and secondary employment policy
• Student behaviour policy and Behaviour code for students
• to contact a learning and wellbeing advisor or officer, or Director, Educational Leadership – Finding a public school or principal network office
• Legal Issues Bulletin 58: Unauthorised entry on department premises
• Legal Issues Bulletin 34 - Defamation