1. What issues does this bulletin address?

1.1 - This bulletin addresses information sharing obligations for NSW public schools under section 18 of the Privacy and Personal Information Protection Act 1998 (NSW) (PPIP Act) and the department’s Privacy Code of Practice (Privacy Code).

2. School’s information sharing obligations

2.1 - Schools hold a range of personal information on each of their students. Schools cannot disclose a student’s personal information unless one or more of the following apply: ¹

1. The release is directly to the student.
2. The disclosure is directly related to the purpose the information was collected, and the school does not have any reason to believe the student (or their parent or carer) would object.
3. The student or the parent or carer was likely to be aware that the school usually makes the kind of disclosure (for example, the department’s privacy collection notice states that personal information collected from students is regularly disclosed to their parents or carers).²
4. The disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of a person.
5. An exception applies (refer to paragraph 2.3).

2.2 - Sensitive personal information³ can only be released to a third party to prevent a serious and imminent threat to the life or health of a person or if one of the exceptions below applies.

Exceptions

2.3 - Schools can share a student’s personal information when one or more of the following exceptions apply:

1. Consent: If the student or their parent or carer (depending on the age or capacity and maturity of the student) has voluntarily provided their consent for the specific disclosure of their information to a particular recipient or for a particular purpose.⁴
2. Lawful authority: If there is a legal requirement or authority that permits or requires the school to disclose the student's information. For example, a court order, subpoena, ⁵ search warrant or statutory obligation.⁶
3. Permitted by law: The PPIP Act allows for the disclosure of personal information permitted under an Act or law.⁷ This means schools can disclose a student’s personal information if it is necessary under law, such as sharing information with relevant government agencies, children’s welfare authorities or medical professionals involved in the student's safety and wellbeing.⁸
4. Legal proceedings: Schools may disclose a student’s personal information for the purpose of obtaining legal advice and representation or for use in legal proceedings.⁹
5. Public interest: Where a request is made under the Government Information (Public Access) Act 2009 (NSW) (GIPA Act), schools can comply with requests for information to a student unless there is an overriding public interest against disclosure.¹⁰ When a request for information is made by a parent or guardian, that parent or guardian will need to provide evidence of the relationship to the student (if not already known to the school) and, if the student is aged 12 years or above, provide written authority from the student to access their personal information. ¹¹
6. Best interests: When it is in the best interests of the student, student personal information may be disclosed to a parent, guardian or caregiver of the student.¹² However, this exception does not apply to counsellor records (refer to paragraph 2.3(7)).
7. Counsellor records: Where a parent, guardian or caregiver refers their preschool or primary aged student or student with a significant intellectual disability to the school counsellor for assessment and advice, personal information from the student’s counselling records may be disclosed by the school counsellor to the parent, guardian or caregiver if it is in the best interests of the student. ¹³
8. Safe learning environment: Where it is considered necessary to promote and maintain a safe and disciplined learning environment, a school can disclose a student’s personal information to persons other than the student to whom it relates.¹⁴
9. Child protection: A school may disclose a student’s personal information for the purpose of child protection.¹⁵
10. Complaint handling and investigation: A school may disclose a student’s personal information to ensure the proper exercise of the school’s complaint handling or investigative functions.¹⁶

3. Student’s right to object

3.1 - When a school relies on an exception under the Privacy Code to limit a student’s rights under the PPIP Act, a student can object to this decision concerning their personal information. For example, when a student does not wish to have their personal information disclosed to a parent, guardian or caregiver.

3.2 - When a student objects to the school’s decision to limit the student’s rights under the PPIP Act, the principal is to review the decision with a right of appeal to the network Director, Educational Leadership. The review should be carried out before the personal information is released unless the student’s objection was received after the release of the personal information.¹⁷

3.3 - The student’s right to object only applies when a school is relying on a provision of the Privacy Code to share the student’s personal information. This right to object does not apply when the school relies on other exceptions listed above in 2.3 or if the disclosure is permissible under section 18 of the PPIP Act.