Privacy and confidentiality policy.

This policy is guided by the paramount consideration that children’s safety, rights and best interests are upheld above all other considerations in all decisions, actions and practices

Introduction

Our education and care service recognises and respects the importance of privacy and confidentiality as an individual right and a basis for building partnerships. Our service requires personal information from families to provide appropriate and responsive care. This policy has been developed to comply with the Australian Privacy Principles (APPs) (2014) and pursues the highest standard in the protection and preservation of privacy
and confidentiality.

Goals

We will:

• Maintain private and confidential files for educators and staff, children and their families. We will develop systems for the appropriate use, storage and disposal of records.

• Ensure the information in these files is used only for the education and care of the child enrolled in the service, and only shared with relevant or authorised people as defined within authorisations of the Education and Care Services National Regulations.

Strategies

Our education and care service aims to meet these goals through the adoption of this specific Privacy and Confidentiality policy and our Privacy Collection statement which will guide our practices in this area.

The Approved Provider will:

Collection of Information

• Ensure that each family, staff, volunteers and students is provided with a Privacy Collection Statement upon enrolment, that includes details about how they can access their personal information, have this corrected as needed, make a complaint about a breach of privacy, if one occurs.

• Ensure each staff member, volunteers and student information is correct in personnel and other files. This includes information on qualifications, working with children checks or equivalent, criminal history checks, staff entitlements, contact and emergency information, health and immunisation information, and any relevant medical and legal information. This would include any other relevant information collected by the service.

• Ensure that information collected from families, educators, and the community is maintained in a private and confidential manner at all times.

• Ensure that such information is not divulged or communicated (directly or indirectly) to another person other than the ways outlined as appropriate in the Education and Care Services National Regulations R181, which says information can be communicated:

  • To the extent necessary for the education, care or medical treatment of the child

  • To the parent of the child to whom the information relates (except for information in staff records)

  • To the regulatory authority or an authorised officer

  • As authorised, permitted or required to be given by or under any act or law, and

  • With written consent of the person who provided the information.

  Ensure families are informed upon enrolment how images/photographs and videos of their children will be used, stored, and disposed of after a period of time.

  Ensure that all digital content, such as photos and videos, is stored securely and access is limited to authorised personnel only.

  Ensure written permission is obtained before taking images, photographs or video of children.

  Children's images will only be shared on approved platforms (i.e. OWNA App) where written authorisation has been obtained, and appropriate privacy safeguards are in place.

  Provide families with information on the Procedure for Dealing with Concerns and Complaints policy if any privacy or confidentiality procedure has been breached. Individuals can make a complaint to the Approved Provider if they believe there has been a breach of their privacy under the Australian Privacy Principles. The breach will be assessed by the Approved Provider within 14 days. If the information collected is incorrect, it will be corrected. Where a serious breach of privacy is found, appropriate actions will be negotiated between the Approved Provider and the individual to resolve the situation, in line with the Complaints Handling policy.

  Ensure information provided by families, staff and committee members is only used for the purpose it was collected for.

  Notifiable Data Breaches (NDB)

  The Notifiable Data Breaches (NDB) scheme requires all businesses regulated by the Privacy Act (including education and care services) to provide notice to the Office of the Australian Information Commissioner and affected individuals of any data breaches (i.e. data leaks) that are “likely” to result in “serious harm.”

  An eligible data breach arises when the following three criteria are satisfied:

  • There is unauthorised access to or unauthorised disclosure of personal information, or loss of personal information, that an entity holds

  • This is likely to result in serious harm to one or more individuals, and

  • The entity has not been able to prevent the likely risk of serious harm with remedial action.

  Should there be a NDB at our service, the approved provider will undertake a reasonable and expeditious assessment to determine if the data breach is likely to result in serious harm to any individual affected.

  A failure to notify that is found to constitute a serious interference with privacy under the Privacy Act may result in a fine of up to $360,000 for individuals or $1.8 million for organisations.

  Individuals at likely risk of serious harm will be notified promptly.

  Ensure information relating to child safety concerns, wellbeing concerns, risk of harm, or mandatory reporting is shared in accordance with relevant legislation and child protection requirements while maintaining the privacy and dignity of children and families.

  The Approved Provider and/or Nominated Supervisor will access The Australian Government – Office of the Australian Information Commissioner website for:

  • The Notifiable Data Breach Form to support their investigation and notification:
    www.oaic.gov.au/__data/assets/pdf_file/0008/2240/oaic-ndb-form-for-training-purposes-only.pdf

  • The Notifiable Data Breaches Scheme for more information:
    www.oaic.gov.au/privacy-law/privacy-act/notifiable-data-breaches-scheme

  The Nominated Supervisor will:

  Ensure each family’s information is correct in enrolment records. This includes information on immunisation updates, income and financial details (credit card or bank information), contact details of family and emergency contact information, children’s developmental records, Family Assistance information, and any medical or legal information – such as family court documentation – required by our education and care service. This would include any information required to be recorded under the Education and Care National Law and Regulations, the Family Assistance Law other relevant information collected to support the enrolment of a child.

  Provide families with details on the collection of personal information collected via the Privacy Collection Statement. This information will include:

  • The types of information collected by our education and care service.

  • The purpose of collecting information.

  • What types of information will be disclosed to the public or other agencies; and when and why disclosure may occur.

  • How information is stored at the service.

  • Approaches used to keep information secure.

  • Who has access to the information.

  • The right of the individual to view their personal information.

  • The length of time information needs to be archived; and

  • How information is disposed.

  Will ensure information provided by families and staff is only used for the purpose it was collected for.

  Storage of Information

  Ensure that education and care service records, personnel records, CCS information, data gathered for other funding requirements (i.e. Start Strong) and children’s and families' information is stored securely, reducing the chance of unauthorised access, use or disclosure and remain private and confidential within the education and care environment at all times.

  All hard copy records containing personal, confidential or sensitive information will be stored securely in locked filing cabinets, locked offices or other secure storage areas when not in use. Access will be restricted to authorised personnel only.

  Electronic records will be password protected, stored on secure systems and only accessible to authorised personnel in accordance with the service's cybersecurity and privacy procedures.

  Access to Information

  Will ensure that information kept is not divulged or communicated, directly or indirectly, to anyone other than:

  • Medical and developmental information that is required to adequately provide education and care for the child.

  • The Department of Education, or an authorised officer; or

  • As permitted or required by any Act or Law.

  Individuals will be allowed access to their personal information as requested. Individuals must request this information in writing from the Approved Provider or Nominated Supervisor. Authorised persons may request to view any information kept on their child.

  Information may be denied under the following conditions:

  • Access to information could compromise the privacy of another individual.

  • The request for information is frivolous or vexatious; and

  • The information relates to legal issues, or there are legal reasons not to divulge the information such as in cases of custody and legal guardianship.

  Digital Images & Child Safety:

  Images, videos, and digital records of children will only be captured, stored, accessed, and shared in accordance with service authorisations, child-safe practices, and the service's Safe and Responsible Use of Digital Technology and Devices and Providing a Child Safe Environment policies.

  Information Exchange Provisions:

  In NSW there are Information Exchange provisions:

  The Children Legislation Amendment Act 2009 increased the information-sharing provisions of the Children and Young Persons (Care & Protection) Act 1998. These provisions authorise agencies and non-government organisations, to exchange/share information that relates to a child or young person’s safety, welfare or well-being. We must comply with a request for information (provided it relates to the safety, welfare, or well-being of a child or young person) if they believe that providing the information may assist the recipient agency, and vice versa.

  This legislation overrides other laws that prohibit or restrict the disclosure of personal information i.e. Privacy and Information Act 1998. Should information need to be exchanged, our service will seek and gain consent from the parent/carer that information about them/their child may be provided, or is being provided to other ‘prescribed bodies’.

  Circumstances in which our service would not seek to inform the parent/carer about exchanging information would include:

  • If it was likely to further jeopardise a child or young person’s safety, welfare or wellbeing

  • If it would place our employees at risk of harm

  • If our service were unable to contact a parent, and the matter was urgent.

  Educators will:

  • Maintain children’s information and store documentation according to policy at all times.

  • Maintain confidentiality when discussing children, families and educators ensuring conversations occur in appropriate settings and cannot be overheard by unauthorised persons.

  • Ensure authorisation is sought before taking images or videos of children

  • Follow the safe and responsible use of digital technologies and devices policy and procedure

  • Not share information about the education and care service, management information, other educators or children and families, without written permission or legislative authority.

  In keeping with the Early Childhood Australia (ECA) Code of Ethics (2016), the Education and Care Services National Regulations and the Australian Privacy Principles, educators and staff employed by our education and care service are bound to respect the privacy rights of children enrolled and their families; educators and staff and their families and any other persons associated with the service. Educators will sign a Confidentiality Statement as it relates to the privacy and confidentiality of information.

  Privacy Online

  Introduction:

  Websites, social media sites, the Centre’s App developed by OWNA Corp Pty Ltd and families can provide information to potential clients on what an organisation offers. A Website maintained by the education and care service can support families to make informed decisions about education and care and find out more about if a particular education and care service will suit their requirements. Families are also able to gain contact information or request further information through emails. Social media and the Centre’s App may be utilised to support enrolled families to communicate and share information.

  Goals:

  Our Centres App (developed by OWNA Corp Pty Ltd) is maintained to inform families about the activities and the services provided by the organisation. Our centre respects the privacy of educators, children, and families. Our centre seeks to keep all records private and confidential and maintains records according to the National Privacy Principles and the Education and Care Services National Regulations 2011. Through our Social Media and OWNA App policy, guidelines are set for educators in regard to social media participation connected with their work as early childhood educators.

  Strategies:

  The Nominated Supervisor will:

  • Ensure that no confidential information can be gained from our centres’ website. Individuals and services are not obliged to give personal information through the website. However, if an individual chooses to provide information to the service via email, that information will remain confidential.

  • Ensure that information gained via email can only be used by administration staff or management to contact a person, offer, or send information about the service and to request feedback on the website or our centre.

  • Ensure that information gained about users from the website will only be used for statistical research for the education and care service to ascertain future development of the website. This information will not be available to any other organisations:

  • IP address, the date and time of the visit

  • pages accessed and documents downloaded on this site

  • search terms used

  • previous site visited

  • network providers name

  • any cookies that the browser has presented to the server

  • the browser, operating system and various plugins that were used in visiting the site.

  • Encourage families and educators to give feedback on the website and how it can be improved to meet the needs of the community.

  • Not disclose or publish any information related to educators, children, or families without written consent from that individual or their family.

  • Utilise guidelines in our Social Media and OWNA App policy for educators regarding their participation with families currently connected with the centre on social media sites such as Facebook and Instagram.

  Centre App

  In 2019 we began using the App OWNA developed by OWNA Corp Pty Ltd. The aim of the App is to cut down on the amount of paper used and stored by the centre and to communicate more effectively to families about their child’s day. As a part of our commitment to privacy and ensuring our commitment to child protection only authorised persons will have access to information contained within the App. All authorised persons will have a Working with Children Check.

  Information from the App and personal records are kept in accordance with our retention of records policy on OWNA’s Server and our company server stored at our head office. The App is available to download via the App store – only families currently enrolled in the centre will be able to access this App. A link will be sent to the families to download. Families permission will be sought to publish their child’s image through the App. These photos will be used to demonstrate the children’s learning. Families who do not which their child’s image to be available to other families will still be included within the App. That child’s photos will still be included in the App however will not be a part of group images of other children and the images will only be visible to that child’s family – a lock feature can be used to ensure this happens.

  Families will have access to the App while enrolled at the centre. Upon leaving the centre the family will be able to access the App for four (4) weeks from the time leaving notice is received by the Centre Director before the child’s account becomes inactive, as per the permission letter.

  Families will be able to post to the App via their login – this will go to draft mode and educators will push through their post on the next business day.

  Evaluation

  All information pertaining to the education and care service, educators and families is maintained in a private and confidential manner in accordance with the Privacy Act 1988 and the Education and Care Services National Regulations.

  This policy will be monitored to ensure compliance with legislative requirements, and unless deemed necessary through the identification of practice gaps, the service will review this Policy every 12 months.

  Families and staff are essential stakeholders in the policy review process and will be given opportunity and encouragement to be actively involved.

  This policy links to the Governance and Management policy.

  Related Legislation

  Education and Care Services National Law

  Education and Care Services National Regulations:
  168(2)(l), 181, 182, 183

  Australian Privacy Principles

  Privacy Act 1988 (Privacy Act)

  Australian Child Protection Legislation https://aifs.gov.au/cfca/publications/australian-child-protection-legislation

  Sources

  ACECQA’s Guide to the National Quality Framework - www.acecqa.gov.au/nqf/about/guide

  Australian Privacy Principles –12-May-Consolidated-APP-Guidelines-Updated-Chapter-3.pdf

  Office of the Australian Information Commissioner – www.oaic.gov.au

  Privacy Act 1988 (Privacy Act) – www.oaic.gov.au/privacy-law/privacy-act

  Early Childhood Australia – www.earlychildhoodaustralia.org.au

  Community Early Learning Australia (CELA)

  Privacy Collection Statement

  This service is committed to maintaining all personal information provided by its children, families, staff, management, volunteers, students and community in accordance with our Privacy Policy, Safe and Responsible Use of Digital Technologies and Devices Policy, CCTV Policy and the Australian Privacy Principles. This includes compliance with emerging online safety requirements under the National Quality Framework, ensuring that personal information, whether collected physically, digitally, or through images, audio, or video recordings, is handled in line with applicable privacy, data protection, and child safety laws.

  Each family, staff member, volunteer, and student is provided with a privacy collection statement upon enrolment or commencement of employment.

  This statement outlines the type of personal information collected by this service and how information is acquired, used and shared. We will not sell personal information to any third parties. See our full Privacy and Confidentiality policy for detailed information.

  The service only collects personal information that is reasonably necessary to provide education and care, meet legislative obligations and ensure the safety and wellbeing of children, families and staff.

  What is personal information? How is it collected and why?

  For Families:

  What information is collected?	How we collect information?	Why we collect this?
  Medical information, health and immunisation	Enrolment form Australian Immunisation Record (AIR) Health care cards – Medicare and health fund information Administration of medication forms Accident, Illness and Injury forms	To ensure the health and safety of every child and as a requirement under the Education and Care Services National Law and Regulations as well as state or territory specific legislation.
  Income and financial details include credit card and banking information	Enrolment form Fee payment and purchases	For the provision of the education and care service, and as required under Family Assistance legislation, and as per Funding Agreements with the state/territory Regulatory Authority and the Australian Government Department of Education
  Contact details of family and emergency contact information	Enrolment form Updated details form Authorisation forms	Required under the Education and Care Services National Law and Regulations and to ensure the health and safety of every child.
  Children’s developmental records	Observations Assessment of children’s learning Programming documents Communications with families	Required under the Education and Care Services National Law and Regulations, and to provide a high-quality education and care service.
  Photographs, video or audio recordings, or other digital media	written consent via enrolment forms or specific consent forms	To document learning, share updates with families, and promote the service in line with privacy, child protection, and digital safety requirements. Usage is governed by the service’s Safe and Responsible Use of Digital Technologies and Devices and Privacy Policies, and content is securely stored and accessed only by authorised personnel. Images and recordings will be used only with families' consent and may be withdrawn at any time unless otherwise required by law. Families, visitors and other authorised persons are requested not to photograph, video record or live stream other children, educators or families while attending the service or service events without prior consent of the Approved Provider and the individuals concerned. This helps protect the privacy, dignity and safety of all children.
  Family Assistance information, including child’s name, CRN and D.O.B. (applicable to CCS-funded services).	Enrolment form Complying Written Agreement (CWA) Fee Relief declaration and consent form	Required under the Family Assistance legislation and under employment legislation under Income Tax legislation.
  Legal information	Enrolment form Court orders, AVOs or parenting plans	Required under the Education and Care Services National Law and Regulations.
  Employment, marital status and nationality/cultural background	Enrolment form	Required under employment legislation and to provide priority of access state legislation.
  Any information required to be recorded under the National Law and Regulations, the Family Assistance Law other relevant information collected to support the enrolment of a child.	Enrolment form Authorisation forms Complaints records	Required under appropriate federal or state/territory funding legislation. Required under the Education and Care Services National Law and Regulations when amending, updating or adding service information via the NQA ITS, including: Notification of complaints

  For Educators:

  What information is collected?	How we collect information?	Why we collect this?
  Employment background and restrictions on working with children	Employment record Prohibition notice declaration for prospective staff members	Required under employment legislation, to support the Approved Provider to not engage a person prohibited from working in an education and care service.
  Working with children checks or equivalent, criminal history checks	The identifying number of the current check conducted under that law The expiry date of that check	Required under the Education and Care Services National Law and Regulations and state/territory specific child protection legislation.
  Approved qualifications and/or evidence of ‘actively working towards’ approved qualifications	Staff Record Certified copies of documents from registered training organisations or universities Teacher registration documents Application, consent and designation of Nominated Supervisor, Responsible Person and Educational Leader positions.	Required under the Education and Care Services National Law and Regulations. Required under relevant state/territory teacher registration or accreditation legislation. Required by the Regulatory Authority when amending, updating or adding service information via the NQA ITS, including: Applications for waivers
  Compliance history	Compliance history statement form Employment record	Required to support the appointment of a person in day-to-day charge or as Nominated Supervisor under the Education and Care Services National Law and Regulations. Required by the Regulatory Authority when amending, updating or adding service information via the NQA ITS, including: Notifications of change to Nominated Supervisor Nominated Supervisor consent form
  For family day care educators: Details of other household members	Register of family day care educators, coordinators and assistants	Required under the Education and Care Services National Law and Regulations.
  Staff entitlements	Payroll records Tax File Number	Provision of entitlements.

  For Volunteers/Students:

  What information is collected?	How we collect information?	Why we collect this?
  Contact details of volunteer/student and emergency contact information	Staff record – Volunteer or student Record of visitors to the service	Required under the Education and Care Services National Law and Regulations.
  Working with children checks or equivalent	The identifying number of the student’s or volunteer’s current working with children check the expiry date of that check	Required under the Education and Care Services National Law and Regulations as well as state/territory specific child protection legislation. Volunteers and students are also required to comply with the service's Privacy and Confidentiality Policy when handling any personal information.

  For Board of Management:

  What information is collected?	How we collect information?	Why we collect this?
  Identification Details	Board contact details form	To distribute to staff and board members. Required under the Education and Care Services National Law and Regulations when amending, updating or adding Approved Provider information via the NQA ITS. Notifications include: Assessment of fitness and propriety Amendment for Approved Providers, including updating persons with management and control Transfer or amendment of service approval Other Regulatory Authority requested information Board and management members are expected to maintain confidentiality regarding all personal information accessed through their governance responsibilities.
  Working with children checks or equivalent	The identifying number of the current check conducted under that law The expiry date of that check	Required under the Education and Care Services National Law and Regulations when amending, updating or adding Approved Provider information via the NQA ITS. Notifications include: Assessment of fitness and propriety Amendment for Approved Providers, including updating persons with management and control Transfer or amendment of service approval Other Regulatory Authority requested information

  Personal information is information that personally identifies an individual, such as a name, residential or email address and includes information relevant to the enrolment process, credit card information, billing records, documentation of a child’s learning and development, and recorded information regarding complaints.

  Publicly available information, such as information on a public website profile, is not considered personal information.

  This service only collects personal information when individuals specifically and knowingly elect to provide this, such as when individuals enrol a child in the service, pay fees or subscriptions, and provide health or family information to support the inclusion of a child.

  All fee payments are paid via BPAY directly from the families. No Direct deposit/credit card information is stored or used at our services.

  Direct communications

  This service uses an individual’s personal information to send information by post, email or telephone. Individuals are given the option to decline to receive such information upon enrolment or by written notification to the service.

  What happens with personal information?

  This service will strive to let individuals know how any personal information will be used at the time of collection. Individuals will be asked if personal information can be used to establish contact with them regarding other aspects of organisational business. This service will not sell or trade individuals’ personal information to other third parties.

  This service collects and uses personal information generally to provide individuals with the information and the services they request, to provide appropriate and relevant information pertaining to the education and care of a child/ren, and to continue to improve service quality.

  Where personal information is shared through secure third-party platforms (e.g., child management systems, communication apps), the service ensures these providers comply with Australian Privacy Principles, relevant child safety legislation, and applicable online safety standards. Families are informed of the platforms used, and consent is obtained before information is stored or transmitted through them.

  The service undertakes reasonable steps to ensure third-party providers maintain appropriate privacy, confidentiality and cybersecurity standards before personal information is shared.

  In the event of a suspected privacy or data breach, the Approved Provider or Nominated Supervisor will take immediate action to contain the breach, assess potential risks, notify affected individuals where appropriate, and comply with any applicable reporting requirements under privacy legislation.

  The service recognises that personal information may also be collected through personal devices such as mobile phones, smart watches, tablets and other recording devices. Families, visitors, contractors and other authorised persons are expected to respect the privacy of children, families and educators by not capturing, sharing or publishing images, audio or video recordings of others without appropriate consent.

  The service reserves the right to request that recording cease or that images or recordings be deleted where they have been taken without appropriate consent or may compromise the privacy, dignity or safety of others.

  Where is personal information stored?

  Personal information is stored in a safe and secure manner, information is backed up and electronically securely stored. using locked filing cabinets or a password protected database and computer. Information is backed up electronically and securely stored. Data will not be altered or destroyed except in extraordinary circumstances.

  Hard copy information is stored at the service, which is secured to prevent entry by unauthorised people. Any personal information not actively being used may be archived, in accordance with regulatory requirements.

  Personal information will remain stored in accordance with the NQF record keeping requirements.

  Where authorised service laptops, tablets or portable devices are used to access personal information, these devices will be password protected and managed to minimise the risk of unauthorised access.

  Access and updating personal information

  Individuals may ask to access, update or delete personal information held about them at any time. Reasonable steps will be taken to verify an individual’s identity before granting access, making any corrections to, or deleting information. If a customer wishes to make a complaint, please refer to the Procedure for Dealing with Concerns or Complaints Policy.

  Privacy complaints will be investigated promptly, confidentially and in accordance with the service's Procedure for Dealing with Concerns and Complaints Policy.

  This policy is the property of Eikoh Seminar Australia Pty Limited and must not be reproduced without the consent of management.