Australian Curriculum, Assessment and Reporting Authority

Contact us
Follow @ACARA_CEO

ACARA privacy policy

Version 3.0, last updated: September 2015

Contents

Overview

1. Scope

Our privacy policy sets out how we comply with our obligations under the Privacy Act 1988 (Privacy Act). As an Australian Government agency, we are bound by the Australian Privacy Principles (APPs) in the Privacy Act, which regulate how agencies may collect, use, disclose and store personal information, and how individuals may access and correct personal information held about them.

In our privacy policy, 'personal information' has the same meaning as defined by sub-section 6(1) of the Privacy Act and:

"means information or an opinion about an identified individual, or an individual who is reasonably identifiable:

a. whether the information or opinion is true or not; and
b. whether the information or opinion is recorded in a material form or not”.

In our privacy policy, ‘you’ and ‘your’ means, where relevant, the reader of this policy or the group of people in relation to whom we collect, use and disclose personal information. ‘You’ and ‘your’ never refers to an organisation.

This part of our privacy policy provides you with a high level overview of how we handle your personal information.

2. ACARA’s functions and purposes

The Australian Curriculum, Assessment and Reporting Authority (ACARA) was established under the Australian Curriculum, Assessment and Reporting Authority Act 2008 (Cth) (ACARA Act). Our functions and purposes are described in sections 6 and 40 of the ACARA Act respectively. They are to:

  • develop and administer a national school curriculum
  • develop and administer national assessments
  • collect, manage and analyse student assessment data and other data relating to schools and comparative school performance
  • facilitate information-sharing arrangements between Australian government bodies in relation to collection, management and analysis of school data
  • publish information relating to school education, including information relating to comparative school performance
  • conduct research relating to a national school curriculum
  • assist federal, state and territory governments to formulate policies in relation to education matters; and
  • formulate national reports consisting of aggregated data on school performance.

We publish a number of national reports consisting of aggregated data on school performance including (without limitation) the annual National Assessment Program – Literacy and Numeracy (NAPLAN) national report, the public reports for the NAP sample assessments, the annual National Report on Schooling in Australia (the annual report on school education in Australia) and aggregated school-level performance and contextualised data on the My School website, updated annually. These reports inform federal, state and territory governments’ policy formulation in relation to, for example:

  • identifying better practice at school level (through My School), leading to policy interventions to encourage similar initiatives in other schools
  • identifying improvements in schools with greater levels of autonomy
  • identifying learning areas for improvement and resource allocation (through the NAP sample assessments public reports)
  • improving teacher quality
  • mounting policy interventions such as creating a national partnership for literacy and numeracy; and
  • resourcing schools.

Upon request from federal, state and territory governments, we disclose other detailed data, including student and parent/guardian personal information, which is used to model proposed policy changes and to assist with the formulation of education policies and resourcing. For example, we may disclose parent/guardian background information to federal, state and territory departments of education to improve the understanding of trends and patterns of student achievement for groups of students that are of interest for policy purposes. In practice, we always provide this information under an agreement signed by both parties restricting the ways in which the data can be used and disclosed by the requesting organisation.

3. ACARA’s mission

Our mission is to improve the learning of all young Australians through world-class school curriculum, assessment and reporting.

We collect and hold personal information in relation to the Australian Curriculum (for example, student work samples), the National Assessment Program (for example, licences for third party materials in tests), reporting (e.g. data that informs My School reporting) and policy formulation (for example, parent/guardian personal background information).

Our use and disclosure of personal information assists us to perform our statutory functions and purposes and to fulfil our mission.

4. Layered privacy policy

In drafting this policy, we have adopted the ‘layered’ privacy policy approach (high level overview + further detail). This part provides you with a high level overview of how we handle your personal information. You can access more information regarding how we handle your personal information at:

Our privacy policy (comprising this suite of documents) replaces our previous privacy policy on our websites and has been updated to include amendments to the Privacy Act 1988 (Cth) (Privacy Act) that commenced on 12 March 2014. The date that this policy was last updated is noted at the beginning of this policy.

5. Personal information handling practices

5.1 Collection of personal information

We usually collect personal information directly from you. Student and parent/guardian data is generally collected from state and territory departments of education or state education authorities responsible for NAPLAN testing (Test Administration Authorities). In some instances, ACARA may collect student parental background information from schools.

Personal information may be collected directly by us, or by people or organisations acting on our behalf (e.g. contracted service providers). It may be collected directly from you, or on your behalf from a representative you have authorised (e.g. employment agency).

5.2 Types of personal information collected by us

We collect a range of personal information including:

  • email and portal subscriber lists – Part A – email and portal subscriber lists
  • membership details of ACARA’s working and reference groups, advisory and expert panels and Board members
  • prospective and current employee records, including sensitive information
  • records of consultants, contractors and creditors, including finance records
  • student and teacher personal information collected in relation to Part B – Australian Curriculum teaching resources
  • student and parent data, collected in relation to the reporting of the National Assessment Program – Literacy and Numeracy (NAPLAN) tests – Part C – NAPLAN; and
  • student data, collected in relation to the National Assessment Program (NAP) sample assessments.

5.3 Collection for authorised purposes

Under section 40 of the ACARA Act, we collect personal information for purposes which are necessary for, and directly related to, any of the following three (3) purposes:

  • conducting research relating to the national school curriculum
  • assisting government to formulate policies in relation to education matters; and
  • formulating national reports consisting of aggregated data on school performance.

Information collection purposes

In this policy, we refer to these purposes as ACARA Authorised Purposes.

5.4 Collection of sensitive information

In carrying out our functions under the ACARA Act we collect personal information that is sensitive information. ‘Sensitive information’ means personal information about you that is of a sensitive nature. Relevantly, this includes:

  • information about racial or ethnic origin (collected by ACARA for the purposes of formulating national school reports and assisting government to formulate education policies – see Part C of this policy); and
  • information about membership of a professional or trade association and health information (collected by ACARA as part of our employee records).

Special requirements apply to the collection and handling of sensitive information. We will only collect sensitive information from you if:

  • you provide your consent; or
  • we are required or authorised by or under law (for example, the ACARA Act authorises us to collect ethnic origin or background information from Test Administration Authorities for the purposes including formulating national school reports); or
  • it is necessary to lessen or prevent a serious threat to the health or safety of any individual.

5.5 Remaining anonymous or using a pseudonym

We understand that anonymity is an important element of privacy and you may wish to remain anonymous, or use a pseudonym, when interacting with us.

In many cases you will be able to advise us that you wish to remain anonymous or use a pseudonym during your contact with us. In circumstances where it is likely that we would need to collect your personal information, such as to resolve a dispute or provide you with a service, we will notify you accordingly at the time of collection.

5.6 Collection of personal information by our contractors

In carrying out our functions under the ACARA Act we may use contracted service providers (commercial enterprises) to collect personal information on our behalf. We always require our contracted service providers (including sub-contractors) to comply with the same privacy requirements applicable to us, as part of our contract requirements. Many contractors will also be subject to the Privacy Act in their own capacity.

5.7 Notification

If we collect personal information directly from you, we notify you at, or before, or as soon as practicable after, the time of collection.

We collect personal information from the Test Administration Authorities, school systems or schools about a large number of students from all schools around Australia. Due to the very large number of schools and individuals involved, it is not practicable to notify every individual each time we collect personal information. For further information, refer to Part C of this policy.

5.8 What we do with your personal information

Use

How we use your personal information will depend on the purposes for which it was collected. Some of the ways in which we use your personal information are:

  • to assist us in operating our business (e.g. paying our accounts)
  • to inform interested members of the public about our activities through our subscriber lists; and
  • to perform our functions and purposes under the ACARA Act.

We use a customer relationship management system to assist us to track our communications with stakeholders, including tracking letters, emails, phone calls, and contact information (for example, job title, organisation, email address and phone number).

We do not give personal information about you, or your child, to third parties for direct marketing purposes.

Disclosure

We only disclose student and parent/guardian personal information in limited circumstances. In practice, we always provide this information under an agreement signed by both parties restricting the ways in which the data can be used and disclosed by the requesting organisation. These limited circumstances of disclosure are:

A. To federal, state and territory education departments upon request, if the disclosure is for an Authorised Purpose. Each request is dealt with on a case by case basis to ensure it comes within an Authorised Purpose. For example, if the request is for parent/guardian personal information to ‘improve understanding of trends and patterns of student achievement for groups of students that are of interest for policy purposes’, this would fall within the Authorised Purpose of assisting government to formulate policies on education matters.

B. To researchers upon request, if the disclosure is for an Authorised Purpose. Each request is dealt with on a case by case basis to ensure it comes within an Authorised Purpose. We manage all data requests through our data access request process, details of which are publicly available on our website. Requests for data are considered by the ACARA Data Request Panel, with requests for unpublished or sensitive data passed to the ACARA Research and Data Committee for decision - see ACARA’s guidelines for more information.

C. To the Australian Bureau of Statistics (ABS) where it issues a Notice of Direction to ACARA under the Census and Statistics Act 1905 (Cth).

In addition, we may be required to disclose any personal information held by ACARA if:

  • it is required or authorised by or under an Australian law or a court/tribunal order (for example, a court may order us to disclose personal information if it is relevant and necessary for legal proceedings); or
  • a permitted general situation exists (such as being necessary to lessen or prevent a serious threat to the life, health or safety of any individual, or to public health and safety); or
  • it is reasonably necessary for enforcement related activities conducted by, or on behalf of, an enforcement body (for example, personal information may be disclosed to the Australian Federal Police or other enforcement body).

5.9 Disclosure of personal information overseas

We may disclose personal information overseas where:

  • the publication on the internet of material which may contain personal information, such as our reports and other documents; photographs, video recordings and audio recordings; and posts and comments on our social media platforms
  • the provision of personal information to recipients using a web-based email account where data is stored on an overseas server
  • where ACARA’s contractors are located overseas; and
  • in other limited circumstances permitted under the Australian Privacy Principles (APPs).

We will not disclose your personal information to an overseas recipient unless one of the following applies:

  • the overseas recipient has been required to contractually comply with the APPs (this would apply, for example, to ACARA’s contractors located overseas)
  • the recipient is subject to a law or binding scheme substantially similar to the APPs, including mechanisms for enforcement
  • you consent to disclosure after being expressly informed that we will not be taking reasonable steps to ensure that the overseas recipient does not breach the APPs
  • disclosure is required or authorised by an Australian law or a court/tribunal order
  • a permitted general situation exists in relation to the disclosure of the information (such as being necessary to lessen or prevent a serious threat to the life, health or safety of any individual, or to public health and safety); or
  • disclosure is reasonably necessary for an enforcement related activity conducted by, or on behalf of, an enforcement body and the recipient performs similar functions.

It is not practicable for us to list every country to which we may provide personal information, as this will vary depending on the circumstances. You may contact us to find out: whether we hold your personal information; whether we disclose this personal information overseas; and if so, which countries your personal information has been given to.

5.10 Data security

We take reasonable steps to protect the personal information we hold against loss, unauthorised access, use, modification or disclosure, and against other misuse. These steps include password protection for accessing our electronic IT system and securing paper files in locked cabinets. Access to your personal information held by us is restricted to authorised ACARA staff, on a need to know basis.

If we disclose personal information, we require recipients to sign confidentiality and data security agreements.

We host our own servers for all our document management systems. These servers are located in Australia.

6. Your choices – access and correction

You can access the personal information that we hold about you, and you can ask us to correct the personal information we hold about you.

If you request access to the personal information we hold about you, or request that we change your personal information, we will allow access or make the changes unless we consider that there is a sound reason under the Privacy Act, Freedom of Information Act 1982 (Cth) or other relevant law to withhold the information, or not make the changes.

In relation to the My School website, ACARA is not able to associate individual student names with school level data. That is, while we hold student identifiers as part of the NAPLAN data sets, we are not able to match these identifiers with a particular student (this matching process is only able to be performed by state departments of education or state education authorities). If you believe that any student personal information in relation to NAPLAN data is incorrect, you should contact your child’s school.

If we do not agree to provide access to your personal information or to amend or annotate the information we hold about you, then you may wish to:

• make a statement about your requested changes and we will attach this to your record; or
• lodge a complaint with us: see below.

7. Complaints regarding the handling of your personal information

If you are unhappy about the way we have handled your personal information, you can complain to us or the Privacy Commissioner. The Privacy Commissioner generally prefers that you raise your complaint with us first. Our Privacy Officer will be able to assist you.

If you are dissatisfied with our investigation, you can complain to the Privacy Commissioner who is independent of us. The Privacy Commissioner has the power to investigate complaints about possible breaches of the Privacy Act. Contact details for the Privacy Commissioner can be found on the Office of the Australian Information Commissioner website.

8. How to contact us

You can obtain further information in relation to this privacy policy, or provide any comments, by contacting us:

Telephone: 1300 895 563 (or from outside Australia +61 2 8098 3100)
Post: refer to the address on our website on the ‘Contact us’ page
Facsimile: 1300 995 468
Email:  info@acara.edu.au

Note: These calls can be made for a local call cost from fixed residential landlines anywhere in Australia, but calls from mobile and pay phones may incur higher charges. If you are concerned about fees for mobile phone usage, please check with your service provider.

This policy makes up a part of ACARA’s Information Publication Scheme.

IPS11

 

Part A. Online collection of personal information

1. Overview

This Part A of our privacy policy provides you with information regarding how we collect personal information from our online platforms (including websites). An outline of the other parts of our privacy policy can be found by clicking on the following link: Overview - layered privacy policy.

2. Collection

ACARA’s public websites (no password protection) are hosted by organisations other than ACARA. Our two (2) service providers are:

Both our service providers are contractually required to ensure the privacy of our online users is protected.

There are several methods and packages that we use to collect visitor behaviours on each of our online platforms. We use Google Analytics on our websites. Information and data collected through Google Analytics is stored by Google on servers in the United States of America, Belgium and Finland. For more information, please read Google’s privacy policy. You can opt out of the collection of information via Google Analytics by downloading the Google analytics opt-out browser add-on.

When you visit any of our online platforms, our metric tools may collect the following information about your visit for statistical purposes:

  • server address
  • top level domain name (for example, .com, .gov, .au, .uk, etc.)
  • your internet service provider
  • if you are connecting to our site from a state or territory department of education or a state education authority, the relevant state or territory
  • the date and time of your visit to the site
  • the pages you accessed and documents downloaded during your visit
  • the previous site you visited (if you followed a link on that site which directed you to this one)
  • in limited circumstances, if you've visited our site before (but only if you do so from the same computer and browser and have not cleared your cookies in the mean- time); and
  • the type of browser used and operating system you are using.

We record this data to maintain our server and improve our services. We generally do not use this information to personally identify anyone. However, we may need to identify users in the unlikely event of an investigation by a law enforcement agency.

3. Email and portal subscriber lists

We have a number of subscriber lists including:

  • our e-newsletter (ACARA Update) email list, which stores information relating to subscribers that have an interest in our activities to enable the distribution of this e-newsletter; and
  • our portal subscriber lists, which store information relating to individual or group subscribers that have an interest in providing feedback on the Australian Curriculum, or school principals (or delegates) that check and provide information relevant to their school for publishing on the My School website.

These records are kept indefinitely or until you choose to unsubscribe. If you are listed on our email (ACARA Update) list, you can opt out at any time. You can unsubscribe by using the ‘unsubscribe’ option noted in our emails. You can obtain access to your personal information stored on this subscriber list by Overview – How to contact us.

We do not sell or transfer these lists to third parties for direct marketing or any other purposes.

4. Cookies

Most of our online platforms use sessions and cookies. The core functionality on these platforms will be largely unaffected if you disable cookies in your browser but you may be unable to access some advanced functions, particularly on sites which require you to log in. ACARA uses cookies and other technologies to enhance your online experience. No personal information is stored within ACARA’s websites cookies.

5. Data quality

We will arrange for the deletion or correction of any personal information that we have collected about you as a result of you visiting our online platforms, on your request.

6. Data security

There are inherent risks in transmitting information across the internet and we do not have the ability to control the security of information collected and stored on third party platforms. In relation to our own servers, we take reasonable steps to manage data stored on our servers to ensure data security. In relation to Google Analytics, please read Google’s privacy policy.

 

Part B. Personal information and Australian Curriculum teaching resources

1. Overview

This Part B of our privacy policy provides you with more detail about how we handle your personal information in relation to Australian Curriculum teaching resources. An outline of the other parts of our privacy policy can be found by clicking on the following link: Overview – Layered privacy policy.

2. Australian Curriculum – student work samples

Student work samples are published on the Australian Curriculum website as a resource for teachers to support planning and implementation of the Australian Curriculum. The portfolios of student work samples are designed to illustrate different levels of student achievement of the standards.

In relation to some student work samples published on the public Australian Curriculum website, we do publish personal information identifying the student (including, but not limited to, photographs, sound recordings and film). We obtain consent prior to publishing these work samples from:

• a parent or a legal guardian (where the student is less than 18 years of age); or
• the student (where the student is 18 years of age or older).

3. Australian Curriculum – other teaching resources

The Australian Curriculum website includes links to films hosted on external platforms such as You Tube including (without limitation), illustrations of primary curriculum management and student diversity. These films have been created by ACARA or its contractor and are presented as resources for principals, schools and teachers. They provide advice on relevant matters and illustrate how, for example, the Australian Curriculum enables students with diverse needs to access and participate in learning.

Some of the published films contain personal information. This might include, for example, a film of a group of students interacting with a teacher. Prior to publishing these materials, privacy consent is obtained from the relevant parents/guardians/students.

 

Part C. Personal information handling practices relating to the National Assessment Program – Literacy and Numeracy (NAPLAN)

1. Overview

This Part C of our privacy policy provides you with a high level overview regarding how we collect and hold your personal information relating to the National Assessment Program – Literacy and Numeracy (NAPLAN). An outline of the other parts of our privacy policy can be found in Overview – Layered privacy policy.

2. Scope

This Part C of our privacy policy only covers the personal information and other data collected by ACARA relating to the finalised NAPLAN tests, which are sat by Australian students in years 3, 5, 7 and 9 and reporting the results of these tests (including on the My School website). It does not cover:

  • the trialling tests, which are sat by a sample of students in each state and territory, to determine whether test questions are suitable for the finalised NAPLAN tests; and
  • the equating tests, which are also sat by a sample of students in each state and territory, to enable the results from NAPLAN tests in different years to be reported on the same assessment scale.

Also, this Part C of our privacy policy does not cover the NAP Sample Assessments. These assessments test students’ skills and understanding in specific areas such as Science Literacy, Civics and Citizenship and Information and Communication Technology (ICT) Literacy. Only selected groups of students in relevant year levels participate in these sample assessments, which occur on a cyclical basis.

There are differences in the personal information that we collect for each of these test programs. For example, in relation to the NAPLAN tests, we do not collect student names. This is discussed further below. In relation to our other testing programs:

  • trialling tests – we do not collect student names
  • equating tests – we do collect student names; and
  • NAP Sample Assessments – generally, we do not collect student names. However, for NAP – Science Literacy, we have collected student names.

If you need further information in relation to our collection and holdings of personal information concerning these other testing programs that we administer, please contact our privacy officer, whose contact details are in the Overview – How to contact us.

3. Test administration authorities

In addition to ACARA, the key organisations that hold personal information in relation to NAPLAN testing are each of the state and territory departments of education or state education authorities responsible for NAPLAN testing test administration authorities (TAAs).

4. Personal information handling practices

4.1 What we collect

We collect and hold a range of student personal information as part of the NAPLAN datasets, comprising combinations of the following:

  • TAA identification
  • year level (3,5,7 or 9)
  • school code and school name
  • student identifier (no names)
  • school geographical location classification
  • school sector (government, Catholic, Independent, home school)
  • date of birth
  • sex (male, female)
  • Aboriginal and Torres Strait Islander status
  • language background other than English
  • test participation for each domain (reading, writing, language conventions and numeracy); and
  • question responses, including historic and current NAPLAN performance information.

We also collect and hold parent/guardian personal background information as part of the NAPLAN question responses dataset, comprising:

  • parent/guardian’ school education
  • parent/guardian’ non-school education; and
  • parent/guardian’ occupation group.

NAPLAN personal information handling practices
 

ACARA does not collect or hold student and parent/guardian names in relation to the finalised NAPLAN tests (see above figure). Student and parent/guardian names are held by school systems and schools. TAAs hold student names and, in some instances, may also hold parent/guardian names.

However, it may be possible to identify a person in this dataset from the background data if combined with other information either held by us or another party. This applies, for example, to student identifiers. Accordingly, we treat all NAPLAN-related student and school level data as if it were personal information and manage this data with appropriate care and diligence in accordance with the Privacy Act and the APPs.

We also collect and hold additional student and parent/guardian background personal information in relation to NAPLAN. This information is held in a separate dataset. This dataset does not contain NAPLAN question responses. Instead, this dataset contains some of the information listed above (minus the question responses), and also contains additional student and parent/guardian personal information connected with a student identifier, comprising:

  • student country of birth
  • student main language other than English spoken at home
  • parent/guardian main language other than English spoken at home
  • Australian citizen indicator
  • permanent resident indicator
  • visa sub-class number
  • date of arrival in Australia and
  • student address details (these are historic holdings only, as ACARA has ceased collecting these data).

4.2 Collection of your personal information by schools

In most cases, personal information about students and families are collected from parent/guardians, by your child’s school. Your school will seek your consent to collect your personal information and personal information of your child and disclose it to the TAAs, who provide the information to ACARA. If you wish to understand how your school deals with personal information, you should familiarise yourself with your school’s privacy policy.

4.3 Collection of your personal information by us

Refer to Overview – Personal Information Handling Practices.

4.4 Use – formulating national reports

Each year, we publish, or assist in the creation of, four (4) reports on NAPLAN results (see figure below), being:

  • NAPLAN summary results, published typically in the third quarter of the year of the test
  • student NAPLAN reports, distributed in the third quarter of the year of the test by TAAs
  • NAPLAN national report, published in December of the year of the test; and
  • aggregated school-level NAPLAN performance data, published on the My School website in the first quarter of the year following the tests.

ACARA and TAAs

The preparation of all these reports requires close cooperation between the TAAs and ACARA. ACARA is responsible for publishing the NAPLAN summary results and NAPLAN national report or as searchable results. ACARA also publishes aggregated school-level performance data on My School.

We use personal information to calculate summary data for inclusion in these reports and enable useful comparisons with similar schools on the My School website. For example, we use personal information to calculate:

  • The index of community socio-educational advantage (ICSEA). ICSEA enables meaningful comparisons of NAPLAN test achievement by schools across Australia. This index enables My School users to gain an understanding of the levels of educational advantage or disadvantage that students bring to their academic studies at individual schools; and
  • Student gains over time. To calculate this gain, TAAs provide ACARA with matched data (e.g. student A in year 3 in 2008 and year 5 in 2010). ACARA calculates and reports the gain, aggregated at school level.

TAAs are responsible for generating the student NAPLAN reports for distribution by schools. We assist the TAAs by calculating scaled NAPLAN scores, for inclusion in the student NAPLAN reports. We perform this calculation using a range of information (including personal information) collected from the TAAs.

We are always very careful in how we use personal information to report on NAPLAN results. All NAPLAN school performance data is aggregated before it is published in the NAPLAN national reports and on My School.

4.5 Data security

We hold the data in this section of our privacy policy in de-identified form (no names). For more information generally on data security, see Overview - Data security.