We’ve heard a lot about consent in the news lately, especially in the context of bodily autonomy, and safe and respectful relationships. There is however, another type of consent that is arguably just as important; and which has historically, often been overlooked by school authorities. We speak of course about consent to collect and use personal information.
Protections for photos and videos
In the current digital landscape, where AI bots are running wild with our information and intellectual property, Australians are growing increasingly concerned about the control of their personal information, and that of their children. It can be disconcerting at best, to see a photograph of yourself (or worse, your child), published without your express knowledge and/or consent. Under the Privacy Act 1988 (Privacy Act) photographic images and videos (from which you can be reasonably identified) are considered your personal information.
Photos and videos of individuals are therefore subject to protection under Australian privacy laws. Independent schools in Australia are required to manage personal information (including photographs) in accordance with the Australian Privacy Principles (APPs). For government schools, state and territory-based privacy schemes, such as the Victorian Information Privacy Principles (IPPs) set out ostensibly the same requirements.
The APPs (and corresponding state/territory-based schemes) set out numerous requirements regarding how personal information may be collected, stored, used and disclosed. This article is focussed on one aspect of these requirements, being consent. Specifically, we discuss the consent that schools must obtain from individuals in order to lawfully publish (i.e. disclose) their image.
Traditional enrolment agreements and consent
Traditionally, school enrolment agreements have taken the form of ‘take it or leave it’ standard-form contracts. There are of course, good reasons for this (consistency between contracts, fairness, reducing administrative burden etc.). However, the inherent power-dynamics of these kinds of agreements can tend to disempower the consumer (in our case, the parent) from asserting their rights or interests in a transaction. This can, in turn, affect schools’ compliance with the APPs. We discuss how below.
There are a couple of key features of standard-form contracts that can cause problems when it comes to privacy protection and compliance:
- The ‘opt-out’ privacy provision: ‘Click here to opt-out of receiving marketing emails’ or ‘tick this box if you do not consent to us sharing your personal information’. Many of us have been caught out by these provisions – I know I have. It’s easy to become confused by a negatively framed consent mechanism. These kinds of ‘opt-out’ clauses often lead to unwitting, and ultimately invalid expressions of consent. As we explain below, consent requires much more than ‘not ticking a box’ (i.e. opting out) in order to be considered valid.
- We often see consent for photographic disclosures framed as a pre-condition for the provision of services. Here’s an example: ‘by completing this application form, you agree to us using your photograph in advertisements and other communications’. This kind of provision offers no opportunity for an individual to opt-out at all – the implication of such provisions is that if a person wants to obtain a good or service, they must agree to the provider’s terms or miss out on the benefits on offer. The problematic nature of such provisions is amplified when they are part of a contract for essential goods or services – education for example. Parents are often captive to the terms and conditions of the school they have chosen for their children, and do not hold the requisite bargaining power to say ‘no’ to pre-conditions that form part of standard-form enrolment agreements.
Why are the traditional methods of consent an issue?
In the ‘old-world’ organisations could more or less get away with a kind of set and forget approach to privacy. In relation to student photos, that might look like (1) the school’s enrolment agreement contains a photographic consent pre-condition (2) the parents agree to this at the point of enrolment – and (3) the school proceeds on the basis of rolling consent for the use of the student’s photographs for the duration of enrolment.
The uncomfortable truth about this approach is that reliance on this alone may not be lawful. As a school, if you do not have valid consent for disclosure, and you publish an individual’s image – you will very likely find yourself in breach of APP 6. In summary, APP 6 sets out that an APP entity (i.e. a school in this case) may only use or disclose personal information for the primary purpose for which it was collected, or if the individual has consented to that use or disclosure. Schools operate to provide education and care, and necessarily collect student information to provide that education and care. It would be a long bow for a school to argue that publishing student photographs on the school’s social media is a primary purpose for the use of student information. Therefore, valid consent it required for that publication to be lawful.
Schools should also consider their duty of care to students when dealing with their personal information. In short, the duty requires schools and teachers to take reasonable steps to reduce the risk of reasonably foreseeable harm occurring. There may be occasions where sharing a student’s image online or in a newsletter could present a risk to their safety – for instance in scenarios where there may be family violence or other complex family dynamics. This is one reason why currency of consent (which we discuss below) is so important. Not only may a school find itself in breach of the APPs due to a social media post – it may be held liable in negligence for failing to protect its students from harm.
This doesn’t mean schools can’t share photos of their students. It is wonderful to share student success and give communities the chance to congratulate and rejoice in our young people’s success; you just need valid consent.
What is considered valid consent with regards to sharing personal information?
Consent requires more than saying ‘yes’ (or not saying ‘no’). The Privacy Act sets out the four elements of consent, without which – consent is not considered valid:
- the individual is adequately informed before giving consent
- the individual gives consent voluntarily
- the consent is current and specific, and
- the individual has the capacity to understand and communicate their consent.
There are a couple of key reasons why, in consideration of these elements of consent, the traditional approach of consent as a pre-condition may no longer be appropriate, or lawful:
- Making consent a pre-condition to enrolling a child at a school may impact on the voluntariness of that consent.
- Some enrolment agreements will persist for up to 13 years (if a child is enrolled at Prep and continues to year 12). How can a school be sure that consent given at a point in time is still current years later?
How do schools ensure consent is valid?
First of all, don’t panic. Many organisations are still catching up to the ‘new world’ of privacy requirements. Taking pro-active steps now can still put you ahead of the curve! Many schools are soon due to update student and parent consents on parent portals. This is a great opportunity to check if your school’s portal consent functions stack up against the requirements of the APPs.
Now is also a great time to review your School’s overall privacy compliance. When was your privacy policy last updated? Do you have in place tailored, compliant collection notices with appropriate consent mechanisms? There are 13 APPs that must be complied with; and we have only discussed one in this article.
How we can help
If you haven’t already, now is a fantastic time to review your enrolment documentation and privacy practices. Given the recent decision of Brindabella, and changes to the Consumer law, many schools have sought our advice to ensure their enrolment contracts are enforceable, and free from unfair terms that could attract the ire of consumer regulators.
We can review, amend, and re-draft your enrolment policies, terms and conditions, and privacy documents to ensure they are not only compliant, but represent best industry-practice and protect your commercial interests. Contact one of our education and privacy specialists today to discuss how we can optimise and future-proof your school’s enrolment practices.
Contact us
Please contact us for more detailed and tailored help.
Subscribe to our email updates and receive our articles directly in your inbox.
Disclaimer: This article provides general information only and is not intended to constitute legal advice. You should seek legal advice regarding the application of the law to you or your organisation.