Home >
ÃÛÌÒÊÓÆµ >
Policies >
Privacy Policy
1. Introduction
ÃÛÌÒÊÓÆµ (ÃÛÌÒÊÓÆµ) is a company limited by guarantee established in 2021 by the Archbishop of the Catholic ÃÛÌÒÊÓÆµ of Melbourne to assume the governance and operation of ÃÛÌÒÊÓÆµ schools across the ÃÛÌÒÊÓÆµ of Melbourne. ÃÛÌÒÊÓÆµ subsequently established Melbourne ÃÛÌÒÊÓÆµ Catholic Specialist Schools Ltd (ÃÛÌÒÊÓÆµS) to provide educational services to children with diverse needs and Melbourne ÃÛÌÒÊÓÆµ Catholic Schools Early Years Education (ÃÛÌÒÊÓÆµEYE) to provide early years care and education services.
The Statement of Mission in the ÃÛÌÒÊÓÆµ Constitution, and the constitutions of its subsidiaries, ÃÛÌÒÊÓÆµS and ÃÛÌÒÊÓÆµEYE, sets out the Archbishop’s expectations of Catholic schooling in the ÃÛÌÒÊÓÆµ and provides an important context and grounding for the company and the direction which the ÃÛÌÒÊÓÆµ Board must always observe in the pursuit of the company’s objects.
The Board must ensure that all policies and procedures concerning the operations of ÃÛÌÒÊÓÆµ, and its subsidiaries are consistent with the Statement of Mission and company objects, as well as any directions issued by the Archbishop from time to time.
2. Background
ÃÛÌÒÊÓÆµ schools, school boarding premises operated by ÃÛÌÒÊÓÆµ schools and specialist schools operated by ÃÛÌÒÊÓÆµ subsidiary, Melbourne ÃÛÌÒÊÓÆµ Catholic Specialist Schools (ÃÛÌÒÊÓÆµS) (in this policy, collectively ÃÛÌÒÊÓÆµ) is bound by the Australian Privacy Principles (APP) contained in the Privacy Act 1988 (Cth) (Privacy Act) and if required by contractual obligations, the Privacy and Data Protection Act 2014 (Vic) and the Information Privacy Principles contained within that Act. ÃÛÌÒÊÓÆµ and its schools are also bound by the Health Records Act 2001 (Vic) (Health Records Act).
3. Purpose
This policy sets out how ÃÛÌÒÊÓÆµ manages the personal information and the rights of Parents and Students in relation to personal information held about them, including how to make a complaint and ÃÛÌÒÊÓÆµ deals with complaints.
4. Scope
This policy applies to all personal and sensitive information (including health information) handled by ÃÛÌÒÊÓÆµ.
5. Principles
The following principles apply to the handling of personal information by ÃÛÌÒÊÓÆµ:
- personal information is managed in an open and transparent way
- only personal and / or sensitive information that is reasonably necessary for ÃÛÌÒÊÓÆµ’ functions or activities is collected
- fair and lawful means is used to collect personal information
- consent to collect sensitive information is obtained unless specified exemptions apply
- reasonable steps are taken to protect the personal information ÃÛÌÒÊÓÆµ holds from misuse, interference and loss and from unauthorised access, modification or disclosure
- personal information is only used or disclosed for the primary purpose of collection unless an exception applies
6. Why ÃÛÌÒÊÓÆµ collects personal information
Why and how ÃÛÌÒÊÓÆµ collect personal information
6.1. ÃÛÌÒÊÓÆµ will only collect personal, sensitive (including health) information, if the information is reasonably necessary for one or more of its functions or activities.
6.2. The types of personal information collected depends on the relationship held and engagement with ÃÛÌÒÊÓÆµ. ÃÛÌÒÊÓÆµ collects personal information by lawful and fair means.
ÃÛÌÒÊÓÆµ collect information about:
- students
- parents, guardians, carers (Parents)
- job applicants and employees
- volunteers
- donors and members
- contracted service providers and suppliers
- visits to ÃÛÌÒÊÓÆµ websites
- members of the public who interact with ÃÛÌÒÊÓÆµ
6.3. ÃÛÌÒÊÓÆµ collects personal information in writing, through technology systems or in conversations, visits to ÃÛÌÒÊÓÆµ offices or schools, directly from the individual or from another source where reasonably required such as Parents, contracted service providers or referrers. In some circumstances, ÃÛÌÒÊÓÆµ collects personal information from other sources, for example:
- from another ÃÛÌÒÊÓÆµ school or entity related to ÃÛÌÒÊÓÆµ
- a third party, such as a contracted service provider providing services to ÃÛÌÒÊÓÆµ
- information provided to a third party by an individual for the purpose of sharing it with ÃÛÌÒÊÓÆµ
- information sharing entities authorised by law
- CCTV systems which are used in ÃÛÌÒÊÓÆµ premises to provide safe environments for staff, students and visitors.
6.4. Where individuals do not provide information requested to ÃÛÌÒÊÓÆµ, it may affect their ability to access ÃÛÌÒÊÓÆµ schools, services and systems. For example, a ÃÛÌÒÊÓÆµ school may not be able to enrol or continue the enrolment of the student or permit the student to take part in a particular activity. ÃÛÌÒÊÓÆµ will inform you when this may affect your engagement with ÃÛÌÒÊÓÆµ.
6.5. ÃÛÌÒÊÓÆµ may receive information about you even where it has taken no active steps to collect information. If permitted or required by law, ÃÛÌÒÊÓÆµ may keep records of this information. If not, we will destroy or de-identify the information where practicable, lawful and reasonable to do so.
7. What information is collected?
Types of personal information
7.1. The information ÃÛÌÒÊÓÆµ collects depends on how individuals interact with ÃÛÌÒÊÓÆµ, the purpose of that interaction and the nature of the relationship with ÃÛÌÒÊÓÆµ. ÃÛÌÒÊÓÆµ also uses specific Collection Notices in connection with the type of engagement.
7.1.1. Students and Parents before, during and after the course of a student’s enrolment at a ÃÛÌÒÊÓÆµ school:
- name, contact details (including next of kin), date of birth, gender, language background, previous school, religion
- parents’ education, occupation, language spoken at home, nationality and country of birth
- health information (e.g., details of medical condition, disability and / or allergies, dietary requirements, absence notes, immunisation details, medical reports, names of doctors)
- Victorian Student Number (VSN)
- results of assessment tasks and other classroom activities
- conduct and complaint records or other behaviour notes, and school reports
- information about referrals to government welfare agencies
- counselling reports
- health fund details and Medicare number
- any Family Court orders
- criminal records
- volunteering information
- photos, videos at school activities, events and through closed circuit television (CCTV) if in use at ÃÛÌÒÊÓÆµ premises
7.1.2. Employees, job applicants, volunteers, contractors
- name, contact details (including next of kin), date of birth, religion
- information on job applications
- qualifications, registrations and professional learning history
- salary and payment information, including banking and superannuation details
- health information (e.g., details of disability and / or allergies, medical certificates
- national police check and working with children check
- complaint records and investigation reports
- leave details
- photos and videos at school events
- workplace surveillance information, including CCTV footage
- work email and private email (when using work email address) and internet browsing history.
7.1.3. Suppliers, donors, members and visitors including, but not limited to:
- name, contact details
- work email and private email (when using work email address) and internet browsing history.
8. How does ÃÛÌÒÊÓÆµ treat sensitive information?
Sensitive information
8.1. ÃÛÌÒÊÓÆµ will only collect Sensitive information (including health information) if it is reasonably necessary for its functions or activities, a permitted general or health situation exists, or where ÃÛÌÒÊÓÆµ has consent from the individual or their Parent (in the case of students).
8.2. Sensitive information will only be used and disclosed for the purpose for which it was collected, a directly related secondary purpose in limited circumstances, with your consent, or as required or authorised by law.
9. How we use and disclose information
Use or disclosure
9.1. ÃÛÌÒÊÓÆµ only uses or discloses Personal, including Sensitive information, under the following circumstances:
- for a purpose which you might reasonably expect is related to the primary purpose (except for sensitive or health information)
- where the individual has consented to the use or disclosure
- if ÃÛÌÒÊÓÆµ is permitted or required by law to do so.
9.2. ÃÛÌÒÊÓÆµ may use Personal information in the following ways:
9.2.1. Students and Parents
- admission and enrolment
- providing schooling and school activities
- satisfying the needs of Parents, the needs of Students and the needs of the school during the whole period a Student’s enrolment in the school
- making the required reports to government authorities
- keeping Parents informed about matters related to their child’s schooling, through correspondence, apps, newsletters and magazines
- day to day administration, operations, and quality assurance
- seeking and processing the payment of school fees within the same diocese including when a student transfers between such schools
- looking after Students’ educational, social, spiritual and health wellbeing
- satisfying ÃÛÌÒÊÓÆµ legal obligations
- allowing schools to discharge duty of care and child safety obligations.
9.2.2. Employees
- administering the individual’s employment or contract including:
- corresponding with employees
- professional learning and development processes
- salary and payment information, including superannuation details
- medical details (e.g. details of disability, and / or allergies, medical certificates)
- complaint records and investigations
- administrative matters including for insurance purposes
- looking after Staff occupational, social, spiritual and health wellbeing
- to respond in the event of an emergency
- for evaluation and improvement of the work environment
- satisfying ÃÛÌÒÊÓÆµ’ and the school’s legal obligations, for example, in relation to child protection legislation.
9.2.3. Volunteers
- to contact individuals and to administer the volunteer position
- administrative matters including for insurance purposes
- satisfying ÃÛÌÒÊÓÆµ’ and a school’s legal obligations, for example in relation to child protection legislation
9.2.4. Job applicants, contractors and others
- assessing and if successful, engaging an applicant or contractor
- information provided by a former employer or a referee
- making an offer of employment or engagement
- administering an individual’s contract
- administrative matters including for insurance purposes
- fulfilling a contract obligation
- corresponding with individuals to administer their relationship with ÃÛÌÒÊÓÆµ
- satisfying ÃÛÌÒÊÓÆµ’ and the school’s legal obligations, for example, in relation to child protection legislation.
10. Third parties
10.1. ÃÛÌÒÊÓÆµ may share Personal information (including Sensitive information) with third parties where it is necessary and appropriate for the purposes set out above including but not limited to:
- other schools and teachers at those schools, including a new school to which a student transfers to facilitate the transfer of the student, and schools within the same diocese where concurrent applications for enrolment are made to those schools
- government departments (including for policy and funding purposes)
- the Victorian Catholic Education Authority (VCEA), the archdiocese and parishes, other church related agencies / entities and schools within other dioceses, or other dioceses
- local parishes associated with the school/college
- medical and health practitioners
- people providing educational support and health services to the school, including specialist visiting teachers, health professionals, sports coaches, volunteers and counsellors
- fundraising organisations, venues and event organisers, marketing and communication agencies
- specialist advisory services including in human resources, child protection and students with additional needs) and providers of learning and assessment
- authorised agencies and organisations to whom ÃÛÌÒÊÓÆµ is required to disclose personal information for administrative, educational and research purposes including
- the Australian Curriculum, Assessment and Reporting Authority (ACARA),
- NAPLAN Test Administration Authorities
- Victorian Curriculum and Assessment Authority (VCAA)
- Nationally Consistent Collection of Data (NCCD) for quality assurance processes
- participation in the Australian Early Development Census (AEDC) and government audits
- regulatory, investigative and law enforcement or government bodies such as to enable ÃÛÌÒÊÓÆµ and the school to discharge its responsibilities under child safety legislation, including Commission for Children and Young People (CCYP), Victorian Institute of Teaching (VIT) and Victoria Police.
- where a ‘permitted general situation’ as defined in the Privacy Act exists
- people and organisations providing administrative, technology, professional, and financial services to ÃÛÌÒÊÓÆµ
- other providers of specific information management and storage systems and other information technology services to ÃÛÌÒÊÓÆµ
- recipients of ÃÛÌÒÊÓÆµ specific publications, such as school newsletters and magazines
- financial institutions for payment processing
- referees whose details job applicants provide to ÃÛÌÒÊÓÆµ
- Students’ Parents
- anyone you authorise ÃÛÌÒÊÓÆµ to disclose information to
- anyone to whom ÃÛÌÒÊÓÆµ is required or authorised by law to disclose the information, including child protection laws.
11. Associated legislation and schemes
11.1. ÃÛÌÒÊÓÆµ is an information sharing entity (ISE) in accordance with the Child Wellbeing and Safety (Information Sharing) Amendment Regulations 2020 (Vic.). This legislation broadens the circumstances in which ÃÛÌÒÊÓÆµ may share information to support the wellbeing and safety of children and students.
11.2. ÃÛÌÒÊÓÆµ maintains appropriate confidentiality when it provides information under legislated information sharing schemes, being Child Information Sharing Scheme (CISS) or Family Violence Information Sharing Scheme (FVISS)) or under the Terrorism (Community Protection) Act 2003 (Vic.)
11.3. Under the Notifiable Data Breaches (NDB) scheme, ÃÛÌÒÊÓÆµ must inform the Office of the Australian Information Commissioner and affected individuals of any data breach likely to result in serious harm to individuals whose personal information contained in the breach.
12. How we store personal information
Storage of Personal information
12.1. ÃÛÌÒÊÓÆµ may store Personal information in hard copy or electronically. ÃÛÌÒÊÓÆµ will store Personal information until no longer required, including where the law requires ÃÛÌÒÊÓÆµ to retain Personal information.
Security of Personal information
12.2. ÃÛÌÒÊÓÆµ have reasonable steps in place to ensure the protection of Personal information that it holds from misuse, interference and loss, unauthorised access, modification or disclosure by use of various methods including locked storage of paper records and access controls to electronic data.
12.3. These steps include:
- restricting access to information on ÃÛÌÒÊÓÆµ systems and local databases to a ‘need to know’ basis with access levels allocated to staff based on their roles and responsibilities
- ensuring all Staff are aware that they are not to reveal or share personal passwords
- ensuring storage of hard copy files containing personal and health information in lockable cabinets in lockable rooms. ÃÛÌÒÊÓÆµ restricts access to these files on a need to know basis
- implementing physical security measures around ÃÛÌÒÊÓÆµ premises to prevent break-ins
- implementing ICT security systems, policies and procedures designed to protect information storage on computer networks
- implementing human resource policies and procedures including a code of conduct, and policies for email and internet usage, information and records management designed to ensure that staff follow correct protocols when managing personal information
- undertaking due diligence with respect to third party providers, including cloud service providers, who may have access to personal information to ensure as far as practicable that they are compliant with the APP or a similar privacy regime.
Sending and storing information overseas
12.4. ÃÛÌÒÊÓÆµ may disclose Personal information about an individual to overseas recipients in certain circumstances where it is necessary to perform its functions and activities. For example, to facilitate a school student tour or similar, or in connection with any third-party cloud service provider. ÃÛÌÒÊÓÆµ may provide some limited Personal information to these service providers to enable them to authenticate users that access their services and provide technical support (e.g., services relating to email, instant messaging and education and assessment applications).
12.5. ÃÛÌÒÊÓÆµ may store Personal information in the cloud. This means information may reside on a cloud service provider’s server which may be situated outside Australia. Examples include Google, which provides GAFE including Gmail, and stores and processes limited personal information for that purpose.
12.6. ÃÛÌÒÊÓÆµ makes reasonable efforts to be satisfied about the security of any Personal information collected, processed and stored outside Australia, in connection with any cloud and third-party services. ÃÛÌÒÊÓÆµ will take reasonable steps to ensure cloud service providers are hosted in Australia or otherwise in countries with substantially similar protections as the APP.
12.7. For further information about locations where a school stores personal information using cloud service provides, please contact the principal of the school.
13. Access and correction of personal information
Access to and correction of personal information
13.1. Under the Privacy Act and the Health Records Act, an individual has the right to seek access to and or correction of any Personal information which ÃÛÌÒÊÓÆµ holds about them. There are some exceptions to access and correction rights which are set out in the applicable Act. For general inquiries about access and correction refer to the contact details below.
13.2. To make a request to access, update or correct any Personal information that a ÃÛÌÒÊÓÆµ school holds about you or your child, please contact the principal by email, post or telephone in the first instance. Refer to the school’s website for contact details or refer to the Student Collection Notice.
13.3. Individuals may seek access to Personal information held by ÃÛÌÒÊÓÆµ by contacting the ÃÛÌÒÊÓÆµ Privacy Officer. There may be occasions, however, when the Privacy Officer may refuse this access request. For example, where the release of the information would have an unreasonable effect on the privacy of others; where the release of the information may result in a breach of the school’s duty of care to the student, or in the case of employees, access to the employee record.
13.4. ÃÛÌÒÊÓÆµ may require verification of your identity and for you to specify which information you require. ÃÛÌÒÊÓÆµ may charge a reasonable fee for giving you access to personal information, but there is no charge for making a request or to correct Personal information. If the information sought is extensive, ÃÛÌÒÊÓÆµ will advise the likely cost in advance.
13.5. If ÃÛÌÒÊÓÆµ refuses a request, ÃÛÌÒÊÓÆµ will provide a written notice explaining the reasons for the refusal (unless, given the grounds for refusal, it would be unreasonable to provide reasons) and how to complain.
13.6. Specific Collection Notices also set out how an individual may access or correct their Personal information.
Mature minors
13.7. In certain circumstances, principal of the ÃÛÌÒÊÓÆµ school may assess a student as a “Mature Minor” in relation to their capacity to make decisions about consent, access or correction.
13.8. When requested by a student, the principal may, at their discretion, grant a student access to information held by the school about them or allow a student to give or withhold consent to the use of their personal information, independently of their Parents. This would normally only occur when the maturity of the student and /or the student’s personal circumstances warrant it. For further information regarding mature minor assessment, please consult ÃÛÌÒÊÓÆµ Legal.
14. Inquiries and complaints
14.1. For further information about how ÃÛÌÒÊÓÆµ manages the personal information it holds or if you wish to complain that you believe a breach of privacy has occurred, please contact the principal by email, post or telephone or the ÃÛÌÒÊÓÆµ Privacy Officer at:
ÃÛÌÒÊÓÆµ Privacy Officer
ÃÛÌÒÊÓÆµ
PO Box 3
EAST MELBOURNE 8002
Phone 03 9267 0228
Email: legal@macs.vic.edu.au.
14.2. ÃÛÌÒÊÓÆµ will investigate any complaint and notify the individual of a decision in relation to the complaint as soon as practicable.
14.3. Individual can refer complaints to the Office of the Australian Information Commissioner (OAIC) or if they are not satisfied with ÃÛÌÒÊÓÆµ’ decision in relation to the privacy complaint, or the OAIC can be contacted directly. Contact details are:
Office of the Australian Information Commissioner
GPO Box 5218 SYDNEY NSW 2001 Telephone: 1300 363 992
An online privacy complaint form is available from .
15. Roles and reporting responsibilities
| Role |
Responsibility |
Reporting requirement |
| Principal |
Ensure publication of this policy and related documents |
Annual attestation to the Executive Director |
| General Manager, Legal ÃÛÌÒÊÓÆµ Corporate (ÃÛÌÒÊÓÆµ Privacy Officer) |
Report breaches of Australian Privacy Principles |
Respond to privacy complaints Director, Governance and Legal |
| General Manager, IT |
Report notifiable breaches of Cyber Security Policy |
Executive Director Office of the Australian Information Commissioner |
16. Definitions
Definitions for standard terms used in this Policy can be found in the Glossary of Terms.
Health information
Health information is a subset of sensitive information. It is information or opinion about the health (including illness, disability or injury) of an individual, an individual’s expressed wishes about the future provision of health services to the individual or a health service provided, or to be provided, to an individual. Health information also includes personal information collected during the provision of a health service. Health information is regulated in Victoria under the Health Records Act 2001 (Vic).
Mature minor
A mature minor is an individual in a ÃÛÌÒÊÓÆµ school who is assessed by the principal of that school to be a mature minor in all or some circumstances.
Personal information
Information or an opinion about an identified individual or an individual who is reasonably identifiable. It does not matter whether the information or opinion is true or not. It does not matter whether the information or opinion is recorded or documented, or not.
Sensitive information
Sensitive information is a type of personal information that is given extra protection and must be treated with additional care. It includes information or opinion about an individual’s racial or ethnic origin, political opinions, religious beliefs or affiliations, philosophical beliefs, sexual orientation or practices, criminal record, membership of a political association, professional or trade association, or trade union. It also includes health information and biometric information.
Student
Student means a person who is enrolled at or attends a ÃÛÌÒÊÓÆµ school.
Victorian student number (VSN)
A randomly generated 9-digit number assigned to all Victorian students as a unique identifier. Every student under 25 years of age is given a VSN when they first enrol at a Victorian education or training provider. The VSN allows education and training providers to record and monitor the enrolment of students in Victorian and to track student progress through their school age years and beyond, should they continue into vocational education and training (VET). The register of VSN is managed by the Victorian Curriculum and Assessment Authority (VCAA).
Updated April 2026
Next Review March 2030