18 August 2020

Online Students

The Office of the Victorian Information Commissioner (OVIC) has published a report on the use of digital learning tools in Victorian government primary schools, and how privacy issues are managed when these tools are selected and used. 

The report notes that state schools are required by the Information Privacy Principles (IPPs) in the Privacy and Data Protection Act 2014 (Vic) to maintain the privacy of children when using tools that will collect, hold, manage, use, disclose or transfer personal information about those children. OVIC collected information from the state Department of Education (DET) and four government primary schools to understand how digital learning tools are being used from Prep to Year 6. It found that 

digital learning tools were a feature of students’ everyday classroom life. The spread of COVID-19 has forced many Victorian schools to deliver lessons remotely, and schools have been increasingly reliant on these tools. Schools are obliged to consider privacy when selecting digital learning tools. However, in some cases schools are selecting and using digital learning tools without properly considering privacy risks. 
 
OVIC has called on DET to provide more support to schools to help them protect student privacy. It concludes that schools would benefit from more assistance to ensure they comply with their privacy obligations. 

 This could involve providing more technical support and improving communication with parents and carers on the use of digital learning tools. Addressing privacy risks associated with digital learning tools and improving communication with parents and carers will increase levels of trust in the community. Improving public trust will enhance the effectiveness of digital learning tools by helping parents and carers feel more confident in using these tools.

The report indicates

1. Primary schools choose which apps and web-based learning tools to use in their schools 

Apps and web-based tools are used widely in Victorian government primary schools. They are generally used for four main purposes: Teaching and learning; Communicating with parents and carers; Assisting teachers to plan and share resources; and Assessing students against school curriculum. DET is responsible for managing Victorian government schools. DET purchases licences for some tools in bulk and offers them to schools. However, in addition to this, schools are free to choose other tools that suit the needs of the children at their school. Decisions about which apps and tools will be used by each year level is usually decided and approved within a school prior to the start of the school year. Examples of the tools used by primary schools in Victoria are listed in the examination report. 

2. Schools have difficulty assessing the privacy risks for all the digital learning tools they use 

Making sure children’s personal information is protected is a complex challenge that needs to be addressed. This is especially important as Victorian schools are currently relying on online teaching and digital learning tools during the Covid-19 pandemic. OVIC’s examination revealed that schools are dealing with competing demands, which make it difficult for them to complete a Privacy Impact Assessment (PIA) for every app or tool they consider using. A PIA document is a thorough assessment of the privacy risks posed by a project. DET told OVIC that it sees its role in ensuring schools handle personal information appropriately as key. In the past 12 months DET has revised its PIA template to better assist schools to carry out this risk assessment process and put more resources into privacy support for schools. For guidance on the use of digital learning tools in Victorian government schools, see DET’s Being online at home – tips for parents and carers. 

3. Managing privacy risks is a shared responsibility 

There are several parties involved in the protection of primary school aged children’s information privacy including DET; schools; and parents and carers. DET assesses the privacy risks of the apps they provide to schools. DET also provides guidance and training to schools about privacy. Schools are responsible for assessing the privacy risk of apps considered for use that are not on DET’s list of provided apps and tools. Schools are also responsible for sending parents and carers information notices and opt out forms where these are required. Parents and carers are responsible for considering the information provided to them by schools and deciding whether to opt out of services where this is an option. Parents and carers also have an important role in educating their children about privacy and protecting themselves online.