Australia, June 2 -- New South Wales Land and Environment Court issued text of the following judgement on May 2:

1. The Applicant, referred to in these proceedings as GHX, commenced proceedings on behalf of his child (Child), seeking administrative review of conduct of the Department of Education (the Department/Respondent) under the Privacy and Personal Information Protection Act 1998 (the PPIP Act). The public school attended by the Child published the Child's name and image in the School's Newsletter without parental consent on 2 occasions, in Term 1 Week 6 2023 (the 2023 Newsletter) and Term 2 Week 10 2022 (the 2022 Newsletter).

2. A chronological outline of notifications and interactions between GHX, the School's Principal, and the Department regarding the non-consensual publications is below.

3. On 24 January 2024 GHX lodged a privacy complaint with the Department in relation to the 2023 Newsletter. On 25 January 2024 the Department acknowledged the complaint as:

The department published the name and image of your [Child] in term 1 week 6 edition of the School newsletter. You have alleged that you wrote to the Principal of the School to remove the newsletter from the internet. You have also alleged that the Principal informed you that the newsletter had been taken down from the internet in 2023 but as of 23 January 2024, the newsletter was still accessible online and an image of your [child] was also available online.

4. GHX responded to the Department on 31 January 2024, identifying that a further identifiable image of his child was published in the School's 2022 Newsletter. On 5 February 2024 the Department confirmed the 2022 Newsletter would be considered as part of the Privacy Internal Review being conducted.

5. On 28 March 2024 the Department finalised the Privacy Internal review, relying on a Report produced by a departmental legal officer, determining that the School had breached ss 17 and 18 of the PPIP Act (also known as IPPs 10 and 11 respectively). Specifically, the Department determined that (emphasis added):

In relation to the First Newsletter, although the inclusion of the personal information collected ... may be classified as a directly related secondary purpose, the department specifically requires consent to be obtained from parents and carers in order to publish information about students in publicly accessible communications. In this instance the school had a permission to publish form relating to [the Child] from the Applicant advising that permission was not given for [the Child's] information to be included in publicly accessible communications. I therefore find that there was a breach of IPP 10.

In relation to the Second Newsletter, although the department did not collect the personal information at the point the school retained the information for the purpose of inclusion in the school newsletter it became personal information collected and held by the department. Given there was a permission to publish form relating to [the Child] advising that permission was not given for [the Child's] [information] to be included in publicly accessible communications I therefore find that there was a breach of IPP 10.

Publication is a form of disclosure...The department disclosed [the Child's] personal information when it published [the Child's] name, image and honorary title in the First Newsletter and when [the Child's] photo was published in the Second Newsletter. As the department expressly were not granted permission to publish personal information of [the Child] publicly, I find there was a breach of IPP 11.

6. The Department determined that breaches of s 15 of the PPIP Act (IPP 8) could not be confirmed in relation to data which was no longer held by the Department following deletion, and that the IPPs did not apply to the cached versions of the 2022 Newsletter and 2023 Newsletter held by Google.

7. The Department agreed with the Report recommendations to:

* By way of refresher training, the School Principal is to complete the following online privacy training within 3 months;

a. the privacy module within the course called School Leaders & The Law - Extension 1 (available online in MyPL).

b. The Data Breach Response Plan - Managing Data Breaches. (available online in MyPL).

* The Director Educational Leadership is to ensure that all departmental staff from the School:

1. familiarise themselves with the department's intranet pages "Permission to publish" and "Privacy" which provides privacy information for staff in particular information about obligations when publishing identifying information.

2. familiarise themselves with the following:

- Consent - IPC Fact Sheet

- Tips for Reducing Data Breaches when Sending Emails - IPC Fact Sheet

*Rest of the document can be viewed at: (https://www.caselaw.nsw.gov.au/decision/196854c37177e93d11b8d05e)

Disclaimer: Curated by HT Syndication.