Is it a breach of privacy law in Australia if schools track student device usage at home?

Question

Since I usually only use programming Stack Exchange sites, sorry if I do anything wrong in this post.

My school recently installed software on all student devices (owned by the school) which can track all activity on the device.

I understand the intent if this was limited to only the school's network, but tracking students at home seems a bit invasive. It was also done without without student or parent consent.

Is this a breach of privacy laws?

Answer 1

Commonwealth

Public Schools

The Commonwealth Privacy Act 1988 does not apply to state and territory governments including public education.

Private Schools

The Privacy Act applies if:

1. they have an annual turnover of more than $3 million - this will capture all but the smallest schools. At a low-end fee of $10k per student per year, this means 300 students will cross the threshold.
2. they’re connected to a larger organisation (with an annual turnover of $3 million) - which captures most private education networks such as Catholic Education Australia.
3. they supply a health service and hold health information, although this isn’t their primary activity - which is unlikely to apply.

Consent is required to collect sensitive information or to disclose non-sensitive personal information for purposes other than for which it was collected. There is no age criterion on consent - an individual who can understand the concepts (as you clearly can) can give or withhold their own consent even if they are a child.

Given that they can monitor all activity, this may be sensitive information (e.g. political opinions or associations, religious or philosophical beliefs, trade union membership or associations, sexual orientation or practices) depending on what you use the computer for. If so, then consent is required. However, if the school prescribes the activities that you are allowed to use the computer for such that you are not required to disclose sensitive information; if you do so knowing that it was being collected this would be implied consent.

State Law

new-south-wales

NSW Education is subject to a specific Code of Practice under the Privacy and Personal Information Protection Act.

Consent may or not be required depending on the purpose for the collection of the information. For example, if its primary purpose is to "control and regulate student discipline in government schools" then consent is not required.