In Victoria the
Privacy and Data Protection Act 2014 (Vic) (PDP Act) and the
Health Records Act 2001 (Vic) establish a regime for the responsible collection and handling of personal and health information in the Victorian public sector. As a Victorian public sector organisation, the Victorian Curriculum and Assessment Authority (VCAA) is required to comply with these two Acts.
2. VCAA Functions
The VCAA is a statutory authority continued under the
Education and Training Reform Act 2006 (Vic). The VCAA has responsibilities relating to curriculum and assessment across year levels Foundation to Year 12 for all Victorian students.
The VCAA’s functions include:
- development and evaluation of the curriculum and assessment for the Victorian Certificate of Education (VCE), the Victorian Certificate of Applied Learning (VCAL) and of the Victorian Curriculum F-10
- delivery and conduct of VCE and VCAL assessments
- conduct and report on the National Assessment Program - Literacy and Numeracy (NAPLAN) for years 3, 5, 7 and 9 students as the Victorian test administration authority;
- development of policies, criteria and standards for learning, development and assessments, which relate to early childhood; monitoring patterns of participation by school students and the quality of student outcomes; and
- preparing and maintaining records of student assessment.
3. Secure retention of personal information in the VCAA
3.1 All ‘personal information’ and ‘sensitive information’ (as defined in the PDP Act) held by the VCAA is kept securely for a period nominated in the VCAA disposal schedule approved by the Keeper of Public Records pursuant to the
Public Records Act 1973 (Vic), after which the information may be destroyed or retained as a permanent State Record. A general retention and disposal authority covering all Victorian public sector organisations can be accessed here: PROS 07/01 General Disposal Authority for Records of Common Administrative Functions
A retention and disposal authority specific to the VCAA can accessed here:
Curriculum & Assessment Functions Records RDA
3.2 All student personal information related to student assessment is stored indefinitely on a password-protected database and access is restricted to authorised VCAA employees and some authorised school employees. Authorised restricted access is also provided to employees of the Victorian Registration and Qualifications Authority (VRQA) for the performance of its statutory functions.
4. Offsite and geographically remote software and data storage
In some circumstances the VCAA may collect, transfer and store personal information in an electronic format using applications and services owned and operated by third party service providers. Some personal information may be collected in ‘social media’ applications owned and operated by third party service providers. In these and other formats, the VCAA ensures that any such collection, transfer and storage of data is undertaken consistent with the PDP Act, and in particular with its provisions relating to outsourcing and transfer of information outside Victoria.
5. Access and Correction
Individuals have the right to seek access to their personal and health information held by the VCAA and to have that information corrected if it is inaccurate. Access to documents will be handled mostly under the Victorian
Freedom of Information Act 1982 (Vic).
Requests for access to personal and health information held by the VCAA should be made in writing to:
The Privacy Officer
Victorian Curriculum and Assessment Authority
Level 7, 2 Lonsdale Street
MELBOURNE VIC 3000
6. Personal Information and its use in the VCAA
6.1 Student Information
6.1.1 Enrolment and assessment
Students who enrol for the VCE, VCAL, General Achievement Test (GAT) and International Baccalaureate (IB) in Victorian schools complete Student Personal Details forms which are used by schools to input or verify information on the VCAA’s student assessment database known as the Victorian Assessment Software System (VASS). Students who sit for the NAPLAN examination also have their personal details recorded. Access to this information is restricted to authorised school employees and authorised VCAA employees engaged in the management of the students’ enrolments and assessments. At various times the authorised employees in schools and in the VCAA may access the students’ information to manage the enrolment records and to accumulate required assessment records. Schools may also extract student personal information from VASS and process this to provide advice to teachers and school administration on educational outcomes and the efficacy of teaching approaches. Personal information so extracted, and its management, becomes the responsibility of the school and the privacy regime applying in that case is the legislation appropriate to the individual school. In the case of Victoria government schools this is the PDP Act. In the case of non-government schools this may be the Commonwealth
Privacy Act 1988, if that Act applies.
The VCAA uses the assessment data to generate final results for students. These results are reported to students and in the case of senior secondary programs are the basis for certification for VCE and VCAL.
Student personal information for VCE, VCAL, GAT and IB students and final VCE, VCAL and GAT results are disclosed to the Victorian Tertiary Admissions Centre (VTAC) for calculation of Australian Tertiary Admissions Rankings (ATARs) and processing of applications for tertiary selection. The VTAC also includes the information provided by the VCAA into its CourseLink database - a password protected, interactive, web-based program enabling VCE and VCAL students to access their own individually tailored career and course options.
VCE, VCAL, GAT and IB students completing Student Personal Details forms for their enrolment also may, depending on the nature of their enrolment, provide personal and sensitive information related to their Overseas Student Status, any hearing impairment they may have, their status as Aboriginal and Torres Strait Islanders, and whether they speak English as a Second Language. The ‘VCAA Collection Notice for Students’, provided at the point of collection notes the purposes for which this information is collected.
The VCAA provides personal information to the Victorian Department of Education and Training (DET), and the Catholic Education Office Victoria (CEOV) about students in their sectors, for use in de-identified format for forward planning related to education provision. A small number of authorised users in those organisations have access to this information in identified format. All other users in those organisations have access only to de-identified personal information. In other cases where data is provided externally to any other organisations, for example for research purposes, it is in de-identified or aggregated form, or by another means which is in accordance with the PDP Act. Should the VCAA transfer personal information outside the State of Victoria, the VCAA will comply with Information Privacy Principle 9 of the PDP Act.
6.1.2 Enrolment amendments
Where a student makes a late amendment or any other change to their enrolment they will complete a form which contains some personal details. This information is used to make amendments to the student’s enrolment records. The information is input directly into VASS.
Where a student seeks exemption from sitting the GAT they also provide personal information to the VCAA. This information is input to VASS.
The VCAA advises schools to either destroy VCAA enrolment forms and enrolment amendment forms after inputting to VASS or to retain them securely as hard copies according to the applicable archiving and disposal schedules
6.1.3 Post-results and ATAR Service
After the release of VCE and VCAL results in December the VCAA and the VTAC jointly conduct the Post-Results and ATAR Service (PRAS). Students may contact this service for advice about their results (but not to request the results). Authorised VCAA and VTAC employees may access the student records of students who contact this service to respond to their queries.
6.1.4 Examination and assessment incidents
Authorised VCAA employees may access VCE students’ personal and sensitive information (as defined in the PDP Act) stored in the VCAA’s password-protected database and use this information in dealing with alleged breaches of VCE and VCAL examination rules, student appeals and teacher error claims in relation to the delivery of the VCE assessment program. Information which is generated from these processes is stored securely electronically and in hard copy.
6.1.5 Special provision
Schools or students who apply for special provision provide personal information and health information which is used by the VCAA to evaluate and decide upon the merits of that application and future applications for the same student. Access to this information is restricted to VCAA employees required to make the decision and professionals engaged by the VCAA to advise it on the application. These applications are kept securely by the VCAA.
6.1.6 Enrolment and assessment related payments
Students may be asked to pay a fee for certain transactions related to their results including issuing a replacement result certificate or a statement of marks and equivalent qualifications or the purchase of recordings of Season of Excellence performances (see below). Personal and financial details collected in these transactions are personal information under the PDP Act. The payment for these services may be made in cash or by e-commerce. E-commerce transactions performed either at the VCAA’s premises or through the VCAA’s website involve the collection of personal information and may involve disclosure of the applicant’s personal information to the VCAA’s bank – currently the National Australia Bank.
The National Australia Bank's Privacy Statement may be viewed at its website (www.national.com.au).
6.1.7 VCE Season of Excellence
In the management of the VCE Season of Excellence (Season), VCAA employees use application forms to collect personal information directly from students who express interest in participating in the Season program. This information may be disclosed to the State Reviewer, Chief Assessor of the relevant VCE studies or panel members involved in the selection of work for Season exhibitions and performances if required. Information is stored electronically and in hard copy and only accessed by authorised VCAA employees. Some information is passed on to the National Gallery of Victoria (for the Top Arts component) and the Melbourne Museum (Top Designs) and DET Communications Division for the purpose of administering and/or publicising the Season.
As part of the presentation and promotion of the Season of Excellence, images of participants may be used in publications such as venue programs, the VCAA website, the VCE Bulletin and the VCAA Annual Report. Permission is sought from Season participants to publish all such images.
All student work and personal information submitted for the Season is kept securely. All student works are returned to the student. For those whose application is not accepted, the information is shredded within four months of their application and any work submitted in support of the application is returned to the student or, with permission disposed of securely.
6.1.8 Examination responses - NAPLAN
The VCAA is the National Assessment Program – Literacy and Numeracy (NAPLAN) Test Administration Authority (TAA) for all Victorian schools and school sectors. In order to fulfil its responsibilities as TAA for Victoria, the VCAA collects the names and a range of other background information on all Year 3, 5, 7 and 9 students who are eligible to participate in the program. This information is used for a range of purposes including pre-printing student names on the test booklets and later in the production of parent and school reports for Victoria.
The VCAA provides Victorian student results data to the Australian Curriculum, Assessment and Reporting Authority (ACARA) so that it can prepare national reports related to the outcomes of the NAPLAN tests.
6.1.9 Early Years Research and Resources
In the management of multidisciplinary practitioner research projects and resource development, the VCAA collects personal information directly from early childhood professionals working in birth to 8 years services and schools, and from children and their families. This personal information may be in the form of names and contact details, work completed by children including images, records, analysis and the opinions of the professionals derived from their work with children. Some of this information may be used in the publication of project reports and development of other resources with the consent of the professionals, children and their families.
Personal information is stored securely and is accessed by VCAA, DET and authorised external researchers commissioned by the VCAA to conduct research.
6.1.10 the Victorian Curriculum F-10
For the purposes of supporting the development and implementation of the Victorian Curriculum F-10 – and providing, timely, appropriate and accurate advice and support to teachers and schools, the VCAA collects and where appropriate publishes annotated student work samples. All student work samples are collected with consent from students’ parents/guardians, and completed permission forms are kept with the student’s work sample. All published student work samples are annotated and de-identified prior to publication.
The VCAA created and maintains the F-10 Curriculum Update mailing list for teachers. Only administrators can access the password protected list. The mailing list is available only to authorised employees. Once a year, members of the list are asked to confirm their wish to continue receiving updates (that is, to opt in to the list again).
6.1.11 Awards and recognition of high achievement
Depending on the nature of their enrolment, students may be asked to consent to the release of some of their personal information:
- to the media, if they have a VCE study score of 40 or higher;
- to relevant government departments for the selection of students for the Premier’s VCE Awards and the Australian Students’ Prize;
- to the DET for its On Track Project;
Students may also be asked to consent to the use of materials, produced by them for assessment in their course, in publications or productions approved by the VCAA. Students have the option to withhold their consent to the use of this information for those purposes.
6.1.12 VCAA Plain English Speaking Award
The VCAA receives applications every year from students wishing to enter the Plain English Speaking Award. The applications, which contain personal information, are used to manage the students’ participation in the competition. The applications are then disposed of securely.
6.1.13 Margaret Schofield Scholarships
Every year the VCAA seeks applications containing personal information from government school students of VCE Music Performance and/or VCE Music Investigation, for the Margaret Schofield Scholarships. Access to this personal information is restricted to authorised VCAA employees and a panel which selects the successful applicants. The applications are securely disposed of at the completion of this process.
6.1.14 VCAA VCAL Achievement Awards
The VCAA invites nominations every year from students, teachers and VCAL partners for a number of VCAL Achievement Awards. The applications seek personal information about both students and teachers involved in VCAL programs, individuals in partner organisations, and testimonials about the programs. They are often initiated by a third person, and the nominee confirms they wish the nomination to proceed. Further personal information may be collected from individuals. On completion of the awards process the applications are disposed of securely.
6.1.15 Occasional surveys
The VCAA from time to time may use surveys to collect personal information directly from individuals for the purpose of assisting in curriculum or program reviews. In order to conduct its duties in research and evaluation, the VCAA uses statistical data and personal information from VASS. Most often this is aggregated and de-identified. The data is stored and disposed of securely.
6.2 Education sector contacts
6.2.1 VASS administration
The VCAA collects personal information including the name, school name and contact details of school and non-school VASS administrators who manage the VASS database and the inputting of information at the school level. Similar information is collected from VASS administrators to facilitate their access to a VASS Forum and for VASS related professional development classes.
6.2.2 VCE Study Review Panels and similar reference groups
The VCAA collects personal information directly from individuals who have expressed an interest in participating in the development of study designs or learning programs. The information is only used to facilitate these purposes. Some of this personal information may be published in the VCAA Bulletin, on the VCAA website and in the Annual Report of the VCAA. Otherwise, access to the data, in electronic format and hard copies, is restricted to authorised VCAA employees and the VCAA Board and its committees. It is securely archived.
6.2.3 VCE VET referral service
The VCE Vocational Education and Training (VET) Unit collects information directly from individuals for the purpose of providing a referral service comprising contractors, sessional employees, consultants and teachers involved in developing and teaching VCE VET programs. The information is disclosed to people involved in these networks mainly through publications produced by the Unit. It is stored electronically and deleted when the services of the individual are no longer required or approval is withdrawn.
6.3 VCAA employees
The VCAA collects information about ongoing, fixed-term and casual employees and applicants for employment.
The personal information, sensitive information and health information (as defined in the
Health Records Act) of ongoing and fixed-term employees is generally collected by the VCAA and disclosed and held by DET as the employing body. The VCAA employs casual personnel and retains records relating to them in written form in secure archives. DET maintains all VCAA personnel records on its eduPay system. Information on current and former employees is stored electronically and only authorised employees have access to it. Hard copies are securely stored and archived.
The VCAA collects personal and health information from current and potential employees who set and mark VCE examination papers. The information is used to appoint examination panels and is used by the Panel Chairperson of each study for the purpose of selecting panel members.
Statistical data is collected from the marking record sheets of examination assessors employed by the VCAA so that the Chief Assessor for each VCE study can monitor assessor performance.
Access to both types of information is restricted to authorised VCAA employees
6.4 Personal information collected from other stakeholders
Personal information about members of the public who are not currently students, employees or commercial providers, may be collected by the VCAA in the conduct of its functions for example in answering queries from past students or members of the public about the functions of the VCAA, or when working with teachers or education professionals while researching curriculum and assessment matters.
The VCAA collects information directly from individuals for the purpose of maintaining hard copy records of consultants, agency staff and freelancers. It also collects information from subscribers to the VCE Bulletin and other publications. This data is stored and updated electronically for an indefinite period and may be provided to external mail houses for mailing purposes. All mail houses are required to destroy this data after a fixed period.
The VCAA may seek permission from individuals including students, teachers and parents/guardians to make and/or use photographs and audio/visual recordings, for example at awards events, to promote VCAA programs. Permission is obtained to make and/or use these representations.
7. Complaints Handling Procedures
7.1 Contacting the VCAA
The VCAA will make every attempt to resolve queries or complaints about privacy through direct communication with the person/s concerned. First contact should be made through the VCAA Privacy Officer on 9032 1662 or
If a complaint cannot be resolved to the satisfaction of the complainant through informal discussion, a written complaint should be lodged with the VCAA.
7.2 Lodging a complaint in writing
Written complaints must be lodged with:
The Privacy Officer
Victorian Curriculum and Assessment Authoriy
Level 7, 2 Lonsdale Street
MELBOURNE VIC 3000
Details to be provided in the complaint should include:
- the name and address of the person lodging the complaint;
- the nature of the privacy complaint, and attempts made to resolve the complaint informally;
- if applicable, how the complainant believes the complaint could be remedied.
7.3 Confirmation from VCAA
Within 14 days of receipt of a complaint, the Privacy Officer will:
- confirm the receipt of the complaint in writing,
- inform the complainant that an investigation will be conducted and a response provided as soon as practicable, but as far as possible, no more than 45 days from the day the complaint is received at the VCAA,
- commence an investigation into the complaint.
7.4 Investigation and response
As a result of the investigation of a complaint the Privacy Officer may:
- respond to the complainant that no further action will be taken on the matter; or
- make a formal apology to the complainant; and/or
- take such remedial action as thought appropriate by the VCAA; and/or
- provide undertakings that the conduct will not occur again; and/or
- implement administrative procedures within the VCAA to ensure that the conduct will not occur again.
Where a written complaint is made to the VCAA the Privacy Officer will inform the complainant of his/her right to lodge a complaint with the Office of the Commissioner for Privacy and Data Protection if the complaint is not resolved.
For more information