In Victoria the
Privacy and Data Protection Act 2014 (Vic) (PDP Act) and the
Health Records Act 2001 (Vic)
(HR Act) establish a regime for the responsible collection and handling of personal and health information in the Victorian public sector. As a Victorian public sector agency, the Victorian Curriculum and Assessment Authority (VCAA) is required to comply with these Acts. The VCAA is also a ‘data sharing body’ within the meaning of the
Victorian Data Sharing Act 2017 (Vic).
All personal and health information collected by the VCAA will be handled in accordance with this policy.
2. VCAA Functions
The VCAA is a statutory authority continued under the
Education and Training Reform Act 2006 (Vic) (ETR Act). The VCAA has responsibilities relating to curriculum and assessment across year levels Foundation to Year 12 for all Victorian students.
The VCAA’s functions are set out in s.2.5.3 of the ETR Act and include:
- the development and evaluation of the curriculum and assessment for the Victorian Certificate of Education (VCE), the Victorian Certificate of Applied Learning (VCAL) and of the Victorian Curriculum F-10;
- the delivery and conduct of VCE assessments;
- to conduct and report on the National Assessment Program - Literacy and Numeracy (NAPLAN) for years 3, 5, 7 and 9 students as the Victorian test administration authority;
- the development of policies, criteria and standards for learning, development and assessments, which relate to early childhood;
- to monitor patterns of participation by school students and the quality of student outcomes;
- the development of tools and instruments (such as the Insight Assessment Platform) to assist educators to provide targeted teaching practices;
- on behalf of the Secretary to the Department of Education and Training (DET), to operate and maintain the Victorian Student Register; and
- to prepare and maintain records of student assessment, and report on student achievement.
3. Collecting personal and health information
Personal information is defined in the PDP Act and means information or an opinion (including information or an opinion forming part of a database) that is recorded in any form and whether true or not about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion, but does not include information of a kind to which the HR Act applies.
Health information is defined in the HR Act and means information or opinion about a person’s physical, mental or psychological health or disability that is also personal information. This includes information or opinion about a person’s health status and medical history.
The VCAA will not collect personal or health information about an individual unless it is necessary to perform one or more of its functions.
When collecting information directly from an individual, or from someone else about an individual, the VCAA will take reasonable steps to advise the individual at the time of collection:
- who is collecting the information;
- what information is being sought;
- why the information is being collected;
- whether any law requires the collection of the information;
- to whom the information may be disclosed;
- the main consequences if the individual does not disclose the information; and
- how the individual can contact the VCAA to gain access to the information collected, and request its correction if inaccurate.
4. Use and disclosure of information
The VCAA will only use or disclose personal or health information for the primary purpose for which the information was collected, or for a related secondary purpose that an individual would reasonably expect. Where information is collected directly from the relevant individual, the primary purpose will be identified at the point of collection.
The VCAA may use and disclose information for secondary purposes (that is, for purposes other than for the primary purpose of collection) in other circumstances set out in Information Privacy Principle 2.1, and Health Privacy Principle 2.2 in the case of health information. For example, personal information can be used for a secondary purpose where the individual has provided their consent, for a law enforcement purpose, or to protect the safety of an individual or the public.
Refer to Appendix A for a non-exhaustive list of what kind of information the VCAA collects, uses and discloses to fulfil its functions.
Where personal or health information is collected by the VCAA, it will only be disclosed to and used by relevant VCAA employees and/or contractors who have been authorised by VCAA Management to access and use such information. VCAA Management will only permit use and disclosure of personal or health information in accordance with the PDP Act and HR Act. Authorised VCAA employees and/or contractors will only access and use the information in accordance with the PDP Act and HR Act, in the performance of the duties of their employment or engagement.
5. Secure retention of personal and health information in the VCAA
The VCAA has security measures designed to protect personal and health information from misuse, loss, unauthorised access, modification or disclosure. The VCAA complies with the Victorian Protective Data Security Framework.
All personal information and health information held by the VCAA is kept securely for a period nominated in the VCAA Retention and Disposal Authority (PROS 08/10) approved by the Keeper of Public Records pursuant to the
Public Records Act 1973 (Vic), after which time the information may be destroyed or retained as a permanent State Record. A general retention and disposal authority covering all Victorian public sector organisations (PROS07/01) can be accessed on the
Public Record Office Victoria website.
All student personal information related to student assessment is stored indefinitely on a password-protected database and access is restricted to authorised VCAA employees and some authorised school employees. Authorised restricted access is also provided to employees of the Victorian Registration and Qualifications Authority (VRQA) for the performance of its statutory functions.
Where the VCAA is made aware of a privacy breach, the VCAA will take appropriate steps to inform the affected individual of the breach and also take action to minimise the risk of similar breaches occurring in the future.
6. Offsite and geographically remote software and data storage
In some circumstances the VCAA may collect, transfer and store personal information in an electronic format using applications and services owned and operated by third party service providers. Some personal information may be collected in ‘social media’ applications owned and operated by third party service providers. In these and other formats, the VCAA ensures that any such collection, transfer and storage of data is consistent with the PDP Act, and in particular with its provisions relating to outsourcing and transfer of information outside Victoria.
7. Data quality
The VCAA takes reasonable steps to ensure that the personal and/or health information it holds is accurate, complete and up-to-date. The VCAA relies heavily on individuals to provide accurate and current information in the first instance, and to notify us when circumstances or details change so that we can update our records accordingly.
8. Unique identifiers
The VCAA assigns a unique identifier for an individual where it is necessary to enable the VCAA to perform its functions efficiently.
The VCAA assigns a Student Number to all Victorian students enrolled in VCE, VET and VCAL. The Student Number is printed on exam papers and is disclosed to and used by the Victorian Tertiary Admissions Centre as a linkage key when calculating a student’s ATAR. The Student Number is also disclosed to the student’s school.
The VCAA adopts a unique identifier of an individual that has been assigned by another organisation in the following circumstances:
- it is necessary to enable the VCAA to perform its functions efficiently; or
- the VCAA has obtained the consent of the individual.
The VCAA adopts the Victorian Student Number (VSN) which is a student identification number assigned by the Secretary to the
DET to all students in government and non-government schools, and to students below the age of 25 undertaking Vocational Education and Training with a TAFE, Registered Training Organisation or Adult and Community Education provider, in accordance with Part 5.3A of the ETR Act. The VCAA operates the Victorian Student Register under a delegation from the Secretary to DET.
In most instances it will be necessary for the VCAA to obtain an individual’s identity in order to fulfil its functions.
However, where practicable and lawful, the VCAA will provide an individual the option of not identifying themselves when dealing with the VCAA.
10. Sensitive information
Sensitive information is defined in the PDP Act and means information or opinion (that is also personal information) about a person’s racial or ethnic origin, political opinions or associations, religion, philosophical beliefs, sexual preferences or practices, professional/trade association or trade union, or an individual’s criminal record.
The VCAA will only collect sensitive information in limited circumstances, and consistently with the PDP Act.
11. Access and Correction
Individuals have the right to seek access to their personal and health information held by the VCAA.
Requests for access to and/or correction of documents containing personal or health information will be handled in accordance with the Victorian
Freedom of Information Act 1982 (Vic) (FOI Act) which provides an individual with the right to request that the VCAA correct or amend their personal information if it is inaccurate, incomplete, out of date, or would give a misleading impression.
Requests for access to and/or correction of personal and health information held by the VCAA should be made in writing to:
The Freedom of Information Officer
Victorian Curriculum and Assessment Authority
Level 7, 2 Lonsdale Street
MELBOURNE VIC 3000
Where such requests are received, the VCAA will first take appropriate steps to verify the identity of the individual who has made the request.
12. Complaints Handling Procedures
12.1 Contacting the VCAA
The VCAA will make every attempt to resolve queries or complaints about privacy through direct communication with the person/s concerned. First contact should be made through the VCAA Privacy Officer on 9032 1662 or
If a complaint cannot be resolved to the satisfaction of the complainant through informal discussion, a written complaint should be lodged with the VCAA.
12.2 Lodging a complaint in writing
Written complaints must be lodged with:
The Privacy Officer
Victorian Curriculum and Assessment Authority
Level 7, 2 Lonsdale Street
MELBOURNE VIC 3000
Or by email:
Details to be provided in the complaint should include:
- the name and address of the person lodging the complaint;
- the nature of the privacy complaint,
- attempts made to resolve the complaint informally; and
- if applicable, how the complainant believes the complaint could be remedied.
12.3 Confirmation from VCAA
Within 14 days of receipt of a complaint, the Privacy Officer will:
- confirm the receipt of the complaint in writing;
- inform the complainant that an investigation will be conducted and a response provided as soon as practicable, but as far as possible, no more than 45 days from the day the complaint is received at the VCAA; and
- commence an investigation into the complaint.
12.4 Investigation and response
Following an investigation into a written complaint, the Privacy Officer may:
- respond to the complainant that no further action will be taken on the matter; or
- make a formal apology to the complainant; and/or
- take such remedial action as thought appropriate by the VCAA; and/or
- provide undertakings that the conduct will not occur again; and/or
- implement administrative procedures within the VCAA to ensure that the conduct will not occur again.
Where a written complaint is made to the VCAA the Privacy Officer will inform the complainant of his/her right to lodge a complaint with the Office of the Victorian Information Commissioner if the complaint is not resolved.
For more information
Contact the VCAA Privacy Officer by email:
Office of the Victorian Information Commissioner
Office of the Health Complaints Commissioner
Department of Education and Training
The Victorian Ombudsman.
Website Privacy Statement
Appendix A - Information collected and used by the VCAA
The following is a non-exhaustive list of what kind of information the VCAA collects, uses, and discloses to fulfil its functions. When the VCAA collects information, a collection notice is provided, to explain why the information is collected and for what purpose.
1. Student Information
1.1 Enrolment and assessment
Students who enrol for the VCE, VCAL, General Achievement Test (GAT) and International Baccalaureate (IB) in Victorian schools complete Student Personal Details forms which are used by schools to input or verify information on the VCAA’s student assessment database known as the Victorian Assessment Software System (VASS). The personal details of students who sit NAPLAN tests is also collected by schools and used by the VCAA.
Access to this information is restricted to authorised school employees and authorised VCAA employees engaged in the management of the student enrolments and assessments. At various times the authorised employees in schools and in the VCAA may use student information to manage the enrolment records and to create and maintain student assessment records. Schools may also extract student personal information from VASS and process this to provide advice to teachers and school administration on educational outcomes and the efficacy of teaching approaches. Personal information so extracted, and its management, becomes the responsibility of the school and subject to the privacy legislation applicable to the school. In the case of Victorian government schools this is the PDP Act. In the case of non-government schools this may be the Commonwealth
Privacy Act 1988, if that Act applies.
The VCAA uses the assessment data to generate results for students in the course of their VCE and VCAL. These results are reported to students and provided to schools and in the case of senior secondary programs are the basis for certification for VCE and VCAL.
Student personal information for VCE, VCAL, GAT and IB students and final VCE, VCAL and GAT results are disclosed to the Victorian Tertiary Admissions Centre (VTAC) for calculation of Australian Tertiary Admissions Rankings (ATARs) and processing of applications for tertiary selection. The VTAC also includes the information provided by the VCAA in its CourseLink database, a password protected, interactive, web-based program enabling VCE and VCAL students to access their own individually tailored career and course options.
The Student Personal Details form requests information about a student’s Overseas Student status, hearing impairment, Aboriginal and Torres Strait Islander status, and whether they speak English as a Second Language. The ‘VCAA Collection Notice for Students’, provided at the point of collection, notes the purposes for which this information is collected.
The VCAA provides personal information to the Victorian Department of Education and Training (DET), and the Catholic Education Office Victoria (CEOV) about students in their sectors, for use in de-identified format for forward planning related to education provision. A small number of authorised users in those organisations have access to this information in identified format. All other users in those organisations have access only to de-identified personal information. In other cases where data is provided externally to any other organisations, for example for research purposes, it is in de-identified or aggregated form, or by another means which is in accordance with the PDP Act. Should the VCAA transfer personal information outside the State of Victoria, the VCAA will comply with Information Privacy Principle 9 of the PDP Act.
1.2 Enrolment amendments
Where a student makes a late amendment or any other change to their enrolment they will complete a form which contains some personal details. This information is used to make amendments to the student’s enrolment records. The information is input directly into VASS. Where a student seeks exemption from sitting the GAT they also provide personal information to the VCAA. This information is input to VASS.
The VCAA advises schools to either destroy VCAA enrolment forms and enrolment amendment forms after inputting to VASS or to retain them securely as hard copies according to the applicable archiving and disposal schedules.
1.3 Post-results and ATAR Service
After the release of VCE and VCAL results in December the VCAA and the VTAC jointly conduct the Post-Results and ATAR Service (PRAS). Students may contact this service for advice about their results (but not to request the results). Authorised VCAA and VTAC employees may access the student records of students who contact this service to respond to their queries.
1.4 Examination and assessment incidents
Authorised VCAA employees may access VCE students’ personal and sensitive information (as defined in the PDP Act) stored in the VCAA’s password-protected database and use this information in dealing with alleged breaches of VCE and VCAL examination rules, student appeals and teacher error claims in relation to the delivery of the VCE assessment program. Information which is generated from these processes is stored securely electronically and in hard copy.
1.5 Special provision
Schools or students who apply for special provision provide personal information and health information which is used by the VCAA to evaluate and decide upon the merits of that application and future applications for the same student. Access to this information is restricted to VCAA employees required to make the decision and professionals engaged by the VCAA to advise it on the application. These applications are kept securely by the VCAA.
1.6 Enrolment and assessment related payments
Students may be asked to pay a fee for certain transactions related to their results including issuing a replacement result certificate or a statement of marks and equivalent qualifications or the purchase of recordings of Season of Excellence performances (see below). Personal and financial details collected in these transactions are personal information under the PDP Act. The payment for these services may be made in cash or by e-commerce. E-commerce transactions performed either at the VCAA’s premises or through the VCAA’s website involve the collection of personal information and may involve disclosure of the applicant’s personal information to the VCAA’s bank – currently the National Australia Bank.
The National Australia Bank's Privacy Statement may be viewed at its
1.7 VCE Season of Excellence
In the management of the VCE Season of Excellence (Season), VCAA employees use application forms to collect personal information directly from students who express interest in participating in the Season program. This information may be disclosed to the State Reviewer, Chief Assessor of the relevant VCE studies or panel members involved in the selection of work for Season exhibitions and performances if required. Information is stored electronically and in hard copy and only accessed by authorised VCAA employees. Some information is passed on to the National Gallery of Victoria (for the Top Arts component) and the Melbourne Museum (Top Designs) and DET Communications Division for the purpose of administering and/or publicising the Season.
As part of the presentation and promotion of the Season of Excellence, images of participants may be used in publications such as venue programs, the VCAA website, the VCE Bulletin and the VCAA Annual Report. Permission is sought from Season participants to publish these images.
All student work and personal information submitted for the Season is kept securely. All student works are returned to the student. For those whose application is not accepted, the information is shredded within four months of their application and any work submitted in support of the application is either returned to the student or, with permission, disposed of securely.
1.8 Examination responses - NAPLAN
The VCAA is the National Assessment Program – Literacy and Numeracy (NAPLAN) Test Administration Authority (TAA) for all Victorian schools and school sectors. In order to fulfil its responsibilities as TAA for Victoria, the VCAA collects the names and a range of other background information on all Year 3, 5, 7 and 9 students who are eligible to participate in the program. This information is used for a range of purposes including pre-printing student names on the test booklets and later in the production of parent and school reports for Victoria.
The VCAA provides Victorian student results data to the Australian Curriculum, Assessment and Reporting Authority (ACARA) so that it can prepare national reports related to the outcomes of the NAPLAN tests.
1.9 Early Years Research and Resources
In the management of multidisciplinary practitioner research projects and resource development, the VCAA collects personal information directly from early childhood professionals working in birth to 8 years services and schools, and from children and their families. This personal information may be in the form of names and contact details, work completed by children including images, records, analysis and the opinions of professionals derived from their work with children. Some of this information may be used in the publication of project reports and development of other resources with the consent of the professionals, children and their families.
Personal information is stored securely and is accessed by VCAA, DET and authorised external researchers commissioned by the VCAA to conduct research.
1.10 The Victorian Curriculum F-10
For the purposes of supporting the development and implementation of the Victorian Curriculum F-10 – and providing timely, appropriate and accurate advice and support to teachers and schools, the VCAA collects and where appropriate publishes annotated student work samples. All student work samples are collected with consent from students’ parents/guardians, and completed permission forms are kept with the student’s work sample. All published student work samples are annotated and de-identified prior to publication.
The VCAA created and maintains the F-10 Curriculum Update mailing list for teachers. Only VCAA administrators can access the password protected list. The mailing list is available only to authorised VCAA employees. Once a year, members of the list are asked to confirm their wish to continue receiving updates (that is, to opt in to the list again).
1.11 Awards and recognition of high achievement
Depending on the nature of their enrolment, students may be asked to consent to the release of some of their personal information:
- to the media, if they have a VCE study score of 40 or higher;
- to relevant government departments for the selection of students for the Premier’s VCE Awards and the Australian Students’ Prize;
- to the DET for its On Track Project.
Students may also be asked to consent to the use of materials, produced by them for assessment in their course, in publications or productions approved by the VCAA.
1.12 VCAA Plain English Speaking Award
The VCAA receives applications every year from students wishing to enter the Plain English Speaking Award. The applications, which contain personal information, are used to manage the students’ participation in the competition. The applications are then disposed of securely.
1.13 Margaret Schofield Scholarships
Every year the VCAA seeks applications containing personal information from government school students of VCE Music Performance and/or VCE Music Investigation, for the Margaret Schofield Scholarships. Access to this personal information is restricted to authorised VCAA employees and a panel which selects the successful applicants. The applications are securely disposed of at the completion of this process.
1.14 VCAA VCAL Achievement Awards
The VCAA invites nominations every year from students, teachers and VCAL partners for a number of VCAL Achievement Awards. The applications seek personal information about both students and teachers involved in VCAL programs, individuals in partner organisations, and testimonials about the programs. They are often initiated by a third person, and the nominee confirms they wish the nomination to proceed. Further personal information may be collected from individuals. On completion of the awards process the applications are disposed of securely.
1.15 Occasional surveys
The VCAA from time to time may use surveys to collect personal information directly from individuals for the purpose of assisting in curriculum or program reviews. In order to conduct its duties in research and evaluation, the VCAA uses statistical data and personal information from VASS. Most often this is aggregated and de-identified. The data is stored and disposed of securely.
2. Education sector contacts
2.1 VASS administration
The VCAA collects personal information including the name, school name and contact details of school and non-school VASS administrators who manage the VASS database and the inputting of information at the school level. Similar information is collected from VASS administrators to facilitate their access to a VASS Forum and for VASS related professional development classes.
2.2 VCE Study Review Panels and similar reference groups
The VCAA collects personal information directly from individuals who have expressed an interest in participating in the development of study designs or learning programs. The information is only used to facilitate these purposes. Some of this personal information may be published in the VCAA Bulletin, on the VCAA website and in the Annual Report of the VCAA. Otherwise, access to the data, in electronic format and hard copies, is restricted to authorised VCAA employees and the VCAA Board and its committees. It is securely archived.
2.3 VCE VET referral service
The VCE Vocational Education and Training (VET) Unit collects information directly from individuals for the purpose of providing a referral service comprising contractors, sessional employees, consultants and teachers involved in developing and teaching VCE VET programs. The information is disclosed to people involved in these networks mainly through publications produced by the Unit. It is stored electronically and deleted when the services of the individual are no longer required or approval is withdrawn.
3. VCAA employees
The VCAA collects information about ongoing, fixed-term and casual employees and applicants for employment.
The personal information, sensitive information and health information (as defined in the
Health Records Act) of ongoing and fixed-term employees is generally collected by the VCAA and disclosed and held by DET as the employing body. The VCAA employs casual personnel and retains records relating to them in written form in secure archives. DET maintains all VCAA personnel records on its eduPay system. Information on current and former employees is stored electronically and only authorised employees have access to it. Hard copies are securely stored and archived.
The VCAA collects personal and health information from current and potential employees who set and mark VCE examination papers. The information is used to appoint examination panels and is used by the Panel Chairperson of each study for the purpose of selecting panel members.
Statistical data is collected from the marking record sheets of examination assessors employed by the VCAA so that the Chief Assessor for each VCE study can monitor assessor performance. Access to both types of information is restricted to authorised VCAA employees.
4. Personal information collected from other stakeholders
Personal information about members of the public who are not currently students, employees or commercial providers, may be collected by the VCAA in the conduct of its functions, for example in answering queries from past students or members of the public about the functions of the VCAA, or when working with teachers or education professionals while researching curriculum and assessment matters.
The VCAA collects information from subscribers to the VCE Bulletin and other publications to maintain mailing lists. This information is stored and updated electronically for an indefinite period and may be provided to external mail houses for mailing purposes. All mail houses are required to destroy this data after a fixed period.
The VCAA may seek permission from individuals including students, teachers and parents/guardians to make and/or use photographs and audio/visual recordings, for example at awards events, to promote VCAA programs. Permission is obtained to make and/or use these representations.