Student consent and online privacy


Posting or sharing information about a person, other than yourself, online requires consent. Consent must be fully informed, freely given, current and specific in how the information will be presented and to whom.

Schools require signed authority for any work, images or information posted online.  Consent can be given freely but can also be withdrawn at any time, which would require the school  to remove any content/resource immediately.

Online privacy

The Information Privacy Act 2000 provides privacy standards when operating in a physical world and online environment. Schools should consider information collected from users in online spaces and the necessary privacy requests.

For example, a teacher wishes to introduce a web 2.0 tool which requires students to register. Therefore, parents/caregivers should be informed of the specific information collected to register (i.e. name, date of birth, etc).

Information Privacy Act 2000

The Victorian Information Privacy Act 2000 and the Information Privacy Principles (IPPs) contained within it regulate how government agencies (schools) must manage personal information, including:

  • how and when personal information can be collected
  • how informaiton should be used and disclosed
  • storage and security of information
  • how individuals can access information and have it corrected if it is wrong.

Social media

Schools wishing to register students/staff on social media accounts should issue a privacy collection statement prior to registration. A privacy collection statement will inform a person about the type of personal information that is likely to be collected, used and/or disclosed in order to register for the tool.

Sample privacy collection statement

The (insert school name/business unit/regional office) is utilising social media tools to (explain purpose for using social media). We will post (list the type of personal information that may be posted – photographs of students, student works, etc). The social media tool will restrict access to registered users (delete if not appropriate). Be aware that other registered users will be able to view any posting made by the moderator, and any responses from other registered users that are posted. The (insert school name/business unit/regional office) will not retain any information posted on social media sites (delete if not appropriate).(If the information collected via a social media platform is to be retained, indicate that some information may be retained, broadly the reason for the retention, and that individuals can access the information be retained by contacting the school//business unit/regional office). Additional information about (insert name of social media platform) can be found below.

All social media sites have their own privacy policies (these are different to privacy collection statements). DEECD employees in schools should consider these carefully prior to creating a social media account.

For more information, see: