The Privacy Act 1988 protects an individual’s personal information regardless of their age. It doesn’t specify an age after which an individual can make their own privacy decision. For their consent to be valid, an individual must have capacity to consent.
An organisation or agency handling the personal information of an individual under the age of 18 must decide if the individual has the capacity to consent on a case-by-case basis. As a general rule, an individual under the age of 18 has the capacity to consent if they have the maturity to understand what’s being proposed. If they lack maturity it may be appropriate for a parent or guardian to consent on their behalf.
If it’s not practical for an organisation or agency to assess the capacity of individuals on a case-by-case basis, as a general rule, an organisation or agency may assume an individual over the age of 15 has capacity, unless they’re unsure.
Education and childcare
Whether the Privacy Act covers your child’s childcare centre, school or tertiary education depends on whether it’s private or public.
Private educational institutions
If your child attends a private childcare centre, private school or private tertiary education institution then the Privacy Act usually covers how their personal information is handled.
Such an organisation must comply with the Privacy Act for one or more of the following reasons:
- they have an annual turnover of more than $3 million
- they’re connected to a larger organisation (with an annual turnover of $3 million)
- they supply a health service and hold health information, although this isn’t their primary activity.
Supplying a health service may include keeping records of a child’s medical condition or general health and doing activities to maintain a child’s health, such as making sure they take prescribed medication or giving them first aid.
Public educational institutions
If your child attends a local government run childcare centre, then the Privacy Act probably won’t cover it. The Privacy Act doesn’t cover state or territory agencies, including local government agencies, unless they’re an incorporated company, society or association. Instead, state or territory privacy laws may apply.
The Privacy Act doesn’t cover a public school or tertiary educational institution, such as a TAFE or most universities. Instead state or territory privacy laws may apply.
The Privacy Act does, however, cover the Australian National University and private universities.
You may also be able to access your child’s school records
