EdLaw
Queensland Department of Education — Guideline for obtaining and managing Online Services Consent
Guideline for Obtaining and managing Online Services Consent
Purpose
This Guideline sets out the responsibilities and processes for Principals and school staff to obtain consent to record, collect, use and disclose a student’s or parent’s (an Individual’s) personal information or materials through the use of online services.
Overview
Online Services
Online services, including websites, web applications, and mobile applications, are delivered over the internet or require internet connectivity. They are used to meet a whole range of needs for education, collaboration and connectivity for students and staff.
Examples of online services include interactive learning sites and games, online collaboration and communication tools, web-based publishing and design tools, learning management systems, and file storage and sharing services. They can be free or paid subscriptions and may or may not be provided by the department.
Within the department, online services can be grouped into three overarching categories:
- Enterprise services
- Supply arrangements
- Third-party services
Enterprise services
Developed and/or managed by the department in a safe and secure manner, Enterprise services support school and business functions, including teaching and learning. Examples include OneSchool, QLearn, Office 365, MyHR, QSchools and QParents. Enterprise services should be the first choice for school and corporate staff. Schools are not required to obtain consent for disclosure of students’ information to, or use of, Enterprise services.
Supply arrangements
Information Communication Technology (ICT) goods and services can be purchased by departmental staff through a supply arrangement set up by the department. This means agreed terms and conditions of supply and negotiated prices are applied. Supply arrangements (DoE employees only) must be the first choice for purchasing ICT goods and services (i.e., where an online service is required but not available as an Enterprise service). Consent for disclosure of information to, or use of online services contracted under a Fsupply arrangement is usually required.
Third-party services
Third-party (or non-departmental) online services are those which are not contracted, hosted or managed by the department. Third-party services should only be considered when there is not a viable service available as an Enterprise offering or under a Supply Arrangement. Consent for disclosure of information to, or use of third party online services is usually required.
Consent requirements
Consent for the recording, collection, use and disclosure of an individual’s Personal Information and/or Materials is required in accordance with the Education (General Provisions) Act 2006 (Qld) (EGPA), Information Privacy Act 2009 (Qld) (IPA) and the Copyright Act 1968 (Cth). Refer to the Obtaining and managing student and individual consent procedure’s Overview section for the Department’s consent requirements and the notice of penalties and/or disciplinary action for breaches.
Consent is required from the individual, or in the case of a minor, consent is required from the parent/carer to use and disclose personal information, including works that are stored, published or shared through use of an online service. Personal information is any information which could reasonably be used to identify an individual. Examples include: name; date of birth; and image, video, audio recording.
In addition, some online services specify in their Terms of Use/Service that parent consent must be obtained for specific users (e.g. users under 13) prior to use of the services and/or account registration.
Online Services Consent Form
The Online Service Consent Form (the Form) (DoE employees only) allows schools to obtain valid consent for the use, disclosure, and/or publication of personal information and for students’ use of third-party online services and those contracted under a Supply Arrangement (where applicable).
The Form collects consent for the recording, use, disclosure and publication of specified student information, and to transfer the information and works within Australia and outside of Australia (in the case of offshore services) to online service providers, for the following purposes:
- For students to register an account for the online services;
- For students to use the online services in accordance with each service’s Terms of Use/Service and Privacy Policy (including service provider use of the information in accordance with their Terms of Use/Service and Privacy Policy); and
- For the school to:
- administer and plan for the provision of appropriate education, training and support services to students;
- assist the school and departmental staff to manage school operations and communicate with parents and students.
The Form is available in both paper and digital forms.
Schools can choose to use the paper or digital form however, the paper form must be used when either of the below special circumstances apply:
- the Form is required to be read aloud (whether in English or in an alternative language or dialect) to the person giving consent; and/or
- the person giving consent is an independent student under the age of 18.
Responsibilities
Principals
- Oversee the development and implementation of a school based Online Services Consent Management process to manage the:
- selection, approval and use of online services;
- collection and recording of Online Services Consent for every student in a school consent register;
- maintenance of a register (DoE employees only) which captures the online services approved for use and the personal information stored within each service. Note: Incoming principals should review their school's register to ensure they are familiar with the services in use and agree to accept responsibility for the continued use of the services.
- Understand and oversee all responsibilities of school staff as outlined within this guideline.
School staff
- Follow the ‘Process for gaining consent’ outlined in this procedure.
- Ensure the Form is completed upon enrolment for the current phase of learning (i.e. Years P-3, 4-6, 7-9 and 10-12) and renew it when:
- students move into a new phase of learning (e.g. minimum every four years); or
- additional consent is required e.g. in the event that new online services are identified for use.
- Ensure the student and/or parent/carer (if the student is under 18 and unable to give consent) has given consent before the:
- recording, use or disclosure of personal information unless for a purpose of the EGPA or otherwise permitted or required by the EGPA or another law (see Obtaining and managing student and individual consent procedure’s Overview section and Consent FAQs); and
- student uses the online service/s in accordance with each service’s Terms of Use/Service and Privacy Policy.
- Ensure the paper version of the Form is used when either of the below special circumstances apply:
- the Form is required to be read aloud (whether in English or in an alternative language or dialect) to the person giving consent; and/or
- the person giving consent is an independent student under the age of 18.
- When completing the Form, specify the additional information required:
- if the online service requires additional student information other than that which is specified by default on the Form; and
- if the online service is being used for a purpose other than that those that are specified by default on the Form.
- Remind parent/carers that it is not compulsory to provide consent and there are no penalties if consent is withheld.
- Consult the school consent register to check if existing consent allows for the proposed use before disclosing students’ or individuals’ information to online services, or allowing students to use online services that have consent requirements specified in their Terms of Use/Service.
- Seek additional or updated consent if necessary (e.g. if the purpose of use changes, if additional online services are being considered for use).
- If a parent/carer/student limits or revokes their consent by notifying the school in writing (email or letter), provide written receipt of this to the parent/carer/student via email, where an email address is provided.
- Ensure consent is requested and received in accordance with the school’s data and collection requirements, for all relevant Individuals.
- Record information collected from the Form and any subsequent requests to limit or revoke consent in accordance with the school’s Online Services Consent Management process.
- Manage consent records in accordance with the Information asset and recordkeeping, Information privacy and right to information, and Information security procedures.
Process
Obtaining consent
- Identify the online services for which consent is required, and collate the following information for each service (schools should refer to the relevant Online Service Risk Review (if available) (DoE employees only) to find this information):
- Service name
- Service URL
- Data hosting (onshore/offshore)
- Purpose of use
- URL for Terms of Use/Service
- URL for Privacy Policy
- Data assets disclosed to each service
- Additional consent requirements (i.e. those not covered by the form by default)
- Determine the individuals for whom the consent is required.
- Determine whether the digital or paper based version of the Form will be used.
- Create a version of the Form for each phase of learning. Each version should list only the services used by students within the specified phase of learning. Parents should not be asked to provide consent for services which will not be used by their student within the phase of learning for which the consent applies.
- Populate the following information on the Introduction to the Online Services Consent Form letter and the Form, which is issued on school letterhead (paper version of the Form) or electronically (digital version of the Form):
- Date
- School name
- Consent contact (name, role, phone number, and email address)
- Online services for which consent is being requested
See Online Services Consent: Paper and Digital forms - KBA0024315 (DoE employees only) for step by step instructions for creating the paper and digital version of the Form. 6. Obtain Principal approval for the completed introduction letter and forms. 7. Distribute the approved letter and forms to all relevant parents/carers/students. 8. Collate the returned forms, and cross reference them against the class/cohort/subject list to identify the outstanding forms and follow up where required (or treat unreturned forms as a ‘do-no-consent’). 9. Record and store in an accessible format, all instances where consent is granted, limited, withheld, withdrawn, modified, contains specific exclusions or is made conditional in accordance with the school’s Online Services Consent Management process. 10. File the completed forms in the relevant student’s file or other storage/retrieval system in accordance with the school’s Online Services Consent Management process. 11. Communicate the consent to relevant school staff to ensure student and staff use of the relevant online service/s is done in accordance with the consent provided.
Limiting consent
The Introduction to the Online Services Consent Form letter advises parent/carers/students that requests to limit consent for specific services (i.e. limitations regarding the data disclosed or purpose for which the service is used) will be treated as ‘do not consent’, as, due to the nature of online services, the school cannot guarantee correct implementation of individual requests.
Parent/carers/students can, however, limit consent by providing consent for some, but not all, online services listed on the Form.
Requests to limit consent for a specific service will be treated as ‘do not consent’.
Revoking consent
- Parents/carers/students wishing to withdraw consent should notify the school in writing (email or letter).
- On receiving a parent’s/carer’s/student’s notice to withdraw consent, the school must provide written receipt of this via email, where an email address is provided.
- Record and store in an accessible format, all instances where consent is revoked in accordance with the school’s Online Services Consent Management process.
- After a notice to revoke consent is received communicate this with relevant school staff to ensure student and staff use of the specific online service/s is done in accordance with the updated consent.
Definitions
See definitions listed within the Obtaining and managing student and individual consent procedure.
Contact
For further information about Online Services Consent, contact:
Online Service Risk Reviews
Phone: (07) 3034 4360
Email: riskreviews@qed.qld.gov.au