Waverley College

EREA NSW Colleges Ltd
Privacy Policy
1 Introduction
1.1 Background
EREA NSW Colleges Ltd is bound by the Australian Privacy Principles (APPs) contained in the Commonwealth
Privacy Act 1988. In relation to health records, EREA NSW Colleges Ltd is bound by the NSW Health Privacy
Principles (HPPs) contained in the Health Records and Information Privacy Act 2002.
EREA NSW Colleges Ltd aims to be proactive in its approach to privacy protection and will assess the privacy
impacts of major initiatives and projects and embed privacy considerations into the design and architecture of
information technology, student and staff experiences and business processes.
1.2 Purpose
EREA NSW Colleges Ltd is committed to protecting personal privacy and recognises that staff and students have
a reasonable expectation that EREA NSW Colleges Ltd will protect and appropriately manage the personal
information it holds about them. This Policy outlines the circumstances in which we obtain personal
information, how we use and disclose that information and how we manage requests to access and/or change
that information.
1.3 Scope
This Policy applies to all EREA NSW Colleges Ltd staff, as well as to the EREA NSW Colleges Ltd Board and
Committee Members and all volunteers, and contractors. EREA NSW Colleges include:
Christian Brothers High School, Lewisham
Edmund Rice College, Wollongong
St Dominic’s College, Penrith
St Edward’s College, East Gosford
St Patrick’s College, Strathfield
St Pius X College, Chatswood
Waverley College, Waverley
This Policy does not apply to EREA Associate or Partner Schools.
2 | Page
1.4 Definitions
Term Definition
Australian Privacy
Principles (APPs)
The Australian Privacy Principles (or APPs) are the cornerstone of the privacy
protection framework in the Privacy Act 1988 (Privacy Act). They apply to any
organisation or agency the Privacy Act covers.
There are 13 Australian Privacy Principles that govern standards, rights and
obligations around:
• the collection, use and disclosure of personal information
• an organisation or agency’s governance and accountability
• integrity and correction of personal information
• the rights of individuals to access their personal information.
The Australian Privacy Principles are principles-based law. This gives an
organisation or agency flexibility to tailor their personal information handling
practices to their business models and the diverse needs of individuals. They are
also technology neutral, which allows them to adapt to changing technologies.
A breach of an Australian Privacy Principle is an ‘interference with the privacy of
an individual’ and can lead to regulatory action and penalties.
EREA NSW Colleges Ltd Entity that operates EREA schools in NSW. It is the proprietor of the NSW
Schools/Colleges. It includes the EREA NSW Office and its NSW Colleges. A
reference to “we”, “us” and “our” in this document is a reference to EREA NSW
Colleges Ltd unless context suggests otherwise.
EREA NSW Office EREA NSW Colleges Ltd office serving and supporting the NSW Colleges.
NSW Colleges Any school or entity governed by EREA NSW Colleges Ltd.
NSW Health Privacy
Principles (HPPs)
The NSW Health Privacy Principles (or HPPs) are the 15 key legal obligations
under the Health Records and Privacy Information Act 2002 (HRIP Act) which
NSW organisations must abide by when collecting, holding, using and disclosing a
person’s health information.
Personal Information
Personal information is information or an opinion that relates to an individual
from which they can be reasonably identified. Depending on the circumstances,
we may collect personal information from the individual in their capacity as a
student, contractor, volunteer, stakeholder, job applicant, alumni, visitor,
employee, member of EREA NSW Ltd Board or Board subcommittee and/or
others who come into contact with any of the NSW colleges.
Ch16A of the Children
and Young Persons (Care
& Protection) Act 1988
The NSW Children and Young Persons (Care and Protection) Act 1998 (the CARE
Act) allows certain people and organisations to exchange information to facilitate
services that promote the safety, welfare and well-being of children and young
people (children). Chapter 16A allows information sharing between prescribed
agencies.
Exchanging information allows you to share information without consent when it
relates to the safety, welfare and wellbeing of a child and helps your organisation
to:
• make a decision, assessment or plan
• initiate or conduct any investigation
• provide any service.
3 | Page
Term Definition
In addition, the Privacy Act Ch16A allows for specific exceptions in relation to the
collection, use or disclosure of personal information. The aim of the section
includes, but is not limited to allowing organisations to do what is necessary to:
● lessen or prevent a serious threat to the life, health or safety of any
individual or to public health or safety or
● to respond to the entity’s obligations if there is suspicion of unlawful
activity, or misconduct of a serious nature, that relates to the entity’s
functions or activities has been, is being or may be engaged in; and
● Information is necessary in order for the entity to take appropriate
action in relation to the matter.
This exception is commonly used for child protection matters.
● Chapter 16A Exchange of information and co-ordination of services
● Privacy Act 1988 Sect16A
Staff
The terms “staff” and “staff member” or “employee” include all teaching and
non-teaching staff. They include all those employed by a NSW College on a
permanent, temporary or casual basis as well as those employed by EREA NSW
Colleges Ltd.

2 Australian Privacy Principles
The Privacy Act 1988 (Cth) requires EREA NSW Colleges Ltd to handle any personal information (including
‘sensitive’ information) we collect about individuals in accordance with the 13 Australian Privacy Principles
(APPs). The Policy must conform with the APPs found in the Act and with the Privacy Legislation Amendment
(Enforcement and Other Measures) Act 2022 (Cth). In accordance with the APPs, our Privacy Policy outlines:
I. the kinds of personal information collected and held by the entity (APP1.4(a))
II. how personal information is collected and held (APP1.4(b))
III. the purposes for which information is collected, held, used and disclosed (APP1.4(c))
IV. how an individual may access their personal information and seek its correction (APP1.4(d))
V. how an individual may complain if the entity breaches the APPs or any registered binding APP code,
and how the complaint will be handled (APP1.4(e))
VI. whether the entity is likely to disclose personal information to overseas recipients (APP1.4(f)), and if
so, the countries in which such recipients are likely to be located if it is practicable to specify those
countries in the policy (APP1.4(g))
Where applicable, this Policy will also conform to the 15 Health Privacy Principles (HPPs) in the NSW Health
Records and Information Privacy Act 2002.
3 Roles and responsibilities
Role Responsibilities
College-level Data
Breach Response
Team
● Supporting the College Privacy Officer on the assessment of data breaches
and immediate corrective actions
● Recommending and implementing corrective actions for data breaches
4 | Page
Role Responsibilities
College Privacy
Officer
● Ensuring their respective NSW College manage privacy and data in line with
this Policy and Procedures
● Providing appropriate support to staff at their respective NSW College to
understand and implement this Policy
Chief Executive
Officer (CEO)
● Ensuring the Policy and Procedures are reviewed and updated as needed
● Ensuring this Policy is implemented in EREA NSW Office and NSW Colleges
● Reporting to EREA NSW Colleges Ltd Board on compliance with this Policy
EREA NSW Privacy
Officer
● Overseeing the successful implementation of this policy across EREA NSW
Office and NSW Colleges
● Providing support to the NSW Colleges Privacy Officer as required
EREA NSW Colleges
Ltd Board (Board)
● Approving this Policy
● Reviewing compliance with this Policy
Principals ● Implementing this Policy and associated Procedures in their respective
schools.
4 Policy Principles
4.1 General
How EREA NSW Colleges Ltd handles information collected about individuals is very important for two main reasons:
● people we deal with expect us to handle their personal information properly; and
● we have a legal obligation to do so.
There are substantial penalties for serious or repeated breaches of the Privacy Act, the APPs and the HPPs.
Non-compliance with our privacy obligations also poses a risk of reputational damage to schools and the
organisation if the privacy of an individual is breached, and further damaged if the breach is managed poorly.
Exceptions
Child Safety
In accordance with Ch16A of the Children and Young Persons (Care & Protection) Act 1988 (CARE Act), EREA NSW
Colleges Ltd may share or receive information about students and other relevant people with external agencies or
individuals, both verbally and in writing, in certain circumstances and for particular purposes relating to the safety and
welfare of children and young people. This information can be shared without the consent of the relevant individual
or, in the case of a student, of their parent/carer. The CARE Act overrides the privacy requirements of the Privacy Act.
Employee Records
Under the Privacy Act and Health Records and Information Privacy Act, the Australian Privacy Principles and Health
Privacy Principles do not apply to an employee record. As a result, this Privacy Policy does not apply to EREA NSW
Colleges Ltd collection, use, disclosure, or handling of an employee record, where the collection, use, disclosure or
handling of an employee record is directly related to a current or former employment relationship between the entity
and employee. However, EREA NSW Colleges Ltd treats employee's information with the same care and diligence as
if these records were covered by the Privacy Act.
5 | Page
4.2 Types of information collected
In the course of providing services and conducting its operations, as part of our recruitment processes for employees,
contractors and volunteers, and the delivery of education services to students, EREA NSW Colleges Ltd may collect
and hold:
● Personal information including names, addresses and other contact details; dates of birth; next of kin
details; contact details of doctors, photographic images; videos; attendance records; financial
information, citizenship, employment references, regulatory accreditation, media, directorships,
property ownership and driver’s licence information.
● Sensitive information (particularly in relation to student and parent records) including but not limited to
government identifiers (such as TFN), religious beliefs, nationality, country of birth, financial hardship,
professional memberships, family court orders and criminal records.
● Health information including medical records, disabilities, immunisation details and psychological
reports.
We will seek consent from an individual in writing before we collect their sensitive information (including health
information), unless it is not reasonable and practical to collect the personal information from the individual
directly.
4.3 Methods of collection
The collection of personal information depends on the circumstances in which EREA NSW Colleges Ltd is collecting it.
If it is reasonable and practical to do so, we collect personal information directly from the individual. Where the
individual is a child that does not have capacity (in our reasonable opinion) to provide their personal information, we
will generally collect the information from their parent(s) or carer(s).
EREA NSW Colleges Ltd has, where possible, attempted to standardise the collection of personal information by using
specifically designed forms (e.g. an Enrolment Form or Health Information Disclosure Form). However, given the
nature of our operations we also receive personal information by email, letters, notes, via our website(s), social media
platforms, over the telephone, in face-to-face meetings, through financial transactions and through surveillance
activities such as the use of CCTV security cameras or email monitoring.
We may also collect personal information from other people (e.g. a third-party administrator, referees for prospective
employees) or independent sources. However, we will only do so where it is not reasonable and practical to collect
the personal information from the individual directly. We may collect information based on how individuals use our
websites across the entirety of EREA NSW Colleges Ltd. We use ‘’cookies’’ and other data collection methods to collect
information on website activity such as the number of visitors, the number of pages viewed and the internet
advertisements which bring visitors to our website(s). This information is collected to analyse and improve our
website, marketing campaigns and to record statistics on web traffic. We do not use this information to personally
identify individuals.
EREA NSW Colleges Ltd may be provided with personal information without having sought it through our normal
means of collection. This is known as “unsolicited information” and is often collected by:
● misdirected postal mail- letters, notes, documents
● misdirected electronic mail- emails, electronic messages
6 | Page
● employment applications sent to us that are not in response to an advertised vacancy
● additional information provided to us which was not requested.
Unsolicited information obtained by EREA NSW Colleges Ltd will only be held, used and or disclosed if it is
considered as personal information that could have been collected by normal means. If that unsolicited information
could not have been collected by normal means, then we will, if we are able, destroy, permanently delete or deidentify the personal information as appropriate.
EREA NSW Colleges Ltd will only collect sensitive information if it is:
● reasonably necessary for one or more of the disclosed functions or activities, and we have the
individual’s consent (or if the individual is a child without the capacity the consent in our reasonable
opinion, the consent of his or her parent or guardian)
● necessary to lessen or prevent a serious threat to life, health or safety
● another permitted general situation under the law.
4.4 Storage of information
EREA NSW Colleges Ltd stores personal information in a variety of formats including, but not limited to:
● databases
● hard copy files
● personal devices, including laptop computers
● third party storage providers such as cloud storage facilities
● paper-based files.
Personal information may also be stored by third parties outside our control, for example, information disclosed
onto social media platforms that provide us with limited ability to store, modify or delete such information.
We take all reasonable steps to protect the personal information we hold from misuse, loss, unauthorised
access, modification or disclosure.
These steps include, but are not limited to:
● restricting access and user privilege of information by staff depending on their role and responsibilities
● ensuring staff do not share personal passwords
● ensuring hard copy files are stored in lockable filing cabinets in lockable rooms. Staff access is subject
to user role-based privilege
● ensuring access to premises is secured at all times
● implementing physical security measures around EREA NSW Colleges Ltd buildings and grounds to
prevent break- ins
● ensuring our IT and cyber security systems, policies and procedures are implemented and proactively
monitored and subject to regular audits and testing
● ensuring staff comply with internal policies and procedures when handling the information
7 | Page
● undertaking due diligence with respect to third party service providers who may have access to
personal information, including customer identification providers and cloud service providers, to
ensure as far as practicable that they are compliant with the APPs or a similar privacy regime
● the destruction, deletion or de-identification of personal information we hold that is no longer needed
or required to be retained by any other laws.
EREA NSW’s public website and the public websites of our NSW Colleges may contain links to other third- party
websites outside of EREA NSW. EREA NSW Colleges Ltd is not responsible for the information stored, accessed, used
or disclosed on such websites and we cannot comment on their privacy policies.
4.5 Use of information
EREA NSW Colleges Ltd only uses personal information for which it has received consent that is reasonably necessary
for one or more of our functions or activities (the primary purpose) or for a related secondary purpose that would be
reasonably expected, or for an EREA NSW Colleges Ltd activity or purpose.
The purpose of collecting and our primary uses of personal information include, but are not limited to:
● delivery of educational and pastoral services to the students enrolled in our NSW Colleges
● satisfying our legal obligations including our duty of care and child protection obligations
● marketing, promotional and fundraising activities
● supporting community-based causes and activities, charities and other causes in connection with our
functions or activities
● helping us to improve our day-to-day operations including training our staff
● systems development; developing new programs and services; undertaking planning, research and
statistical analysis
● school administration including for insurance purposes
● the employment of staff
● the engagement of volunteers.
If personal information is not collected, some services may be diminished or unable to be provided.
We will only use or disclose sensitive or health information for a secondary purpose if it is reasonably expected of us
to use or disclose the information and the secondary purpose is directly related to the primary purpose.
Use of information may include the transmission of personal information from a NSW College to the EREA NSW Office
and vice versa for the purposes of providing and promoting the activities and services of EREA NSW College Ltd and
the NSW Colleges. We may share personal information with related bodies, but only if necessary for us to provide
our services.
We may disclose information about an individual to overseas recipients only when it is necessary, for example to
facilitate a student exchange program. We will not however send information about an individual outside of Australia
without their consent.
Nationally Consistent Collection of Data (NCCD) on School Students with Disability
Catholic Schools NSW (CSNSW) may provide assistance to EREA NSW Colleges so they can meet their obligations
under the Commonwealth Australian Education Regulation 2013 (the Regulations). The Regulations require schools
8 | Page
to provide the Commonwealth Department of Education (DoE) with certain information under the NCCD on students
with a disability, including category of disability and level of adjustment. Schools collect the required information at
an individual student level and may provide it to Catholic Schools NSW or other relevant organisations as Approved
Authorities (for funding). Approved Authorities must comply with reporting, record keeping and data quality
assurance obligations under the NCCD. Student information provided to the DoE for the purpose of the NCCD does
not explicitly identify any student.
AI and Automated Decision-Making
Due diligence will be conducted to ensure any commercially available AI system employed by EREA NSW Colleges is
suitable for its intended use.
Every effort will be made to avoid using identifiable data however in circumstances where personal information is
input into an AI system or automated decision-making tool, this will only be for the purpose for which the information
was collected (in the case of sensitive information), or for a reasonably expected secondary use. Circumstances
where personal information may be used for automated decision-making include but are not limited to:
- analysis of student assessment and examination data
- recording and monitoring wellness data
- processing regular payment plans
As a matter of best-practice, EREA NSW Colleges will not enter personal information into publicly available generative
AI tools.
4.6 Disclosure of information
Personal information is used for the purposes for which it was given to EREA NSW Colleges Ltd, or for purposes which
are directly related to one or more of our functions or activities.
Personal information may be disclosed to government agencies, other parents, other schools, recipients of school
publications, visiting teachers, counsellors and coaches, our service providers, agents, contractors, business partners,
related entities and other recipients from time to time, if an individual:
● has given consent; or
● would reasonably expect the personal information to be disclosed in that manner.
As EREA NSW Colleges Ltd operates all of the NSW Colleges, as a part of the provision of our services, fundraising
activities, or marketing or promotional activities, we may use and disclose personal information of students,
parents or staff of a NSW College. Disclosure of information may include the transmission of personal information
from a NSW College to EREA NSW Office and vice versa for one or more of the purposes set out in this document.
EREA NSW Colleges Ltd may disclose personal information without consent or in a manner which an individual
would reasonably expect if:
● we are required to do so by law.
● the disclosure will lessen or prevent a serious threat to the life, health or safety of an individual or to
public safety and it is unreasonable or impracticable to obtain the individual’s consent to the
collection, use or disclosure.
● another permitted general situation applies.
● another permitted health situation exists.
9 | Page
Parents may seek access to personal information held about them or their child by directly contacting the relevant
College; however, there will be occasions when access is denied. Such occasions would include:
● where release of the information would have an unreasonable impact on the privacy of others; or
● where the release may result in a breach of the College’s duty of care to the student;
● where the release of the information is unlawful.
Disclosure of personal information to overseas recipients
Personal information about an individual may be disclosed to an overseas organisation in the course of providing
our services, for example when storing information with a “cloud service provider” which stores data outside of
Australia.
We will however take all reasonable steps not to disclose an individual’s personal information to overseas
recipients unless:
● we have the individual’s consent (which may be implied);
● we have satisfied ourselves that the overseas recipient is compliant with the APPs, or a similar privacy
regime;
● we form the opinion that the disclosure will lessen or prevent a serious threat to the life, health or
safety of an individual or to public safety; or
● we are taking appropriate action in relation to suspected unlawful activity or serious misconduct.
EREA NSW Colleges Ltd may share sensitive information with other entities in our organisational structure, but only
if it is necessary for us to provide our services.
4.7 Responding to breaches
EREA NSW Colleges Ltd will take appropriate, prompt action if we have reasonable grounds to believe that a
data breach may have, or is suspected to have occurred. Depending on the type of data breach, this may include
a review of our internal security procedures, taking remedial internal action, notifying affected individuals, and
the Office of the Australian Information Commissioner (OAIC).
If we are unable to notify individuals, we may publish a statement on our website(s) and take reasonable steps
to publicise the contents of this statement.
4.8 Managing personal information
Access and correction of personal information
Requests may be submitted directly to EREA NSW or any of the NSW Colleges to access or change the personal
information we hold. Upon receiving such a request, we will take steps to verify the requester’s identity before
granting access or correcting the information. All requests for access to personal information are formally
recorded and approved by the Privacy Officer and/or the relevant EREA NSW Colleges Ltd authorised person.
If we reject the request, notification will be sent accordingly. Where appropriate, we will provide the reason/s
for our decision. If the rejection relates to a request to change personal information, an individual may make a
statement about the requested change, and we will attach this to their record.
10 | Page
Complaints
You can make a complaint about how EREA NSW Colleges Ltd manages personal information, including a breach
of the APPs or the HPPs, by notifying us in writing as soon as possible. We will respond to the complaint in line
with our internal Policies and we may seek further information to provide a full and complete response. EREA
NSW Colleges Ltd does not charge a fee for the handling of complaints.
If you are not satisfied with our response, you may refer the complaint to the OAIC. A complaint can be made
using the OAIC online Privacy Complaint form or by mail, fax or email. A referral to the OAIC should be a last
resort once all other avenues of resolution have been exhausted.
How to contact us
Each NSW College has a Privacy Officer that can be contacted directly through each College's website.
For Privacy concerns related to the EREA NSW Office, or that are general and not particular to a specific NSW
College, the EREA NSW Privacy Officer can be contacted by:
Emailing EREANSW@erea.edu.au
Phoning (02) 8705 8608
Writing to EREA NSW’s Privacy Officer - 13 Frederick Street, East Gosford NSW 2250
We can be contacted on an anonymous basis or by using a pseudonym. However, if you choose not to
identify yourself, we may not be able to provide the information or assistance you might otherwise receive
if it is not practical to do so.
5 Policy Compliance
5.1 Breach of this Policy
EREA NSW Colleges Ltd takes infringements of this Policy very seriously. Staff who fail to abide by these
principles may face disciplinary action, including dismissal.
5.2 Policy Review
A review of this Policy shall be conducted every three years or earlier if required, such as due to changes in
legislation.
The EREA NSW Colleges Ltd CEO is responsible for ensuring this Policy is reviewed and updated as needed.
6 EREA NSW Colleges Ltd Related Policies, Documents and Legislation
6.1 Related internal Policies and Documents
This Policy is supported by the following internal policies and documents:
● Code of Conduct
● Privacy Program Guide
11 | Page
● Data Breach Response Plan
● Data Breach Identification Flow Chart
● Student Privacy Collection Notice
● Job Applicant Privacy Collection Notice
● External Provider Privacy Collection Notice
6.2 Related legislative instruments
The following legislation, standards and regulations apply, and this Policy aligns with these mandated
requirements:
• Commonwealth Privacy Act 1988
• Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022
• Privacy Amendment (Notifiable Data Breaches) Act 2017
• Health Records and Information Privacy Act (NSW) 2002

6.3 Version Control
Action Detail
Subject Matter Expert Director of Governance, Risk and Improvement
Approved by EREA NSW Colleges Ltd Board
Approval date 3 April 2025
Review date April 2028
Policy ID 2025-01