Unit 1 of 12
Privacy at school and at home
Who the Privacy Act applies to, and where the line sits between the school's obligations and your private life.
Who does the Privacy Act apply to?
The Privacy Act 2020 governs how organisations handle personal information. As an organisation, St Cuthbert's College is an "agency" under the Act, and every staff member, contractor and volunteer handling information on the school's behalf shares that responsibility.
Here is a quick summary of who the Act applies to.
- The Privacy Act always applies to organisations, including the school, the boarding house, the health centre and the wider Trust.
- It also applies to personal or domestic activity when the subject matter is highly offensive to a reasonable person.
- It does not usually apply to genuinely personal or domestic activity that is not highly offensive.
What a privacy breach can look like
A breach happens when personal information is lost, or is seen, used or shared by the wrong person. In a school these are everyday risks, not abstract ones.
- A boarding staff member mentions to a parent that another boarder is frequently in the health centre with anxiety symptoms.
- The Admissions office posts a letter about a student's learning support plan to an out-of-date home address.
- An enrolment database is copied to a USB drive to work on at home, and the drive is lost on the bus.
When private life is still covered
The Act reaches into personal activity only when the subject matter is highly offensive. For example:
- A person shares intimate images of a former partner online.
- A person sets up a camera to film into a neighbour's bathroom.
When private life is not covered
Ordinary personal and domestic activity normally falls outside the Act. For example:
- A staff member photographs their own untidy flat and posts it for a laugh.
- A family member gossips to relatives about another relative's relationship.
- A person keeps notes about when their own teenager gets home.
The school is accountable for its people
An organisation can be held to account for what an individual does within it. The lesson: when you act in your school role, the school answers for it.
- The school breaches privacy when an administrator replies-all with a spreadsheet of family contact details attached.
- A sports programme breaches the Act when a coach uses the team list to promote an unrelated private venture.
- The health centre breaches privacy when a staff member looks up the record of a student who is a family friend, out of curiosity.
Read each scenario and decide whether it would be a privacy breach the school is responsible for.
A health centre staff member looks at the medical record of a student they know socially, with no clinical reason.
At home, a staff member opens and reads their own teenager's mail.