ACARA's privacy policy

Version 7.1, last updated: May 2022

Note:

This privacy policy describes the categories of personal information that ACARA collects and handles in performing its statutory functions. 

If you want to find out about what data we collect as part of our testing programs, go straight to the overview (particularly 3.7–3.9) and part C.

Contents

Overview

1. Scope

Our privacy policy sets out how we comply with our obligations under the Privacy Act 1988 (Cth) (Privacy Act). As an Australian Government agency, we are bound by the Australian Privacy Principles (APPs) in the Privacy Act, which regulate how agencies may collect, use, disclose and store personal information, and how individuals may access and correct personal information held about them.

In our privacy policy, 'personal information' has the same meaning as defined by sub-section 6(1) of the Privacy Act and:

“means information or an opinion about an identified individual, or an individual who is reasonably identifiable:

1. whether the information or opinion is true or not
2. whether the information or opinion is recorded in a material form or not”.

You can access more information regarding how we handle your personal information in Part A, Part B and Part C of this policy, as well as the NAPLAN privacy notice.

2. ACARA’s functions and purposes

The Australian Curriculum, Assessment and Reporting Authority (ACARA) is established under the Australian Curriculum, Assessment and Reporting Authority Act 2008 (Cth) (ACARA Act).

ACARA’s purpose is to be the authoritative source of advice on, and delivery of, national curriculum, assessment and reporting for all Australian education ministers, with international recognition of our work.

Our functions and purposes are described in sections 6 and 40 of the ACARA Act respectively. They are to:

• develop and administer a national school curriculum;
• develop and administer national assessments;
• collect, manage and analyse student assessment data and other data relating to schools and comparative school performance;
• facilitate information sharing arrangements between Australian government bodies in relation to the collection, management and analysis of school data;
• publish information relating to school education, including information relating to comparative school performance;
• conduct research relating to the national school curriculum;
• assist federal, state and territory governments to formulate policies in relation to education matters; and
• formulate national reports consisting of aggregated data on school performance.

We publish a number of national reports consisting of aggregated data on school performance including:

• the annual NAPLAN report;
• the public reports for the National Assessment Program (NAP) sample assessments;
• the annual National Report on Schooling in Australia (the annual report on school education in Australia); and
• aggregated school-level performance and contextualised data on the My School website, updated annually. 

3. Personal information handling practices 

3.1 Collection of personal information

We collect personal information directly from you, or on your behalf from a representative you have authorised (e.g. an employment agency). We collect personal information from people or organisations who work or act on our behalf, such as contracted service providers.

Student and parent/guardian data is collected from state and territory departments of education or state education authorities responsible for NAPLAN testing (test administration authorities). 

ACARA also collects data from other education organisations to assist in NAPLAN reporting and in relation to its other national testing programs, including the NAP sample tests. ACARA may collect data from departments of education (regardless of whether or not they are test administration authorities in their jurisdiction), Catholic systems and independent schools or independent school systems.

3.2 Types of personal information collected by us

We do not collect or hold student and parent/guardian names in relation to the NAPLAN tests (refer to Part C). Student level data collected is not associated with student names. 

We collect student names in 2 test programs:

• The item trialling in limited circumstances (only the Year 3 students who sit the writing test on paper); and
• The NAP Sample Assessments (main study only).

We collect a range of personal information including:

• email and portal subscriber lists – Part A – email and portal subscriber lists (click on the hyperlink for more detail);

• membership details of ACARA’s working and reference groups, advisory and expert panels and Board members;
• stakeholder information collected in our customer relationship management system (Salesforce);
• prospective and current employee records, including sensitive information;
• records of consultants, contractors and creditors, including finance records;
• student and teacher personal information collected in relation to Part B – Australian Curriculum teaching resources (click on the hyperlink for more detail);
• student and parent data (no student or parent names), collected in relation to the reporting of NAPLAN tests – Part C – NAPLAN;
• student data, collected in relation to the NAP Sample Assessments; and
• student data, collected in relation to ACARA’s other testing programs including, for example, trialling and equating tests, research and development tests and other student testing programs conducted in accordance with directions from Education Ministers.

3.3 Collection for authorised purposes

Under section 40 of the ACARA Act, we collect student, teacher or school performance personal information for purposes which are necessary for, or directly related to:

• conducting research relating to the national school curriculum;
• assisting government to formulate policies in relation to education matters; or
• formulating national reports consisting of aggregated data on school performance.

In this policy, we refer to these purposes as ACARA Authorised Purposes.

3.4 Collection of sensitive information

In carrying out our functions under the ACARA Act we collect personal information that is sensitive information. The term ‘sensitive information’ is defined in the Privacy Act, and includes but is not limited to:

• information about racial or ethnic origin (collected for the purposes of formulating national school reports and assisting government to formulate education policies – see Part C of this policy); and
• information about membership of a professional or trade association and health information (collected by ACARA as part of our employee records).

We only collect sensitive information from you if:

• you provide your consent; or
• we are required or authorised by or under law (for example, the ACARA Act authorises us to collect ethnic origin or background information from Test Administration Authorities, Departments of Education, Catholic systems and some independent schools for the ACARA Authorised Purposes); or
• it is necessary to lessen or prevent a serious threat to the health or safety of any individual.

3.5 Remaining anonymous or using a pseudonym

We understand that anonymity is an important element of privacy, and you may wish to remain anonymous, or use a pseudonym, when interacting with us.

In many cases you will be able to advise us that you wish to remain anonymous or use a pseudonym during your contact with us. In circumstances where it is likely that we would need to collect your personal information, such as to resolve a dispute or provide you with a service, we will notify you at the time of collection.

3.6 Notification

When we collect personal information directly from you, we notify you at, or before, or as soon as practicable after, the time of collection.

We collect personal information from the test administration authorities, school systems or schools about a large number of students from all schools around Australia. Due to the very large number of schools and individuals involved, it is not practicable to notify every individual each time we collect personal information. 

For further information, refer to our NAPLAN privacy notice and Part C of this policy.

3.7 What we do with your personal information

Use

We use your personal information to:

• perform our functions and purposes under the ACARA Act;
• assist us in operating our business (e.g. paying our accounts); and
• inform interested members of the public about our activities through our subscriber lists.

We use a customer relationship management system (Salesforce) to assist us to track our communications with stakeholders, including tracking letters, emails, phone calls and contact information (for example, job title, organisation, email address and phone number). We use personal information in Salesforce to (1) improve stakeholder experience and (2) better understand stakeholder sentiment.

Disclosure

ACARA will only disclose student and parent/guardian personal information where consistent with our legal obligations. This includes obligations in any agreement that regulates the ways in which personal information can be used and disclosed by ACARA.

In limited circumstances, we provide detailed data, including student and parent/guardian information, to:

• federal, state and territory departments of education:
• approved researchers upon request. We manage all data requests through our data access request process, details of which are publicly available on ACARA website; and
• the Australian Bureau of Statistics (ABS), where it issues a Notice of Direction to ACARA under the Census and Statistics Act 1905 (Cth); and

• another entity if required to do so by or under an Australian law or a court/tribunal order (for example, a court may order us to disclose personal information if it is relevant and necessary for legal proceedings).

Unless ACARA is required by law to provide information in particular circumstances, we always provide this information under an agreement signed by both parties, which restricts how the data can be used and disclosed.

We do not give personal information about you or your child to third parties for direct marketing purposes.

Contracted Service Providers

Education Services Australia Limited (ESA) operates the platform that will deliver NAPLAN Online (see Part C for more information). We disclose personal information to ESA so that ESA can administer NAPLAN Online. This personal information comprises names and work contact information about key school contacts employed at schools. This might be a school principal or an authorised teacher or administrative staff member. ACARA discloses this personal information:

• for the primary purpose for which it was collected (formulating national reports consisting of aggregated data on school performance); and
• under an agreement with ESA restricting the ways in which the data can be used and disclosed by ESA.

ACARA may disclose information held in Salesforce in limited circumstances including to the Salesforce vendor where technical assistance is required.

3.8 Disclosure of personal information overseas

We may disclose personal information overseas where ACARA:

• publishes on the internet material that may contain personal information, such as our reports and other documents, photographs, video recordings and audio recordings, and posts and comments on our social media platforms;
• engages contractors who are located overseas; or
• corresponds with researchers and education bodies who are located overseas.

We will only disclose your personal information to an overseas recipient after:

• expressly informing you of the potential consequences of providing your consent to the overseas disclosure, and obtaining your consent; or
• another exception to the prohibition against overseas disclosure exists under the Privacy Act. 

The countries to which we may provide personal information will vary depending on the circumstances. 

3.9 Data security

We take reasonable steps to protect the personal information we hold against loss, unauthorised access, use, modification or disclosure, and against other misuse. These steps include password protection for accessing our IT system and securing paper files in locked cabinets. Access to your personal information held by us is restricted to authorised ACARA staff, on a need-to-know basis.

ACARA’s current records management system, network drives and virtual server environment are hosted by ACARA within Australia.

ACARA requires any contracted service providers engaged by ACARA to collect, process or store personal information to maintain appropriate security practices. ACARA’s data breach response plan sets out procedures and clear lines of authority for ACARA staff in the event that ACARA experiences a data breach of personal information (or suspects that a data breach has occurred).

4. Access and correction

You can access the personal information that we hold about you, and you can ask us to correct the personal information we hold about you.

If you request access to the personal information we hold about you, or request that we change your personal information, we will allow access or make the changes unless we consider that there is a sound reason under the Privacy Act, Freedom of Information Act 1982 (Cth) or other relevant law to withhold the information, or not make the changes.

In relation to student and parent/guardian data collected as part of NAPLAN reporting, ACARA is not able to associate or match individual student names with student level data. If you wish to access or correct your child’s personal information or NAPLAN data, contact your child’s school in the first instance.

If we do not agree to provide access to your personal information or to amend or annotate the information we hold about you, then you may wish to:

• make a statement about your requested changes and we will attach this to your record; or
• lodge a complaint with us: see section 5: Complaints regarding the handling of your personal information.

5. Complaints regarding the handling of your personal information

If you wish to make a complaint about how ACARA deals with your personal information, you can complain to us or the Privacy Commissioner. The Privacy Commissioner generally prefers that you raise your complaint with us first. Our Privacy Officer will be able to assist you.

If you are dissatisfied with our response, you can complain to the Privacy Commissioner. The Privacy Commissioner has the power to investigate complaints about possible breaches of the Privacy Act. Contact details for the Privacy Commissioner can be found at (www.oaic.gov.au/about-us/contact-us).

6. How to contact us 

You can obtain further information in relation to this privacy policy, or provide any comments, by contacting us:

Telephone: 1300 895 563 (or from outside Australia +61 2 8098 3100)
Post: refer to the address on our website on the ‘Contact us’ page

Webform: Submit an online enquiry on the ‘Contact us’ page

Note: These calls can be made for a local call cost from fixed residential landlines anywhere in Australia, but calls from mobile and pay phones may incur higher charges. If you are concerned about fees for mobile phone usage, please check with your service provider.

---

Part A. Online collection of personal information

1. Overview

This part A of our privacy policy provides you with information regarding how we collect personal information from our online platforms (including websites). An outline of the other parts of our privacy policy can be found by clicking on the following link: Contents.

2. Collection

ACARA’s public websites are hosted by Microsoft Azure and Adobe Managed Services. The ACARA corporate website, the Australian Curriculum website, the My School website, the My School Principals’ Portal, the National Assessment Program website and the NAP reports are hosted on Azure while the Version 9 Australian Curriculum website is hosted by Adobe Managed Services. These hosting services are located within Australia. For more information, please read Microsoft Azure’s privacy policy and Adobe's Privacy Policy.

Microsoft and Adobe are contractually required to ensure the privacy of our online users is protected.

There are several methods that we use to collect visitor behaviours on each of our online platforms. We use both Google Analytics and Adobe Analytics on our websites. Information and data collected through Google Analytics is stored by Google on servers in the United States of America, Belgium and Finland. For more information, please read Google’s privacy policy. You can opt out of the collection of information via Google Analytics by downloading the Google Analytics Opt-out browser add on.

Information collected through Adobe Analytics is stored on the Adobe servers located in Australia. Adobe’s Experience Cloud uses cookies and similar technologies to enable companies to collect information. Most browsers automatically accept cookies, but you can configure your browser to block all cookies, or to block only those set by companies other than the one whose website you are visiting. If you configure your browser to block cookies, you may prevent a company from collecting information using Adobe Experience Cloud solutions on its websites.

When you visit any of our online platforms, our metric tools may collect the following information about your visit for statistical purposes:

• server address;
• top level domain name (for example .com, .gov, .au, .uk, etc.);
• your internet service provider;
• if you are connecting to our site from a state or territory department of education or a state education authority, the relevant state or territory;
• the date and time of your visit to the site;
• the pages you accessed and documents downloaded during your visit;
• the previous site you visited (if you followed a link on that site which directed you to our site);
• in limited circumstances, if you've visited our site before (but only if you do so from the same computer and browser and have not cleared your cookies in-between visits); and
• the type of browser used and operating system you are using.

Sometimes ACARA issues surveys via SurveyMonkey. Stakeholders can complete surveys anonymously or add contact details if they wish. A link to the SurveyMonkey privacy policy is here.

We record this data to maintain our server and improve our services. We generally do not use this information to personally identify anyone. However, we may need to identify users in the unlikely event of an investigation by a law enforcement agency.

3. Email and portal subscriber lists

We maintain subscriber lists for the purpose of communicating with stakeholders.

You can unsubscribe from our subscriber lists by:

• using the unsubscribe option in our communications
• contacting us

We store subscriber information in compliance with the Archives Act 1983 (Cth). To obtain your personal information stored in our subscriber lists you can contact us.

We do not sell or transfer subscriber lists to third parties for direct marketing or any other purposes.

4. Cookies

Most of our online platforms use sessions and cookies. ACARA uses cookies and other technologies to enhance your online experience. The core functionality on these platforms will be largely unaffected if you disable cookies in your browser but you may be unable to access some advanced functions, particularly on sites which require you to log in. No personal information is stored within ACARA’s websites cookies.

5. Data quality

We will arrange for the deletion or correction of any personal information that we have collected about you as a result of you visiting our online platforms, on your request.

6. Data security

There are inherent risks in transmitting information across the internet and we do not have the ability to control the security of information collected and stored on third party platforms. In relation to our own servers, we take reasonable steps to manage data stored on our servers to ensure data security.

Part B. Personal information and Australian Curriculum teaching resources

1. Overview

This section provides more detail about how we handle your personal information in relation to Australian Curriculum teaching resources. An outline of the other parts of our privacy policy can be found by clicking on the following link: Contents.

2. Australian Curriculum - Student work samples 

Student work samples are published on the Australian Curriculum website as a resource for teachers to support planning and implementation of the Australian Curriculum. The portfolios of student work samples are designed to illustrate different levels of student achievement of the standards.

In relation to some student work samples published on the Australian Curriculum website, we do publish personal information identifying the student (including, but not limited to, photographs, sound recordings and film). We obtain consent prior to publishing these work samples from:

• a parent or a legal guardian (where the student is less than 15 years of age); or
• a parent or a legal guardian and the student (where the student is 15 years of age or older).

3. Australian Curriculum – other teaching resources 

The Australian Curriculum website includes links to films hosted on external platforms such as YouTube including (without limitation) illustrations of primary curriculum management and student diversity. These films have been created by ACARA or its contractor and are presented as resources for principals, schools and teachers. The films provide advice on relevant matters and illustrate how, for example, the Australian Curriculum enables students with diverse needs to access and participate in learning.

Some of the published films contain personal information. This might include, for example, a film of a group of students interacting with a teacher. Prior to publishing these materials, privacy consent is obtained from the relevant parents/guardians/students. 

Part C. Personal information handling practices relating to the National Assessment Program – Literacy and Numeracy (NAPLAN)

1. Overview

This section provides information regarding how we collect and hold your personal information relating to the National Assessment Program – Literacy and Numeracy (NAPLAN) tests. The data is used to report the results of these tests (including on the My School website).

An outline of the other parts of our privacy policy can be found by clicking on the following link: Contents.

A brief overview of the way privacy is managed as part of NAPLAN is summarised in our NAPLAN privacy notice (PDF 48 kb). For further details about testing information handled by ACARA see Overview, Part 3.7 What we do with your personal information.

2.Online tests

NAPLAN online assessments are conducted through a real-time internet connection or onscreen without an internet connection. More information about the move to online NAPLAN assessments is available at the NAP website.

Education Services Australia Limited (ESA) operates the Online National Assessment Platform used for NAPLAN. ESA is a national, not-for-profit company owned by all Australian education ministers. More information about ESA can be found at the ESA website.

The records containing personal information are stored on the platform by ESA on behalf of the relevant state/territory test administration authority. Test administration authorities (and the Queensland Department of Education in respect of Queensland government school data) have responsibility for holding these records.

Data stored on the platform are separated into tenancies, which allows the relevant state/territory test administration authority to retain ownership and control of the records stored within their respective tenancies in the platform. ACARA does not access these records. Data stored may include assessments and data archived for inclusion in a future Longitudinal Data Store.

This part of our privacy policy covers online testing (including Year 3 writing, which continues to be undertaken on paper). A small number of students will continue to use alternative format (paper or electronic PDF) tests, and their data is managed as described in point 4.1 below.

3. Test administration authorities

In addition to ACARA and schools, the key organisations that hold personal information in relation to NAPLAN testing are each state and territory test administration authority. Test administration authorities are responsible for the implementation and administration of the NAPLAN tests in their jurisdiction. Contact details for each state and territory test administration authority are listed on the NAP website.

4. Personal information handling practices

4.1 What we collect

We collect and hold a range of student and school data as part of the NAPLAN datasets, comprising combinations of the following:

• test administration authority identification;
• year level (3,5,7 or 9);
• school identifier and school name;
• student identifier (no names);
• school geographical location classification;
• school sector (government, Catholic, Independent, home school);
• date of birth;
• gender;
• Aboriginal and Torres Strait Islander status;
• language background other than English;
• test participation for each domain (reading, writing, language conventions and numeracy); and
• student question responses, and all statistics and data derived from the student question responses.

We also collect and hold parent/guardian background information as part of the NAPLAN question responses dataset, comprising:

• parent/guardian’s school education;
• parent/guardian’s non-school education; and
• parent/guardian’s occupation group. 

ACARA does not collect or hold student and parent/guardian names in relation to the finalised NAPLAN tests (see above figure). Student and parent/guardian names are held by school systems and schools. Test administration authorities hold student names for their state or territory and, in some instances, may also hold parent/guardian names.

Participating state and territory test administration authorities will upload a more comprehensive set of data, including student names, onto the online platform as part of preparing for online testing. A full list of data fields (including student names) collected on the online platform by ESA on behalf of state and territory education authorities can be found in the technical documentation available on the National Schools Interoperability Program’s GitHub site.

In respect of NAPLAN 2016 and earlier years, ACARA collected additional student and parent/guardian background personal information in relation to NAPLAN. This information is held in a separate dataset. ACARA does not collect these additional data from NAPLAN 2017 onwards. The additional student and parent/guardian personal information that ACARA collected in 2016 and prior comprises:

• student country of birth;
• student main language other than English spoken at home;
• parent/guardian main language other than English spoken at home;
• Australian citizen indicator;
• permanent resident indicator;
• visa sub-class number;
• date of arrival in Australia; and
• student address details (collection stopped prior to 2016).

4.2 Collection of your personal information by schools

In most cases, personal information about students and families is collected by schools from parent/guardians. If you wish to understand how your school deals with personal information, you should familiarise yourself with your school’s privacy policy.

4.3 Collection of your personal information by us

Refer to Overview (heading 3) – Personal Information Handling Practices.

4.4 Use – formulating national reports

Each year, we publish, or assist in the creation of, 5 reports on NAPLAN results, being:

• NAPLAN summary results, published typically in the third quarter of the year of the test;
• NAPLAN national report, or as searchable results, typically published in the fourth quarter of the year of the test;
• School and Student Summary Report, available for NAPLAN online schools only, at the end of the second quarter of the year of the test;
• Individual Student Reports, available for distribution by schools in the third quarter of the year of the test; and
• Aggregated school-level NAPLAN performance data, published on the My School website in the first quarter of the year following the tests.

The preparation of all these reports requires close co-operation between the Test Administration Authorities and ACARA. ACARA is responsible for publishing the NAPLAN summary results and NAPLAN national report. ACARA also publishes aggregated school-level performance data on My School.

We use data to calculate summary data for inclusion in these reports and to enable useful comparisons with similar schools on the My School website. For example, we calculate:

• the index of community socio-educational advantage (ICSEA). ICSEA enables meaningful comparisons of NAPLAN test achievement by schools across Australia. This index enables My School users to gain an understanding of the levels of educational advantage or disadvantage that students bring to their academic studies at individual schools. School level ICSEA data are used by the Australian Government to inform funding for schools with high proportions of disadvantaged students. This dataset contains parental background information in relation to all students enrolled in a school. The ICSEA does not contain any NAPLAN data. We collect this data from a range of sources including the departments of education, Catholic systems and some independent schools; and
• student progress over time. To calculate this progress, test administration authorities provide ACARA with matched data without names (e.g. student A in Year 3 in 2017 and Year 5 in 2019). ACARA calculates and reports the progress at the school level.

The individual student reports are distributed to parents/guardians by their child’s school. We assist the test administration authorities by calculating scaled NAPLAN scores, for inclusion in the individual student reports. We perform this calculation using a range of information (including personal information) collected from the test administration authorities and, in the case of some jurisdictions, the departments of education.

We are always very careful in how we use data to report on NAPLAN results. All NAPLAN school performance data is aggregated before it is published in the NAPLAN national reports and on the My School website.

4.5 Data security

We hold the data referred to in this section of our privacy policy in anonymous form (no names). For general information about data security, see Overview (heading 3.9) - Data security.