tyson brennan. 06 november 2025.
Under the Privacy Act 1998, (Privacy Act), photographs, films and other recordings of individuals are considered personal information, and as such, are protected in the same way as other personal information. As the use of digital marketing continues to expand, it is important for schools to ensure that they are publishing content of students with the valid consent of their parents and guardians. This is particularly important in the current circumstances where AI capabilities grow rapidly, and the public access of students’ photographs present evident risks.
Independent schools in Australia are required to manage personal information, such as photographs, in accordance with the Australian Privacy Principles (APPs). These principles include the requirement to be transparent in privacy policies and compliant as to:
The 13 APPs that school policies must comply with are:
Victorian Information Privacy Principles (IPPs) practically mirror the same requirements as a state-based privacy scheme for government schools.
traditional approaches to consent forms
Ordinarily, parents and guardians of students will encounter consent forms in the school enrolment agreements. Whilst these standard-form contracts have been effective in producing consistency and fairness amongst families and reducing administrative burden, the way in which they may disempower parents and guardians from asserting their rights can impact schools’ compliance with the APPs.
The approach to student photographs often resembled the following:
As noted above, privacy clauses, such as those relating to consent for photographic disclosures are often presented as a pre-condition for the provision of services. For example, some clauses will state: ‘by completing this application form, you agree to use using your photograph in advertisements and other communications’. This effectively prevents parents and guardians from accessing any opportunity to deny consent – indeed, the implication of a provision such as this is that if a person seeks to succeed in their enrolment application, it is a requirement for them to agree to the school’s terms. Parents and guardians not hold the requisite bargaining power to decline the pre-conditions that form part of the enrolment agreement.
the issue with traditional methods
Plainly, reliance with the traditional approaches discussed above may not be lawful. Schools that lack valid consent for disclosure yet nonetheless publish a student’s image will very likely find themselves in breach of APP 6. This principle establishes that the relevant entity (i.e. the school in these circumstances), may only use or disclose personal information for the primary purpose for which it was collected, or if the individual has consented to that use or disclosure.
Schools operate to provide education and care, and will therefore necessarily collect student information to provide that education and care. An argument that the publication of student photographs on the school’s website or social media pages is within the primary purpose for the use of student information would is far-fetched.
the relevance of the school’s duty of care
When dealing with the personal information of students, it is important for schools to consider the duty of care owed to students. That is, to take reasonable steps to reduce the risk of reasonably foreseeable harm occurring. This duty is particularly critical in circumstances where the publication of the student’s image would present risks to their safety, as is often the case where there is family violence or other complex issues with their protection. Thus, proceeding to publish photographs of students without valid consent may breach both APPs and the duty of care owed to students
elements of consent according to the Privacy Act
The Privacy Act establishes four elements of consent. Without the satisfaction of these elements, consent cannot be considered valid:
As outlined previously, traditional approaches which treat consent as a pre-condition to student enrolment may no longer be appropriate as they often impact the voluntariness of the consent. Additionally, where the enrolment agreement spans for an extended period of time, it can be argued that the consent, at some point, ceases to be ‘current and specific’.
next steps
Schools should understand that many organisations are yet to catch up with modern privacy requirements. Nonetheless, schools should review their privacy policy and the relevant forms, noting the considerations set out in this article. Ultimately, schools must ensure that they have tailored and compliant consent mechanisms.
