Skip Ribbon Commands
Skip to main content
Sign In Skip to Content

Privacy policy

1. Introduction

In Victoria the Privacy and Data Protection Act 2014 (Vic) (PDP Act) and the Health Records Act 2001 (Vic) (HR Act) establish a regime for the responsible collection and handling of personal and health information in the Victorian public sector. As a Victorian public sector agency, the Victorian Curriculum and Assessment Authority (VCAA) is required to comply with these Acts.

The VCAA is a ‘data sharing body’ within the meaning of the Victorian Data Sharing Act 2017 (Vic), and an Information Sharing Entity (ISE) for the purposes of the Child Wellbeing and Safety Act 2005 (Vic) and the Family Violence Protection Act 2008 (Vic).

The VCAA has obligations under the Privacy Act 1988 (Cth) in relation to its collection of Tax File Numbers.

This policy applies to employees, contractors, volunteers and members of the VCAA.

2. VCAA Functions

The VCAA is a statutory authority continued under the Education and Training Reform Act 2006 (Vic) (ETR Act). The VCAA has responsibilities relating to curriculum and assessment across year levels Foundation to Year 12 for all Victorian students.

The VCAA’s functions are set out in s.2.5.3 of the ETR Act and include:

  • the development and evaluation of the curriculum and assessment for the Victorian Certificate of Education (VCE), the Victorian Pathways Certificate (VPC) and of the Victorian Curriculum F-10;
  • the delivery and conduct of VCE assessments;
  • conducting and reporting on the National Assessment Program – Literacy and Numeracy (NAPLAN) for years 3, 5, 7 and 9 students as the Victorian test administration authority;
  • the development of policies, criteria and standards for learning, development and assessments, which relate to early childhood;
  • monitoring patterns of participation by school students and the quality of student outcomes; and
  • preparing and maintaining records of student assessment, and reporting on student achievement.

The VCAA carries out other work, including:

  • the development of tools and instruments (such as the Digital Assessment Library and the Insight Assessment Platform) to assist educators to provide targeted teaching practices;
  • on behalf of the Secretary to the Department of Education (DE), to operate and maintain the Victorian Student Register; and
  • corporate services functions including human resources, finance, legal services and technology infrastructure.

3. Collecting personal and health information

Personal information is defined in the PDP Act and means information or an opinion (including information or an opinion forming part of a database) that is recorded in any form and whether true or not about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion, but does not include information of a kind to which the HR Act applies.

Health information is defined in the HR Act and means information or opinion about a person’s physical, mental or psychological health or disability that is also personal information. This includes information or opinion about a person’s health status and medical history.

The VCAA collects personal and health information about an individual to enable it to perform its statutory functions and comply with its legal responsibilities.

When collecting information directly from an individual, or from someone else about an individual, the VCAA will take reasonable steps to advise the individual at the time of collection:

  • who is collecting the information;
  • what information is being sought;
  • why the information is being collected;
  • whether any law requires the collection of the information;
  • to whom the information may be disclosed;
  • the main consequences if the individual does not disclose the information; and
  • how the individual can contact the VCAA to gain access to the information collected, and request its correction if inaccurate.

4. Use and disclosure of information

The VCAA will uses and discloses personal or health information for the primary purpose for which the information was collected, for a related secondary purpose that an individual would reasonably expect, or for other purposes as permitted by Information Privacy Principle 2, and Health Privacy Principle 2 in the case of health information. For example, personal information can be used for a secondary purpose where the individual has provided their consent, for a law enforcement purpose, or to protect the safety of an individual or the public.

Where information is collected directly from the relevant individual, the primary purpose will be identified at the point of collection.

Refer to Appendix A for a non-exhaustive list of what types of information the VCAA collects, uses and discloses to fulfil its functions.

5. Secure retention of personal and health information in the VCAA

The VCAA has security measures designed to protect personal and health information from misuse, loss, unauthorised access, modification or disclosure. The VCAA complies with the Victorian Protective Data Security Framework.

All personal information and health information held by the VCAA is kept securely for a period nominated in the VCAA Retention and Disposal Authority (PROS 08/10) approved by the Keeper of Public Records pursuant to the Public Records Act 1973 (Vic), after which time the information may be destroyed or retained as a permanent State Record. A general retention and disposal authority covering all Victorian public sector organisations (PROS07/01) can be accessed on the Public Record Office Victoria website.

All student personal information related to student assessment is stored indefinitely on a password-protected database and access is restricted to authorised VCAA employees and some authorised school employees. Authorised restricted access is also provided to employees of the Victorian Registration and Qualifications Authority (VRQA) for the performance of its statutory functions.

Where the VCAA is made aware of a privacy breach, the VCAA will take appropriate steps to inform the affected individual of the breach and also take action to minimise the risk of similar breaches occurring in the future.

6. Offsite and geographically remote software and data storage

In some circumstances the VCAA may collect, transfer and store personal information in an electronic format using applications and services owned and operated by third party service providers. Some personal information may be collected in ‘social media’ applications owned and operated by third party service providers. In these and other formats, the VCAA ensures that any such collection, transfer and storage of data is consistent with the PDP Act, and in particular with its provisions relating to outsourcing and transfer of information outside Victoria.

7. Data quality

The VCAA takes reasonable steps to ensure that the personal and/or health information it holds is accurate, complete and up-to-date. The VCAA relies on individuals to provide accurate and current information in the first instance, and to notify us when circumstances or details change so that we can update our records accordingly.

8. Unique identifiers

The VCAA assigns a unique identifier for an individual where it is necessary to enable the VCAA to perform its functions efficiently.

The VCAA assigns a Student Number to all Victorian students enrolled in VCE, VET and the VPC. The Student Number is printed on exam papers and is disclosed to and used by the Victorian Tertiary Admissions Centre as a linkage key when calculating a student’s ATAR. The Student Number is also disclosed to the student’s school.

The VCAA adopts a unique identifier of an individual that has been assigned by another organisation in the following circumstances:

  • it is necessary to enable the VCAA to perform its functions efficiently; or
  • the VCAA has obtained the consent of the individual.

The VCAA is an authorised user of the Victorian Student Number (VSN). The VSN is a student identification number assigned by the Secretary to the Department of Education to all students in government and non-government schools, and to students below the age of 25 undertaking Vocational Education and Training with a TAFE, Registered Training Organisation or Adult and Community Education provider. For further information about the Victorian Student Register, see The Victorian Student Number page.

9. Anonymity

In most instances it will be necessary for the VCAA to obtain information that identifies individuals in order to fulfil its functions.

Where possible and lawful, the VCAA will provide an individual the option of not identifying themselves when dealing with the VCAA.

10. Sensitive information

Sensitive information is defined in the PDP Act and means information or opinion (that is also personal information) about a person’s racial or ethnic origin, political opinions or associations, religion, philosophical beliefs, sexual preferences or practices, professional/trade association or trade union, or an individual’s criminal record.

The VCAA will only collect sensitive information in limited circumstances, and consistently with the PDP Act.

11. Access and Correction

Individuals have the right to seek access to their personal and health information held by the VCAA under Information Privacy Principle 6 and Health Privacy Principle 6.

Most requests for access to and/or correction of documents containing personal or health information will be handled in accordance with the Freedom of Information Act 1982 (Vic) (FOI Act).

Requests for access to and/or correction of personal and health information held by the VCAA should be made in writing to: 

The Freedom of Information Officer
Victorian Curriculum and Assessment Authority
Level 7, 2 Lonsdale Street
MELBOURNE VIC 3000
vcaa.foi@education.vic.gov.au

Where such requests are received, the VCAA will first take appropriate steps to verify the identity of the individual who has made the request.

Further information about making an FOI request is available on the Freedom of Information (FOI) page.

The VCAA makes available a range of information to former students enrolled in senior secondary education for a fee, such as replacement certificates. Further information is available on the Past and adult students page.

12. Complaints Handling Procedures

12.1 Contacting the VCAA

The VCAA will make every attempt to resolve queries or complaints about privacy through direct communication with the person/s concerned. First contact should be made through the VCAA Legal Services Unit: vcaa.privacy@education.vic.gov.au.

If a complaint cannot be resolved to the satisfaction of the complainant through informal discussion, a written complaint should be lodged with the VCAA.

12.2 Lodging a complaint in writing

Written complaints must be lodged with:

The Manager, Legal Services Unit
Victorian Curriculum and Assessment Authority
Level 7, 2 Lonsdale Street
MELBOURNE VIC 3000
Or by email: vcaa.privacy@education.vic.gov.au

Details to be provided in the complaint should include:

  • the name and address of the person lodging the complaint;
  • the nature of the privacy complaint,
  • attempts made to resolve the complaint informally; and
  • if applicable, how the complainant believes the complaint could be remedied.

12.3 Confirmation from VCAA

Within 14 days of receipt of a complaint, the VCAA will:

  • confirm the receipt of the complaint in writing;
  • inform the complainant that an investigation will be conducted and a response provided as soon as practicable, but as far as possible, no more than 45 days from the day the complaint is received at the VCAA; and
  • commence an investigation into the complaint.

12.4 Investigation and response

Following an investigation into a written complaint, the VCAA may:

  • respond to the complainant that no further action will be taken on the matter; or
  • make a formal apology to the complainant; and/or
  • take such remedial action as thought appropriate by the VCAA; and/or
  • provide undertakings that the conduct will not occur again; and/or
  • implement administrative procedures within the VCAA to ensure that the conduct will not occur again.

Where a written complaint is made, the VCAA will inform the complainant of his/her right to lodge a complaint with the Office of the Victorian Information Commissioner if the complaint is not resolved.

For more information

VCAA

VCAA website

Contact the VCAA Privacy Officer by email: vcaa.privacy@education.vic.gov.au

Others

Office of the Victorian Information Commissioner

Office of the Health Complaints Commissioner

Department of Education

The Victorian Ombudsman.

Related Information

Website Privacy Statement

Appendix A - Information collected and used by the VCAA

This is a non-exhaustive list of what kind of information the VCAA collects, uses and discloses. When the VCAA collects information, a collection notice is provided, to explain why the information is collected and how and to whom it will be used and/or disclosed.

1. Student Information

1.1 VCE, VPC, GAT and IB enrolment and assessment

Students who enrol for the VCE, the VPC, General Achievement Test (GAT) and International Baccalaureate (IB) in Victorian schools complete Student Personal Details forms which are used by schools to input or verify information on the VCAA’s student assessment database known as the Victorian Assessment Software System (VASS). The personal details of students who sit NAPLAN tests is also collected by schools and used by the VCAA.

Access to this information is restricted to authorised school employees and authorised VCAA employees engaged in the management of the student enrolments and assessments. At various times the authorised employees in schools and in the VCAA may use student information to manage the enrolment records and to create and maintain student assessment records. Schools may also extract student personal information from VASS and process this to provide advice to teachers and school administration on educational outcomes and the efficacy of teaching approaches. Personal information so extracted, and its management, becomes the responsibility of the school and subject to the privacy legislation applicable to the school. In the case of Victorian government schools this is the PDP Act. In the case of non-government schools this may be the Commonwealth Privacy Act 1988, if that Act applies.

The VCAA uses the assessment data to generate results for students in the course of their VCE and VPC. These results are reported to students and provided to schools and in the case of senior secondary programs are the basis for certification for VCE and VPC.

Student personal information for VCE, VPC, GAT and IB students and final VCE, VPC and GAT results are disclosed to the Victorian Tertiary Admissions Centre (VTAC) for calculation of Australian Tertiary Admissions Rankings (ATARs) and processing of applications for tertiary selection. The VTAC also includes the information provided by the VCAA in its CourseLink database, a password protected, interactive, web-based program enabling VCE and VPC students to access their own individually tailored career and course options.

The Student Personal Details form requests information about a student’s Overseas Student status, hearing impairment, Aboriginal and Torres Strait Islander status, and whether they speak English as a Second Language. The ‘VCAA Collection Notice for Students’, provided at the point of collection, notes the purposes for which this information is collected.

1.2 Digital Assessment Library registration and assessment

The Digital Assessment Library (DAL) is an online assessment platform operated by the VCAA for use by teachers and students in Victorian schools. The DAL supports teaching and learning by identifying student learning opportunities and informing teaching practice, research and system wide policy development.

The DAL will enable teachers to assess student performance over time in a range of learning areas. Assessments will be delivered to classes of F-10 students at the school’s discretion (or as determined by DET policy for government schools).

Schools provide information about students so that the VCAA can create DAL student user accounts, uploading the information on enrolment at the school, or in the case of some government schools, by manual data entry.
Student information may include:

  • student name
  • student date of birth
  • student gender
  • local school identifier
  • student school
  • student year level
  • student enrolment time fraction
  • student home group.

When students take tests on the DAL, their results are stored with their information.

Teachers are required to provide personal information to create their own accounts in the DAL.

Access to student personal information and results in the DAL is restricted to school employees (as determined by the school), authorised VCAA employees engaged in the management of the DAL, and authorised VCAA contractors. Access by contractors is necessary to manage the DAL platform and support IT infrastructure.

Authorised school and VCAA employees may access and use student personal information and results in the DAL to manage school registration, to create and maintain student user accounts and assessment records, and to produce assessment reports at student, class and school level. Schools will have access to all current and past assessment results for all current students, regardless of the school the student attended at the time of the assessment.

Schools’ access, use and disclosure of personal information (including assessment results) from the DAL is subject to applicable privacy legislation. In the case of Victorian government schools this is the PDP Act. In the case of non-government schools this may be the Commonwealth Privacy Act 1988, if that Act applies.

The VCAA uses assessments to generate progressive student results. These assessment results are reported to schools, who may communicate results to students.

The VCAA discloses identifying information about students and student results in the DAL to facilitate analysis, research and planning on condition that it is used and disclosed in accordance with privacy laws:

  • about government school students, to the Department of Education or its successor bodies.
  • about Catholic school students, to the relevant diocesan body, such as the Victorian Catholic Education Authority (VCEA) and Melbourne Archdiocese Catholic Schools Ltd

Personal information collected in the DAL will not otherwise be used or disclosed by the VCAA, except with the prior consent of the individual, or if the VCAA is required or otherwise permitted by law to do so.

1.4 Enrolment amendments

Where a student makes a late amendment or any other change to their enrolment they will complete a form which contains some personal details. This information is used to make amendments to the student’s enrolment records. The information is input directly into VASS. Where a student seeks exemption from sitting the GAT they also provide personal information to the VCAA. This information is input to VASS.

The VCAA advises schools to either destroy VCAA enrolment forms and enrolment amendment forms after inputting to VASS or to retain them securely as hard copies according to the applicable archiving and disposal schedules.

1.5 Post-results and ATAR Service

After the release of VCE results in December the VCAA and the VTAC jointly conduct the Post-Results and ATAR Service (PRAS). Students may contact this service for advice about their results (but not to request the results). Authorised VCAA and VTAC employees may access the student records of students who contact this service to respond to their queries.

1.6 Examination and assessment incidents

Authorised VCAA employees may access VCE students’ personal and sensitive information (as defined in the PDP Act) stored in the VCAA’s password-protected database and use this information in dealing with alleged breaches of VCAA examination rules, student appeals and teacher error claims in relation to the delivery of the VCE assessment program. Information which is generated from these processes is stored securely electronically and in hard copy.

1.7 Special provision

Schools or students who apply for special provision provide personal information and health information which is used by the VCAA to evaluate and decide upon the merits of that application and future applications for the same student. Access to this information is restricted to VCAA employees required to make the decision and professionals engaged by the VCAA to advise it on the application. These applications are kept securely by the VCAA.

1.8 Enrolment and assessment related payments

Students may be asked to pay a fee for certain transactions related to their results including issuing a replacement result certificate or a statement of marks and equivalent qualifications or the purchase of recordings of Season of Excellence performances (see below). Personal and financial details collected in these transactions are personal information under the PDP Act. The payment for these services may be made in cash or by e-commerce.  E-commerce transactions performed either at the VCAA’s premises or through the VCAA’s website involve the collection of personal information and may involve disclosure of the applicant’s personal information to the VCAA’s bank – currently the National Australia Bank and Westpac Banking Corporation.

The National Australia Bank's Privacy Statement may be viewed at its website. The Westpac Banking Corporation’s Privacy Policy is available at its website.

1.9 VCE Season of Excellence

In the management of the VCE Season of Excellence (Season), VCAA employees use application forms to collect personal information directly from students who express interest in participating in the Season program. This information may be disclosed to the State Reviewer, Chief Assessor of the relevant VCE studies or panel members involved in the selection of work for Season exhibitions and performances if required. Information is stored electronically and in hard copy and only accessed by authorised VCAA employees. Some information is passed on to the National Gallery of Victoria (for the Top Arts component) and the Melbourne Museum (Top Designs) and DE Communications Division for the purpose of administering and/or publicising the Season.

As part of the presentation and promotion of the Season of Excellence, images of participants may be used in publications such as venue programs, the VCAA website, the VCE Bulletin and the VCAA Annual Report. Permission is sought from Season participants to publish these images.

All student work and personal information submitted for the Season is kept securely. All student works are returned to the student. For those whose application is not accepted, the information is shredded within four months of their application and any work submitted in support of the application is either returned to the student or, with permission, disposed of securely.

1.10 NAPLAN

The VCAA is the National Assessment Program – Literacy and Numeracy (NAPLAN) Test Administration Authority (TAA) for all Victorian schools and school sectors. In order to fulfil its responsibilities as TAA for Victoria, the VCAA collects the names and a range of other background information on all Year 3, 5, 7 and 9 students who are eligible to participate in the program. This information is used for a range of purposes including pre-printing student names on the test booklets and later in the production of parent and school reports for Victoria.

The VCAA provides Victorian student results data to the Australian Curriculum, Assessment and Reporting Authority (ACARA) so that it can prepare national reports related to the outcomes of the NAPLAN tests.

Further information about the collection, use and disclosure of information in the course of administering NAPLAN is available on the NAPLAN Test Administration website.

1.11 Early Years Research and Resources

In the management of multidisciplinary practitioner research projects and resource development, the VCAA collects personal information directly from early childhood professionals working in birth to 8 years services and schools, and from children and their families. This personal information may be in the form of names and contact details, work completed by children including images, records, analysis and the opinions of professionals derived from their work with children. Some of this information may be used in the publication of project reports and development of other resources with the consent of the professionals, children and their families.

Personal information is stored securely and is accessed by VCAA, DE and authorised external researchers commissioned by the VCAA to conduct research.

1.12 The Victorian Curriculum F-10

For the purposes of supporting the development and implementation of the Victorian Curriculum F-10 – and providing timely, appropriate and accurate advice and support to teachers and schools, the VCAA collects and where appropriate publishes annotated student work samples. All student work samples are collected with consent from students’ parents/guardians, and completed permission forms are kept with the student’s work sample. All published student work samples are annotated and de-identified prior to publication.

The VCAA created and maintains the F-10 Curriculum Update mailing list for teachers. Only VCAA administrators can access the password protected list. The mailing list is available only to authorised VCAA? employees. Once a year, members of the list are asked to confirm their wish to continue receiving updates (that is, to opt in to the list again).

1.13 Awards and recognition of high achievement

Depending on the nature of their enrolment, students may be asked to consent to the release of some of their personal information:

  • to the media, if they have a VCE study score of 40 or higher;
  • to relevant government departments for the selection of students for the Premier’s VCE Awards and the Australian Students’ Prize;
  • to the DE for its On Track Project.

Students may also be asked to consent to the use of materials, produced by them for assessment in their course, in publications or productions approved by the VCAA.

1.14 VCAA Plain English Speaking Award

The VCAA receives applications every year from students wishing to enter the Plain English Speaking Award. The applications, which contain personal information, are used to manage the students’ participation in the competition. The applications are then disposed of securely.

1.15 Margaret Schofield Scholarships

Every year the VCAA seeks applications containing personal information from government school students of VCE Music Performance and/or VCE Music Investigation, for the Margaret Schofield Scholarships. Access to this personal information is restricted to authorised VCAA employees and a panel which selects the successful applicants. The applications are securely disposed of at the completion of this process.

1.16 Lynne Kosky Memorial Applied Learning Grants

The VCAA invites nominations each year for grants to provide financial stimulus to providers of VCE Vocational Major and Victorian Pathways Certificate providers to develop learning initiatives for students. The VCAA collects information from applicants for the purposes of awarding and publicising the grants.

1.17 VCAA VCAL Achievement Awards

The VCAA invites nominations every year from students, teachers and VCAL partners for a number of VCAL Achievement Awards. The applications seek personal information about both students and teachers involved in VCAL programs, individuals in partner organisations, and testimonials about the programs. They are often initiated by a third person, and the nominee confirms they wish the nomination to proceed. Further personal information may be collected from individuals. On completion of the awards process the applications are disposed of securely.

1.18 Occasional surveys

The VCAA from time to time may use surveys to collect personal information directly from individuals for the purpose of assisting in curriculum or program reviews. In order to conduct its duties in research and evaluation, the VCAA uses statistical data and personal information from VASS. Most often this is aggregated and de-identified. The data is stored and disposed of securely.

2. Education sector contacts

2.1 VASS and DAL administration

The VCAA collects personal information including the name, school name and contact details of school and non-school provider VASS and DAL administrators who manage the VASS and DAL databases and the inputting of information at the school/provider level. Similar information is collected from VASS and DAL administrators to facilitate their access to a VASS Forum and for VASS related professional development classes.

2.2 VCE Study Review Panels and similar reference groups

The VCAA collects personal information directly from individuals who have expressed an interest in participating in the development of study designs or learning programs. The information is only used to facilitate these purposes. Some of this personal information may be published in the VCAA Bulletin, on the VCAA website and in the Annual Report of the VCAA. Otherwise, access to the data, in electronic format and hard copies, is restricted to authorised VCAA employees and the VCAA Board and its committees. It is securely archived.

2.3 VCE VET referral service

The VCE Vocational Education and Training (VET) Unit collects information directly from individuals for the purpose of providing a referral service comprising contractors, sessional employees, consultants and teachers involved in developing and teaching VCE VET programs. The information is disclosed to people involved in these networks mainly through publications produced by the Unit. It is stored electronically and deleted when the services of the individual are no longer required or approval is withdrawn.

3. VCAA employees, volunteers and Authority members

The VCAA collects information for the purposes of assessing and recommending prospective Authority members, and for communicating with and paying Authority members.

Ongoing and fixed-term personnel at the VCAA are employees of the Secretary to the Department of Education. The VCAA collects and uses personal and health information about these employees (and applicants for employment) and discloses this information to DE Corporate Human Resources for the purposes of recruitment, selection and employment including payment, leave and entitlements. The VCAA otherwise discloses this information as permitted by the PDP Act and the Health Records Act.

The VCAA directly employs fixed-term (‘sessional’) and casual employees under the ETR Act, and collects and uses personal and health information for recruitment and selection and employment purposes.

4. Personal information collected from other stakeholders

Personal information about members of the public who are not currently students, employees or commercial providers, may be collected by the VCAA in the conduct of its functions, for example in answering queries from past students or members of the public about the functions of the VCAA, or when working with teachers or education professionals while researching curriculum and assessment matters.

The VCAA collects information from subscribers to the VCE Bulletin and other publications to maintain mailing lists. This information is stored and updated electronically for an indefinite period and may be provided to external mail houses for mailing purposes. All mail houses are required to destroy this data after a fixed period.

The VCAA may seek permission from individuals including students, teachers and parents/guardians to make and/or use photographs and audio/visual recordings, for example at awards events, to promote VCAA programs. Permission is obtained to make and/or use these representations.