Obtaining and managing student and individual consent procedure

Audience

Department-wide

Purpose

To ensure schools, regional offices and Department of Education (department) divisions are aware of their responsibilities and the process to obtain and manage student and individual consent, for:

• the use of a student, employee or volunteer’s (an individual’s) copyright materials by the State (through the department or school) for day-to-day school activities and for stand-alone projects/events
• the recording, use or disclosing of an individual’s personal information to a third party beyond what is already authorised or required by law

Overview

The department (the State) can use copyright materials and or record, use or disclose personal information as required or authorised by:

• the Copyright Act 1968 (Cwlth)
• Education (General Provisions) Act 2006 (Qld) (EGPA)
• another law
• with the individual’s express or implied consent.

Before using an individual’s copyright materials or recording, using or disclosing their personal information, consent must be gained from the individual or their parent/carer by the relevant departmental employee. In some instances the department may be required by the EGPA or another law to record, use or disclose personal information about an individual, without consent.

Consent is valid if it is:

• Voluntary – the person giving the consent knows that they do not have to give consent and that there will be no adverse consequences if they do not give consent.
• Informed – the consenting individual knows how their copyright works will be used, and/or, what, how, to whom and under what conditions, their personal information will be recorded, used or disclosed before agreeing.
• Specific – consent must be specific and identify the activities, information and parties that it will cover.
• Current – the consenting individual must be advised of the specified period for which the consent will be relied on, and how a person can revoke consent.

Note: students under 18 years living independently, who have sufficient maturity and intelligence to understand how the school or department will use their copyright works, or the consequences of any agreed recording, use and disclosure of their personal information, may sign the consent form. An agreement in respect to use of copyright materials, signed by a person under 18 years, may not be binding.

Images and recordings of students and staff can be used on a variety of platforms. A list of initiatives and online accounts is available on the departmental website.

Unauthorised recording/collection, use or disclosure of personal information

An employee’s decision to record, use or disclose a State school student’s personal information without valid consent may breach the confidentiality provisions in the EGPA, which carries a maximum penalty of 50 penalty units. A decision to disclose personal information by a public service employee in breach of the EGPA may amount to misconduct as defined in s.187 of the Public Service Act 2008 (Qld) and corrupt conduct as defined in s.15 of the Crime and Corruption Act 2001 (Qld). In addition, this action may also breach the department’s Code of Conduct and Standard of Practice.

Section 408E of the Criminal Code Act 1899 (Qld) establishes computer hacking and misuse as a criminal offence with a maximum term of imprisonment of from two to ten years depending on the specifics of the offence. Hacking and misuse may also amount to official corruption (s. 87 of the Criminal Code Act 1899 (Qld)), abuse of office (s. 92) and/or misconduct in relation to public office (s. 92A). It may result in referral to the Queensland Police Service and/or the Crime and Corruption Commission and could also fall within the definition of misconduct under s. 187 of the Public Service Act 2008 (Qld) or corrupt conduct as per s. 515(i) of the Crime and Corruption Act 2001 (Qld). In all cases, it may result in the subject officer being subject to disciplinary action.

Collection, use and disclosure of personal information about individuals (excluding State school students), is also subject to the requirements of the Information Privacy Act 2009 (Qld) (IP Act). A breach of the provisions of the IP Act may also have disciplinary consequences for staff.

Associated consent processes and forms

This procedure outlines the responsibilities and processes for the State School Consent Form, Staff and Volunteer Consent Form and Project Consent Form. Please see the following guidelines and consent forms for the administration of Highly Accomplished and Lead Teacher Certification and Renewal consent and Online Services consent. 

Highly Accomplished (HAT) and Lead Teacher (LT) certification and renewal consent

The Guideline for obtaining and managing consent for Highly Accomplished and Lead Teacher Certification and Renewal of Certification details the specific responsibilities and processes that must be adhered to by teachers intending to apply for this certification or at renewal. The HAT and LT Certification and Renewal of Certification Consent Form must also be used for this purpose.

Online Services consent

The Guideline for obtaining and managing consent for Online Services details the specific responsibilities and processes that must be adhered to by school staff before disclosing students' personal information to non-departmental online services. The Online Services Consent Form (DoE employees only) must also be used for this purpose.

Responsibilities

Principals

• Understand and oversee all responsibilities of students and school staff consent as outlined within this procedure including how to use the OneSchool Consent Management Module (DoE employees only).
• Oversee and approve business processes to track the collection and use of consent using the consent forms.
• Ensure that information collected from the consent forms is entered into OneSchool and subsequent limitations or withdrawals to the consent are noted in OneSchool and are observed and complied with.
• Request that a Staff and Volunteer Consent Form is completed at the commencement of engagement to ensure that consent is obtained before sharing images and/or details of school staff, parent or community volunteers. Yearly reviews of staff and volunteer consent should be undertaken to ensure the consent remains valid. The collection and management of consent should adhere to the process for the collection of the State School Consent Form, with a copy of the form saved in the relevant file.
• Approve all requests from media outlets and production companies after contacting the central office media unit - media@qed.qld.gov.au for advice.

School staff

• Follow the ‘Process for gaining consent’ outlined in this procedure including how to use the OneSchool Consent Management Module (DoE employees only).
• Ensure the State School Consent Form is completed at the time a student enrols and that parent/carers are aware that this can be amended at any time.
• Ensure the consent is valid (i.e. voluntary, informed, specific and current).
• Ensure the student and/or parent/carer (if the student is under 18 and unable to give consent) has given consent before:
  • using their copyright works unless the use of the works is permitted under the statutory education licence or copyright exception. Refer to the National Copyright Guidelines
  • the recording, use or disclosure of personal information unless for a purpose of the EGPA or otherwise permitted or required by the EGPA or another law (see Overview section and Consent FAQs).
• Remind parent/carers that it is not compulsory to provide consent and there are no penalties if consent is withheld.
• Ensure any limitations to the consent are noted in OneSchool and considered before using or disclosing the students’ image or material for an intended purpose, to ensure the limitations are not breached.
• Note further consent may be required for special events or unforeseen activities like projects, filming and competitions if they are not specified on the State School Consent Form.
• Notify parent/carers if third parties (e.g. production companies) wish to film or photograph students and provide the third party consent form to parent/carers for consideration and signing.
• The onus is on school staff to check if existing consent allows for the proposed use and what name parent/carers’ have specified on the State School Consent Form before disclosing the students’ details to the media.
• School staff must seek additional consent if necessary and ensure consent is gained by the production companies for each individual involved in the activity using the production companies consent form.
• If a parent/carer/student limits or revokes their consent by notifying the school in writing (email or letter), staff must provide written receipt of this via email, where an email address is provided.
• Manage consent records in accordance with the Information asset and recordkeeping, Information privacy breach and privacy complaints procedure, and Information security procedures.
• Ensure students are not identified by their full name on social media sites through associated posts, comments or tagging. It is considered best practice to only publish first or last names online. Please refer to the Social media for school and departmental promotion procedure for further information.
• Schools must not use image hosting sites such as Vimeo, Pinterest, Flickr, Picasa, Image Shack, Snapchat, Tumblr or the like. Please refer to the Social media for school and departmental promotion procedure for further information.
• School staff must comply with the department’s Code of Conduct and Standard of Practice when using social media. Staff should not upload pictures of students (excepting their own children) or school staff onto their own social media accounts without consent. The ‘Appropriate use of social media’ and ‘Employee interactions with students’ sections in the Standards clearly outline expectations of departmental employees.

Directors/Project Supervisors

• Understand and oversee the responsibilities of departmental staff outlined within this procedure.
• Oversee and approve business processes to track the collection and use of the individual’s consent using the Project Consent Form.
• Ensure any limitations to the consent are noted, observed and complied with.

Departmental staff

• Ensure that a signed Project Consent Form is collected for all participants (including students, employees and volunteers) at the beginning of a project.
• Ensure the consent is valid (i.e. voluntary, informed, specific and current).
• Ensure the participant (student and/or parent/carers on behalf of students, employee and volunteer) has given consent before:
  • using their copyright works unless the use of the works is permitted under the statutory education licence or copyright exception. Refer to the National Copyright Guidelines
  • the recording, use or disclosure of personal information unless for a purpose of the EGPA or otherwise permitted or required by the EGPA or another law (see Overview section and Consent FAQs).
• Remind participants (students and/or parent/carers on behalf of students, employees and volunteers) that it is not compulsory to provide consent and there are no penalties if consent is withheld.
• Departmental staff must note any limitations to the consent and consider these before using or disclosing the participants’ image or material for the project, to ensure the limitations are not breached.
• Manage consent records in accordance with the Information asset and recordkeeping, Information privacy breach and privacy complaints procedure, and Information security procedures.
• Ensure participants are not identified by their full name on social media sites through associated posts, comments or tagging. It is considered best practice to only publish first or last names online.
• Departmental projects/events must not use image hosting sites such as Vimeo, Pinterest, Flickr, Picasa, Image Shack, Tumblr or the like. Please refer to the Social media for school and departmental promotion procedure for further information.
• Staff must comply with the department’s Code of Conduct and Standard of Practice when using social media. Staff should not upload pictures of students (excepting their own children) or school staff onto their own social media accounts without consent. The ‘Appropriate use of social media’ and ‘Employee interactions with students’ sections in the Standards clearly outline expectations of departmental employees.

Process

There are five consent forms available for use by departmental staff. Please select the appropriate consent form to meet your purpose.

State School Consent Form

• The State School Consent Form covers the recording, use and disclosure of students’ personal information and use of student copyright materials during the day-to-day educational activities (including school intranet and social media). This form is to be signed by parent/carers upon enrolment of a student.

Staff and Volunteer Consent Form

• The Staff and Volunteer Consent Form covers the recording, use and disclosure of staff and volunteer’s personal information and use of their copyright materials during day-to-day educational activities (including school intranet and social media).
• The collection and management of staff and volunteer consent should adhere to the process for the collection of the State School Consent Form.

Project Consent Form

• The Project Consent Form is used for stand-alone projects or events managed by departmental areas, where consent to use, record and disclose an individual’s information is required. It cannot be used by schools in lieu of the State School Consent Form. The Project Consent Form is to be signed by participants (students and/or parent/carers on behalf of students, employees and volunteers) involved in the project or event.
• For more information on the consent forms see the Consent FAQs.
• Consent forms cannot be shortened or changed. Please contact Strategic Communication and Engagement should you have queries related to these templates.
• The consent forms within this procedure are not suitable in all instances where the consent of the individual is required to record, use and disclose their personal information. Many departmental procedures incorporate consent as part of the documentation tailored to a particular situation (e.g. transfer of state school student’s records to a school in another state), however relevant departmental procedures specifically refer staff to the consent forms within this procedure.

HAT and LT Certification and Renewal of Certification Consent Form

• The HAT and LT Certification and Renewal of Certification Consent Form must be used by teachers applying for the Highly Accomplished and Lead Teacher Certification or Certification Renewal.
• The consent form should be used in conjunction with the Guideline for obtaining and managing consent for Highly Accomplished and Lead Teacher Certification or Certification Renewal.

Online Services Consent Form (DoE employees only)

• The Online Services Consent Form must be used to obtain consent for disclosure of information to and use of online services.
• The consent form should be used in conjunction with the Guideline for obtaining and managing consent for Online Services. 

Process for the State School Consent Form

1. Schools must complete necessary information in the Introduction to the State School Consent Form and the State School Consent Form. Schools cannot use the Project Consent Form as this does not specify school-based platforms and specific activities.
2. The consent process can occur using the hardcopy State School consent form, or schools can use the OneSchool Consent Management Module (DoE employees only) to:

• create a digital state school consent form;
• seek consent through QParents; and
• digitally record, track and manage consent.

3. Hardcopies must be distributed to parents who do not use QParents.
4. The following information must be completed on the Introduction to the State School Consent Form, which is issued on school letterhead:

• date and school name
• media sources used: list the school’s website, Facebook, YouTube, Instagram, Twitter and LinkedIn accounts, as appropriate
• who to contact: insert the name, role, phone number and email address of the person who should be contacted if parent/carers have questions regarding consent.

5. Further activities that the consent form may need to cover must be completed in Section 4 ‘Timeframe for consent’. These should only be activities not covered by the range of regular activities outlined in the Introduction to the State School Consent Form.
6. Collect a consent form permitting the school to use student’s copyright materials and/or, to record use or disclose their personal information, signed by:

• the student/employee/volunteer if 18 years or more
• the parent/carer of a student/volunteer under 18 years (a child)
• the parent/carer and the student or volunteer, if the student or volunteer is under 18 years and has sufficient maturity and intelligence to understand what is proposed
• the student under 18 years if the student is living independently and has sufficient maturity and intelligence to understand how the department will use their copyright works, or to understand the consequences of any agreed recording, use and disclosure of their personal information.

Note: students under 18 years living independently who have sufficient maturity and intelligence to understand how the school or department will use their copyright works, or to understand the consequences of any agreed recording, use and disclosure of their personal information may sign the consent form. An agreement in respect to use of copyright materials, signed by a person under 18 years, may not be binding.

7. File the completed consent form in the student’s file or other storage/retrieval system and record consent, including any limitations in OneSchool.
8. Ensure the consent is current, by reminding parent/carers periodically (e.g. at the start of every school year) that they may review, limit or revoke consent.

Limiting/revoking consent

1. Parent/carers/students may limit their consent at any time.
2. Parent/carers/students wishing to limit their consent should notify the school in writing (email or letter). The school will provide written receipt of this via email, where an email address is provided.
3. Schools must ensure limitations to the consent are noted in OneSchool and considered before using or disclosing the students’ image or material for an intended purpose, to ensure limitations are not breached. Noting all records (databases/OneSchool) dependent on the terms of the consent should be updated each time the consent is renewed, modified or revoked.
4. Record and store in an accessible format, all instances where the individual’s consent is limited, withheld, withdrawn, modified, contains specific exclusions or is made conditional.
5. Parent/carers/students wishing to revoke consent should notify the school in writing (email or letter). The school will provide written receipt of this via email, where an email address is provided, or by letter.
6. After a notice to revoke consent is received, the school will not be able to make any ‘new’ use of the student’s personal information or student work.
7. Due to the viral nature of the internet, including social media, consent cannot be fully revoked as it may not be possible to ensure that all copies of the material are deleted or cease to be used.

Additional information regarding the State School Consent Form

1. Additional consent must be obtained if a school wishes to further use an individual’s copyright works and/or to record, use or disclose personal information for a purpose:

• not clearly covered by the original consent (State School Consent Form)
• not authorised or required under the EGPA or another law (e.g. assessment for moderation).

2. If there is any doubt about the schools’ lawful authority to use a student’s copyright work or to record, use or disclose their personal information, schools are advised to obtain written consent again, or not to use the personal information/material.

Process for the Project Consent Form

1. Relevant departmental staff must complete the Project Consent Form to provide individuals with a description of the purpose and specific activities to be undertaken.
2. Ensure that the completed Project Consent Form is sent to participants (including students and/or parent/carers on behalf of students, employees and volunteers) at the beginning of the project and/or event.
3. Collect the consent forms permitting the department to use student, employee or volunteer’s copyright materials and/or, to record, use or disclose their personal information, signed by:

• the student/employee/volunteer if 18 years or more
• the parent/carer of a student/volunteer under 18 years (a child)
• the parent/carer and the student or volunteer, if the student or volunteer is under 18 years and has sufficient maturity and intelligence to understand what is proposed
• the student under 18 years if the student is living independently and has sufficient maturity and intelligence to understand how the department will use their copyright works, or to understand the consequences of any agreed recording, use and disclosure of their personal information.

Note: students under 18 years living independently who have sufficient maturity and intelligence to understand how the school or department will use their copyright works, or to understand the consequences of any agreed recording, use and disclosure of their personal information may sign the consent form. An agreement in respect to use of copyright materials, signed by a person under 18 years, may not be binding.

4. File all completed consent forms in HPE Records Manager (for central office and regions) and the project/event file.

Revoking consent

1. Participants (students and/or parent/carers on behalf of students, employees and volunteers) wishing to revoke consent should notify the department in writing (email or letter). The department will provide written receipt of this via email, where an email address is provided, or by letter.
2. After a notice to revoke consent is received, the department will not be able to make any ‘new’ use of the individual’s personal information or work.
3. Due to the viral nature of the internet, including social media, consent cannot be fully revoked as it may not be possible to ensure that all copies of the material are deleted or cease to be used.
4. Record and store in an accessible format, all instances where the individual’s consent is limited, withheld, withdrawn, modified, contains specific exclusions or is made conditional.

Additional information regarding the Project Consent Form

1. If there is any doubt about the department’s lawful authority to use a student, employee or volunteer’s copyright work or to record use, or disclose their personal information, obtain written consent again or do not use the personal information /material.

Definitions

Legislation

• Copyright Act 1968 (Cwlth) Parts III, IV, VA, VB, VII and IX
• Education (General Provisions) Act 2006 (Qld) s426
• Information Privacy Act 2009 (Qld) Chapter 2

Delegations/Authorisations

• Nil

Other resources

• Code of Conduct and Standard of Practice
• Queensland Public Sector Intellectual Property Principles
• Copyright and other intellectual property procedure
• Information asset and recordkeeping procedure
• Information privacy breach and privacy complaints procedure
• Information security procedure
• Access to records held in schools procedure
• National Copyright Guidelines
• Office of the Information Commissioner, Queensland; Privacy Guideline – Sections 4 and 11
• Online Services Consent Form (DoE employees only)

Superseded versions

Previous seven years shown. Minor version updates not included.

6.0 Obtaining and managing student and individual consent

5.0 Obtaining and managing student and individual consent