Where privacy law and school marketing intersect

As a marketing firm wrote in one of its regular emails to me, “your contacts are the heart of your strategies.”

If you are an advancement professional in a school working in alumni and community relations, fundraising or marketing, you already know how true this is. And where do your contacts come from? Principally from school records containing contact details of current and former parents, current and former students, and other friends of the school. But can you use this personal information?

According to a 2018 survey by McAfee, New Security Priorities in An Increasingly Connected World, 43 percent of people worldwide feel they lack control over their personal information. Such concerns are not new. Similar concerns in 2001 led to the extension of the federal Privacy Act 1988 to non-government organisations, including schools. From 2014, schools have had to follow the 13 Australian Privacy Principles (APP) which set out how they must collect, use, keep secure and disclose personal information. The principles also give individuals a right to know what information an organisation holds about them, and a right to correct that information if it is wrong.

Under APP 3, a school must not collect personal information unless that information is reasonably necessary for one or more of its functions or activities. Under APP 6, a school must not use or disclose personal information about an individual that was collected for a primary purpose for a secondary purpose, unless the individual has consented to the use or disclosure of the information or one of the exceptions applies. The exception most relevant to those involved in school marketing and communications is that the school may use or disclose the personal information if the individual would reasonably expect them to do so for a purpose which is related to the primary purpose.

APP 6 does not apply to a school’s use or disclosure of personal information for the purpose of direct marketing. This is because direct marketing has its own privacy principle – APP 7. Direct marketing involves the use and/or disclosure of personal information to communicate directly with an individual to promote goods and services. For example, this would apply to communications encouraging people to send their children to the school. A school may only use personal information for direct marketing if the individual has consented or has a reasonable expectation that his or her personal information will be used for direct marketing. The school must also ensure that the conditions relating to opt-out mechanisms are met.

So when you want to use personal information for a purpose other than direct marketing, you must first consider:

• Do I have consent to this use from the person whose information I want to use?
• If not, is my proposed use related to the purpose for which the school collected the information?

Schools must have a privacy policy and the enrolment conditions ought to require parents to acknowledge they have read that policy and agree to its terms. Further, in accepting the conditions, parents ought to agree to photographs and videos of their child being placed in the school’s records, displayed from time to time around the school and published in school publications, on its website and in other marketing and promotional material.

While it is not necessary, some schools like to ask parents to sign a further consent to the use of such material each year. In any event, it would be prudent for schools to obtain specific consent to the use of a child’s personal information (for example, their photo) where that use will be quite public (such as on the side of a bus).

Schools also need to be careful when including images of students from other schools in their marketing and promotional material.

Finally, if you do not have consent, you need to be sure there is a connection between your proposed use of the information and the school’s primary purpose in collecting it. There must be more than a tenuous link.

Navigating the intersection between privacy law and school marketing can be tricky. The cost in terms of time, money and reputation for getting it wrong can be significant. A Queensland school and its faith-based parent organisation discovered this a few years ago when the Privacy Commissioner awarded a former student $7,500 for non-economic loss caused by the interference with the student’s privacy. In that case, the student was able to show that his personal information had been used for a purpose other than the school’s primary purpose in collecting it and that the other purpose was not related to the primary purpose.

The most brilliant marketing and communication strategies can be undone, albeit unwittingly, if the niceties of privacy law are not observed.