Completing the Privacy Impact Assessment (PIA) for Victorian public schools

Victorian public schools must complete a Privacy Impact Assessment before implementing Intellischool products.

To save you some time, we've compiled answers to questions that you'll be asked as part of the Privacy Impact Assessment.

1. Will the software use or store personal, sensitive or health information, including biometric?
   Yes. Intellischool stores personal and health information, and depending on configuration may also store sensitive information. Intellischool does not store biometric information.
   In Victorian public schools, Intellischool collects the following information:
   
   • personal details including name, date of birth, gender, current school and/or future Educational Institution, educational grade, parental relationships and other pertinent information;
   • personal details of Family members living in an Attendee’s household including name, date of birth, gender, contact details, and economic/personal relationships to the Attendee;
   • information about how an Attendee interacts with an Educational Institution;
   • standardised testing results (including but not limited to NAPLAN, ACER PAT, PISA, and others);
   • information provided to us through customer surveys;
   • your browser session and geo-location data, device and network information, statistics on page views and sessions, acquisition sources, search queries and/or browsing behaviour; and
   • details of Services we have provided to an Attendee or Family.
     
     
2. Why do you need a PIA?
   ☑ Using new software or application
   ☑ Using previously collected information in a new way
   
   
3. What functions or activities does this software support and how will your school use it?
   
   Teaching and Learning
   ☑ Academic Assessment and Reporting
   ☑ Education - Curriculum Planning and Activities
   ☑ Education - Individualised Planning
   
   School Administration and Management
   ☑ Finance Management - Budgets and Reporting
   ☑ Statistical Research and Analysis
   ☑ Staff Performance & Evaluation
   
   ☑ Other or additional functions:
   Analysis of student academic performance, attendance, behavioural trends and standardised testing results
   
   
4. How will the school use the software in its day-to-day operations?
   Consider this example - you may wish to elaborate further:
   Relevant data will be automatically collected by the software and presented back to staff in data visualisations and e-mail alerts. Students and parents may also be granted access to view dashboards pertaining to themselves / their child.
   
   
5. What benefits will this software deliver for your school, parents and/or students?
   Consider this example - you may wish to elaborate further:
   Providing a single place to surface all the data the school has on a student will enable our teachers, parents, and students to be more informed about student progress. Additionally, automated alerts will enable teachers and parents to address potential issues for students that are approaching risk thresholds before they escalate.
   
   
6. What personal, sensitive and/or health information will be used in the software?
   All data used by Intellischool is stored in the cloud. You can utilise the information contained in the Personal, Health and Sensitive information storage breakdown for Australian schools article to complete the remainder of this question.
   
   
7. Will personal information from a school system other than CASES21 be used?
   ☑ Yes - add the names of your SIS and/or LMS, e.g. SIMON, Compass, Sentral, Canvas.
   
   
8. Do you have processes in place, that you will use when implementing this software, to notify and seek consent from parents and/or relevant individuals about the collection and use of information?
   The answer to this question is a matter for the school to decide. If you need assistance in developing communications or appropriate process, please reach out.
   
   
9. Will you take information from the software and de-identify it to use for things such as reporting?
   ☑ Yes - refer to the How Intellischool anonymises data Help Centre article for a detailed explanation of the process.
   
   
10. Is there a process in place to reasonable ensure information collected is accurate, complete, and up to date?
    ☑ Yes - Intellischool automatically and securely synchronises data from [insert SIS name]. As such, data will remain as up-to-date as the SIS.
    
    
11. If you are using unique identifiers, are you using them only when permitted?
    ☑ Yes - Intellischool uses CASES21 IDs to ensure student data is matched correctly between systems. The CASES21 ID is not used for any other purpose.
    
    
12. Who will use the software? What information will they access and for what purpose?
    This section will be completed differently for each school depending on your plans to roll out Intellischool products to different audiences. Intellischool has the ability for role-based access control to be applied throughout our products - you may choose to only deploy them to teachers, or to students and/or parents as well. Please speak to your Intellischool representative if you need assistance completing this question.
    
    
13. What steps will you take to protect information from misuse, loss, unauthorised access or modification?
    At a minimum, you can select the following:
    ☑ Two-factor authentication is used where possible
    ☑ Access is removed for staff when no longer required
    ☑ Roles and permissions are clearly defined
    ☑ Staff are well trained in using the software
    ☑ Information is encrypted where appropriate
    ☑ Software has access/audit logs available
    
    
14. What country/countries will the data be stored in?
    Australia only; refer to our Data Storage and Processing Locations document.
    
    
15. Have you ensured that records retention and disposal processes have been considered and are adequate?
    Assuming your policies for maintaining data in the systems that Intellischool connects to are adequate, you can answer:
    ☑ Yes;
    refer to our Statement of Compliance: Records Management - School Records Policy (Victoria).
    
    
16. Please consider any other risks related to the use of this software.
    Depending on how your school plans to use Intellischool products, you may wish to select the following:
    ☑ Accessible on portable devices which could be lost or stolen