Privacy

27 February 2014 Revised: 20 September 2017

NCVER privacy policy

The National Centre for Vocational Education Research Limited (NCVER) is a not-for-profit company owned by the Commonwealth and state and territory ministers responsible for vocational education and training (VET). It is a professional and independent body responsible for collecting, managing, analysing, evaluating and communicating research and statistics about VET nationally. NCVER operates under the authority of ministers responsible for education and training, the legislated registration requirements for training providers under national VET regulation, and other relevant legislation.

1.     Commitment to Privacy and Information Security

NCVER is committed to managing personal information, and ‘sensitive’ personal information, in an open and transparent way. In collecting, holding, using and disclosing personal information, NCVER is bound by the Australian Privacy Principles (APPs) set out in Schedule 1 of the Privacy Act 1988 (Cth). This policy sets out how NCVER manages personal information in accordance with these requirements.

2.     Regulatory Environment for VET Data

The Australian Skills Quality Authority (ASQA) is the regulatory body for the VET sector. ASQA was established through the enactment of the National Vocational Education and Training Regulator Act 2011 (Cth)(the Act).

Registered training organisations (RTOs) are obliged, as a condition of registration with ASQA, to collect and report Total VET Activity Data which must comply with the Australian VET Management Information Statistical Standard (AVETMISS).

Total VET Activity data collection and reporting requirements are regulated through the Data Provision Requirements 2012 legislative instrument, together with the National VET Provider Collection Data Requirements Policy, published by the Australian Government Department of Education and Training, and the Australian Quality Training Framework. Access to and disclosure of national VET provider collection data is governed by the VET Data Protocol agreed by the Council of Australian Governments Ministers responsible for skills under the Act and Guidance issued to NCVER in respect of the VET Data Protocol Guidance on the VET Data Protocol .

Regulation of the adoption, use and disclosure of the Unique Student Identifier (USI) is regulated by the Student Identifiers Act 2014 (Cth), and Student Identifiers Regulations. NCVER is authorised, under the Student Identifiers Regulations, to adopt, use and disclose USIs in certain circumstances (see paragraph 4).

3.     Meaning of Personal Information and ‘Sensitive’ Personal Information

The Privacy Act 1988 defines ‘Personal Information’ as information or an opinion about an identified individual, or someone who is reasonably identifiable, whether the information/opinion is true or not, and whether the information/opinion is recorded in material form or not. ‘Sensitive Personal Information’ is a sub-set of personal information which relates to a person’s racial or ethnic origin, political opinions, philosophical or religious beliefs/affiliations, memberships (political, professional or trade association, trade union), sexual preferences/practices, criminal record, health, genetic or biometric information.

3.1    Type of information collected by NCVER

NCVER may collect contact information (such as name, organisation, position, address, telephone, and email) for marketing, client support services, servicing data requests, managing research grants, conducting research, VOCEDplus research database services, or for communicating with stakeholders and suppliers as part of day to day services. Student information for the national VET collections and national VET surveys is not at present collected directly by NCVER (see paragraph 6.3 of this policy).

The management of NCVER employee information complies with this policy. Personal information collected includes names, addresses, phone numbers, emergency contact details and other employment related information.

Personal information defined as ‘sensitive’ under the Privacy Act 1988, which may be collected by NCVER, includes information such as dietary requirement for events and biographical information for key note speakers. Data collected for the national VET collections, national VET surveys, and some VET research conducted by NCVER may include personal information which infers ethnicity (eg. Indigenous status, country of birth, language spoken at home), and disability status (including types of disability). NCVER employee information may include professional association memberships, health and work injury information.

4.     Government Related Identifiers

NCVER does not adopt, use or disclose a government related identifier of an individual as its own identifier, unless NCVER is authorised by law and prescribed in regulations to do so.

NCVER is authorised by the Student Identifiers Act 2014 and Student Identifiers Regulation 2014 to collect, use and disclose a student identifier for purposes specified in the Regulations, including for purposes related to the collection and preparation of statistics relating to VET, for the purpose of auditing the accuracy and reliability of the national VET statistical collections, for the purposes of research, to enable the VET Registrar to prepare an authenticated VET transcript, and for the purpose of assisting the VET Registrar to identify, investigate and resolve a problem that occurs in relation to the assignment of student identifiers.

5.     Anonymity and Pseudonymity

As far as practicable, NCVER aims to offer individuals the options of anonymity and pseudonymity when collecting personal information. Examples of situations where it is not possible to offer anonymity include servicing data requests, resolving client support service requests, registrations for events, document delivery requests, and HR management.

6.     Collection and Use of Personal Information

When necessary, personal information is collected by NCVER for marketing services, client support services, and research activities. NCVER does not directly collect data for the national VET collections, national VET surveys, or the Longitudinal Survey of Australian Youth (LSAY), but receives this data from the organisations that collect it. A log book of visitor names and contact information is also maintained for administrative, safety and security purposes.

6.1    Marketing Services

Personal information is collected directly from individuals who subscribe to NCVER marketing communications (see also paragraph 10.4); or who register for events (such as research forums) and NCVER hosted webinars; and from stakeholders for day-to-day business and information dissemination. Personal information is kept as long as it is required for the purpose it was collected. Subscribers to any of NCVER’s marketing communications can unsubscribe at any time.

6.2    Research

NCVER’s research activities encompass NCVER’s own research program and research consultancy, management of the national competitive research grants on behalf of the Australian Government Department of Education and Training, and the VOCEDplus research database.

- NCVER’s own research program and research consultancy – Privacy notification is provided ahead of conducting research interviews or at the time of inviting individuals to participate in a survey. Personal information is collected directly from individuals. Where personal information is collected from persons under 18, parental consent is obtained and NCVER researchers comply with the relevant jurisdiction’s Children’s Protection Act. Personal contact information is kept only for as long as required for the research. Research data is de-identified and retained with appropriate security as required for research data archive requirements.

- Managed research grants – Privacy notification is provided when applicants apply for funding, when reviewers are invited to be part of the editorial board, and when respondents are invited to participate in a survey. Personal information is collected directly from researchers who have been awarded grants by telephone and/or written communications. This information is kept as required by contractual obligations.

- VOCEDplus research database – Privacy notification is provided at the point of collecting personal information via online forms. Personal contact information is collected directly from end-users for services including document delivery, reference queries, document submission for inclusion in the research database, general enquiries, and application for membership of the Pathways Practitioners Community. Information obtained for document delivery requests is retained in accordance with copyright law. Personal information collected for other purposes is not retained longer than required for the purpose it was collected.

6.3    National VET Collections and National VET Surveys

NCVER manages four national collections covering different aspects of vocational education and training in Australia, as well as a number of surveys.

- National VET Collections – Data for the national VET collections are collected by training providers and provided to NCVER as regulated by the Australian Skills Quality Authority (see paragraph 2). Student names and contact information are required fields in the AVETMIS Standard (AVETMISS Data Elements Definitions). These fields are encrypted as soon as AVETMISS data are received by NCVER from data submitters. NCVER does not at present retain any student names or contact details.

- National VET Surveys – Student information for the national VET surveys is collected by professional social research organisations that are contracted by NCVER on behalf of the Australian Government Department of Education and Training. Student names and contact information are removed by the contractor before providing the data to NCVER. The contractor destroys student names and contact details on completion of the survey.

- Longitudinal Survey of Australian Youth (LSAY) – This survey tracks people as they move from school into further study, work, and other destinations, and provides important information for understanding young people’s key learning transitions and pathways. LSAY is managed and funded by the Australian Government Department of Education and Training. Data for LSAY are collected by a professional market and social research organisation via phone and online interviews. This organisation provides the data to NCVER after removing the names and contact information of the survey respondents. NCVER provides analytical, reporting and publishing services for LSAY.

6.4    Uses of NCVER Research, National VET Collections and Surveys Data

Research – Data collected as part of research informs published research. Research reports, with the exception of some consultancy reports, are publically available, and can be used by anyone to facilitate understanding of VET sector dynamics and performance, support critical policy and other decision making, and shed light on evolving VET sector priorities.

National VET Collections and Surveys – The data from the national VET collections and national VET and LSAY surveys are used by NCVER to produce publications and data tools that facilitate an understanding of VET sector dynamics and performance, support critical policy and other decision making, and are aligned to evolving VET sector priorities. Data published by NCVER are de-identified. Data are, upon request, accessible to the Commonwealth and state and territory governments, training providers, peak bodies, researchers, and the general public in accordance with the VET Data Protocol and the Guidance to NCVER for disclosure and publication of national VET Administrative Collections and Surveys. Data may also be provided to the Australian Skills Quality Authority (ASQA) upon request in accord with the National Vocational Education and Training Regulator Act 2011 (Cth) and other state regulations.

6.5    Data Linking

NCVER participates in projects which link the National VET Collections data with other datasets, such as datasets collected by the Australian Government Department of Education and Training and by other Commonwealth Government agencies. Data linking projects are expected to increase because of the benefits of enriched information for policy decision making, improving training pathways and options, and research for example.

In linking datasets, NCVER takes rigorous steps to protect the privacy of individuals. NCVER manages its datasets and conducts all data linking projects in accordance with the requirements of the Australian Privacy Principles, as outlined in the Privacy Act 1988, and also the Student Identifiers Act 2014 (and Regulations) where Unique Student Identifiers (USIs) may be included. Although not mandated to do so, NCVER follows the Guidelines on Data Matching in Australian Government Administration published by the Office of the Australian Information Commissioner. Where Commonwealth data are involved, NCVER liaises with the Commonwealth agencies and complies with the High Level Principles for Data Integration Involving Commonwealth Data for Statistical and Research Purposes published by the Australian Government National Statistical Service. NCVER also conducts Privacy Impact Assessments for all data linking projects with the aim of reducing any privacy risks.

6.6    NCVER Employee Information

Privacy notification and collection of personal information occurs on employment commencement and throughout employment as necessary for administrative and other HR management purposes. After an employee leaves NCVER, their personal information is retained as required by Australian law.

6.7    Unsolicited personal information

If NCVER should receive unsolicited personal information, it will be treated and managed according to the Australian Privacy Principles if found to be related to one of its collections, otherwise it will be destroyed or de-identified if lawful to do so.

7.     Disclosure of Personal Information

NCVER does not disclose personal information other than for the purpose for which it was collected, or if a person has consented to the disclosure of their information for a specific purpose, or they would reasonably expect this (eg. receiving communications about upcoming events), or if required by law.

NCVER may share personal information with the Commonwealth government in accordance with contractual obligations. In these circumstances NCVER will take reasonable steps to inform and seek consent from the individuals concerned if this is necessary, and take all reasonable steps to ensure that the recipient manages the personal information according to the Australian Privacy Principles.

NCVER takes rigorous steps to ensure data in publications are de-identified and confidentialised. Where requests are made to NCVER (typically by researchers or by government personnel for administration purposes) for national VET collection and survey data or for access to NCVER’s data tools, NCVER will release data in accordance with the VET Data Protocol and Guidance to NCVER for disclosure and publication of national VET Administrative Collections and Surveys, and on written application and signed undertaking to protect the data according to the requirements of the Privacy Act 1988. The national VET collection and surveys data do not contain any names or contact information.

NCVER does not disclose personal information to overseas recipients. While people around the world can access material published on the NCVER Portal, LSAY and VOCEDplus websites, all data in statistical and research publications are de-identified and confidentialised.

8.     Information Security

NCVER takes active steps to protect personal information and data from cybercrime, interference, misuse, modification, and unauthorised access or disclosure. NCVER’s information security management system aligns with the requirements of ISO 27001 (Information Security Management System) and ICT systems security recommendations published by the Australian Signals Directorate. ICT system security measures include system security, information security, network security, physical security, personnel security and training, and ensuring any contracted third-parties have appropriate security policies and certified ICT safeguards before engagement.

Generally, NCVER retains personal information for as long as it is required for its business activities, and for as long as we are legally required to retain the information, or are required to do so under a court/tribunal order. When personal information is no longer necessary for the business activity it was collected for, and it is legal to do so, NCVER destroys or takes reasonable steps to de-identify the information.

9.     Access to and correction of personal information

NCVER endeavours to ensure the personal information it collects and uses or discloses is accurate, up to date, complete and relevant. NCVER routinely updates the information in its customer relationship management system.

Individuals may request access to and correction of personal information at any time. This can only be done for personal information collected by NCVER directly from individuals. Subscribers to any of NCVER’s marketing communications are able to access their online accounts and make changes or unsubscribe at any time.

NCVER is not able to update or provide access to personal information collected for the national VET collections, the national VET surveys, or Longitudinal Survey of Australian Youth (LSAY) (see paragraph 6.3). NCVER does not at present hold the names of individuals and their contact details. To seek access to or correction of this information, students should contact their training provider regarding the national VET collections data which are submitted to NCVER by registered training organisations, and people who have provided information for the national VET surveys or LSAY should contact the organisation who collected the information. For the Student Outcomes Survey refer to Student Outcomes Survey-Participant Information and for the LSAY refer to LSAY-Participant Information.

10.     Online Privacy

10.1    NCVER’s website management

The web servers for the NCVER Portal, LSAY, AVETMISS Validation Software, and VOCEDplus websites automatically log information such as server address, date and time of visit and web pages accessed. No personal information is recorded. These logs are used for website management and improvement.

Where there are links on NCVER’s websites to third party websites, NCVER cannot guarantee the privacy of those sites and is not responsible for the privacy practices of the linked websites. Any concerns regarding the privacy policies of linked websites should be directed to those websites.

10.2    Google Analytics

NCVER uses Google Analytics for improving its Portal, LSAY, AVETMISS Validation Software and VOCEDplus websites.

Google Analytics is a web analytics service provided by Google Inc. Cookies are used to generate data on website activity and usage, including your IP address. This information is transmitted to and stored in Google servers in the United States where it is used to compile web-use reports. Google may transfer this information to third parties that process information on Google’s behalf, or where required by law.

By default information about your website usage will be collected by Google Analytics. You may opt-out of Google Analytics if you disable or refuse cookies, disable JavaScript, or use the Google Analytics Opt-Out Tool provided by Google. For more information on the safeguards used for Google Analytics, including Google’s privacy policy, see Google Analytics Safeguards and Privacy Policy.

10.3    MailChimp and Facebook Pixel

MailChimp

NCVER uses the MailChimp subscription service for its marketing communications. When you sign up to NCVER’s marketing communications on any of our websites, your personal information will be captured by MailChimp and held in servers located in the United States and subject to USA law. MailChimp may transfer this information to third parties that process information on their behalf, or where required by law.

MailChimp uses cookies, Web Beacons and Flash Player code to collect your website usage, your browser type and version, your operating system, and IP address.

Although the MailChimp Subscription Service is subject to USA laws, MailChimp confirms it, and its subcontractors, are subject to the operation of the Australian Privacy Act 1988 in regard to its Australian customers. For more information, see Mailchimp Privacy Policy.

Facebook Pixel

NCVER uses Facebook Pixel on the LSAY website to measure the effectiveness and reach of our LSAY advertisements as we would like communications to be relevant and of interest to potential audiences in promoting the survey.

Facebook Pixel is an analytics tool that allows measurement of the effectiveness of advertising based on website usage. Facebook Pixel uses cookies to collect information such as the referral URL, browser information, and Facebook user ID. For more information, see Facebook Privacy Policy which applies to all Facebook brands, products and services.

By default, Facebook Pixel may collect or receive information when you access the LSAY website and use the information to provide measurement services and target advertisements. If you do not want your information collected or received by Facebook Pixel, you may opt-out of Facebook’s use of cookies and Facebook Pixel through the settings on your Facebook account. For more information, see https://www.facebook.com/ads/settings.

10.4    SurveyMonkey

NCVER may use SurveyMonkey occasionally for research purposes or for gathering views from users of the VOCEDplus database and website in order to make improvements.

SurveyMonkey is a global provider of web-based survey solutions. When you enter information for a survey conducted by NCVER using SurveyMonkey, your responses are stored on servers located in the USA. SurveyMonkey treats the information as private to NCVER (the survey creator) who also owns and manages the data. The data are disclosed to NCVER only. Surveys conducted by NCVER using SurveyMonkey are completely voluntary.

SurveyMonkey collects information such as: usage data, device data, referral data, information from page tags, cookies and Google Analytics.

Although located in the USA, SurveyMonkey includes privacy provisions for Australian survey respondents and supports reporting any privacy complaints to the Australian Office of the Information Commissioner. For more information, see SurveyMonkey Privacy Policy.

11.     Privacy Complaints

Complaints or concerns about NCVER’s management of personal information should be directed in writing to NCVER’s Privacy Officer at privacy@ncver.edu.au. NCVER will respond in writing within 14 business days.

12.     Privacy Contact

For all privacy related enquiries, or to request a pdf copy of this policy, contact:

The Privacy Officer

NCVER, Level 5, 60 Light Square, ADELAIDE, SA 5000.

E. privacy@ncver.edu.au

P. 08 8230 8400

12. Policy revision history

REVISION DATES:Policy created: 27/2/2014; Last revised: September 2017