Retention of data is a topical issue at present. Retaining data for too long raises the potential for any data breaches to be more damaging and significant. But how long is too long? Schools are not at liberty to simply dispose of all information relevant to a student once they have ceased being educated by that school. There are complex recordkeeping obligations imposed on schools.
Victorian schools are obliged under the Ministerial Order 1359 (MO1359) to create, maintain and dispose of records relevant to child safety and wellbeing in accordance with the Public Records Office Victoria (PROV) Recordkeeping Standards, including minimum retention periods (clause 6(f)). But what does this mean in practice?
Child Safety and Wellbeing Records
The reference to ‘child safety and wellbeing’ in MO1359 is broader than the PROV standard, PROS 19/08, introduced in response to the Royal Commission into Institutional Responses to Child Sexual Abuse. This standard requires organisations, in relation to records about organisational responses to child sexual abuse, to:
- indefinitely retain records about the development of policy, strategy and procedure;
- retain reporting and investigation records for 99 years; and
- retain training and development records for 45 years.
What about documents that are not ‘records about organisational responses to child sexual abuse’? This is where schools need to balance competing obligations, such as privacy requirements to destroy documents when no longer required and the MO1359 to retain documents relevant to ‘child safety and wellbeing’.
There are a number of matters to consider when undertaking this balancing act. We recommend all schools create a Data Retention Policy that outlines those considerations and identifies the retention periods for student data. Bear in mind that student data may involve sensitive health information and other detailed personal information.
There is no ‘one size fits all’ document that will serve the school’s purpose in this regard. Each school will have to make decisions itself and develop its own policy.