Privacy notice causes student angst

Some RTOs that have provided students with the new Privacy Notice have shared reactions to the document.

I’m not signing this. I don’t understand anything it says, really.
Why does the government want to know everything about me just because I’m doing this course?
I don’t get this. What am I saying is ‘true and correct’? 
What are the legal consequences if it turns out that something I said isn’t ‘true and correct’?
Does this say anything I write down can be sent to the government?
Am I still allowed to do the course if I don’t sign this?
My employer doesn’t know I’m doing this course. Will you tell them?
What’s my training activity data? Is it all the assessments that I do?
Is NCVER going to give my personal information to an overseas call centre?

Read: Privacy Notice and Declaration

Some students are refusing to sign the Notice/Declaration. This is their right, of course. However, it presents the RTO with some logistical challenges.

Challenge 1
Department of Education and Training have the following paragraph on their website:

RTO’s may provide training to a student, even if a student does not provide their consent to the collection, use and disclosure of their personal information (via the acknowledgement to the Privacy Notice and Student Declaration). RTOs must submit the data for that student to the National VET Provider Collection and advise at the time of reporting that student consent was not provided.

Fair enough. The challenge is how does an RTO ‘advise at the time of reporting that student consent was not provided’?  All reporting must be AVETMISS compliant, so if there is no field to record this, then the student’s refusal to provide consent cannot be reported. There is an AVETMISS field in the NAT00080 file to exclude a student from being contacted by NCVER as part of the Student Outcomes Survey (linked below), but this is one small part of what is covered by a student’s refusal to provide consent.

So the current situation is that an RTO can still enrol a student who refuses to consent to the release of their personal information, but the RTO is obligated to report the student’s data to NCVER anyway. There is a privacy challenge here.

Challenge 2
If a student refuses to provide consent, then it appears as though they are also refusing permission for their results to be added to their VET transcript. This needs attention.

Challenge 3
Some RTO personnel have found that they spend considerable time deciphering the Notice so that it makes sense to students, and re-assuring them about the intention, so that they will sign it. Some of the issues are listed below.

‘RTO may disclose your personal information for these purposes to third parties’
There is not ‘may’ about it. The RTO is ‘required’ to collect and disclose some personal information to NCVER, to a VET regulator on request, and a government department if they have a funding contract with that department.

At no point does an RTO have to disclose directly to ‘organisations conducting student surveys’ or ‘researchers’.

The use of personal information or training activity data by an RTO for ‘statistical, regulatory and research purposes’ is an in-house matter. Most RTOs analyse their data to inform operations: 68% of students completed this course; 90% of students attend the night class. These findings are not published and do not breach any privacy laws.

There is no requirement to disclose all personal information that may be collected by an RTO, yet this inference is implicit in the language. RTOs may also collect personal information to assist them to deliver quality programs to their target audience. Shirt size? Type of industry? Work location? Internet literacy level? Name of emergency contact?

‘I declare that the information I have provided to the best of my knowledge is true and correct’. The student has not provided any information as part of this Notice.

Personal information disclosed to NCVER may be used or disclosed for the following purposes: Issuing a VET Statement of Attainment or VET Qualification. Really? NCVER issues testamurs?

The lack of any information about protection of a student’s personal information makes this a Release Notice, rather than a Privacy Notice.

‘One-size-fits-all’ Notice
RTOs are identifying clauses that are never relevant to their operational context. Thousands of RTOs never have anything to do with a school. Thousands of RTOs operate business to consumer, so they enrol individuals and have no contact with employers. Thousands of RTOs work with unemployed people who are not at school and have no employer. The blanket approach makes it unnecessarily long and adds significantly to student confusion.

No sense of audience
The Notice is not yet fit-for-purpose. The first paragraph is incomprehensible to many students. Several students read ‘collect personal information about you and to disclose [it]’ and then they refused to read any further.  Thousands of adult learners have no experience with legalese as a literary genre. Thousands of adult learners have English as a second language. Thousands of adult learners are top guns in their trade but are not advanced readers.

Unclear who is issuing this Notice
It is not clear if this is an RTO-issued Notice or an NCVER-issued Notice. If it is the former, then where is the RTO’s authority to issue a Notice about what NCVER will do with personal information? What is the legal repercussion for the RTO if there is a data breach at NCVER?

Options if you have questions

Department of Education and Training – Read FAQs at this page and if you do not find the answer to your question here, further questions may be directed through the Skilling Australia information line on 13 38 73 or via email at

 NCVER – If you have a query, their client support team can be contacted in a number of ways, which are listed on their website: click here

Reference:  VET Data Policy

Reference:  AVETMISS-Survey-contact-status