Category Archives: VET compliance

RTO privacy notice must change – again

The verbose, convoluted and confusing VET Data Use Statement that was part of the original National VET Data Policy has been quietly amended and is now available as ‘Version 2’. (See previous editorial about Version 1).

RTO’s have until 30 June 2019 to update their enrolment processes to include the amended Privacy Notice. RTOs are no longer required to collect a student declaration and consent. This is the minimum mandatory content:

Privacy Notice

Under the Data Provision Requirements 2012, [insert RTO name] is required to collect personal information about you and to disclose that personal information to the National Centre for Vocational Education Research Ltd (NCVER).

Your personal information (including the personal information contained on this enrolment form), may be used or disclosed by [insert RTO name] for statistical, administrative, regulatory and research purposes. [insert RTO name] may disclose your personal information for these purposes to:

  • Commonwealth and State or Territory government departments and authorised agencies; and
  • NCVER.

Personal information that has been disclosed to NCVER may be used or disclosed by NCVER for the following purposes:

– populate authenticated VET transcripts;
– facilitate statistics and research relating to education, including surveys and data linkage;
– pre-populate RTO student enrolment forms;
– understand how the VET market operates, for policy, workforce planning and consumer information; and
– administer VET, including program administration, regulation, monitoring and evaluation.

You may receive a student survey which may be administered by a government department or NCVER employee, agent or third party contractor or other authorised agencies. Please note you may opt out of the survey at the time of being contacted.

NCVER will collect, hold, use and disclose your personal information in accordance with the Privacy Act 1988 (Cth), the National VET Data Policy and all NCVER policies and protocols (including those published on NCVER’s website at

The text above comes from the Federal Department of Education and Training website. There is still a lot of reference to the old policy, so the site is a bit confusing. Click here.

Extension of time for TAE upgrade requirements

The Federal Department of Education and Training website has another little gem that is important to RTOs. There was a requirement that trainers and assessors update their qualification by 1st April 2019.

However, ‘the Skills Ministers has agreed to delay the introduction of these requirements to 1 July 2019, so that trainers and assessors can continue to train while undertaking gap training for a further three months.’ The reason given for the extension is in the FAQ section. Essentially, RTOs who are accredited to train and assess in TAE qualifications cannot keep up with demand.

Please note that the upgrade requirements are not an optional extra. Trainer and assessors who do not meet the requirements by 1st July must not train or assess after that time unless they are supervised as per standard 1.18.

Federal DET FAQS: click here

Privacy notice causes student angst

Some RTOs that have provided students with the new Privacy Notice have shared reactions to the document.

I’m not signing this. I don’t understand anything it says, really.
Why does the government want to know everything about me just because I’m doing this course?
I don’t get this. What am I saying is ‘true and correct’? 
What are the legal consequences if it turns out that something I said isn’t ‘true and correct’?
Does this say anything I write down can be sent to the government?
Am I still allowed to do the course if I don’t sign this?
My employer doesn’t know I’m doing this course. Will you tell them?
What’s my training activity data? Is it all the assessments that I do?
Is NCVER going to give my personal information to an overseas call centre?

Read: Privacy Notice and Declaration

Some students are refusing to sign the Notice/Declaration. This is their right, of course. However, it presents the RTO with some logistical challenges.

Challenge 1
Department of Education and Training have the following paragraph on their website:

RTO’s may provide training to a student, even if a student does not provide their consent to the collection, use and disclosure of their personal information (via the acknowledgement to the Privacy Notice and Student Declaration). RTOs must submit the data for that student to the National VET Provider Collection and advise at the time of reporting that student consent was not provided.

Fair enough. The challenge is how does an RTO ‘advise at the time of reporting that student consent was not provided’?  All reporting must be AVETMISS compliant, so if there is no field to record this, then the student’s refusal to provide consent cannot be reported. There is an AVETMISS field in the NAT00080 file to exclude a student from being contacted by NCVER as part of the Student Outcomes Survey (linked below), but this is one small part of what is covered by a student’s refusal to provide consent.

So the current situation is that an RTO can still enrol a student who refuses to consent to the release of their personal information, but the RTO is obligated to report the student’s data to NCVER anyway. There is a privacy challenge here.

Challenge 2
If a student refuses to provide consent, then it appears as though they are also refusing permission for their results to be added to their VET transcript. This needs attention.

Challenge 3
Some RTO personnel have found that they spend considerable time deciphering the Notice so that it makes sense to students, and re-assuring them about the intention, so that they will sign it. Some of the issues are listed below.

‘RTO may disclose your personal information for these purposes to third parties’
There is not ‘may’ about it. The RTO is ‘required’ to collect and disclose some personal information to NCVER, to a VET regulator on request, and a government department if they have a funding contract with that department.

At no point does an RTO have to disclose directly to ‘organisations conducting student surveys’ or ‘researchers’.

The use of personal information or training activity data by an RTO for ‘statistical, regulatory and research purposes’ is an in-house matter. Most RTOs analyse their data to inform operations: 68% of students completed this course; 90% of students attend the night class. These findings are not published and do not breach any privacy laws.

There is no requirement to disclose all personal information that may be collected by an RTO, yet this inference is implicit in the language. RTOs may also collect personal information to assist them to deliver quality programs to their target audience. Shirt size? Type of industry? Work location? Internet literacy level? Name of emergency contact?

‘I declare that the information I have provided to the best of my knowledge is true and correct’. The student has not provided any information as part of this Notice.

Personal information disclosed to NCVER may be used or disclosed for the following purposes: Issuing a VET Statement of Attainment or VET Qualification. Really? NCVER issues testamurs?

The lack of any information about protection of a student’s personal information makes this a Release Notice, rather than a Privacy Notice.

‘One-size-fits-all’ Notice
RTOs are identifying clauses that are never relevant to their operational context. Thousands of RTOs never have anything to do with a school. Thousands of RTOs operate business to consumer, so they enrol individuals and have no contact with employers. Thousands of RTOs work with unemployed people who are not at school and have no employer. The blanket approach makes it unnecessarily long and adds significantly to student confusion.

No sense of audience
The Notice is not yet fit-for-purpose. The first paragraph is incomprehensible to many students. Several students read ‘collect personal information about you and to disclose [it]’ and then they refused to read any further.  Thousands of adult learners have no experience with legalese as a literary genre. Thousands of adult learners have English as a second language. Thousands of adult learners are top guns in their trade but are not advanced readers.

Unclear who is issuing this Notice
It is not clear if this is an RTO-issued Notice or an NCVER-issued Notice. If it is the former, then where is the RTO’s authority to issue a Notice about what NCVER will do with personal information? What is the legal repercussion for the RTO if there is a data breach at NCVER?

Options if you have questions

Department of Education and Training – Read FAQs at this page and if you do not find the answer to your question here, further questions may be directed through the Skilling Australia information line on 13 38 73 or via email at

 NCVER – If you have a query, their client support team can be contacted in a number of ways, which are listed on their website: click here

Reference:  VET Data Policy

Reference:  AVETMISS-Survey-contact-status

RTO new privacy requirements


Even if your eyes glaze over when you hear the word ‘data’ you need to get your head around these new requirements. The National VET Data Policy applies to RTOs from 1 January 2018. However, we are in a ‘transitional’ phase, so that RTOs can make the necessary amendment to processes.

The  Policy is now a 24-page document available on the website of the Federal Department of Education and Training.

Student Declaration
The collection and submission of AVETMISS compliant data to government agencies is not new, and most RTOs notify their students that this data is being provided to outside agencies. This process of notification has now been formalised. The Policy requires that an RTO:

  • ensures every student signs the mandatory Privacy Notice and Student Declaration
  • retains evidence that the student is aware of the purposes for which information may be used

Schedule 1 of the Policy provides the minimum mandatory content for this declaration.  It is also on the Federal government website. Most RTOs are adding it to their enrolment forms.

It is more a ‘no privacy’ statement though, as it says your identifiable personal information will be forwarded to NCVER and that the RTO may also disclose it to a list of other assorted third parties, including ‘researchers’. Really? Researchers? Just think about that for a minute. A nefarious mind could construe that in a way that facilitates the on-selling of student data. Perhaps the second paragraph needs some re-wording. It is NCVER that is ‘using or disclosing’, not the RTO that is collecting and submitting to NCVER.

Survey contact status
The Student Declaration mentioned above lists ‘Organisations conducting student surveys’ as a third party that may be given the student’s data.

The 2018 AVETMISS changes include a new field ‘Survey contact status’. This field says that the individual student is available to be surveyed unless they are flagged by the RTO as either in prison, a minor, overseas or deceased.

These two together clear the way legally for the Regulator and/or NCVER to contact the RTO’s current and former students, which is part of the new audit model.

RTO Declaration
But wait, there’s more……

The Policy also requires that any organisation an RTO provides with student data must inform that RTO about how the data will be used. A VET Data Use Statement and RTO Declaration and Understanding is included as Schedule 2 in the Policy. Government bodies and NCVER will need to do this, so expect to see a new screen that requires you to click ‘I agree’ or similar, when you submit AVETMISS data.

It is worth noting that you are agreeing to identified RTO level information that supports consumer information, transparency and understanding of the national VET market may be published in reports, tables and a range of other data products, including data cubes and websites.

The VET sector has entered the age of Big Data. Don’t agree? Check the definition of ‘data cube’.