Perfecting an online privacy policy

The security of personal data is top of everyone’s mind when surfing the web, but how do you keep information coming through your school’s website secure? And how do you let visitors know how the information they provide through the website will be used?

One of the easiest ways for schools to inform parents, caregivers and other visitors to the website of how their data is collected and disseminated is to publish a privacy policy.

In its simplest form a privacy policy is a statement that reveals how personal information is gathered, used and managed, including names and email addresses. If, for example, a school chooses to invite parents to receive newsletters via email, the privacy policy should state how the addresses will be stored and whether they will be distributed to anyone else.

A recent scan of New Zealand school websites by the Privacy Commissioner showed there is often no information given to users about how their personal information collected via the site will be used and shared. It also showed that very few school websites had any privacy policy at all.

Those that had a privacy policy were then examined further to see whether the explanations were in simple language and easy to understand, and whether a new user to the site could read the policy.

Annabel Fordham, spokesperson for the Privacy Commissioner, says schools need to be clear about the reason for collecting personal information. “Be open about where the information will be used and disclose who it will be used by. If you simply tell people what their information will be used for, then you’re 95% of the way there.”

It can also be useful to include some information about cookies and about clickstream data collected, such as IP addresses, the date and time a person visited the site, and the type of browser or operating system used.

Additionally, if the website doesn’t collect any personal information, then let visitors know that too, says Fordham.

The Privacy Commissioner’s Office can provide further information on developing a privacy policy through its enquiry service, or see www.privacy.org.nz.