Schools are the keepers of personal and sensitive data which is provided at the time of enrolment and entrusted to the school. As the student progresses through his or her academic years, further information and performance data are collected and stored in order to best gauge the position of the student and provide support. Some of this information is for administrative purposes while other data is collected to track achievement or bring attention to a particular area of need. With the convenience and space available for online and cloud storage of student data, teachers have an increased responsibility towards protecting personal information. This information can typically include names, addresses, religious affiliations, nationality, date of birth, behavioural notes and medical information. Photographs, video clips, and online and hard-copy documents used in schools also fit the criteria of personal information (Australian Law Reform Commission, ). Personal information is not limited to students as it can also apply to staff, volunteers, contractors, parents and others who are connected to the school.

Chapter 6 investigates the different foundational structures and jurisdictional perspectives of information privacy law that involve EU, US and Australian legal frameworks. A historical perspective of information privacy law developments in each jurisdiction is provided based on three founding legal instruments for each jurisdiction. Historical development is important because it highlights that, although different jurisdictional laws are based on the same principled approach, different jurisdictions adopt different emphases. Two particularly emphases are examined: the type of regulated information that triggers regulatory response, namely, personally identifiable information in the US, and personal data in the EU and personal information in Australia. Information privacy law’s principled process of protection is also examined. Attention is given to collection principles as a means of outlining foundational differences between sectoral and comprehensive regimes of information privacy, particularly regarding the overt use of a notice and consent model.