With so many students filtering through our collective school systems every year, records management has become an issue for institutions around the world. The slow pace at which many schools have upgraded from paper-based systems to electronically stored information means that standards on what is kept and how it is kept differ from one place to the next.
Storage isn’t only an issue for schools that are yet to go paperless; it also raises problems for those who store data digitally. When it comes to storing data securely, there’s always a risk that it’s not secure enough, so for how long should a school retain your personal data?
Well, it may just depend on where you live.
In Australia, the recent introduction of controversial data retention laws has sparked debate. While these laws only apply to telecommunications, they’ve still generated intense conversation about data retention across the board and how our data can be used against us. The fact that many schools use online educational tools that will collect metadata on students that could fall under these laws and, therefore, be retained for up to two years, further muddies the waters about what is collected and for how long.
Metadata aside, Australia’s laws on student data are somewhat vague. The Australian Privacy Principles state that non-government schools are required to destroy or de-identify personal information when it is no longer ‘needed’, leaving it in the hands of schools to define the meaning of ‘needed’.
Government schools are more clearly defined but differ wildly from state to state. Victorian government schools can hold data for up to a year after the student leaves while, in NSW and ACT, it can be held until the student either turns 25 or seven years after they leave.
In the US, schools are not required by federal law to keep records for any set period of time. If someone has submitted a request to view your education record, however, schools are prevented from destroying it before the request is fulfilled.
State and local laws are varied, so it is possible that where you live or go to school may have more specific guidelines regarding your records. Recent legislations about how schools can use your data did not outline any changes to its retention.
In the UK, similar recommendations are in place, stating that schools should not hold personal information on students longer than is required, once again leaving it up to the school’s discretion. Recent moves in Ireland to hold students’ data until they reach the age of 30 was widely condemned as going too far.
Why retain data at all?
The risks of data retention have been extolled many times, mainly focusing on the privacy and personal information being used for nefarious purposes without our knowledge.
In Australia, the Royal Commission into Institutional Responses to Child Sex Abuse has relied heavily on school records to investigate possible crimes by organisations. The findings showed how important data retention is for schools, and these cases have highlighted schools’ legal obligations and duty of care to students.
Schools should keep records for greater transparency and to mitigate risks, however, finding a way to do so safely and deciding how long they should be held is a tricky issue.
Many schools have to take into account their storage space, as physical files can quite literally populate room after room. If working with a paper-based system, a move to digital storage is the cheaper and more efficient alternative. Just as long as we can keep this information secure, the length of time it is held may no longer become such a prickly issue.
ParentPaperwork takes data storage and security seriously. Take a read through our FAQs.