The role of members of not-for-profit incorporated associations and companies limited by guarantee includes holding the Board members[1] accountable for the exercise of their powers. This is consistent with ACNC Governance Standard 2, which provides that those not-for-profits that are registered charities must take reasonable steps to be accountable to their members and must allow their members adequate opportunities to raise concerns about how the charity is run.

Members who have concerns about how a not-for-profit is being run or have a grievance with the Board may request the governing body call and hold a general meeting. The request will often include motions for consideration at the general meeting. Common motions proposed include removing one or more members of the Board or amending the Constitution.

Ascertaining the rights of the members (and the obligations of the Board) in relation to members’ resolutions and requests for general meetings requires a careful review of both the relevant legislation[2] and the organisation’s governing document[3]. Registered charities should also be aware of section 111L of the Corporations Act 2001 (Cth), which provides that registered charities are exempt from a number of provisions of the Corporations Act, including the provisions which relate to member requests for meetings.

While it is important to ensure the Board is accountable to the members, not every member request will be valid. It may not be in the interests of the members as a whole for the Board to entertain an invalid request.

A not-for-profit or charity Board that receives a request for a general meeting should give consideration to the following matters.

Timing of notice and meeting

Be aware of any requirements set out in the governing document or legislation in relation to the time within which notice of the meeting must be sent or the meeting held. In some cases, if the Board fails to act on a valid request within the required timeframe, the members may be able to convene the general meeting themselves at the organisation’s cost.

Validity of the request

Assess the validity of the member’s request itself. Key considerations include whether:

  • the prescribed form (if any) for the request was used;
  • the request was submitted correctly (for example, the governing document may require that the request be submitted to the secretary);
  • the request was signed by the required number of individuals – this may be either a fixed number of members or a proportion of members (in which case the organisation should ensure its member register is up to date and the proportion has been properly calculated);
  • the individuals who signed the request are in fact all current members of the organisation (if membership fees are levied, are any payments outstanding);
  • it is evident from the face of the document that the members knew what they were signing. For example, a Court has found that pages of signatures should not be counted in circumstances where each page signed did not contain the wording of the request and the motion[4]. In this case, it is not possible for the Board to confirm the members knew the purpose for which their signature was being provided.

If the request is invalid, the Board should notify the requesting members that it will not proceed to convene a general meeting and give its reasons.
How the Board must respond to valid request for a general meeting will depend on the governing document and legislation. In some cases, the Board is required to act on a valid request and proceed to convene a general meeting. In other cases, the Board is not required to act on a valid request, but failing to do so will enliven the requesting members’ right to convene the meeting themselves.

Validity of any motion

The second matter for assessment is the validity of any motion(s) that the requesting members want considered at the general meeting. Key considerations include whether the motion conflicts with the governing document or relevant legislation. A motion must not go beyond the legal powers of the body or its purposes. For example, the members may not, in general meeting, pass a resolution requiring the organisation to do something that is inconsistent with the organisation’s governing document – instead, they must first pass a special resolution (and comply with any statutory process) to amend the governing document itself.

If the motion is invalid (and the meeting request discloses no other residual valid purpose for the meeting), the governing body is not required to convene a meeting[5]. If the governing body does not convene a meeting in these circumstances, the requesting members’ right to convene the meeting themselves (if any) is not enlivened.

If the Board resolves not to call a meeting

The Board may resolve not to call a meeting. If the Board does so because the meeting request or any motion was not valid, the requesting members will often seek to fix any identified issues and again request a meeting be convened. The Board should consider engaging with the requesting members in this interim period in order to ascertain whether their concerns can be addressed without convening a general meeting. This may reduce the potential for a disruptive and divisive general meeting and ensures the Board is giving members a fair opportunity to raise concerns.

If the Board resolves not to call a meeting in circumstances where it is choosing not to respond to a valid request, the Board should prepare for the possibility of a member convened general meeting. The members will ordinarily be entitled to access the member register in order to enable them to send out a notice of meeting. While the Board is not responsible for convening the meeting, it will usually be in the organisation’s best interests for the Board to ensure (if possible) that any procedural requirements for a properly convened meeting are met. This is because the organisation may be placed in a legally uncertain position if the meeting is improperly convened but seeks to pass resolutions that are binding on the organisation.

If the Board proceeds to call and convene a meeting

If both the request and the motion(s) are valid, the Board may call and hold a general meeting. Practical considerations for holding a meeting at the request of members include:

  • the Board’s recommendation (if any) on the motion. Boards are not required to remain neutral on member-proposed resolutions. It is appropriate for the Board to form a position based on the Board’s assessment of the organisation’s best interest and to communicate this to the members;
  • how the Board will communicate with the members regarding:
    • the requesting members’ position – the relevant legislation or governing document may require the organisation to distribute a statement in support of the meeting or motion; and
    • the Board’s position – the Board is free to communicate with its members in any way it deems appropriate regarding a proposed meeting or motion. This includes social media, email and face to face engagement. The quality of the Board’s communication can have a significant influence on the outcome of a member-convened general meeting. Clear, succinct and balanced communications which focus on the organisation’s purpose and the best interests of all members can be highly persuasive.
  • whether it is appropriate to engage an independent chair or returning officer;
  • protocols or standing orders for the efficient and orderly conduct of the meeting – if there are none in place, the Board might consider inviting the requesting members to agree to a set of appropriate protocols;
  • the requirements in the governing document and relevant legislation regarding how the meeting and vote will be conducted. Proxy voting provisions may be particularly important.
  • If a meeting is being held by technology the features of the relevant technology should be carefully reviewed and ideally tested before the meeting. Consider also the new Corporations Act Chapter 2G.5 meeting technology provisions for companies limited by guarantee.

How we can help

For more information or guidance regarding responding to member requests for general meetings, please contact us.


[1] In incorporated associations the governing body may be referred to as the ‘Committee’ – we have used the term ‘Board’ in this article to refer to both Boards and Committees.
[2] For a company limited by guarantee the Corporations Act 2001 (Cth) applies. For an incorporated association, the associations legislation in the relevant State or Territory applies.
[3] For a company limited by guarantee, this will be a Constitution or Memorandum and Articles of Association. For an incorporated association, the entity may operate according to Model Rules or may have adopted its own Rules.
[4] Gratton v Carlton Football Club Ltd (2004) 51 ACRS 29
[5] National Roads & Motorists’ Association v Parker (1986) 6 NSWLR 517, Queensland Press Ltd v Academy Investments No 3 Pty Ltd [1988] 2 QD R 575

Moores is currently taking bookings for December 2021 and January 2022 School Professional Development days.

Available slots are limited. If you are still wanting to book a session and/or decide on topics, we are currently experiencing high demand for the following sessions:

  • Child Safety – general staff, including the new Child Safe Standards. (Meets the requirements of the Minimum Standards);
  • Child Safety for Child Safety Officers. Intensive with case studies (including the Child Information Sharing Scheme);
  • Challenging parents and students, including the new Safety Order legislation;
  • Disabilities and reasonable adjustments – school obligations through the lens of the latest cases;
  • Separated families – managing information, pick-ups, court orders and IVOs;
  • Mental health in focus – supporting students and staff, including best practice support and return-to-school plans;
  • Vaccination mandates for staff – ongoing challenges for heads of school;
  • Supporting Diversity – carrying out your duty of care to LGBTQIA+ students and staff;
  • Understanding your obligations through the lens of faith and discrimination, including new laws on suppression practices;
  • Safety and risk in the COVID era, including managing students and parents (including unvaccinated) and the latest on Rapid Antigen Testing;
  • Privacy and Avoiding Data Breaches – includes COVID and vaccination information and interactive scenarios.

How to book

We will have a discussion on tailoring, pricing and scheduling based on your individual School’s requirements. To make an enquiry please call Caryn Fitzsimons on 9843 0418 or email cfitzsimons@moores.com.au.

The Federal Court has set aside an Australian Taxation Office (ATO) decision that revoked the deductible gift recipient endorsement of a school building fund operated by a Buddhist society (The Buddhist Society of Western Australia Inc v Commissioner of Taxation (No 2) [2021] FCA 136) (Buddhist Society (No 2)). This decision may assist non-traditional schools and faith based organisations co-locating with schools that are seeking to fund (or partially fund) the acquisition, construction and maintenance of buildings with tax deductible gifts.

The Commissioner’s current position on school building funds is set out in Taxation Ruling 2013/2 (TR 2013/2). In Buddhist Society (No 2) the Federal Court found that TR 2013/2 had inappropriately elevated factors referred to in case law to the level of “prerequisites or inherent requirements” for school building funds and that a more holistic approach was required. The Court preferred the broad ‘ordinary meaning’ of the term ‘school’ set out in dictionary definitions and in case law and cited with approval Barwick CJ’s statement that:

“…a ‘school’ is ‘a place where people, whether young, adolescent or adult, assemble for the purpose of being instructed in some area of knowledge or of activity”[1] (emphasis added).

Importantly, in Buddhist Society (No 2) the Court found that:

  • The adoption of ‘factors’ including a set curriculum, instruction by qualified persons, enrolment, assessment and provision of a recognised qualification in TR 2013/2 as prerequisites for a school was ‘misplaced’;
  • A school could provide both recreational and non-vocational instruction;
  • A school is not required to provide certificates or other recognition or to conduct formal examinations or tests; and
  • Whether a building is to be ‘used’ as a school should not be determined simply by comparing the proportion of time for which a building is used for ‘school’ and ‘non-school’ activities. Regard must also be had to the purpose for which a building is established and the importance of the activities to that purpose.

While these factors might be considered when considering whether a set of factual circumstances met the ordinary meaning of ‘school’, they are not requirements in all cases.

The matter was referred back to the Commissioner for further consideration and determination.

TR 2013/2 is applied by the ATO when assessing new applications for the endorsement of school building funds. It has also been used in recent years as the basis for an audit of pre 2013 approved faith based school building funds. Buddhist Society (No 2) suggests that new applicants and the operators of existing school building funds may have grounds to argue for a broader, more holistic application of the ordinary meaning of school rather than the strict application of the indicia set out in TR 2013/2. This may improve the ability of non-traditional schools and faith based organisations co-locating with schools to fund (or partially fund) the acquisition, construction and maintenance of buildings with tax deductible gifts.

The Commissioner may yet appeal the Federal Court decision. If the decision is not appealed, TR 2013/2 will likely require review to reflect the decision.

How we can help

Moores regularly supports clients to establish and ensure the ongoing compliance of school building funds (as well as other deductible gift recipient funds and entities). Please contact us if we can assist you further.


[1] Cromer Golf Club Ltd v Downs (1973) 47 ALJR 219

On 26 October 2021 we invited Maree Dellaportas, a leading clinical psychologist to join us for a discussion about how best to support students moving from remote learning to face-to-face teaching on school premises.

We’re aware that the mental health and wellbeing of students is a focus of the Victorian Government at this time of transition. With the introduction of rapid antigen testing for students, additional stresses may be introduced to their lives.

The Commission for Children and Young People took a snapshot of what young people and children said about their experiences of Victoria’s lockdowns. It included their reflections on mental health and wellbeing, education, the impacts of remote learning, safety and security at home and the future.

Some common issues faced by students in returning to face-to-face learning include:

  • Students are anxious about recommencing friendships.
  • Older students are worried about their future job prospects and impact on their schooling.
  • Younger students may experience separation anxiety when leaving the family home.
  • Students who thrived during remote learning may not relish returning to school.

Duty of Care and Mental Health

The school owes a non-delegable duty of care to their students to take reasonable measures in the circumstances to protect students from risks of harm that are reasonably foreseeable. The duty extends beyond the scheduled school day. Schools also owe a similar duty of care to their teaching staff.

Ways to assist schools in meeting their duty of care obligations include:

  • conducting surveys to see determine the needs of students and staff – this also helps meet the empowerment requirements of Ministerial Order 870;
  • scheduling activities to help students bond with each other;
  • having ‘screen free’ time to allow students to be in the moment;
  • being flexible during classes and taking more breaks if required;
  • being creative with tasks as a way to understand the issues students are facing;
  • utilising rapid antigen testing to ensure a safe school environment;
  • ensuring staff concerns are catered for.

Key Takeaways from Maree Dellaportas

“As a Clinical Psychologist supporting children and adolescents throughout the COVID-19 pandemic, I have had many conversations with teachers around supporting their student’s mental health. Prior to the pandemic approximately 1 in 5 youth struggled with a mental health disorder. We know this incidence has risen over the past 19 months as students have had to pivot and adapt to the ever changing new normal.

My message to educators and to students is to be kind to yourselves and allow time for adjustment to in-person learning. Students may have issues reconnecting to peers and managing classroom and learning expectations. When students feel supported by teachers, they are more likely to feel like the classroom is safe and will engage in learning. Teachers can help by providing a space for calm and a space for being perfectly imperfect.”

Contact Dr Maree Dellaportas via email at mareedellaportas@gmail.com

How we can help

Moores recommend schools consider implementing the two key documents to equip staff to manage and promote the well-being of students returning to campus:

  1. Safety management plan.
  2. Return to school plan.

Please contact us for further assistance.

In a recent High Court case – the Voller case[1] – the High Court affirmed that organisations can be liable in defamation law for comments made by a third party. This means schools need to closely monitor their social media accounts and take responsibility for the information that is shared via their platforms.

The media organisations had created a Facebook page, and posted content about Mr Voller. Members of the public (third parties, unrelated to the media organisations) had then commented and posted defamatory comments on that Facebook page. The High Court found that the organisations, by running the Facebook page, had facilitated and encouraged the defamatory comments, and were therefore legally responsible.

What does this mean for schools?

This decision highlights the risks in facilitating and encouraging the posting of comments by third-party users on webpages that an organisation controls. Simply allowing comments – or not removing them – may be seen as “facilitating and encouraging” the publication of those comments.

Examples where schools need to monitor online content for staff, students or parent groups.

Other issues relating to social media use

There is an increasing scope of activity for which schools need to take responsibility as our world becomes increasingly digital.

Ministerial Order 870 considers the ‘school environment’ as any place made available to students by a school. This likely includes digital spaces. Social media blurs the line between home and school life, and means schools may need to take additional steps to ensure its students are safe and protected from risks presented in the online space, such as bullying or grooming.

Bullying online via social media can have significant impacts on students’ mental health. Also, moving digital for education by using social media and other software platforms can increase the risks of data breaches, causing harm to and interfering with the privacy of students and other community members.

If harm occurs via school platforms, like the Voller case, the school could also be liable for defamation.

How we can help

Our experienced education team can help you review Codes of Conduct to ensure online bullying or defamation is addressed in your acceptable standards of behaviour. We can also help with a Social Media Policy. It is important to ensure that enrolment documents and any grievance procedures link to codes of conduct and acceptable standards of behaviour so your school is empowered to take action.

We also offer duty of care training for schools specifically addressing social media and digital environments.

Please contact us for further assistance.


[1] Fairfax Media Publications Pty Ltd v Voller; Nationwide News Pty Limited v Voller; Australian News Channel Pty Ltd v Voller [2021] HCA 27.

From Monday 15 November 2021, Victorian schools will be able to offer at-home rapid antigen tests to students who are primary close contacts of a positive case at school.

The rapid antigen tests will be offered to unvaccinated and partially vaccinated students, primarily those aged under 12. The aim will be to allow them to return to school after seven days of quarantine, rather than 14.

Fully vaccinated students who are primary close contacts of a positive case at school will not be offered at-home rapid antigen tests, as they are already only required to quarantine for seven days.

The move has been welcomed by educators and parents, who are concerned about the many months of interrupted learning in Victoria and the impact on young people’s wellbeing and learning.

To optimise students’ learning and limit the spread of COVID-19, schools will need to ensure they have a policy and procedure for rapid antigen testing. Requirements need to be clearly communicated to parents as well, to ensure testing and attendance is done properly. Schools will also need to consider the feasibility of dual-stream teaching – that is to students at school, and remotely to students in quarantine. If this is not feasible, then alternatives for students in quarantine need to be implemented and communicated.

How will testing work?

At present, unvaccinated and partially vaccinated students who are primary close contacts of a positive case at school are required to quarantine for 14 days before returning to school. From Monday 15 November, they will only need to quarantine for seven days before returning to school, provided they:

  • return a negative PCR test on day six of their quarantine; and
  • return a negative rapid antigen test at home on each school day before school on days eight to 14 of their quarantine.

They will also need to return a negative PCR test on day 13 of their quarantine in order to conclude their quarantine on day 14 and return to school on day 15.

Timeline showing when students may return to school

PCR tests are free of charge and can be obtained from a COVID-19 testing site. Rapid antigen tests will also be provided free of charge and are able to return a test result within 15-30 minutes. Whereas PCR testing results must be provided directly to schools, rapid antigen testing results must be provided to schools via the Department of Education and Training’s web-based form.

How can students participate?

The Victorian Government has secured 200,000 rapid antigen tests for schools, and more are expected to arrive each week. Once received by schools, they will be distributed free of charge to unvaccinated and partially vaccinated students who choose to opt-in to undertake rapid antigen testing. Students who choose not to opt-in must quarantine for 14 days and return a negative PCR test on day 13 of their quarantine in order to return to school from day 15.

What are the advantages and disadvantages of rapid antigen testing?

Rapid antigen tests are relatively low cost and can determine whether an individual is likely or not to have COVID-19 within a short space of time. For these reasons, they will be suitable for daily use by students prior to their school day and able to maximise school attendance for students who return negative results. Ultimately, the provision of free rapid antigen testing is likely to:

  • minimise the spread of coronavirus throughout school communities;
  • allow unvaccinated and partially vaccinated students to spend more time in class and less time in quarantine;
  • promote students’ mental health and wellbeing;
  • enable schools to meet their duty of care to take reasonable measures to protect students from reasonably foreseeable risks of injury; and
  • provide peace of mind to school staff when teaching younger students who are not eligible to be vaccinated.

However, there are likely to be a number of challenges associated with rapid antigen testing. In particular:

  • there will need to be sufficient stock of rapid antigen tests to enable students to undertake daily tests between days eight and 14 of their quarantine period;
  • rapid antigen tests are not as accurate as PCR tests and are only able to determine whether an individual is likely or not likely to have COVID-19;
  • rapid antigen tests are susceptible to returning a false negative or false positive result;
  • rapid antigen tests may return invalid results, and students who return two successive invalid results will not be able to return to school until they return a negative PCR test;
  • there is a risk that rapid antigen tests will be improperly administered; and
  • there is a risk that rapid antigen testing results will be improperly reported by parents or guardians.

There are also industry calls for further reliance on rapid antigen testing, so that students can “test and stay” at school and avoid a quarantine period altogether. The seven day period is considered too long by many in circumstances where remote learning may not be offered to quarantining students, given the challenges of providing “dual-stream” learning. If implemented, there will be further requirements for schools in relation to the physical environment at school, perhaps similar to the VCAA guidelines in place at present for senior exams.

Rapid antigen testing pilot in schools

The Department of Education started piloting the use of rapid antigen tests in 20 schools affected by COVID-19 outbreaks from Monday 8 November. The pilot program aims to determine:

  • how students and their families will respond to rapid antigen testing in their homes; and
  • how schools will manage the receipt of testing results from students and their families.

The Department of Education is yet to publish the results of the pilot. The results will be used to inform the rollout of rapid antigen testing to all schools from Monday 15 November.

How we can help

We can help you to:

  • prepare and adopt policies and procedures for rapid antigen testing and COVID-19;
  • review your existing policies and procedures to ensure that they are in line with current public health advice;
  • effectively communicate your school’s policies and procedures on COVID-19 to your school community and respond to any queries or concerns raised;
  • manage student attendance and absence if students at your school become primary close contacts and are required to quarantine; and
  • minimise the impact on students’ learning when they are required to quarantine, including by implementing dual-stream teaching which meets your duty of care without unnecessarily burdening staff.

Please contact us for further assistance.

Not-for-profits and charities that are companies (and incorporated associations with an ARBN) should ensure that their directors or committee members obtain a Director Identification Number (Director ID) by 30 November 2022 (if appointed on or before 31 October 2021) or within 28 days of appointment (if appointed on or after 1 November 2021). From 5 April 2022, a Director ID must be obtained before appointment.

What is a Director ID?

A Director ID is a unique 15 digit number issued to a director (or someone who intends to become a director) to prevent fraud and reduce the use of false director identities. Directors must apply once and will then retain their Director ID forever.

Who will need a Director ID?

All directors of a company, registered Australian body, registered foreign company or Aboriginal and Torres Strait Islander corporation will need a Director ID. This includes:

  • directors of companies limited by guarantee; and
  • committee members of those incorporated associations that are registered Australian bodies with an Australian Registered Body Number (ARBN).

When is a Director ID required?

All Directors can apply for a Director ID now. The following table sets out the deadline by which you must apply.

Type of companyDirector appointment dateWhen application must be made
Companies, registered Australian bodies (including incorporated associations with an ARBN)– On or before 31 October 2021

– Between 1 November 2021 and 4 April 2022

– From 5 April 2022
– By 30 November 2022

– Within 28 days of appointment

– Before appointment
Aboriginal and Torres Strait Islander corporations registered under the Corporations (Aboriginal and Torres Strait Islander) Act 2006 (Cth)– On or before 31 October 2022

– From 1 November 2022
– By 30 November 2023

– Before appointment

How do I apply for a Director ID?

The Australian Business Registry Services website provides information on how to apply for a Director ID.

  1. Set up a myGovID.
  2. Have your documents handy. You will need your tax file number, residential address (as held by the ATO) and information from two documents to verify your identity (passport, driver’s licence, notice of assessment, PAYG payment summary etc.).
  3. Apply for your Director ID.

What happens if I do not apply for a Director ID?

If you do not apply for a Director ID within the timeframes set out above, you may face civil and criminal penalties or be issued with an infringement notice.

What should I do after I receive my Director ID?

After receiving your Director ID, you will need to provide the number to the company or incorporated association’s record holder (usually the Secretary).

How we can help

If you would like further information, please do not hesitate to contact us.

Acknowledging the various privacy regimes across Australia, the national and state and territory privacy commissioners have collaborated on 5 National COVID-19 Privacy Principles.

Below is our summary of these 5 National COVID-19 Privacy Principles and some tips for how to implement them in your organisation.

No.PrincipleExplanation
1Data minimisationOnly collect and hold the minimum amount of vaccination information you need.
Do you need to store copies of certificates?
Can you sight certificates instead?
2Purpose limitationOnly use and disclose vaccination information for the purpose for which it was collected.
Your collection statement should describe the primary purpose of collection.
3SecurityTake reasonable steps to secure this information. Community expectations are that you do not store this overseas.
Reflect on your cloud service providers, and other data protection measures such as password protections and access limitations.
4Retention and deletionEnsure information handling processes reflect on how long your organisation needs the vaccination information for, and when it can be deleted.
Delete as soon as possible.
5Regulation under privacy lawIndividuals should have enforceable rights and a means to redress (despite the employee records exemption).

The national regulator, the Office of the Australian Information Commissioner, has also recently published privacy guidance for businesses collecting COVID-19 vaccination information that draws on these 5 key principles.

Privacy by design

Privacy by design is the concept that privacy protections should be built into systems from the beginning to ensure privacy is an automatic feature of information handling processes.

This is why a change in information handling practices – such as starting to collect vaccination information – is the perfect time to reflect on how your organisation meets its privacy compliance obligations and can better design privacy into technical systems and human processes.

How we can help

Moores has expertise in privacy, from technical data flow assessments and audits to better understand how you can manage your data assets, to privacy training and refreshers to staff, and helping you respond to data breaches.

Please contact us for further assistance.

The British privacy regulator, the Information Commissioner’s Office (ICO), has fined charity HIV Scotland £10,000 for a data breach. This data breach was notified to the British regulator under a similar scheme to the Australian Notifiable Data Breach scheme introduced in 2017.

The data breach was caused by an email sent to 105 people in February 2020 using the carbon copy (CC) function instead of blind carbon copy (BCC). This meant the email addresses were visible to all recipients.

Because email addresses often identify people’s names, this data breach identified 65 people by name. Due to the nature of the email and the charity – HIV Scotland – the breach could also have led to assumptions about people’s HIV status or risk. This is understandably very private information, and in Australia, would be classified as health and sensitive information under the Privacy Act 1988 (Cth).

Email risks for vaccination information

A similar risk in the current environment is around COVID-19 vaccination status. Organisations need to be particularly aware of the dangers of collecting sensitive information via email. For example:

  • Email is not the most secure collection method. Instead, consider collecting vaccination information in another manner.
  • Emails can be easily forwarded, leading to unauthorised disclosures and data breaches.
  • You will likely be saving the vaccination information elsewhere in your records, but the information will remain in an inbox. Consider deleting emails once information is collected.

Also remember, when replying to emails, the personal information that could be disclosed below in the email chain.

Human error data breaches in Australia

The danger of the CC is present for Australian organisations too. Between January and June 2021, the Office of the Australian Information Commissioner (OAIC) reported:

  • 30% of data breaches were caused by human error;
  • 8% of human error breaches were from failing to use BCC; and
  • 40 of human error breaches were caused by emailing personal information to the wrong recipient.

See the OAIC’s report for more information about Australian data breaches.

How to protect your organisation from email related data breaches

We recommend you:

  • implement staff privacy and refresher training;
  • establish set methods of sending bulk emails by BCC; and
  • have a privacy policy that staff are familiar with, and preferably internal procedures and fact sheets to inspire best practice.

In response to this data breach, the ICO is encouraging all organisations to revisit their bulk email policies to ensure they have robust procedures in place. This is particularly relevant for charities and not-for-profit organisations for whom personal information (such as contact details) is central to the very nature of their work.

How we can help

We can help you prepare for data breaches through privacy training, privacy audits and designing custom privacy and data protection procedures and internal tools for staff.

We can help you respond to a data breach by assessing the breach under the Notifiable Data Breach Scheme, and helping you implement a Data Breach Response Plan.

Please contact us for further assistance.

The Victorian Registration and Qualifications Authority’s (VRQA) School intervention framework for risks relating to the care, safety and welfare of students complements the existing school review process by explaining how the VRQA will make decisions about intervention action to ensure the safety of children in Victorian schools.

By releasing the framework, the VRQA is empowering Victorian schools to predict and understand intervention action.

The VRQA may intervene in the administration and running of a school to protect students when child safety risks are identified, for example, through media reports, referrals from other agencies such as the Commission for Children and Young People, or complaints.

Indicators of child safety risks

The framework identifies indicators of increased child safety risks, and an increased need for high-level intervention as:

  • School leadership is not responding appropriately to allegations.
  • The school does not have a culture of child safety.
  • The school has a history of poor governance.
  • Allegations indicate there is a current risk of harm to students.
  • Allegations are of a serious nature and/or consequences to students are serious:
    • may or do constitute reportable conduct or a criminal offence;
    • multiple incidents or complaints;
    • involve a teacher, employee or volunteer;
    • failure by school to report allegations of reportable conduct or criminal conduct;
    • failure by mandatory reporter to report abuse;
    • imminent risk to students; students have suffered physical, sexual, emotional abuse or neglect etc.

This demonstrates the importance of strong reporting processes and procedures in schools, as well as regular refresher training for staff to empower them to meet child safety reporting obligations. For more information about identifying child safety blind spots, you can watch our 2nd September webinar here.

Scale of intervention

The VRQA framework also explains the scale of intervention it might take in a school when responding to child safety risks. The lower end of intervention involves contacting the Principal, or writing a letter to the school, while higher level intervention involves sending Authorised Officers to the school to investigate.

Graph with scale of intervention between lower and higher levels.

How we can help

Moores has extensive experience dealing with VRQA reviews of schools, handling intervention action such as enforceable undertakings, and helping you do the ground work to prevent intervention in the first place. We can help implement strong child safety measures and governance practices to best equip your school to provide a safe environment for all students.

Please contact us for further assistance.