Introduction

This document outlines ICHK HLY’s approach to protecting the privacy and personal data of our community members, in conjunction with Hong Kong law, and emerging best-practice. Since becoming a public utility in the late 1990s, the Internet has challenged existing views, norms and practices around privacy, with broad impacts on data protection. Social media and mobile devices have further complicated matters.

Definitions

Personal data is taken to include any information relating to, and able to identify, a living individual. This includes information in digital and analog forms, such as text, images, audio and biometrics.

Although we are all rich and constant sources of data, this policy is primarily concerned with that information about individuals (known as data subjects), that is captured by ICHK HLY (known as a data user). It also deals with those external organisations from whom we obtain services (known as data processors). In this policy the term “parents” is taken to include parents, guardians and caregivers.

Legal Framework

In Hong Kong we are subject to the Personal Data (Privacy) Ordinance (PDPO), passed in 1995, amended in 2012. ICHK HLY is also subject to the standards of the Council of International Schools. Hong Kong’s PDPO enshrines 6 technology-neutral Data Protection Principles:

1. Purpose & Manner of Collection – data should be lawfully collected, and adequate for the required task, without being excessive.
2. Accuracy and Duration of Retention – data should be accurate and kept only for the duration required.
3. Use of Data – data should only be used for the purposes stated at the time of collection.
4. Data Security – data should be protected, using all practicable steps, from improper access and deletion.
5. Openness and Transparency – policies and practices need to be shared and accessible.
6. Access and Correction – data subjects have the right to view and correct data stored about them.

These are summarised, in Cantonese and English, in the government’s Six Data Protection Principles publication.

Key Privacy Statements

The following statements define ICHK HLY’s commitment to the privacy of your data.

1. ICHK HLY collects data only for purposes related to, and in the service of, the education of our existing and prospective students.
2. Our school’s Data Protection Officer (DPO) is responsible for oversight of data collection, processing and privacy. You can contact the DPO via email, data@ichkhly.edu.hk, should you have any privacy- or data-related questions.
3. When using our school website, data collection is voluntary, and takes place when submitting any form.
4. When using our other online services, including Gibbon, data collection is obligatory. Failure to submit such data means that we may be unable to offer educational services and/or employment to you or your child.
5. Through the act of submitting data through our online systems users give their consent for the collection of this data, and agree to this policy.
6. Parents and staff will be prompted to update personal, family, financial and medical data related to themselves and their families at the start of each academic year.
7. Parents will be offered, via Orchard, a range of options to limit sharing of data (particularly photo/video/audio) relating to their children.
8. Data deemed essential to the long-term functioning of the school, such as academic records, employment records (name, email, job title) and voluntarily contributed alumni contacts, will be stored indefinitely. Other, non-essential information will be removed from our records according to the following schedule:
   1. Staff – 7 years after ceasing employment
   2. Students, Parents and Families –  36 months after leaving the school
   3. Admissions – 36 months after submission
9. In general we will not transfer your data to third party services, except those that are required for the education of your child (e.g. Toddle, Google, Meet The Teacher). When data is transferred, it will only be to services with whom we enter into an agreement which satisfies the requirements of this policy. Such compliance will be established through the use of terms of service and other contractual agreements.
10. Our data policies and practices are shared with the community, and data subjects will be notified upon any change.
11. Your right to view and correct data held about you is recognised under this policy. To exercise this right parents and other data subjects over the age of 18 can contact our Data Protection Officer. We reserve the right to retain or redact data in cases where the wellbeing or education of our students is deemed to be adversely impacted by its disclosure.
12. Our policies are subject to regular review, and staff are offered the professional development required to enact them.