Policy Confidentiality

Home Policy Confidentiality

POLICY REGARDING CONFIDENTIALITY

The purpose of this policy is to establish guidelines for the handling, protection, and disclosure of confidential information to ensure it remains secure and private.

PREAMBLE

For the purposes of this guideline and School policy implementation, School and Confidential Material (“information”) will mean any documentation, records or data, whether in paper or electronic format, relating to the School’s operations and its business, and the affairs of its Employees, Learners, Parents, Suppliers, Advisors, Service Providers, Clients, Associates or any other third parties with any dealings with the School.

PRINCIPALS

Due to the nature of employment, all School employees have access to the School’s information, and will gain knowledge of the School’s business, its strategies, plans, practices, procedures, policies and trade secrets. Employees will also obtain confidential information relating to the terms of employment, rewards, benefits, attitudes and capabilities of
School employees and/or its contractors.
In light of employees having access to this confidential information, and the policies and practices of the School, the School will take all reasonable and lawful steps that it considers appropriate to protect its proprietary interests and intellectual property, as well as the privacy rights of all of its stakeholders, particularly employees, learners, parents
(Clients) and third parties having business or educational dealings with the School.
The intention of any such steps taken by the School will not be to unreasonably restrict the rights of employees or any other persons having dealings with the School, nor to unreasonably prevent any person from seeking employment or providing a service to another party, organisation or School. Its intention shall be to prevent the unauthorised access, communication, disclosure or use of the School’s intellectual property and confidential information, as well as that of its
stakeholders.

PROTECTION OF PERSONAL INFORMATION (POPI Act)

The purpose of POPI

The Protection of Personal Information Act (POPI) was signed into law on 19 November 2013 and published in the Government Gazette on 26 November 2013. The POPI Act:

recognises that a person’s right to privacy includes protection against unlawful collection, retention, dissemination and use of personal information.
introduces measures to protect personal information that is processed by public and private bodies.
prescribes minimum requirements for processing personal information.

The main purpose of POPI is to:

give effect to everyone’s right to privacy as enshrined in the Constitution;
facilitate the balance between the right to privacy with other rights, such as the right to access information; and
safeguard important interests such as the free flow of information within the Republic and across international borders.

What does this mean for schools?
The scope of POPI includes schools as entities that handle personal information for administrative purposes. The standards set in POPI for the protection of personal information will significantly impact upon the collection, handling and disposal of data in schools. In order to comply with POPI, schools will need to:

plan and allocate resources to lawfully collect, handle and dispose of data;
analyse their current practices in dealing with personal information;
draft or review their own data protection policy in line with the new requirements set out in POPI; and
proactively implement the significant requirements of POPI to enable schools to avoid the pressure of meeting the compliance deadline of POPI.

What will happen if you do not comply with POPI?
Schools that do not comply with POPI may be liable to pay a penalty of up to R10 million. In their individual capacity, responsible personnel (Principal / Head) who breach POPI, may be liable for a fine and/or imprisonment for up to 12 months.
What conditions does POPI impose on schools to keep the personal information safe and secure?
POPI requires schools to:

secure the integrity and confidentiality of the personal information that it has in its possession or under its control;
take appropriate steps to prevent the loss of, or damage to, the personal information;
prevent unlawful access to, and unauthorised destruction of, the personal information;
identify internal and external risks to the personal information under its control or possession; and
establish and maintain appropriate safeguards against losing or damaging the personal information.

Definitions
What is ‘personal information’?
Personal information is broadly defined in POPI as meaning information relating to an identifiable, living, natural person, and where applicable, an identifiable, existing juristic person, including, but not limited to:

information relating to the race, gender, sex, pregnancy, marital status, national, ethnic or social origin, colour, sexual orientation, age, physical or mental health, well-being, disability, religion, conscience, belief, culture, language and birth of the person;
information relating to the education or the medical, financial, criminal or employment history of the person;
any identifying number, symbol, e-mail address, physical address, telephone number, location, online identifier or other particular assignment to the person;
the biometric information of the person;
the personal opinions, views or preferences of the person;
correspondence sent by the person that is implicitly or explicitly of a private or confidential nature or further correspondence that would reveal the contents of the original correspondence;
the views or opinions of another individual about the person; and
the name of the person if it appears with other personal information relating to the person or if the disclosure of the name itself would reveal personal information about the person.

What is ‘processing’ of personal information?
Processing refers to any act that can be performed when handling personal information. POPI defines processing to include collecting, recording, organising, updating, storing, distributing, destroying or deleting personal information.

CONFIDENTIALITY OF SCHOOL INFORMATION

In order to protect the School from unlawful access, disclosure or use of its confidential information or intellectual property, for any unauthorised purpose or to its disadvantage or for the purpose of unfair competition, the School will
expect all its employees to undertake in favour of the School that

The Employee will not, during his/her employment with the School or at any time thereafter, and whether for his/her own benefit or for the benefit of any other person, business, enterprise or organisation:
Remove, abstract, take copies of, reproduce in any other way or have in his/her possession (save in the ordinary course of his/her duties with the School) any document or other record, including visual and sound records, which contains information relating to any or a full or partial list of learners, parents, clients or sponsors, or any information relating to their personal details or interests, other than those which are published for general information;
Remove, abstract, take copies of, reproduce in any other way or have in his/her possession, save in the ordinary course of his/her duties with the School, any information relating to the identity of or terms of employment or rewards, attitudes or capabilities or any School employee, contractor, supplier or service provider, other than information which is freely available to the general public;
Divulge to any other or unauthorised person, party or organisation any School information as described herein,
except in the ordinary course of their duties with the School.
The Employee will refer all potential educational or new business opportunities, however identified, to the School to be transacted by and for the exclusive benefit of the School.

NON-ACCESS AND NON-DISCLOSURE

Further to the requirements set out above, employees may not during their service with the School, for their own benefit or for the benefit of any other person or party or organisation:

Undertake unauthorised access or usage of computer equipment of whatever nature, neither will they permit unauthorised access or usage thereof by persons who are not employees or contractors of the School;
Permit or undertake the unauthorised access to or disclosure of software or hardware packages, networks, designs or ICT systems and configurations provided or in use by the School or its stakeholders;
Permit software, hardware and physical access passwords and other security measures, including but not limited to staff identity numbers and entry cards, to be transferred or to come within the knowledge of another person, whether the transferee be an employee or contractor or not.

LIMITED RESTRAINT

Employees who are employed in senior or key positions by the School may be contracted on the basis of further confidentiality and non-disclosure provisions being imposed upon them in terms of their contract of employment.

The extent and effect of any such further provisions, and any restrictive provisions as may be generally applicable in terms of their contracts of employment, will be in accordance with the employee’s seniority or their level of access to School Information.
Unless indicated to the contrary, ALL School employees will be subject to the following limited restraints:
Employees may not, during their service with the School, and for a period of up to 2 (two) years thereafter, directly or indirectly and whether on their own behalf or on behalf of any other person, party or organisation or School, encourage, entice, persuade or induce learners or parents to terminate their relationship with the School, or to refrain from entering into such a relationship with the School as the case may be;
Employees may not, during their service with the School, and for a period of up to 2 (two) years thereafter, directly or indirectly and whether on their own behalf or on behalf of any other person, party or organisation or School, encourage, entice, persuade or induce any Employee or Contractor to terminate his/her employment or service with the School, or to seek to change the terms of his/her employment or service with the School as the case may be.
The School submits that the above undertakings in terms of confidentiality and limited restraint are reasonable and warranted, and are required for the legitimate and lawful protection of the School and its stakeholder’s interests, and as such are fair and lawful.

INVENTIONS AND PUBLICATIONS

An employee’s creation and development of educational material, notes, presentations, models, products or any printed or reproduced material, or any other form of invention associated with his/her duties and the practices and business of the School, will be regarded as an inherent part of the employee’s normal duties and as a normal School activity.
Any title, copyright, patents or royalties stemming from these creations or inventions will be exclusively vested in the School.
Employees will, if and when required by the School, and at the School’s expense, be required to apply or join with the School in applying for Letters Patent or other equivalent protection, in the Republic of South Africa or in any other part of the world for such creation, discovery, invention, process or improvement. The employee will execute all
instruments and do all things necessary for vesting the said Letters Patent or other equivalent protection in the name of the School as sole beneficial owner, or in the name of such other person or organisation as the School may nominate.
Insofar as may be necessary, employees will assign to the School the copyright in all present and future works eligible for copyright including, without limitation, educational material and technologies or aids, literary or artistic works or software programmes of which they may be the author, which works were or are created, compiled, devised or brought into being during the course and in the scope of their employment with the School.
No consideration will be payable by the School to an employee in respect of any such assignments or applications for Letters Patent.
All reports, manuals, research papers, letters or other similar documents (the nature of which is not limited by the specific reference to the foregoing items) which are compiled, refined or updated or brought into being by an employee, or that come into an employee’s possession during the course and in the scope of his/her employment with the School, and all copies thereof, will be the exclusive property of the School.

RETURN OF SCHOOL PROPERTY AND ASSETS

On termination of the employee’s employment with the School, for whatever reason, the employee will immediately return and deliver to the School all its assets and property in the possession of the employee, whether or not they were originally supplied by the School to the employee.
The intentional non-return of any assets or property of the School upon termination of employment may be considered by the School as constituting unauthorised possession, misappropriation and /or theft of same by the employee.