A New Zealand primary school has been officially censured after it displayed a student's "extremely sensitive" medical information about their toileting in its staffroom.
The Privacy Commissioner ruled in October the primary school breached the Privacy Act after they displayed a child's Medical Action Plan in the staffroom.
• Premium - Jacinda Ardern warned by Privacy Commissioner not to give Police a 'blank cheque for information sharing'
• Facebook are 'morally bankrupt, pathological liars' - NZ Privacy Commissioner
• 'Your silence is an insult to our grief,' Privacy Commissioner tells Facebook
• Privacy Commissioner deletes Facebook 'pathological liars' tweet
The child had high needs and the Medical Action Plan devised by the school included sensitive medical information regarding the student's toileting.
The school sent the Medical Action Plan home to the parents via the child in an unsealed letter.
The parents were concerned with the way the school delivered the information, which they believed should have been enclosed in an envelope or marked as confidential.
The parents also worried their child's dignity could have been compromised if the medical information was viewed by their child's classmates.
However, the school argued not having the information easily accessible could compromise the school's ability to deal with students with serious health needs.
The school also claimed the staffroom was a private location, not open to students and that the most sensitive information in the document was known to other students, who were extremely kind to the child and sensitive to the problem of the student concerned.
However, the Privacy Commission did not agree, and in the case notes for their October 15 decision ruled:
"Our investigation concluded that the school had breached principle 5 of the Privacy Act. Given the extremely sensitive nature of the child's medical condition, we did not believe the staffroom was the appropriate location to display the MAP.
"Although the staffroom was predominantly accessed by school staff, it was reasonable to assume that children or other adults may enter it."
In censuring, the Privacy Commission recommended the school apologise to the parents and undertake privacy training.
But as the school removed the Medical Action Plan from the staffroom and undertook steps to review its processes, there was no further action.