One father, Justin Samson*, has been lodging Freedom of Information requests to find out what is being recorded about his son at his Melbourne state school. "I can't pay $28 every month to find out what is happening at my son's school," he said, referring to the cost of an FOI request. The father, who works in IT, is alarmed that parents aren't notified when a record is made. He also raised concerns about the security of the data. "What sort of society do we live in when they are collecting this information about children?" Earlier this year police investigated two major privacy breaches at Victorian state schools involving information about families stored on Compass.

It's understood that students accessed the data by obtaining staff passwords – the company said it hadn't identified any security flaw. At Camberwell High School, one student gained unauthorised access to personal information about families, while at Blackburn High, the phone numbers, addresses and Medicare details of parents were published online. Freedom-of-information documents obtained by Mr Samson detail 62 incidents, spanning 3½ years, that his now 11-year-old son has been involved in. Redacted copies of some of the entries about Mr Samson's son are shown below:

The entries range from his son playing games on an iPad in class to pulling down a student's pants, throwing wet toilet paper at a wall, calling someone gay, swearing and choking another student. One of the grey-rated incidents details how students tickled his son "on the side and even touched his private part". Mr Samson said he was never told about this incident, along with most of the entries. He said some of the incidents recorded were untrue. The records can be accessed by all teachers at the state school and Mr Samson is worried that they could unfairly cloud a teacher's opinion of a child.

He found out about the student chronicles after questioning a comment about his son's behaviour in his school report. The school said it had evidence to back up the statement and that Mr Samson could FOI his son's Compass records. The records also contain observations about parents. "His parents have had issues with the college and are not to have meetings with teachers without another member of staff present," one entry about Mr Samson's son reads.

The student chronicles have been available to schools since 2011 and many schools consider them a replacement for paper records previously stored in locked drawers. Parents Victoria chief executive Gail McHardy said she had never heard of the student chronicles, and parents should be notified of all incidents relating to a student's wellbeing. "These things should be automatically reported to parents ... record keeping needs to be done in a secure way." Principals say they let teachers pass on important knowledge to other teachers. "In the past you went into the class blind. This helps meet student needs. It might help the next teacher understand why a student is agitated," said one principal, who did not want to be named.

Compass director John de la Motte said the chronicles were a secure tool and schools could determine which staff had access to the data. Mr de la Motte said the data was protected using encryption, password protection and suspicious users were blocked. "We undertake regular, certified security penetration tests from an independent testing organisation," he said. The data is stored in Australia and does not follow students if they move schools, he said.

An Education Department spokesman said the information was held for the duration of a student's time at a school and may be transferred if they moved school. "There is no obligation for a school to notify a parent when a record is made about their child," he said. He said the Department worked with schools to ensure they followed best practice security standards when using third-party systems such as Compass. "Teachers regularly track student progress throughout their schooling to help them complete reports and monitor students' progress and wellbeing, including through programs like Compass," he said. Victorian Association of State Secondary Principals president Judy Crowe said teachers had always kept notes about students.

"In the past teachers may have recorded information in their own diaries, there may have been discussions between teachers," she said. "They tend to keep some records in the best interests of students." A spokeswoman for the Office of the Victorian Information Commissioner said organisations must take reasonable steps to inform a person whose information is being collected. "Personal information can only be collected if it is required for the organisation to fulfil its functions and its collection must not be unreasonably intrusive," she said.