ECE privacy procedures

These procedures apply to all University Members who work for or with the University’s ECE Services (including both centres and Kōhanga Reo), and to any volunteers, including whānau.

These procedures support the University’s Privacy Framework by outlining specific privacy procedures and considerations relating to the management of personal information by the University’s ECE Services.

The University’s Privacy Framework includes a high-level Privacy Policy, privacy procedures relating to Disclosure, Personal Information Requests and Privacy Breach Management, and a set of Privacy Guidelines (or FAQs). All University Members are expected to manage personal information in accordance with the University’s Privacy Framework, which promotes the following concepts:

• Data minimisation – limiting the amount of personal information the University collects and retains
• Transparency – being open and honest about what information the University collects and how it will be used
• Security – protecting the personal information the University holds from harm.
• Use limitation – making sure the University uses and discloses personal information only when necessary and with a lawful basis
• Privacy rights – helping the University’s data subjects to exercise their privacy rights and maintain some control over their information.

Privacy is particularly important for ECE Services, which collect and process personal information about vulnerable people – including tamariki and their whānau – and may have to use or share personal information in ways that could impact individual trust. These procedures are intended to help ECE Centres/Kōhanga Reo to manage their specific regulatory and safety requirements in a way that protects and respects tamariki and whānau privacy.

ECE Services/Kōhanga Reo must generally manage personal information in accordance with the University’s Privacy Policy and associated procedures, with the exception of the specific procedures set out below. In the event of any inconsistency between these ECE procedures and the University’s general Privacy Policy and associated procedures, the ECE procedures will prevail.

Governance

1. Each Centre Leader/ Kaiwhakahaere will act as the first line Privacy Officer for their service/Kōhanga Reo. The ECE General Manager, with the support of other Department Leaders, will provide support and a point of escalation to Centre Leaders/Kaiwhakahaere where required. The ECE General Manager will escalate significant privacy issues to the University Privacy Officer where required.

Collection

2. ECE Services/Kōhanga Reo must collect only the personal information they need to deliver services and meet their regulatory and other requirements. The types of personal information we collect about tamariki and their whānau are listed in the ECE Privacy Statement.

3. ECE Services will generally collect personal information about tamariki from their parents/guardians. If we need to collect personal information from another third-party source – such as the Police – we should obtain the parents’/guardians’ consent before doing so. If we cannot obtain consent (for example, where the collection is necessary for health or safety purposes and we cannot contact the parent/guardian), we must provide the parent/guardian with a privacy notice about the collection as soon as practicable afterwards.

4. ECE Services staff, students, volunteers, and contractors must read and understand the ECE Privacy Statement and be able to explain to parents/guardians or others why personal information is required, and how it may be used or shared.

5. ECE Services must collect information in ways that are fair and not unreasonably intrusive. This requires us to consider:

• The age of the person we’re collecting information from. The younger they are, the less they may understand about the consequences of giving us information or authorising us to collect it from someone else.
• Cultural or religious sensitivities about sharing certain information. For example, gender differences could be more important for some cultures.
• The power imbalance between a teacher and their tamariki, or between ECE staff and parents/guardians, which can have an impact on fairness.
• The environment within which we’re collecting information. For example, we should not ask tamariki to reveal sensitive information in a classroom setting.  

6. In some cases, ECE Services/Kōhanga Reo must ask parents/guardians for their consent to collect or use personal information in certain ways. For example, we must obtain the written consent of parents/guardians to use photographs or video footage of their tamariki for any public purposes, such as research, promotion, marketing, or sharing with parent/guardian class groups.

7. Parents/guardians or whānau must not be permitted to take photographs or video footage of tamariki at ECE Services/Kōhanga Reo.

8. ECE Services/Kōhanga Reo must use only service devices to capture photographs or video footage of tamariki. If personal devices are used, photographs or videos must be promptly transferred to centre systems and deleted from those devices.

Use and disclosure

9. ECE Services should generally use and disclose personal information only in the ways we outline in the ECE Privacy Statement. Any uses of information for new purposes, or disclosures to third parties not listed in the ECE Privacy Statement, must be approved by the ECE General Manager.

10. ECE Services staff, students, volunteers, and contractors must confirm that the relevant parent/guardian has provided written consent before using photographs, videos, or other media about their tamariki for any public purposes, such as research, promotion, marketing, or sharing with parent/guardian class groups. These confirmations of written consent must be provided to the ECE Department's Management or Leaders for appropriate storage/retrieval, if required.

11. ECE Services staff, students, volunteers, and contractors must never disclose personal information, including photographs or videos of tamariki, on social media platforms or other websites. For more information on acceptable use of social media platforms and other technology, see the University IT Acceptable Use Policy.

12. ECE Services must manage requests for information from government or law enforcement agencies, including Oranga Tamariki or the Police, in accordance with the Information Sharing Process set out at Appendix 1.

13. ECE Services may proactively disclose personal information to certain government or law enforcement agencies if they believe this is necessary to ensure the safety of a tamaiti. Such disclosures should be managed in accordance with the Information Sharing Process at Appendix 1.

14. ECE Services must manage requests from parents/guardians for personal information about their tamariki in accordance with paragraphs 14-17.

Access and correction

15. All data subjects have the right to request a copy of personal information ECE Services/ Kōhanga Reo holds about them. This means parents/guardians, staff, volunteers, students, and contractors can request a copy of their personal information. These requests must be escalated to the Centre Leader/ Kaiwhakahaere, and managed in accordance with the University Personal Information Request Procedures.

16. The Privacy Act does not give parents/guardians an enforceable right to request a copy of the personal information we hold or create about their tamariki. In practice, we will share personal information about tamariki with their parents/guardians, both on request and proactively as part of our ongoing operations. However, we must always consider the best interests of tamariki. There may be circumstances in which it is not in the best interests of the tamaiti for us to release personal information to their parent/guardian (for example, where we have documented suspicions of child abuse or neglect). In these cases, we may refuse to release personal information to parents/guardians.

17. When a parent/guardian enrolls their tamaiti, they will be asked to authorise the ECE Service/ Kōhanga Reo to confirm the use of and gain access to their tamaiti’s online portfolio. This access will allow the service and the parent/guardian to share information about the tamaiti and to record the tamaiti’s growth and development. Online portfolios are created on a secure online learning platform, which will contain written and visual materials about their tamaiti’s experience while attending the ECE Service.

Retention

18. Personal information must be retained in accordance with the University General Disposal Authority (GDA).

19. Where the GDA does not specify a retention period for a specific type of personal information, ECE Centres/Kōhanga Reo must ensure that the information is not retained for longer than we have a lawful purpose to use it. In some cases, the information we hold is subject to legislative retention requirements. For example, the Early Childhood Education Regulations 2008 require us to retain tamariki enrolment forms for 7 years.

Security

20. All ECE Services/Kōhanga Reo staff, students, volunteers, and contractors must take reasonable steps to protect the personal information we hold from loss, unauthorised access, use or disclosure, or any other misuse.

21. ECE Services/Kōhanga Reo staff, students, volunteers, and contractors must ensure that they access and use only the personal information they need to discharge their lawful functions.

22. Personal information must be stored securely, in lockable cabinets, or in the secure system of record for that type of information. Some employment information is stored in the University’s HR Services' secure systems.

23. Physical personnel files onsite for ECE Services/Kōhanga Reo staff, students, volunteers, and contractors may only be directly accessed by the Centre Leader/ Kaiwhakahaere or Assistant Centre Leader. Where necessary, personal information about staff, students, volunteers, and contractors may be made available to HR staff, authorised administrative staff, or third parties required to conduct audits, such as the Ministry of Education or Education Review Office.

24. Physical personnel files onsite for ECE Services/Kōhanga Reo staff, students, volunteers, and contractors may only be directly accessed by the Centre Leader/ Kaiwhakahaere or Assistant Centre Leader. Where necessary, personal information about staff, students, volunteers, and contractors may be made available to HR staff, authorised administrative staff, or third parties required to conduct audits, such as the Ministry of Education or Education Review Office.

25. University Privacy Breach Management Procedures. Complaints from parents/guardians or whānau about privacy issues should also be reported to the Centre Leader/Kaiwhakahaere and, where necessary, escalated to ECE Department Leaders.

26. Artificial Intelligence (AI) tools may only be used when they comply with the Privacy Act 2020, and the University of Auckland AI policy. Public or insecure AI tools must not be used to process personal information. Personal information may only be processed by AI tools approved by the University for such use. Before relying on the output of AI tools to make decisions about data subjects, these outputs must be verified for accuracy and completeness.

27. To ensure privacy breaches are minimised, or possible breaches are handled effectively, any individual using University-approved AI tools must ensure they can provide and explain how, when, and why an AI tool is used. 

The following definitions apply to this policy:

Parent/guardian means the adult/s who are responsible for the upbringing and care of the tamaiti. This could include the mother OR the father acting as a sole guardian, and anyone else the Family Court has appointed as a guardian. For more information on who could be a guardian, check this Ministry of Justice website.

Data subject means any natural person about whom the University collects and holds personal information and includes students, staff members, contractors, alumni and friends, donors, and visitors to the University’s websites or campuses. For the purposes of these procedures, the term 'data subject' includes tamariki, parents/guardians, and whānau.

Personal information means any information, whether electronic or hard copy, about a data subject, whether or not the information directly identifies the data subject, and includes but is not limited to contact, demographic, health, and academic information (including course results), CCTV footage, staff performance information, emails and other correspondence, and opinions about the data subject.

Privacy breach means an event (whether intentional or unintentional) in which personal information is lost or is accessed, altered, disclosed, or destroyed without authorisation, or is at increased risk due to poor security safeguards, including but not limited to:

• accidental disclosure of personal information to the wrong recipient.
• employee browsing of personal information without a legitimate business reason.
• an external attack on a university system; or
• a lost or stolen University device or document.

University member includes members of Council, committee members, staff members, committee appointees, the University’s companies’ staff and board members and contractors working for and on behalf of the University and, for the purposes of this procedure, includes students who collect or process personal information in the course of their studies or research, or who are otherwise permitted access to personal information held by the University.

• Privacy Act 2020
• Education (Early Childhood Service) Regulation 2008
• Health and Safety in Employment Act 1992
• Children's Act 2014
• Oranga Tamariki Act 1989
• ECE Privacy Statement
• Employee Privacy Statement
• University Privacy Framework
• IT Acceptable Use Policy
• IT Security Policy
• Records Management Policy

In some cases, ECE Services may be requested to, or decide to, share personal information about tamariki with government agencies.

Where such disclosures are required or permitted by another law (such as sections 15 or 66 of the Oranga Tamariki Act), these will not breach the Privacy Act. Where no other law applies, we must ensure that an exception to principle 11 of the Privacy Act (which relates to disclosure) permits us to share the information.  

Responding to requests for information from government agencies

ECE Services may receive requests for information about tamariki from various government agencies, including the Police, the Ministry of Education, or Oranga Tamariki. These requests must be managed in accordance with the following steps.

1. Escalate the request – Requests for information from government agencies must be directed in writing to the CL/K and the CL/K will send the request to a Department Manager before taking any action. The Cl/K remains the key contact where possible.
2. Verify that the request is genuine – Ensure that the request has been received in writing from a valid agency email address or on agency letterhead. If in doubt, contact the agency using a publicly available phone number to verify the request.
3. Confirm the legal basis for the request – Ensure that the request states the specific legislative provision under which it is being made. For Oranga Tamariki, this will usually be section 66 of the Oranga Tamariki Act. If there is no legislative basis for the request, the ECE Centre/Kōhanga Reo will need to ensure the disclosure is permitted under the Privacy Act (see below).
4. Clarify the request – Before deciding on a request, we need to be clear about:
   a. The scope of the request – how much information is the requester asking for, about whom, in relation to what time period, etc?
   b. The purpose for the request – is it made as part of a child welfare concern or investigation, or as part of legal proceedings?
5. Limit the scope of the disclosure – Remember, we should only ever disclose the minimum amount of personal information required to meet the purposes of the request. Always ensure that the information provided is objective, impartial, and factual, and that the information is not hearsay. Consult the University Privacy Officer if there is any uncertainty about the request.

Proactive disclosures of information to government agencies

ECE Services can always disclose personal information to third parties in the ways outlined in the ECE Privacy Statement. However, situations may arise in which we believe it is necessary to disclose information in ways that our tamariki, parents/guardians, or whānau might not expect.

Reporting suspected abuse

Section 15 of the Oranga Tamariki Act states that, if we believe that a child or young person has been, or is likely to be, harmed, ill-treated, abused, (whether physically, emotionally, or sexually), neglected, or deprived, or if we have concerns about the well-being of a child or young person, we may report the matter to Oranga Tamariki or the Police.

Sharing other safety concerns

In cases where section 15 of the Oranga Tamariki Act will not apply – for example, where we need to disclose information to a member of a tamaiti’s whānau – principle 11 of the Privacy Act permits us to disclose personal information if we believe on reasonable grounds that it is necessary to prevent or lessen a serious threat to health or safety.

To rely on this exception, we need to:

• be satisfied that a serious threat exists; and
• believe on reasonable grounds that disclosure is necessary to prevent or lessen that serious threat.

To decide if a threat is serious, the Privacy Act requires us to consider:

1. The likelihood of the threat occurring – is there a good chance this thing will happen?
2. The severity of the consequences if the threat occurs – if it happens, how bad will it be?
3. The time at which the threat might occur – how soon could this happen?

We also need to make sure we disclose personal information to a person or agency that can actually address the threat. This might be the Police, a member of a tamaiti’s whānau, a healthcare provider, or an emergency healthcare provider. We cannot use this exception to disclose information to the media or any other person or agency that does not have a role in protecting people or the person concerned.

Remember, we should only ever disclose the minimum amount of personal information required to assist with preventing or lessening the threat.

Keep a record of all disclosures

In the event of a complaint to the Privacy Commissioner, we must be able to demonstrate that we had a reasonable basis for believing we could disclose personal information at the time we disclosed it. This means we must keep a record of all disclosures made under this procedure, which includes the following information:

1. Date of the disclosure
2. Details of the person or agency to which the information was disclosed
3. Copy of the request
4. Record of reasons for disclosing the information
5. Copy of any advice received about the disclosure
6. Record of what information was disclosed