Privacy in Schools - Office of the Privacy Commissioner

10
PRIVACY
Privacy principles
The backbone of the Privacy Act is the 12 privacy principles. It is to
these principles that you should turn when dealing with:
• collection of personal information;
• storage of personal information;
• use of personal information;
• disclosure of personal information; and
• access to and correction of personal information.
This chapter summarises and explains the 12 privacy principles. The
full text of the principles is set out in Appendix A, page 38.
You will see that although there are 12 principles, there are a number
of exceptions to the principles which make them guidelines to the
implementation of the Privacy Act rather than rigid statements of law.
One important exception to the principles is that the Privacy Act is
subject to all other legislation. Therefore your obligations under the
Education Act must be met before you consider the Privacy Act. For
example, all schools are required to comply with the requirements for
enrolment records under the Education Act and all schools are required
to report any expulsion to the Ministry of Education. It is anticipated
that in 2010, primary and intermediate schools will be required to report
to parents on how their child is doing against new National Standards
in reading, writing and maths.
If you have any questions about the principles or if you wish to make a
complaint then you should contact the Offi ce of the Privacy
Commissioner. For contact details, see page 37 and the Commissioner’s
website, www.privacy.org.nz.
Principle 1 – only collect information that you need to have
When collecting personal information about students, their parents,
caregivers, or families, you must be sure you are collecting it for lawful
purposes of the school and the information is necessary for those
purposes.
So what are lawful purposes of a school
It is perhaps easiest to defi ne lawful purposes as those that are not
unlawful. So, for example, if a purpose is to breach the anti discrimination
obligations of the Human Rights Act or the purpose is for criminal
activity, then obviously neither of these will be a lawful purpose.
The more challenging aspect to principle 1 is identifying when it is
necessary to collect the information.
A good starting point is the teaching profession’s ethical code.
At the date of this publication, the New Zealand Teachers Council Code
of Ethics describes the goal or purpose of teaching which is to attain the
highest standards of professional service in the promotion of learning.
The Code also recognises that this complex professional task is
undertaken in collaboration with colleagues, learners, parents/guardians
and family/whānau, as well as with members of the wider community.
Another document to consider is the school’s charter or strategic plan
that identifi es the school’s mission (vision or purpose), aims, objectives,
directions, and targets together with its values or principles (kaupapa
and tikanga). From there, the school needs to identify what it needs to
know about students and their families to meet those purposes.
A good approach for schools is to consider whether or not the
information is needed to complete a process such as enrolment or an
application to attend a school camp. If so, then the school probably
needs to collect the information. A further check is to see if other
schools are collecting the same information in the same
circumstances.
An obvious example is a student’s home address. That information will
be necessary to complete the enrolment process and it is information
collected by other schools.
To give another example, some schools set the celebration of
achievement as part of their vision. That value may mean that one of
the purposes for collecting information is the identifi cation of a student
(maybe with a photograph) and the publication of that student’s results
or other success as part of the celebration of achievement. In that
scenario, can a school ask for a photograph or consent to use
a photograph
PRIVACY
11