The purpose of this operational policy is to ensure our centre is clear about its privacy responsibilities under the Privacy Act 2020.
Position Statement
Our centre protects the privacy of children and their families enrolled in our service, and staff employed by our service, and in so doing adheres to the Privacy Act 2020.
Issue Outline
The Privacy Act 2020 sets out protections for individual’s right to privacy, including the privacy of children attending our centre, and their families. As a licensed early childhood education centre receiving government subsidies, we are, however, required to collect some information in order to operate our service and meet government requirements for our sector. Children, their families and staff are entitled to know what information is being collected and its purpose; and who information about them is being shared with and why.
Overview of the information privacy principles
The Privacy Act has 13 Information Privacy Principles (IPPs) which outline how personal information is collected, stored, accessed, corrected, used and disclosed. An overview of the IPPs can be read here: https://www.privacy.org.nz/privacy-act-2020/privacy-principles/
In summary, the IPPs are:
- Only collect the information you need
- Where possible, get the information directly from the person
- Be clear about what the information will be used for
- Use fair and reasonable ways of collecting information
- Keep information safe
- Let people access information about themselves
- Correct information if the person thinks it is wrong
- Make sure information is accurate before you use it
- Only keep information as long as you need it
- Only use the information for the purpose you collected it
- Only share personal information if you have a good reason
- Only send personal information overseas, if the agency outside of New Zealand, if there are similar safeguards to those in the Privacy Act.
- Only use individual identifiers if it is clearly allowed.
Privacy Officer
The centre has appointed a privacy officer. The privacy officer has participated in training offered by the Privacy Commissioner’s office (see: https://www.privacy.org.nz/further-resources/online-privacy-training-free/). The responsibilities of the privacy officer are to:
- Encourage the centre to comply with the information privacy principles
- Deal with requests for personal information
- Work with the Privacy Commissioner in relation to investigations
- Ensure that the centre complies with the Privacy Act
- Training others
- Monitoring compliance with policies and procedures
- Dealing with complaints.
Use of CCTV on Kidz World premises
CCTV systems are in use on all Kidz World premises.
Kidz World operates CCTV for the following purposes:
- To deter criminal activity;
- For insurance purposes;
- For training and development purposes;
- For protection of staff
The information held in the CCTV systems are accessible only by the Director and management. In some cases the CCTV information may be passed on to the New Zealand Police or Oranga Tamariki.
Parents, staff and members of the public may contact the Director in regards to any issues related to the CCTV systems.
To communicate to people entering Kidz World premises that CCTV systems are in operation signage will be displayed in public areas of the premises.
Impacts of Policy on Staff, Parents, Children
This policy impacts on staff by ensuring they remain aware and vigilant when it comes to information that identifies any specific child or family attending our centre.
The policy impacts on families by ensuring they are aware that their privacy and that of their children will be protected.
Preventing Privacy Breaches
Our centre undertakes a regular annual Privacy Impact Assessments (see the OPC’s website) and robust staff induction/training on privacy issues.
Managing Privacy Breaches
All staff are required to report potential privacy breaches that they become aware of as soon as possible to the privacy officer.
Where a potential privacy breach has been discovered, the centre privacy officer will take immediate steps to contain and assess the situation on an urgent basis.
A privacy breach, in relation to personal information held by an agency,—
a . Means –
i. unauthorised or accidental access to, or disclosure, alteration, loss, or destruction of, the personal information; or
ii. an action that prevents the agency from accessing the information on either a temporary or permanent basis; and
b. includes any of the things listed in paragraph (a)(i) or an action under paragraph (a)(ii), whether or not it –
i. was caused by a person inside or outside the agency; or
ii. is attributable in whole or in part to any action by the agency; or
ii. is ongoing.
The centre will undertake an initial investigation to determine what has happened and take steps to stop it from continuing and/or becoming worse.
Certain privacy breaches also must be ‘notified’ both to the Privacy Commissioner and to the people affected. The Centre is in breach of the Privacy Act and liable for a fine if it does not adhere to these requirements.
For more information about which breaches need to be notified, when, and to who, refer to the Privacy Commissioner’s website (see NotifyUs – For organisations to report privacy breaches) and to sections 112-122 of the Privacy Act.
In summary:
If the breach has or is likely to cause serious harm to affected individuals, the centre will notify the breach to the Privacy Commissioner and the affected individual(s) as soon as practicable after becoming aware of the breach.
When determining whether the breach is likely to cause serious harm, the following factors will be considered:
- The actions have been taken to reduce the risk of harm following the breach
- Whether the personal information is sensitive in nature (information about children)
- The nature of the harm that may be caused to affected individuals
- The person or body that has obtained or may obtain personal information as a result of the breach (if known)
- Whether the personal information is protected by a security measure
- Any other relevant matters.
Notifying breaches can be complex and care will be taken. Failure to notify and failure to follow the Privacy Act requirements is an offence. Reference to the Privacy Commissioner’s website and/or seeking legal advice is therefore a step that may be taken by the Privacy Officer from time-to-time.
Dealing with information requests
Parents have a right to access and correct the information about them and their child that the Centre holds, with only some limited exceptions. All privacy information requests should be forwarded to and dealt with promptly by the Centre’s privacy officer, in accordance with all the process and other requirements under the Privacy Act.
Parents and guardians need to be aware that under the Education Act and the Licensing Criteria for ECE services, any government official may request and access any information held by the centre about any child or parent. For more information please see the Ministry of Education’s website.
Further information about dealing with information requests is available on the Privacy Commissioner’s website.
Storing and disposing of records
The Ministry of Education requires that all enrolment and attendance information collected about children and their families is retained by the centre for seven years. This includes health information about the child. Our centre stores this information so that it is retrievable but is otherwise stored securely and safely with controlled access.
When information is no longer required, it is destroyed so that it cannot be retrieved.
Procedures for when parents/guardians separate and guidance specific to dealing with children’s information
Unless otherwise specified by Court Guardianship Order, the centre recognises the role of both parents of the child where applicable in relation to information requests about the child, whether parents have separated or remain together. Only when the centre is made aware that the Court orders a specific guardianship or custody order, by provision of a copy of that written order to the centre, will the centre act on such an order and refer any requests for information to the legal guardian named by the Court.
It should be noted that it is not this centre’s role to become engaged in matters of dispute between parents.
Implications and/or Risks
Following this policy helps to ensure we are meeting our privacy obligations and protecting the privacy of children, their families and our staff. It significantly reduces the risk of harm caused by privacy breaches, losing trust with parents and maintaining our reputation.
Implementation
The implementation of this policy occurs at the time new staff are inducted into the centre and periodically through reference and discussion in staff meetings. The implementation of privacy procedures is monitored by the Privacy Officer.
More information
More information about the Privacy Act and useful resources can be found here on the Privacy Commissioner’s website: https://www.privacy.org.nz/.
Privacy Statement for Parents
We collect personal information from you and your child in order to provide our services, including information about your:
- name and your child’s name
- contact information including emergency contacts
- address details
- child’s health and disability details
- child’s enrolment detail
- billing information
- your child’s day-to-day activities, progress and development
We collect your/your child’s personal information in order to:
- administer education and care programmes and provide our services
- meet the requirements for providing a quality and safe early childhood education service
- be able to invoice you for the costs of our service and advise you of changes to our service when necessary.
Besides our staff, we share this information with:
- the Ministry of Education and the Education Review Office and other government officials on request in order to meet legal compliance requirements.
- Discover Student Management System, information about children’s learning is kept on Google Drive and private chats on Facebook Messenger. Information is uploaded to this platform by teachers and can be moderated or altered by you and others to whom you give access.
The Ministry of Education allocates a National Student Number to all children participating in early childhood education. This number travels with your child as they enter school and beyond in the education system. For more information about the Ministry’s approach to the Privacy Act and their use of information about you and your child go to the Ministry of Education website.
Providing some information is optional. If you choose not to provide requested information, we may be unable to complete enrolment or provide our services.
We keep your/your child’s information safe by storing it in safe physical files or encrypted electronic files and only allowing appropriate staff to view it.
We keep your/your child’s information for seven years at which point we securely destroy it by shredding physical files and deleting electronic records, unless otherwise required by law.
You have the right to ask for a copy of any personal information we hold about you or your child, and to ask for it to be corrected if you think it is wrong. If you’d like to ask for a copy of your information, or to have it corrected, please contact us at: acct.kidzworld@gmail.com
If you have complaints or concerns about privacy matters, please contact our privacy officer:
Beverley Carlton
beverleycarlton@gmail.com