• Home /
• Resources and learning /
• A - Z guidance topics /
• Children and young people’s privacy /
• Children's Privacy Guidance for the Education Sector /
• Chapter 7: Sharing information

Resources and learning

How this chapter is set out:

This chapter is broken down into the following sections:

Legal Frameworks for Sharing

• Sharing under the Privacy Act 2020
• Using IPP11 exceptions in practice
• Sharing under Oranga Tamariki Act 1989
• Using the Oranga Tamariki Act in practice
• Sharing under the Family Violence Act 2018
• Using the Family Violence Act in practice
• When you are required to share information

Read our quick reference guide on information sharing frameworks.

Information Sharing in Practice

• Sharing with other education providers
• Sharing within an education provider
• Education providers sharing with service providers
• Sharing with parents
• Sharing in emergencies
• Sharing with education agencies
• Sharing at multi-agency meetings
  
  

Download a PDF of the guidance on this page (PDF, 749KB).

Information sharing is a critically important activity within the education sector.

Education providers will often need to work together to ensure learners are getting the services and supports they need to succeed through their education journey. This means making sure that relevant information is available to the right people at the right time in the right way.

Information sharing can occur in various ways. For example:

• one-off share of information about a learner
• a one-off share about multiple learners 
• ongoing sharing of information about one or multiple learners 
• between different education providers e.g. between schools, schools and ECEs, or schools, ECEs and service providers
• within an education provider e.g. between teachers, between a principal and a teacher or between a school and a learner (or their parents).
  
  

When sharing information about learners, you need to get your privacy thinking right. Not doing so can cause real harm (in the short term and long term) and undermine trust and confidence in the sector. Failing to think things through properly can also impact learner engagement and achievement.

Good information sharing practices:

• create transparency and build trust and confidence in how education providers are sharing personal information
• enable the delivery of effective, learner specific services and supports that improve educational outcomes
• build awareness within an education provider of what information is being shared, who the information is being shared with, and for what purpose
• support people working in the education sector to make good judgment-based decisions when sharing a learner’s information.

Different ways to share information about learners

All information sharing must be permitted by legislation. A legislative provision that permits the sharing of information is referred to as the ‘legal authority’.

• There are various legal authorities that permit the sharing of information about learners for a variety of purposes, for example:
• The Privacy Act 2020 permits personal information about learners to be shared for a number of specified purposes.
• The Oranga Tamariki Act 1989 enables sharing of information about learners for specified wellbeing and safety purposes.
• The Family Violence Act 2018 enables sharing of information about learners for specified family violence purposes.
• The Education and Training Act 2020 also permits information sharing for specified purposes.
  
  

Knowing what you can share, when, and with whom can feel challenging, especially if there is urgency e.g. there are wellbeing or safety concerns about a learner, or the needs of the learner are complex.

This chapter provides the information you need to make good decisions when sharing information about your learners.

Back to top.

Sharing under the Privacy Act 2020

Information privacy principle (IPP) 11 permits the sharing of personal information that is held by education providers in certain circumstances. 

Read more information about the Privacy Act 2020 and the information privacy principles in Chapter 2: the Privacy Act and personal information.

Read guidance on sharing information using the other Privacy Act mechanisms.

Relevant information privacy principles

The Privacy Act refers to “disclosing” information. The relevant information privacy principles (IPP) for sharing or disclosing personal information are:

Principle 11: Limits on disclosure of personal information

An education provider that holds personal information must not disclose the information to another agency or to any person unless it believes on reasonable grounds that an exception applies.

Principle 8: Accuracy of personal information to be checked before use or disclosure

An education provider that holds personal information must not use or disclose that information without taking steps that are reasonable, in the circumstances, to ensure that the information is accurate, up to date, complete, relevant and not misleading.

Information Privacy Principle (IPP) 11 enables you to share personal information (either proactively or on request) with another agency or person in certain circumstances (exceptions).

IPP11 requires that an agency believes on reasonable grounds that one of the listed exceptions applies.

Back to top.

IPP11 exceptions

IPP11 contains a number of exceptions. The exceptions that commonly apply within the education sector include:

• The purpose for sharing is one of the purposes, or directly related to one of the purposes, for which the information was obtained.
• The learner (or their parent where appropriate) has authorised the sharing of their information.
• The information being shared is being used in a way that does not identify the learner.
• The information is required by law (e.g. section 66 of the Oranga Tamariki Act).
• Sharing the information is necessary to prevent or lessen a serious threat to the learner’s life or health, or public health and safety more broadly.
• Sharing the information about the learner is necessary to uphold or enforce the law.

What you need to consider when applying an IPP11 exception

Deciding whether an IPP11 exception applies will be a judgement call and will depend on the circumstances. To help you decide whether an IPP11 exception applies in the circumstances you should consider:

• Are there reasonable grounds to believe that the exception applies in the circumstances?
• Is sharing of the information necessary to achieve the purpose of the exception?
• Could harm result from sharing, or not sharing, the information?
• Is the recipient the appropriate agency or person to share the information with?
• Is the information being shared particularly sensitive in nature?
• Is the information you are intending to share current and up to date?
• Is sharing the information is in the best interests of the learner at this time?

The following sections look at some of these considerations in more detail.

You must believe on reasonable grounds that an exception applies

To rely on an IPP11 exception, you must:

• believe that the exception applies at the time you are sharing the information 
  and
• your belief must be reasonably held.
  
  

The means you need to consider whether the exception applies before you share the information, and you must have properly considered all the relevant information in the circumstances.

Whether there is a reasonable basis will depend on:

• what you know about the circumstances of the learner 
• what you have been told by the requestor about why the information is required 
• what information is being requested about the learner.

When you are sharing a learner’s information in response to a request, the requestor advising you that an exception applies is not sufficient for believing on reasonable grounds that an exception applies – you need to come to reasonable belief yourself.

If you do not have enough information to decide whether the IPP11 exception applies you should ask the requestor for additional information. If there is some urgency to the request, it might be quicker to call the requestor and seek the additional information over the phone. 

Some exceptions require you to consider necessity

The IPP11 exceptions for exceptions for preventing or lessening a serious threat and maintenance of the law and also require you to consider whether sharing the information is necessary in those specific circumstances. 

Whether the sharing of the information for these specific exceptions is necessary is a relatively low threshold - is the use of the information needed or required in the circumstances, or required for a given situation?

To help determine whether the sharing of information is necessary you should consider whether not sharing the information could, in the circumstances:

• increase the likelihood of the serious threat occurring (e.g. an infectious disease spreading throughout the community)
  or
• compromise a law enforcement agency’s ability to maintain the law (e.g. investigate suspected offending).
  
  

Is the information accurate, up to date, relevant, complete and not misleading?

IPP8 requires that you take reasonable steps to ensure information is accurate, up to date, complete, relevant, and not misleading before you share it with another agency or person. 

Sharing inaccurate, out of date or misleading information can result in prejudicial information about the learner being used by people to make decisions about them. This can have significant short- and long-term impacts for the learner and potentially their family or whānau.

Read more information about accuracy in Chapter 10: Accuracy of information.

Can I share sensitive personal information?

The Privacy Act does not define or provide rules around sharing sensitive information. However, in practice special care should be taken when sharing intimate or particularly sensitive personal information about a learner. Sensitive information is information that has some real significance to the learner, is revealing, or generally relates to matters they might wish to keep private.

However, there may be situations where the sharing of sensitive information is necessary – for example, when there is a serious threat to a learner’s life or health. The relative sensitivity of the information, and whether it is in the best interests of the learner, will be an important consideration when thinking about sharing sensitive information under an IPP11 exception. 

Read more about sensitive personal information and the Privacy Act.

Do I need consent to share under an IPP11 exception?

One of the IPP11 exceptions is the authorisation (consent) of the individual. This means that you can obtain the authorisation of the learner (or their parents where appropriate) to share their personal information for a secondary purpose. 

When relying on another IPP11 exception, you do not need the consent of the learner (or their parent where appropriate) to share their information.

Can I decline a request to share information?

If, after considering the circumstances of the request, you are not satisfied that there are reasonable grounds to share the information under one of the IPP11 exceptions, you should decline the request.

However, there may be another legal authority that permits you to share the information, (e.g. section 66C of the Oranga Tamariki Act 1989 or section 20 of the Family Violence Act 2018). You should always consider whether these provisions apply in the circumstances, especially when the purpose of sharing the information is to keep a learner safe.

Just because you have a legal authority to share a learner’s information doesn’t always mean you should. You can also decline the request to share information for other reasons, such as:

• Sharing at this time may not be in the best interests of the learner
• You may have assured the learner (or their parents where appropriate) that you will keep their information confidential 
• You may be subject to other legal, ethical or professional standards that require you to maintain confidentiality. 

Read more information on confidentiality in Chapter 4: Privacy and confidentiality.

Keep good records

It is important to keep good records of your information sharing activities. At a minimum you should record:

• the request you received and from whom (including receipt and response date)
• any additional information you requested from the requestor
• your decision whether, or not, to share the information requested 
• the IPP11 exception you relied on to share the information, including the information you considered to form the reasonable belief that the exception applied in the circumstances
• the information that you shared.
  
  

An easy way to do this is to create an Information Sharing Register. This can be as simple as an excel spreadsheet. Registers will contain personal information, and in some cases sensitive information. It is important to keep your information sharing record secure (e.g. password protect your spreadsheet) and limit access to only those that need to have access.

Back to top.

Using IPP11 exceptions in practice

This section provides some examples of sharing learner information under the IPP11 exceptions in practice.

Authorisation (consent) exception

IPP11 provides an exception where personal information you hold about a learner can be shared if the learner (or their parents where appropriate) provides authorisation (consent).

You will need to consider whether the learner is old enough to be able to authorise (consent to) the intended sharing of their information. Where the learner is younger, or not sufficiently able to understand, then you should obtain authorisation (consent) from the learner’s parents.

For a learner (or their parents where appropriate) to provide authorisation to share their personal information you will need to ensure that they have sufficient information to make an informed decision.

Obtaining authorisation (consent) can be done through:

• a consent form (where a learner or their parent can explicitly authorise (consent to) the intended sharing) 
  or 
• an opt out form (where information about a learner will be shared for a specified purpose unless the learner (or their parents where appropriate) opts out).
  
  

You should attach the collection privacy statement to the consent or opt out form. The privacy statement will provide the learner (or their parents where appropriate) with the information they need to make an informed decision to authorise the sharing of their information. You should also provide a link to your privacy policy in your consent or opt out form so that learners (or their parents where appropriate) can have confidence in how you collect, use, share and protect personal information more generally.

Read more guidance on how to inform learners and their parents in Chapter 8: Keeping learners and parents informed.

Authorisation is not a ‘one and done’ thing. Where authorisation has been provided, learners (or their parents where appropriate) should be able to withdraw that authorisation at any time. Also, if it has been some time since the learner (or their parents where appropriate) provided authorisation for their information to be shared you should check whether they are still comfortable with the information being shared for that purpose.

When a learner (or their parents where appropriate) withdraws authorisation

A learner or their parents can withdraw authorisation they have previously provided for their information to be shared for specified purposes. For example, learners (or their parents where appropriate) may withdraw authorisation for their images to be posted on social media.

When a previously provided authorisation is withdrawn, you must stop sharing their information for the purpose to which the authorisation applied.

Law enforcement exception 

To rely on the law enforcement exception, you must believe in reasonable grounds that sharing information is necessary to avoid prejudice to the maintenance of the law including prevention, detection, investigation, prosecution and punishment of offences.

This exception supports the maintenance of criminal and regulatory enforcement processes. It does not give Police or other law enforcement agencies the right to access any information. The exception applies to situations where not providing specific and relevant information would prejudice or be detrimental to enforcing the law.

In the early stages of an investigation into an offence, a law enforcement agency may not have sufficient information to apply for a production order or a search warrant. This can make it difficult to progress a criminal or regulatory investigation. A request for information using the law enforcement exception may be the only practical means of obtaining the information necessary to effectively investigate the offending, particularly during the initial stages of an investigation. 

The law enforcement agency requesting information must show a link between the offence(s) being investigated and the relevance of the information being requested - simply asserting that the information is needed for a law enforcement agency investigation is not sufficient. You need sufficient details to form a reasonable belief that sharing the information is necessary for the purpose for which it is being requested. Without this information, you will not be able determine that the law enforcement exception applies. 

To help decide whether sharing the information is necessary, you should ask yourself what the effect would be if the information requested by the law enforcement agency was not provided – for example, would not sharing the information compromise the ability of the law enforcement agency to do their job?

Read more information about releasing personal information to Police and law enforcement agencies.

Serious Threat Exception 

To rely on the serious threat exception, you must be satisfied that a serious threat exists and believe on reasonable grounds that the information requested is necessary to prevent or lessen that threat. 

The exception provides for two types of threats:

• to public health or safety
  or
• the life or health of a learner or another person
  
  

When is a threat serious?

There are three factors that need to be considered when deciding whether a threat is serious:

• the likelihood of the threat occurring
• the severity of the consequences if the threat occurs
• the time at which the threat might occur.

All three factors don’t need to be present to reach the threshold of serious threat. For example, if there is a high likelihood of the threat occurring and the severity of the consequences are significant (factors 1 and 2), but it is unclear when the threat may eventuate (factor 3), the serious threat threshold will likely be met. The test is what a reasonable person would consider to be serious in the circumstances.

A serious threat assessment will be situation specific and should consider all relevant circumstances, including those of the learner or learners concerned. A serious threat can arise for one learner based on the relevant risk factors to them but may not meet the threshold in relation to a different learner. 

For example, a threat of harm to a learner may more readily meet the threshold of serious harm due to a learner’s age or ability to act independently and make their own decisions.

Is sharing the information necessary to lessen the threat?

Once you have decided that a serious threat exists, you need to determine whether sharing the learner’s personal information is necessary to prevent or lessen that threat. You should ask yourself whether not sharing the information requested would increase the likelihood of the serious threat occurring – for example:

• Is the information requested relevant or needed to address and lessen the serious threat?
• How will sharing the information do this? 
• Is the person receiving the information in a position to use the information to respond to and lessen the serious threat? 
  
  

Back to top.

Sharing under the Oranga Tamariki Act 1989 (wellbeing and safety purposes)

The following sections provide guidance on how to share information under the Oranga Tamariki Act.

Raising or reporting concerns

If you believe that a learner has been or is likely to be harmed, ill-treated, abused, neglected, or deprived or you have concerns about the wellbeing of a learner, section 15 permits you to share information about your concerns directly with Oranga Tamariki.

You can discuss and share your concerns with Oranga Tamariki by calling 0508 326 459 or by emailing contact@ot.govt.nz. 

When you are required to share (section 66)

Oranga Tamariki or Police can require an agency or individual to provide relevant information if that information is required:

• to determine whether the child or young person needs care or protection or assistance
  or
• for any proceedings under Part 2 of the Oranga Tamariki Act (including a Family Group Conference).
  
  

When you receive a section 66 request you must provide the information specified in the request (unless the information is covered by legal professional privilege). Unlike section 66C, you do not need to consult the learner (or their parents) before you provide the information under a section 66 request.

If you are unsure whether the request is being made under section 66, or what the purpose of the request is, you should ask the requestor for this information before you share the information with them.

When you want or are asked to share (section 66C)

Section 66C of the Oranga Tamariki Act permits the sharing of information about a child or young person for specified wellbeing and safety purposes.

Under section 66C you can proactively share information, or you can share information in response to a request from a CWPA or Independent Person.

Who you can share with

Section 66C of the Oranga Tamariki Act permits Child Welfare and Protection Agencies (CWPAs) or Independent Persons to share information about a child or young person with other CWPAs or Independent Persons for specified wellbeing and safety purposes. 

• Child Welfare and Protection Agencies (CWPAs) are a group of organisations, and therefore their employees, or volunteers including:
• Any social, family and community service that provides services under section 396 of the Oranga Tamariki Act.
• Any person, body or organisation that provides regulated services under schedule 1 of the Children’s Act 2014.
• Housing New Zealand Corporation.
• Ministry of Education, schools and early childhood education services.
• Ministry of Health, Health NZ and health providers.
• Ministry of Justice.
• Department of Corrections.
• Ministry of Social Development.
• Oranga Tamariki – Ministry for Children.
• New Zealand Police.
  
  

Independent Persons are professionals or people including: 

• A practitioner under the Health Practitioners Competence Assurance Act 2003 who provides health or disability support services. 
• A Children’s Worker (under section 23(1) of the Children’s Act). 
• A person or class of persons designated as an independent person by regulations made under section 447(1)(ga)(ii) of the Oranga Tamariki Act.
  
  

Read more information on who section 66C applies to (appendix one).

The purposes for which you can share

Section 66C enables information about a learner to be shared for specified purposes, including:

• preventing harm or neglect to a child or young person
• for Family Group Conferences and other Care and Protection work
• making, carrying out, or reviewing a risk assessment, needs assessment, prevention plan or support plan for a child or young person
• external services facilitated by Oranga Tamariki for a child or young person and their family or whānau.

If you are unsure of the purpose for which the information is being requested, you should ask the requestor for this information before you decide to share any information with them. If you do not know the purpose you will not be able to determine whether one of the purposes in section 66C applies, and what information is necessary to share with the requestor.

What does wellbeing and safety mean in practice?

Wellbeing of a child or young person includes:

• strong positive whānau relationships 
• spiritual and cultural connections 
• having their developmental needs met and supported – education, behaviour, life skills and self-care skills 
• emotional resilience and support 
• social and peer groups that are supportive, caring and positive,
• physical and mental wellness 
• security – being safe from harm, living in a safe community, having a warm dry home, having enough food.

Safety concerns include:

• physical, emotional, sexual abuse, deprivation, neglect, and ill-treatment 
• situations where parents or caregivers aren’t willing or able to care for the child, where a child is subject to family harm (including where they are exposed to it) 
• and where the development of a child or their physical, mental or emotional wellbeing is likely to be impaired or neglected in a way that is avoidable.
  
  

What information is relevant?

You can share information that you believe is relevant to help achieve one or more of the purposes set out in section 66C. Deciding what information is relevant will often be a judgement call and depend on the circumstances of each situation.

• Things to consider when deciding whether information is relevant include:
• your knowledge of the learner and their circumstances including information about:
  
  • the learner themselves
  • their home environment
  • their needs, aspirations, strengths 
  • challenges they are experiencing (financial pressures, housing, family harm, health, access to education and learning difficulties)
  • support they have or are receiving – what worked well, what didn’t work well and why
  • information about other people they have a relationship with such as their parents, wider family and whānau, teachers, doctors, sports coaches.
• the person making the request, the purpose for which they are requesting the information and what they will be able to do with the information to support the learner
• the age of the information – older information may be out of date and therefore less relevant to the current circumstances or needs of the learner
• the context of the information – could the information be misinterpreted by the recipient without additional context?
  
  

There aren’t any limits on who the information can be about. You can share information about a learner, their family or other people they have a relationship with if you believe it is relevant to protecting their wellbeing or keeping them safe.

Consent to share is not required

You do not need to obtain the consent of the learner (or their parents or legal guardian where appropriate) to share their information under section 66C. 

Requirement to consult with the learner

Section 66K of the Oranga Tamariki Act requires you to consult with the learner either before, or as soon as possible after, you share their information where it is practicable or appropriate to do so. Where a learner is very young or may not be able to understand why you want to share their information, you should consult with their parents or legal guardian if it is appropriate and safe to do so.

This ensures that the learner is aware that their information is being shared, with whom, and what that person is going to do with their information. It also gives them the ability to share any concerns they may have about their information being shared. 

You are required to consider their views before you share their information. While you can still share information if they strongly disagree, if their concerns relate to their wellbeing or safety, you should consider whether sharing the information with the requestor is in the learner’s best interests at that time. You may need to advise the requestor of the wellbeing or safety concerns the learner has raised to ensure the sharing of the information doesn’t place them at risk of further harm. 

Examples of when it may not be practicable or appropriate to consult with a learner include:

• they are not developmentally able to understand (remember even young children can understand sharing information if you talk to them in an age-appropriate way)
• it might put them or someone else at risk of harm
• it might distress or upset them, or have a negative impact on their wellbeing
• it could get in the way of a Police investigation or prosecution 
• you need to share information quickly because tamariki might be harmed otherwise 
• after making reasonable efforts you, or another professional, can’t get in touch with them, and you still think sharing is important to protect tamariki from harm.
  
  

You should always record the reasons why you decided not to consult with the learner.

Sharing information about multiple learners 

When sharing information about multiple learners (e.g. sharing datasets or sharing information at multi-agency meetings), you are still required to consult with each individual learner prior to sharing their information where it is practicable or appropriate to do so.

Just like when sharing information about a single learner, whether it is impracticable or inappropriate to consult should be considered when you are developing the dataset or setting up your multi-agency meeting. For multi-agency meetings, each meeting participant will need to determine whether it is impracticable or inappropriate to consult with the learner.

You should always record the reasons why you decided not to consult with the learner when sharing datasets or sharing their information at multi-agency meetings.

Sharing information in good faith

Sharing information under section 66C requires you to make a judgement call. Every circumstance will be different – in some cases you might decide to share, in others you might not. When you are under pressure, and a child or young person may be at risk, making these judgement calls can feel overwhelming.

The Oranga Tamariki Act provides protection from civil, criminal and disciplinary proceedings when you share information under section 66C unless you have shared in bad faith. Bad faith includes sharing information when you know you shouldn’t.

Acting in good faith means you have:

• made your best effort to share in line with the relevant statutory provisions
• checked that the information you intend to share is relevant, accurate, up to date complete and not misleading
• undertaken measures to ensure the information is shared safely with the right person in the right role
• consulted with the learner (or their parents where appropriate) if it is safe and appropriate to do so.
  
  

Read the Oranga Tamariki factsheet about sharing information in good faith from their Information sharing resources page.

Checklist: Deciding whether to share when using Section 66C

Download a printable PDF version of this checklist (PDF, 212KB).

Use this checklist when deciding whether to share information using section 66C.

Confidentiality obligations

Obligations of confidence protect information deemed to be confidential from unauthorised access and disclosure. However, obligations of confidence are subject to exceptions which include situations where a learner’s wellbeing or safety is at risk.

You can consider sharing confidential information when sharing information under section 66C. However, you will need to ensure that:

• you are sharing for a purpose set out in section 66C
• the confidential information is relevant to that purpose
• you have consulted with the learner before you share their information.
  
  

Your professional code of ethics, industry code of conduct or employment agreement will set out what information is considered confidential, under what circumstances that information may be shared and what you need to advise the child or young person when you are collecting their information.

Read more information about privacy and confidentiality in Chapter 4: Privacy and confidentiality.

When the requirements of section 66C aren’t met

If you determine that the requirements of section 66C have not been met, you can consider whether one of the following applies in the circumstances:

• Section 20 of the Family Violence Act 2018.
• a Privacy Act IPP11 exception.

Additional resources

For more guidance on sharing information to protect children and young people, including a section 66C checklist, see our guidance on this topic. 

For more guidance on sharing information under the Oranga Tamariki Act, including a section 66C request template, see Oranga Tamariki's guidance.

Keep good records

It is important to keep good records of your information sharing activities. At a minimum you should record:

• the request you received and from whom (including receipt and response date)
• any additional information you requested from the requestor
• your decision whether, or not, to share the information requested 
• the specified purpose you shared the information
• whether you consulted with the learner, any views they shared with you, or the reasons why you didn’t consult them
• the information that you shared.
  
  

An easy way to do this is to create an Information Sharing Register. This can be as simple as an excel spreadsheet. Registers will contain personal information, and in some cases sensitive information. It is important to keep your information sharing record secure (e.g. password protect your spreadsheet) and limit access to only those that need to have access.

How does the Privacy Act apply to sharing under the Oranga Tamariki Act?

Section 66 and 66C authorise the sharing of personal information for specific purposes related to the wellbeing and safety of children and young people. This means that you don’t need to rely on one of the exceptions to Information Privacy Principle (IPP) 11 to share the information with another CWPA or Independent Person. 

However, section 66Q requires you to comply with IPPs 1, 4, 5, 6, 7, 8, 9 and 13 in the Privacy Act.

In practice, this means when you are sharing information under section 66C of the Oranga Tamariki Act, you must also ensure you:

• share information in a safe and secure way and protect it from unauthorised access, use and disclosure (IPP5) 
• have taken reasonable steps to ensure the information is accurate, up to date, relevant, complete and not misleading information (IPP8)
• are mindful about sharing unique identifiers.
  
  

When you are receiving information requested or provided under section 66C of the Oranga Tamariki Act, you must also ensure you:

• are requesting the information necessary for a lawful purpose of your agency (IPP1)
• receive the information:
  
  • in a manner that is fair and not unreasonably intrusive on the child or young person’s personal affairs (IPP4)
  • in a safe and secure way and protect it from unauthorised access, use and disclosure (IPP5)
  • only retain the information for as long as it is necessary to do so (Public Records Act and IPP9).
    
    

Learners (or their representatives) have the right to request access to and correction of their personal information under IPP6 and 7. If you correct personal information or attach a statement of correction to personal information that is also information that you have shared under the Oranga Tamariki Act, you must, so far as is reasonably practicable, inform that CWPA or Independent Person of the correction.

Back to top.

Using the Oranga Tamariki Act in practice

The following examples work through the application of section 66C of the Oranga Tamariki Act.

Example: ECE service and Oranga Tamariki social worker (decision to share)

An ECE service manager receives an email request from a social worker working for a Non-Government Organisation (NGO) that provides support services to families in need. The social worker states that the request is being made under section 66C of the Oranga Tamariki Act.

The social worker is requesting information about a 3-year-old who is enrolled at the ECE. The information requested includes parent contact details, attendance records, and any behaviour related incident reports over the last 12 months. The social worker advises that the information is required to complete a needs assessment and identify appropriate supports for the child. 

Can the ECE service manager share the information with the social worker?

To use section 66C both parties must be a Child Welfare and Protection Agency or an Independent Person. The ECE service is a CWPA but should confirm with the social worker that either the NGO they work for is a CWPA or they themselves are an Independent Person. 

Information can be shared if the information will be used for one of the purposes set out in section 66C. In this case, the social worker has stated the information will be used to complete a needs assessment for the child, which is a purpose under section 66C.

The ECE service manager should ensure that the information they share with the social worker is relevant to the purpose of completing a needs assessment and is accurate and up to date. The social worker has requested information covering the last 12 months. If there is older information that the manager believes is relevant to the needs assessment it can share that information also. If the manager is unsure whether the older information is relevant, they could contact the social worker and talk to them. 

The ECE service manager doesn’t need the consent of the learner’s parents to share the information, but they must consult with the learner (unless it is not practical or appropriate to do so). At 3 years old, the learner is too young to understand the request and share their views. As such, the ECE service manager should consider consulting with the learner’s parents if it is practical and appropriate to do so. 

While section 66C provides the legal authority to share the information, the ECE service manager must still comply IPP1 and 4 (lawful purpose for collection, necessity, method of collection), IPP5 (security and storage), IPP6 and 7 (access and correction rights), IPP8 (accuracy), IPP9 (retention of information) and IPP13 (unique identifiers) requirements. 

The ECE service manager should record the request, the date of the request, the information they shared with the social worker, and the views of the learner’s parents if it was practical and appropriate to consult with them. 

Example: School and Oranga Tamariki social worker (unclear request/decision to share)

A school principal has received an email request from an Oranga Tamariki (OT) social worker. The principal is aware that the learner is under the care of Oranga Tamariki and is currently in foster care. The request is for information about the learner’s educational progress and achievement. 

Can the school principal share the information with the OT social worker?

It is unclear from the email request whether the OT social worker is requesting the information under section 66 (mandatory) or section 66C (voluntary) of the Oranga Tamariki Act. Where it is unclear, the school principal should seek confirmation from the social worker. To assist, the principal could provide the social worker with the template request form and ask them to complete it. See the forms on the Oranga Tamariki website.

The school principal does not need the consent of the learner or their parents to share the information under section 66C. After confirming the request is a section 66C request and identifying the relevant information the principal must consult with the learner (or their parents) if it is practical and appropriate to do so. The principal should talk to the learner about the request, who made it, what information is being requested and what it will be used for. They should also let the learner know that they will be sharing the information and provide space for them to voice any concerns that they may have.

While section 66C provides the legal authority to share the information, the school must still comply with IPP1 and 4 (lawful purpose for collection, necessity, method of collection), IPP5 (security and storage), IPP6 and 7 (access and correction rights), IPP8 (accuracy), and IPP13 (unique identifiers) requirements. The school must also comply with the retention requirements of the Public Records Act 2005.

The school principal should record the request, the information shared with the social worker, and the views of the learner (if it was practical and appropriate to consult with them).

Example: School requesting information from OT youth justice social worker

A school is preparing for a new learner due to start at the school after a period of time spent in a Youth Justice facility. The learner has been receiving education services whilst at the Youth Justice facility and is looking forward to returning to school. The school principal wants to know what the learner’s charges and convictions were so that they can assess and identify any additional supports the learner may require.

Can the school principal request this information from the youth justice social worker? 

Criminal offending history information is considered sensitive personal information. Misuse or unauthorised sharing of this type of information can be prejudicial to a learner and cause short- and long-term harm.

The school does not have an automatic right to the learner’s criminal offending history. The school principal could request this information from the youth justice social worker using section 66C as the legal authority for the sharing of the information requested. As part of the request, the principal would need to provide the social worker with sufficient information to enable the social worker to be satisfied that the information was to be used for one of the purposes set out in section 66C – in this case completing an assessment of the learner’s educational needs.

The responsibility for disclosing information under section 66C in this situation is on the social worker, including consulting with the learner. If the social worker doesn’t reasonably believe that disclosing the information will assist the school in completing the educational needs assessment, then they can refuse to provide the information requested. 

When deciding whether to share sensitive information the best interests of the learner should always be considered. It would likely be in their best interests that the school is able to adequately support their reintegration back into school. In this case after considering whether sharing the criminal offending information is necessary for the purposes of the educational needs assessment, the potential prejudice and harm to the learner, and what would be in their best interests, the social worker could decide to advise the school principal that the charges and/or convictions were not of a nature where the learner may then require additional education support or would create a health and safety risk for the school, teachers or other learners. 

Alternatively, the learner may consent to their criminal offending history, or certain parts of that history being disclosed (either by them directly or by the social worker) to the school for the specific purpose of identifying any additional supports that may require at school. Where the social worker was authorised by the learner to disclose the information, the legal authority for sharing the information with the school could also be the authorisation exception under IPP11 of the Privacy Act 2020.

Back to top.

Sharing under the Family Violence Act 2018 (when a learner is subject to family harm)

The following section provides guidance on how to share information under the Family Violence Act 2018. 

You have a duty to consider sharing

Section 24 of the Family Violence Act requires that you actively consider sharing information about a victim or perpetrator of family violence to another FVA or SSP if you:

• believe on reasonable grounds that the sharing of information to that FVA or SSP will or may help ensure that a victim is protected from family violence
• receive a request from a FVA or SSP to share information for one or more of the purposes set out in section 20.
  
  

When you want or are asked to share (section 20)

Section 20 of the Family Violence Act 2018 permits the sharing of personal information when a child or young person is or has been subject to family harm.

Under section 20 you can proactively share information, or you can share information in response to a request.

Who you can share with

Section 20 of the Family Violence Act 2018 permits the sharing of personal information between Family Violence Agencies (FVAs) and Social Sector Practitioners (SSPs).

Family Violence Agencies (FVAs) are a group of organisations, and therefore their employees, or volunteers including:

• specified government agencies (see section 19, Family Violence Act 2018)
• non-government organisations funded by government to provide family violence-related services
• school boards and licenced early childhood education.
  
  

Social Sector Practitioners (SSPs) are professionals or people providing education, health or other social services including:

• teachers with current practising certificates
• registered health practitioners
• registered social workers.
  
  

The purposes for which you can share

Section 20 enables sharing information about a learner who has been a victim of family violence where you reasonably believe that sharing the information will help the other FVA or SPP achieve one or more the following purposes:

• to help ensure that a victim is protected from family violence
• to make or contribute to a family violence risk or need assessment
• to make, or contribute to the making or carrying out of, a decision or plan relating or responding to family violence.
  
  

If you receive a section 20 request for information and the purpose of the request is unclear, you should clarify the request with the requestor. If you are unsure why the information is being requested, you won’t be able to determine whether one of the purposes set out in section 20 applies, or what information may be relevant to share with the requestor.

What information is relevant?

You can share information that you believe is relevant to help achieve one or more of the purposes set out in section 20. Deciding what information is relevant will often be a judgment call and depend on the circumstances of each situation.

Things to consider when deciding whether information is relevant include:

• your knowledge of the learner and their circumstances
• the person making the request, the purpose for which they are requesting the information and what they will be able to do with the information to support the learner and their family
• the age of the information – older information may be out of date and therefore less relevant to the current circumstances or needs of the child or young person.
• the context of the information – could the information be misinterpreted without additional context?
  
  

If you are unsure whether information you hold may be relevant, talk to the requestor or the person you want to share the information with. Together you may be able to identify what information is relevant in the circumstances. 

Consent to share is not required

You do not need to obtain the consent of, or consult with, the learner (or their parents where appropriate) to share their information under section 20. 

You should, however, consider the best interests of the learner – in some cases it may be in their best interests to let them know you are sharing their information, in other cases it could expose them to additional risk and harm.

Talking with the learner (or the parents where appropriate) can also help inform your decision about whether it is in their best interests to share their information in the circumstances. 

Sharing in good faith

Sharing information under section 20 requires you to make a judgement call. Every circumstance will be different – in some cases you might decide to share, in others you might not. When you are under pressure, and a learner may be at risk, making these judgement calls can feel overwhelming.

The Family Violence Act provides protection from civil, criminal and disciplinary proceedings when you share information under section 20 unless you have shared in bad faith. Bad faith includes when you don’t attempt to comply with the provision, or when you act carelessly or recklessly with information. 

Acting in good faith means you have:

• made your best effort to share in line with the relevant statutory provisions
• checked that the information you intend to share is relevant, accurate, up to date complete and not misleading
• undertaken measures to ensure the information is shared safely with the right person in the right role.
  
  

Confidentiality obligations

Obligations of confidence protect information deemed to be confidential from unauthorised access and disclosure. However, obligations of confidence are subject to exceptions which include situations where a child or young person’s wellbeing or safety is at risk.

The Family Violence Act provides an exception to an obligation of confidence. The Act requires you to consider the principle that helping to ensure a victim is protected from family harm should usually take precedence over any applicable obligation to keep the information confidential.

However, you will need to ensure that:

• you are sharing for a purpose set out in section 20
• the confidential information is relevant to that purpose.
  
  

An individual staff member’s professional code of ethics, industry code of conduct or employment agreement may set out what information is considered confidential and under what circumstances that information may be shared.

Read more information about privacy and confidentiality in Chapter 4: Privacy and confidentiality.

When the requirements of section 20 aren’t met

If you determine that the requirements of section 20 have not been met, you can consider whether one of the following applies in the circumstances:

• Section 66C of the Oranga Tamariki Act
• a Privacy Act IPP 11 exception.

Keep good records

It is important to keep good records of your information sharing activities. At a minimum you should record:

• the request you received and from whom (including receipt and response date)
• any additional information you requested from the requestor
• your decision whether, or not, to share the information requested 
• the specified purpose you shared the information
• the information that you shared.
  
  

An easy way to do this is to create an Information Sharing Register. This can be as simple as an excel spreadsheet. Registers will contain personal information, and in some cases sensitive information. It is important to keep your information sharing Register secure (e.g. password protect your spreadsheet) and limit access to only those that need to have access.

How does the Privacy Act apply to sharing under the Family Violence Act 2018?

Section 20 authorises the sharing of personal information for specific purposes related to family violence. This means that you don’t need to rely on one of the exceptions to Information Privacy Principle (IPP) 11 to share the information with another FVA or SSP. 

However, you still need to comply with the other IPPs in the Privacy Act. 

In practice, this means when you are sharing information under section 20 of the Family Violence Act, you must ensure you:

• share information in a safe and secure way and protect it from unauthorised access, use and disclosure (IPP5) 
• have taken reasonable steps to ensure the information is accurate, up to date, relevant, complete and not misleading information (IPP8)
• are mindful about sharing unique identifiers (IPP13).

When you are receiving information requested or provided under section 20 of the Family Violence Act, you must ensure you:

• are requesting the information necessary for a lawful purpose of your agency (IPP1)
• meet your notification requirements (IPP3A after 1 May 2026)
• receive the information:
  
  • in a manner that is fair and not unreasonably intrusive on the child or young person’s personal affairs (IPP4)
  • in a safe and secure way and protect it from unauthorised access, use and disclosure (IPP5)
  • only retain the information for as long as it is necessary to do so (Public Records Act and IPP9).
    
    

Learners (or their representatives) have the right to request access to and correction of their personal information under IPP6 and 7. If you correct personal information or attach a statement of correction to personal information that is also information that you have shared under the Family Violence Act, you must, so far as is reasonably practicable, inform that FVA or SSP of the correction.

Back to top.

Using the Family Violence Act in practice

The following examples work through the application of section 20 of the Family Violence Act.

Example: School Alerts Programme

Under the School Alerts programme schools can receive alerts about their learners who have been involved in a family harm episode in the last 24 hours. Names of the learners are provided to a participating school so they are aware of the incident, enabling them to identify and provide any additional supports learners may need while at school.

The legal authority for sharing the information with the participating school is section 20 of the Family Violence Act. The information is proactively shared to a school for the purpose of helping to ensure that a victim is protected from family violence. Section 20 also provides the legal authority for the school principal to share the information with a learner’s teacher so that the teacher is aware and can contribute to the development of a support plan if one is required.

If a school requires further information about the learner and the family harm incident that occurred, it can use section 20 to request additional information from a relevant FVA or an SSP. The school must, however, be requesting the additional information for one of the purposes in section 20.

Example: ECE service (decision to share)

An ECE service manager receives a request for information about a learner enrolled in its service from a local organisation which provides support to families who are or have experienced or family harm. The organisation has requested information about the learner to help them developed a comprehensive support plan for them and their family. The information requested includes attendance, behaviour, and any incidents that have occurred at the ECE that may be relevant to the development of that plan.

Can the ECE provide the information to the requesting organisation?

To use on section 20, both the ECE service manager and the requesting organisation must be either a Family Violence Agency (FVA) or a Social Services Practitioner (SSP). Under the Family Violence Act a licenced ECE service is a FVA. To be a FVA, the requesting organisation must be a non-governmental organisation that is wholly or partly funded by government to provide family harm services. The ECE service manager should check with the requesting organisation that they are a FVA or the person making the request is a SSP.

The information being requested is for one of the purposes set out in section 20 (making a support plan for the family who have experienced family harm) and is relevant to achieving that purpose. The information will help the requesting organisation to ensure that the child and their family get appropriate and effective supports including those which ensure the child can attend the ECE service. It would be appropriate for the ECE service manager to rely on section 20 to share the information with the requesting organisation (once they have confirmed the requesting organisation is a FVA or SSP).

While section 20 provides the legal authority to share the information, the ECE service manager must still comply with IPP1 and 4 (lawful purpose for collection, necessity, method of collection), IPP5 (security and storage), IPP6 and 7 (access and correction rights), IPP8 (accuracy) IPP9 (retention of information) and IPP13 (unique identifiers) requirements. 

The ECE service manager should record details of the request including the request, what was shared and for what purpose.

Back to top.

When you are required to share information

Legislation may require you to share personal information for specific purposes. Some examples of these types of legislative provisions include:

• section 17B of the Tax Administration Act 1994
• section 66 of the Oranga Tamariki Act 1989
• section 23 of the Data and Statistics Act 2022
• section 619 of the Education and Training Act 2020
• section 22 of the Education and Training Act 2020
• schedule 6 clause 2 of the Social Security Act 2018
• section 27 of the Children’s Commissioner Act 2022
• schedule 5 of the Pae Ora (Healthy Futures) Act 2022
• section 20 of the Inquiries Act 2013
  
  

When a government agency uses a legislative provision requiring you to provide information they should provide you with a notice. A notice requiring the provision of information:

• should be made by the government agency in any prescribed form that might apply
• clearly identify the legal authority under which the notice has been issued
• clearly state the information you are required to provide and for what purposes.
  
  

When you receive a notice, you must provide the information requested to the issuing agency within the specified timeframe. You should also record the notice and your response to the notice in your information sharing register.

Back to top.

Information sharing in practice

The following section works through common information sharing examples in the education sector.

Sharing with other education providers

Enrolment records - Schools

The Education and Training Act (section 237(2)) provides legal authority for sharing enrolment records between registered schools. 

When a learner has enrolled in a new school, the principal of the old school must ensure that the learner’s enrolment records are shared with the principal of the new school – you do not need to consider whether an IPP11 exception or other legal authority applies. 

Enrolment records are defined in the Rules for Student Enrolment Records Gazette Notice.

ENROL is the system used to capture enrolment records for all learners. Schools are required to use ENROL unless they have received an exception from MoE. ENROL enables enrolment records to be shared between schools. When a learner enrols in and moves to a new school, the new school will have access to the learner’s enrolment record via ENROL. 

This specific legal authority under the Education and Training Act applies only to enrolment records. This means that no other information about the learner e.g. attendance or learning support information should be shared with the new school unless:

• another provision of the Education and Training Act (e.g. directed enrolment) applies 
  or
• an IPP11 exception applies
  or
• another legal authority applies.
  
  

Enrolment records - ECE services

When a learner moves to a new ECE, the new ECE will have access to the learner’s enrolment record via ELI. ELI is the system used to capture enrolment records for all learners. ECEs are required to use ELI unless they have received an exception from MoE 

This means that no other information about the learner, outside of that contained in ELI, should be shared with the new ECE unless the learner or their parents has consented to that information being shared.

Dual Tuition or Enrolment 

In some cases, a learner may have dual tuition or enrolment.

Information about the learner will often need to be shared to facilitate dual tuition or enrolment. In most cases, information shared for this purpose should be with the consent of the learner or their parent. It is important to ensure that only information necessary for the purpose of referring and assessing and approving dual tuition or enrolment should be shared. 

Where a learner has dual tuition or enrolment, the education provider at which the learner is enrolled retains all legislative accountabilities, including those under the Privacy Act. The education provider providing the additional education service is also accountable for ensuring the learner’s personal information they collect, use and share is managed according to the Privacy Act.

All other learner information

Sharing of any other learner information with education providers must have a legal authority that permits the sharing. For example:

• An IPP11 exception.
• Section 66C of the Oranga Tamariki Act.
• Section 20 of the Family Violence Act.
• Other legislation such as the Education and Training Act.
• An information sharing provision that requires specified information to be shared for a specified purpose.

Sharing within an education provider

Information sharing isn’t just about sharing a learner’s personal information externally. It also occurs internally within your organisation e.g. a conversation or email between teachers about a learner, a list of learners and their learning support needs place on a notice board in the staff room. 

The Privacy Act refers to this kind of internal sharing as a “use” of information within your organisation, rather than a “disclosure”. As well as considering whether the use of a learner’s information is permitted under IPP10, when sharing internally you should always consider who in your organisation actually needs to know that information.

Education provider sharing with service providers

Where a learner requires additional support (e.g. health, social or cultural supports) a school or ECE service may need to engage a service provider (e.g. a non-government organisation, marae-based services or a private business) to assist.

The education provider may need to share information about the learner with the service provider to:

• make a referral
  and
• support the service provider to identify, deliver and assess the effectiveness of the services provided to the learner.
  
  

Referrals

When a school or ECE service refers a learner to a service provider they should obtain the consent of the learner or their parent to make the referral. When making the referral, you should only share information that is necessary for the service provider to assess and approve the referral should be provided.

As part of the consent process, the learner or their parent should be advised why the referral is being made, to whom the referral is being made, and what the service provider will do with the information. This enables the learner or their parent to make an informed decision to consent to the referral being made, and the for the information to be provided to the service provider.

Where consent is provided to make the referral, the information must be provided to the service provider in a safe and secure way.

Information to support delivery of services

Service providers

When a referral has been accepted by the service provider it may be necessary for them to seek more detailed information about the learner to identify and deliver appropriate services. The service provider may also need information to help them assess the effectiveness of the services being delivered.

When a service provider requests (collects) information about the learner it must ensure that it is collecting the information appropriately (see Chapter 5: Collecting Information).

Education providers

When responding to a request from a service provider, the education provider should make sure they know the legal basis for which the information is being requested. For example:

• Has the learner or parent provided consent for the information to be provided by the school or ECE service?
• Is the request being made under another information sharing provision such as section 66C of the Oranga Tamariki Act or section 20 of the Family Violence Act?

If you are unsure, you should seek clarification from the service provider before you share information with them.

When you are satisfied that a legal authority exists to share the information, you must ensure that the information you are sharing is accurate and up to date (IPP8), and the information must be provided to the service provider in a safe and secure way (IPP5). 

Sharing with parents

Section 165: Education and Training Act 2020 – Monitoring of and reporting on student performance

A school board must ensure that information about a learner’s performance is shared with that learner’s parents in a timely manner and in a form that is easily understandable. 

If section 165 is used as the legal authority to share information with a parent, the school board does not need to consider whether an IPP11 exception or other legal authority applies. However, the school board must ensure that the information shared is accurate (IPP8) and is provided to the parents in a secure way (IPP5).

Section 103: Education and Training Act 2020 – State and Charter schools

State, state integrated and charter schools must inform parents of matters that, in the opinion of the state school principal or person responsible for teaching and learning at a charter school are:

• preventing or slowing the learner’s progress through the school
  or
• harming the learner’s relationships with teachers or other students.
  
  

It is up to the state or state integrated school principal or the person responsible for teaching and learning at a charter school to determine, in the circumstances, what learner information is relevant to the two purposes above and should then be shared with the parent.

If the section 103 is used as the legal authority to share information with a parent, the state or state integrated school or charter school does not need to consider whether an IPP11 exception or other legal authority applies. However, the state or state integrated school principal or the person responsible for teaching and learning at a charter school must ensure that the information shared is accurate (IPP8) and is provided to the parents in a secure way (IPP5).

Requests for information from parents

The Privacy Act does not provide parents with an automatic right to information about their children.

If you receive a request for information from a parent and the information requested is not covered by sections 103 or 165 of the Education and Training Act, you will need to determine whether the parent is acting as a representative of the learner and exercising the learner’s access (IPP6) and correction (IPP7) rights under the Privacy Act on their behalf. 

Read more detailed guidance on how to respond to a request for information about a child or young person.

Sharing in emergencies

State of national emergency

The Civil Defence National Emergencies (Information Sharing Code) 2020 (the Code) enables agencies to collect, use and share personal information in the event of a major disaster that has triggered a state of national emergency.

The Code facilitates the sharing of information to:

• relevant agencies to assist the government response to the national emergency, and 
• a person who is responsible for an individual who may be involved in the emergency (e.g. the parent or other relative of a learner.
  
  

For an education provider, this means that when a state of national emergency is declared, you can share personal information about learners with a public sector agency, or an agency involved in managing or assisting with the emergency for permitted purposes. 

For example:

• The education provider could share the names and other relevant information about learners who are at a school and are unable to return home due to the emergency with Police. 
• The education provider could share health information about learners with medical conditions who are not able to return home due to the emergency with a health care provider.
  
  

Read more information about the Civil Defence National Emergencies (Information Sharing) Code 2020.

Traumatic events

Traumatic events are sudden, unpredictable events that can occur with no warning. Traumatic events are those that:

• Cause sudden and/or significant disruption to the operation of an education provider.
• Have potential to affect a large number of learners and staff.
• Create significant dangers to the physical and emotional wellbeing of learners, staff and the wider community.
• Often attract media attention.
  
  

Examples of traumatic events include:

• A sudden accidental or non-accidental death or serious injury of a learner, their family member or a staff member
• Witnessing serious injury or death of a learner, their family member or a staff member.
• Threats to the safety of learners or staff.
• A missing learner or staff member.
• Floods, fires, earthquakes or other community crisis or natural disaster.
  
  

Managing a traumatic event can be stressful with many moving parts. You will be receiving a lot of information from various people, and there will often be gaps in information about what is happening. Learners, their parents and staff will be wanting information to understand what is happening. Knowing what you can and shouldn’t share during a traumatic event can help ensure such events are managed effectively.

Sharing information about learners

Depending on the nature of the traumatic event you may be asked to share information about learners from agencies or organisations responding to the event.

Where there is a serious threat to the life or health of the learners, you can consider whether sharing relevant learner information under the IPP11 serious threat exception is appropriate in the circumstances. 

For example:

• You may need to share learners’ health information with medical responders to help ensure learners with urgent medical needs are triaged and assisted appropriately.
• You may need to share information about learners to help public health officials prevent and manage an outbreak of an infectious disease in the community.
  
  

Where you have concerns for the wellbeing or safety of your learners and risk or needs assessments of the learners are necessary, you can consider whether sharing relevant learner information under section 66C of the Oranga Tamariki Act is appropriate in the circumstances.

For example, you may need to share information about learners with specialist trauma counsellors to ensure they get appropriate support during and after the traumatic event.

Where a traumatic event is about a learner, information about them and the circumstances of the event should not be shared unless:

• You are sharing the information to support Police, or another law enforcement agency, investigate the event (IPP11 law enforcement exception).
• You are sharing the information to support a coronial inquiry.
• You have the consent of the learner’s parents to share specific information about the learner and the event (IPP11 authorisation exception).
  
  

Sharing with education agencies

The Education and Training Act 2020 and associated regulations provide the legal basis for sharing learner information with education agencies for specified purposes.

Education agencies include:

• Ministry of Education (MoE).
• New Zealand Qualifications Authority (NZQA). 
• Education Review Office (ERO).
• Teaching Council New Zealand Aotearoa (TCNZ).
  
  

Where the Education and Training Act provides a legal authority for sharing information, you do not need to consider IPP11 or other information sharing provisions (e.g. Oranga Tamariki Act or Family Violence Act). 

You still need to ensure that the information you are sharing with an education agency is shared safely and securely and is accurate and up to date.

You will need to let your learners (and their parents where appropriate) know what information you share with education agencies, the legal basis for sharing the information and how the information is used by those agencies. An easy way to do this is to document your information sharing with education agencies in your privacy policy.

Sharing with the Ministry of Education (MoE)

Schools

The Education and Training Act (section 619) enables MoE to collect information about learners directly from schools for certain purposes (e.g. statistical purposes, ensuring learners and education providers receive appropriate funding or enrolment and attendance purposes).

Where MoE is using its powers under the Education and Training Act, it does not require the consent of learners or their parents to collect this information.

MoE collects this information in a number of ways, including:

• enrolment information entered in ENROL and ELI
• attendance data collections
• School Roll Returns
• ECE Service Census Returns.
  
  

MoE uses the learner information to fulfil its functions under the Education and Training Act which include funding and staffing schools, policy analysis and development, monitor outcomes of the education system, undertaking research and publishing education statistics and identifying learners that may require additional learning support. 

Where schools are required to provide learner information to MoE, you do not need to consider whether an IPP11 exception or other legal authority (e.g. Oranga Tamariki Act or Family Violence Act) applies. 

Because schools have initially collected the information directly from the learner or their parents (at enrolment or throughout the learner’s education journey), the school is required to comply with IPP3 and inform the learner or their parents:

• that learner information collected by the school will be shared with MoE to enable MoE to fulfil its functions under the Education and Training Act
• what learner information is being shared
• how MoE will use the learner information
• how it is being shared and kept safe
• the learner’s rights to access (IPP6) and correct (IPP7) their information.
  
  

Read more information about the School Roll Return process.

Outside of enrolment records, attendance data collections, and School Roll Returns MoE may request learner information from a school for other purposes. Such situations may include when MoE is:

• assessing a learner’s eligibility for services or funding offered by MoE
• undertaking an evaluation of education services and programmes
• undertaking a specific research project
• seeking confirmation of how funding was utilised.
  
  

Where the information being shared with MoE is not for one of the purposes set out in the Education and Training Act, the school should ensure that a legal authority exists for sharing the information with MoE (e.g. an IPP11 exception or another legal authority such as those under the Oranga Tamariki Act or Family Violence Act).

The school should also consider whether MoE already hold the information that is being requested about a learner or group of learners. Where MoE already holds the information, then the school can consider whether it is appropriate to decline the request.

ECE Services

ECE services must comply with minimum requirements set out in the Education and Training Act and Education (Early Childhood Services) Regulations 2008 and the Education (Playgroups) Regulations 2008.

The Education and Training Act (section 22) requires licenced ECE services to keep and make available to MoE specified records. Information that MoE requires licenced ECE services to provide includes:

• a register of the children who attend or have attended the service, specifying the date of birth of each
• a record of the attendance of children at the service
• a record of all fees and other charges paid in respect of children’s attendance at the service
• evidence that parents of children attending the service have regularly examined the attendance record
• any other records that are necessary to enable the service’s performance to be monitored adequately.
  
  

This information is shared with MoE using the Early Learning Information System (ELI). 

Read more detailed information on ELI and its privacy related requirements in Early Learning Information (ELI) and Privacy and ELI Principles of Use.

ECE services and certificated playgroups must also ensure that appropriate written procedures and records are developed and maintained and made available upon request by any person exercising powers or carrying out functions under section 626 (powers of entry and inspection without warrant) of the Education and Training Act.

Where an ECE service or certificated playgroup is sharing information under the requirements of the Education and Training Act and associated regulations, they do not need to consider whether an IPP11 exception or other legal authority applies. 

Sharing with New Zealand Qualifications Authority (NZQA)

NZQA are responsible for managing the New Zealand Qualifications and Credentials Framework, running the assessment system for secondary schools, and keeping complete records of learners’ educational achievements.

The Education and Training Act (section 458) provides NZQA with the powers to collect information to carry out its functions.

Secondary schools are required to share learner information to NZQA for the purposes of assessment and issuing of qualifications. Information shared includes the learners name, National Student Number (NSN), residential address, the standard and assessment information and the name of the school.

Read more information about sharing learner information with NZQA.

Sharing with Education Review Office (ERO)

ERO is an external education review agency. ERO is responsible for evaluating and reporting on the education of learners by education providers.

The Education and Training Act (section 464) provides ERO with the powers to collect information to carry out its functions. Those functions include reviewing, inspecting and reporting on the performance of education providers.

When exercising its information collection powers, ERO makes it clear that it does not collect personal information about learners as part of its review process. When responding to a request for information ensure you are not providing personal information about your learners (e.g. redact learners names from reports or documents).

Sharing with Teaching Council Aotearoa New Zealand

The Teaching Council is the professional body for registered and certificated teachers across early childhood, primary and secondary education in both English and Māori medium settings. The functions of the Teaching Council are set out in the Education and Training Act 2020. These functions include performing the disciplinary functions relating to teacher misconduct and reports of teacher convictions and performing the functions relating to teacher competence.

To perform this function, the Teaching Council will often require information from schools and early childhood services to assess and investigate reports and complaints about teacher conduct or competence.

Under the Education and Training Act 2020 (Part 5, Subpart 4), the Teaching Council may request information to be provided within a specified timeframe from:

• school boards 
• a service provider that operates any licenced early childhood service or any certified playgroup 
• managers of a private school.
  
  

The requirement to provide this information is dependent on the stage of the disciplinary process that the matter is at.

In all cases, the Teaching Council will make clear what legislation they are relying on to request the information so that you can make an informed decision on the appropriate action.

Triage

When a report or complaint is first received by the Teaching Council, the Triage Committee completes an initial assessment of the matter and determines whether further action is warranted. Under rule 11C(2)(a)(i) of the Teaching Council Rules 2016 the Triage Committee may request further information from any person.

These requests are different to the ones made under sections 497(7), 502(1)(b) and 507(2) of the Education and Training Act 2020, detailed further below, and you are not obliged to provide information at this stage. In this case, you should consider whether an IPP11 exception under the Privacy Act applies.

You also need to ensure that you provide relevant and up to date information (IPP8) and that you supply the information to Teaching Council in a secure manner (IPP5).

Complaints Assessment Committee (CAC)

Section 497(7) of the Education and Training Act 2020 and rule 15(3) of the Teaching Council Rules 2016 provide the CAC, and investigators appointed to conduct investigations on behalf of the CAC, the power to require an employer, former employer, or a government agency to provide information necessary for the purposes of an investigation.

You still need to ensure that you provide relevant and up to date information (IPP8) and that you supply the information to the Teaching Council in a secure manner (IPP5).

New Zealand Teachers Disciplinary Tribunal (DT)

Section 502(1)(b) of the Education and Training Act 2020 provides the DT with the power to require a person to produce any documents, records, or other information that relate to the subject matter of the hearing.

You still need to ensure that you provide relevant and up to date information (IPP8) and that you supply the information to the Teaching Council in a secure manner (IPP5).

Competence Authority (CA)

Section 507(2) of the Education and Training Act 2020 states that the Teaching Council may require the teacher’s current or former employer to supply information for the purpose of investigating a report that relates to the teacher’s competence. Under this section, the current and/or former employer must supply this information.

You still need to ensure that you provide relevant and up to date information (IPP8) and that you supply the information to the Teaching Council in a secure manner (IPP5).

Sharing at multi-agency meetings

A multi-agency meeting is a meeting where different agencies and organisations come together for a common purpose e.g. identifying effective supports for learners who are not regularly attending school.

Sharing information about learners in such settings often an effective and efficient way to identify appropriate supports, interventions and services in a collaborative and timely manner.

You need to ensure, however, that you:

• have a legal authority to share the information (e.g. section 66C of the Oranga Tamariki Act, section 20 of the Family Violence Act, or an IPP11 exception), 
• are sharing relevant information about the learner or their family and whānau
• are sharing that information with the right people
• record your information sharing activities.
  
  

To be confident you are sharing learner information appropriately you need to embed best practice information sharing into the governance and operation of your multi-agency meetings. This will protect the learners you are sharing information about and help you meet the objectives of your multi-agency meetings in a privacy protective and respectful way.

Read more guidance on how to set up good information sharing practices at your multi-agency meetings.