Your responsibilities

A small boy of about eight sides on the grass. He's got short, brown, curly hair and a green t-shirt and teal pants. He is blowing on a dandelion like he's making a wish. This guidance aims to help agencies respond appropriately to requests for personal information about children and young people. The guidance covers:

Information Privacy Principle 6 (IPP 6) of the Privacy Act 2020.
Who can make an IPP 6 request for information about a child or young person.
Requests made by parents, legal guardians or other caregivers, including:
- when a parent, legal guardian or caregiver is acting as a representative of the child or young person.
- whether the Privacy Act 2020 or the Official Information Act 1982 applies
- what other laws may apply.
Requests made by a Lawyer for the Child.
Responsibilities of an agency before giving access to personal information.
Requests made by other agencies.
Applying the guidance in practice- some examples.

Information Privacy Principle (IPP) 6

The Privacy Act applies to any individual regardless of age. A child or young person has the same privacy rights as an adult but sometimes needs the assistance of another person to exercise those rights.

One of those rights is a person’s right to ask for information about themselves, set out in IPP 6.

An agency must respond to the requester within 20 working days and usually has to provide the information, unless one of the refusal grounds applies.

Read more general information about responding to IPP 6 requests.

Information covered in this guidance

Download a copy of this guidance (opens to PDF, 333 KB).

Who can make an IPP 6 request about children and young people?

An IPP 6 request may be made by the child or young person themselves or their representative. A representative is a person who is lawfully acting on the child or young person’s behalf.

Information requests from parents, legal guardians or caregivers

The Privacy Act does not provide an automatic right of access by a parent, legal guardian, or caregiver to their child’s personal information.
Assessing and processing a request from a parent, legal guardian or caregiver is a two-step process:

Determine whether the parent, legal guardian or caregiver is a representative.
If yes, then determine whether any of the refusal grounds apply.

In most cases, a parent or legal guardian can be considered a representative, particularly where the child is too young or otherwise not able to act on their own behalf. Where a caregiver is making the request, determining whether they are a representative may not be so clear cut as they won’t have the same legal status as a parent or legal guardian.

The circumstances will be different for each request, so it is important that an agency considers each request on a case-by-case basis before deciding whether the parent, legal guardian or caregiver is acting as a representative of the child or young person.

Step 1: When is a parent, legal guardian or caregiver a representative?

For the purposes of IPP 6, a parent, legal guardian or caregiver may be considered representative of the child where:

the child is too young or otherwise not able to act on their own behalf, or
an older child or young person has authorised them to make the request on their behalf.

Before determining that a parent, legal guardian or caregiver is a representative, agencies should consider:

The age and maturity of the child and whether they are capable of understanding and exercising their rights under the Privacy Act.
Any court orders relating to parental access or responsibility (e.g. protection orders, custody and guardianship orders).
Whether, based on what is known to the agency, it is (or isn’t) likely to be in the best interests of the child or young person for the parent, legal guardian or caregiver requesting the information to be able to exercise their child’s Privacy Act rights on their behalf.

Where there is a family breakdown of some sort such as family harm, a custody or guardianship dispute or where the child is or has experienced abuse, the best interests of the child or young person should be a primary consideration. When determining whether it is in the best interests of the child or young person agencies should consider:

the interests of the parent, legal guardian, caregiver and the child or young person are no longer the same or are in conflict, and/or disclosing the information to the parent/legal guardian would go against the child’s interests.
whether there are reasonable grounds for believing the child or young person does not or would not wish the information to be disclosed.

If any of the factors above exist, an agency may determine that a parent, guardian or caregiver is not acting as representative of the child or young person and the request does not fall under the Privacy Act.

Where a parent, guardian or caregiver is not a representative you can consider the request under the Official Information Act (see table below).

Non-custodial parents

A non-custodial parent is the parent who doesn’t live with their child most of the time. Non-custodial parents with guardianship rights still have legal rights and responsibilities, ensuring they can maintain a relationship with their child. A non-custodial parent has guardianship rights if they meet the test in section 17 of the Care of Children Act 2004 (or are otherwise appointed by the Court).

A non-custodial parent with guardianship rights can exercise their child’s privacy rights in the same way the custodial parent can, taking the wishes of the child into account if expressed or known (for older children or young people).

Where an agency receives an information request from a non-custodial parent with guardianship rights, it should follow the same process for managing a request from a custodial parent or other legal guardian.

Step 2: Decision to release or refuse the request

A representative does not have automatic access to a child or young person’s personal information. An agency still needs to consider whether any of the refusal grounds apply in the circumstances.

In situations where parents are separated, agencies do not need the consent of the other parent (either custodial or non-custodial) to disclose information about the child or young person. However, agencies should consider whether the child or young person’s personal information also reveals personal information about the other parent (e.g., the other parent’s home address or contact details where there is a protection order in place).

Read more general information about refusal grounds: Office of the Privacy Commissioner | Principle 6 - Access to personal information.

When a request for information should be managed as an Official Information Act request

The Official Information Act (OIA) enables an individual to make a request for ‘official information’ (certain information held by public sector agencies). Official information can include personal information about other people, including children and young people.

Where the person requesting the information isn’t the child or young person or a representative, the request should be considered under the OIA.

The following table can help you determine which Act may apply depending on the specific circumstances of the request:

Individual making request	Purpose of request	Applicable Act
Child/young person – capable of making their own request.	Their own personal information	Privacy Act
Parent/legal guardian/caregiver of child/young person who is too young or not capable of exercising their rights. (Parent/legal guardian/caregiver probably a representative)	Personal information about the child or young person	Privacy Act, unless there are circumstances which suggest the Parent/Legal Guardian/caregiver is not acting on their behalf or in their best interests, then the request should be processed under the OIA
Parent/legal guardian/caregiver of older child or young person capable of making their own request with the older child/young person’s authorisation to make the request on their behalf. (Parent/legal guardian/caregiver probably a representative)	Personal information about the older child or young person	Privacy Act, unless there are circumstances which suggest the Parent/Legal Guardian/caregiver is not acting on their behalf or in their best interests, then the request should be processed under the OIA
Parent/legal guardian/caregiver of older child capable of making their own request where the older child/young person has made it clear they do not authorise the requestor to make the request on their behalf.(Parent/legal guardian/caregiver is not a representative)	Personal information about the older child or young person	Part 2 OIA/LGOIMA. Subject to eligibility requirements in the OIA (s 12(1)), but not the LGOIMA.
All other cases where a parent/legal guardian/caregiver of child/young person is determined not to be a representative.	Personal information about the child or young person	Part 2 OIA/LGOIMA. Subject to eligibility requirements in the OIA (s 12(1)), but not the LGOIMA

Other laws that may apply

Agencies should also consider whether any other laws may apply to requests made by parents, legal guardians or caregivers and proactive disclosures of children and young person’s information. These laws include:

The Health Act 1956 and the Health Information Privacy Code (HIPC) regulate access to “health information” held by a “health agency”. Under the HIPC, parents or guardians of children under 16 years are legally defined as their ‘representatives’, whose access requests are treated as though made by the child themselves.
As with any information privacy request, these requests may be refused in certain circumstances (Rule 11(4) HIPC).
Section 103 of the Education and Training Act 2020 says that principals should tell parents about matters affecting their child’s progress through school or relationships with others.
Under IPP 11 of the Privacy Act 2020, an agency may disclose personal information to a third party if it believes there are reasonable grounds that one of the exceptions in IPP 11 applies.

For example, this could be when the child or young person authorises the disclosure (IPP11(1)(c)) or where disclosure to parents is one of (or is directly related to) the purposes for which an agency obtained the information (IPP11(1)(a)).

However, unlike IPP 6 and the OIA, IPP 11 does not give a right to access or request information. IPP 11 gives an agency discretion to disclose personal information where that agency considers it is necessary to do so (rather than legally being required to respond to a request for the information). Whether an exception applies will depend on the circumstances.

Information requests from Lawyer for the Child

A Lawyer for the Child is a specialist lawyer appointed by the Family Court to represent the interests of the child or young person in Family Court proceedings involving custody or guardianship disputes, or situations of family harm.

To fulfil their responsibilities, the Lawyer for the Child often needs information about the child or young person held by agencies such as a school or healthcare provider. When making a request for information, the Lawyer for the Child will be acting as a representative for the child or young person.

The Lawyer for the Child should provide evidence of their appointment and brief from the Family Court. (A Lawyer for the Child is appointed by Court Minute and receives their brief by letter from the Court.) If it not clear whether the requestor is acting as the Lawyer for the Child, you should ask them to provide evidence of their appointment before you provide access to any personal information.

Responsibilities of an agency before giving access to personal information

Providing access to personal information to an unauthorised person can cause serious harm to an individual and be a form of notifiable privacy breach - where the personal information is about children and young people the harm can be long lasting and significant.

When providing access to personal information under IPP 6, the agency must (Section 57 of the Privacy Act 2020):

be satisfied of the identity of the requestor (e.g. the child or young person or the representative)
not provide access to the information if the agency has reasonable grounds to believe that the request is being made under the threat of physical or mental harm (coercion)
ensure that the information intended for the requestor (or their representative) is provided to the right person.

You may need to request additional information from the requestor to satisfy these requirements of the Privacy Act.

Confirming a requestor’s identity

Where additional information is required to confirm a requestor’s identity the agency should inform the requestor what information is required and why. Agencies must also ensure that any identification documentation requested is securely destroyed once confirmation of the requestor’s identity has been made.

Where a decision has been made to grant access to personal information, agencies should confirm with the requestor (or their representative) the method in which they would like to receive the information and double check email, or postal addresses are correct.

Information requests from other agencies

Where a request for information about a child or young person is made by another agency other laws may apply. These include:

Section 66C of the Oranga Tamariki Act permits Child Welfare and Protection Agencies to request and share information about children and young people for specified purposes.
Section 20 of the Family Violence Act permits Family Violence Agencies to request and share information about individuals who have been subject to family harm for specified purposes.
Any law that requires the information to be provided to the requestor e.g. section 66 Oranga Tamariki Act, section 11 Social Security Act, section 17 Tax Administration Act.

Where requests for information are made under one of these laws an agency cannot refuse the request under one of the IPP 11 refusal grounds (or a withholding ground under the OIA). An agency should assess the request and decide whether to share the requested information in line with the law under which the request was made.

Examples

See examples of how this guidance is applied in practice.

Download a copy of this guidance (opens to PDF, 333 KB).