How the DPUP Guidelines and Principles support each other
While the Data Protection and Use Policy (DPUP) Principles describe values and behaviours, the Guidelines offer detailed advice on key topics that are relevant to different situations and roles.
When to use the guidelines
The guidelines provide good practice advice when working with people's information, including:
- deciding what and when to collect
- how to support people’s understanding of what happens with their information
- helping people understand and use their rights
- ensuring that communities are involved in the development and use of insights that may affect them.
When to use the Purpose Matters Guideline
When collecting or using information that is or was about people
This Guideline should be used when an agency is deciding whether to collect or use information that is or was about people who use services.
From a privacy perspective, questions of purpose generally come up in relation to the use of personal information. However, questions of purpose can also arise when personal information has been de-identified or anonymised.
Because the Privacy Act 2020 regulates what is done with personal information (not non-personal information) its legal controls do not apply to de-identified or anonymised information. However, ethical and other issues can still arise.
For these reasons, this Guideline is relevant to the collection and use of:
- personal information
- non-personal information that, prior to de-identification, was personal information.
- Personal information, in the form of information about identifiable individuals, may be removed from a dataset that was collected for a given purpose. However, if the information is culturally sensitive or otherwise of interest to Māori, using it even in de-identified form for another purpose without involving Māori may not be appropriate.
- Personal information may be removed from the description of a serious offence against a child or another vulnerable member of society, resulting in there being no reasonable prospect of the child or other vulnerable person being identified. That does not necessarily mean it's ethically appropriate to use the information for any other purpose, particularly when publication is involved.
When to use the Transparency and Choice Guideline
When deciding how to inform people about the collection and use of their information and giving them choice
Use this Guideline when deciding how to help service users understand why their information needs to be collected, how it will be used and what rights and choices they have.
The Guideline applies to agencies collecting information:
- directly from service users, including non-governmental organisations and other service delivery organisations
- through other agencies and organisations.
This Guideline is mostly about people’s understanding and rights in relation to their personal information. However, people often think of information they have supplied, or is about them, as personal even when it has been de-identified or anonymised and is being used in a non-personal form.
For this reason, the Guideline recommends practices relating to the use of this type of information as well. The relevant sections of the Guideline make it clear when those additional recommended actions are not required by the Privacy Act 2020.
When to use the Access to Information Guideline
When defining processes that ensure people's information can be easily accessed
This Guideline is for people involved in:
- collecting, storing or recording personal information collected from or about service users
- identifying or designing methods and practices to ensure that information is readily available if and when service users ask about it
- managing or designing services that service users regularly use, for example digital and face-to-face channels, during which they may voice an interest in their information.
The practices described in this Guideline may sometimes be carried out by people outside of the areas of responsibility identified above.
In these situations, the responsibility to enable and apply those practices may sit with people in a range of different roles, who will need to know about and understand this Guideline.
When to use the Sharing Value Guideline
When working together for better insights and outcomes
This Guideline is for people involved in collecting or using personal or non-personal information for these purposes:
- managing funding and contracting processes between service providers and funders
- carrying out analytical or research activities to support policy or service development
- developing or enabling research or analytical capability through the development of datasets
- understanding the operational performance or effectiveness of services and programmes.
This Guideline generalises these sorts of purposes as being activities which focus on the production of ‘insights’ (as defined in DPUP terminology).
While this Guideline is only concerned with sharing insights in the form of non-personal information, it includes considerations that relate to collection of personal information for developing those insights.
How the Guidelines relate to each other
Elements of each Guideline inform the other Guidelines.
How Purpose Matters informs the other 3 guidelines
To be clear about the purposes of collecting personal information, only collect what’s needed and consider how collection and use could affect people's wellbeing. Agencies need to:
- help people understand why their information is needed and what their rights are. The purpose of collection is a key aspect of what agencies need to tell people when collecting their personal information
Transparency and Choice Guideline - help people understand their rights of access, have control over their information where possible, and make it easy for them to exercise their rights. Understanding the purposes of collection, in the context of the intended outcomes and methods of processing, can influence how people are given access to their information and how they can request that inaccuracies be corrected
Access to Information Guideline - work together to develop valuable insights from information collected from or about service users and share the value of those insights with others. Involving others in the design and implementation of intended collection and use processes may influence how the purposes of collection are formulated and communicated to people and how much information needs to be collected.
Sharing Value Guideline
How Transparency and Choice informs the other 3 guidelines
When collecting information from people, help them understand why it’s being collected, how that might help them or people in similar circumstances, and what rights they have to access and request changes. Provide them with choices whenever possible and:
- identify if there are any negative consequences to the outcome (for example, people not using a service because they’re worried about what might happen to their information) and enable choices where possible.
Purpose Matters Guideline - consider ways to enable people to understand and exercise their rights to access and request correction of their personal information.
Access to Information Guideline - make sure that when information is collected to improve outcomes, service users can be given examples of where and how this will occur or has occurred.
Sharing Value Guideline
How Access to Information informs the other 3 guidelines
Help people to understand what personal information is held about them, how to access it, request correction of it and, where possible, correct it themselves, by:
- understanding why it’s important to be clear about the purpose information is collected for, and how to do that. Service users can only ensure information is accurate and relevant to the purpose of collection if they are given a reasonable understanding of what information is held about them, and why it is held.
Purpose Matters Guideline - acknowledging that a service user should be enabled to understand, and what rights and choices they should be informed about when information is collected from them, including the rights discussed in this Guideline.
Transparency and Choice Guideline - understanding the importance of collaborating with people who have a rich knowledge of the information and the people it represents to achieve the best outcomes. This sets an expectation that when information is collected to improve outcomes for service users, they can be given examples of where and how this has occurred, if they express any interest in what is happening with their information.
Sharing Value Guideline
How Sharing Value informs the other 3 guidelines
Work together and be inclusive to ensure that information used to create insights is relevant and usefully describes real experiences. The Sharing Value Guideline supports the other Guidelines by helping agencies to:
- understand why it’s important to be clear about the purpose for which information is collected and how to do that.
Purpose Matters Guideline - help people understand why their information is needed and what their rights are.
Transparency and Choice Guideline - understand ways to enable people to understand and exercise their rights to access and request correction of their personal information.
Access to Information Guideline
How the Guidelines work with the Principles
Because the Guidelines flow in part from the DPUP Principles, it's useful to read the Guidelines with the 5 Principles in mind.
How to use Purpose Matters with the Principles
The Principles can help identify considerations that are relevant to understanding and framing purposes for collecting and using information about people, even where these considerations may exceed minimum legal requirements.
He Tāngata
Are purposes of collection and use clearly focused on positive outcomes (whether for individuals, groups or wider society) and is the information to be collected or used necessary to achieve those outcomes?
Manaakitanga
Is the collection or use of people’s information for particular purposes sufficiently respectful of them or the cultures, communities or groups to which they belong? Does it support or detract from their wellbeing?
Mana Whakahaere
To what extent, given the purposes of collecting personal information, can an agency allow people to opt out of providing their information?
Kaitiakitanga
How, as a kaitiaki of people’s information, can the purposes of collecting or using that information be framed in a manner that is easy to explain to people and that fosters their understanding and trust in what is being done with their information?
Mahitahitanga
To what extent can involving others help to formulate and double-check if proposed collections and uses of people's information are appropriate?
How to use Transparency and Choice with the Principles
The Principles can help identify considerations that are relevant to providing people with choices where possible and helping them to understand what happens with their information.
He Tāngata
Will service users understand that providing their information is either useful or necessary to help them, or may help people in similar circumstances?
Manaakitanga
What actions can be taken to uphold people’s mana by involving them in defining useful steps to take to improve understanding of their choices?
Mana Whakahaere
How can people be empowered to make decisions by knowing what their choices are and the value of those choices?
Kaitiakitanga
As kaitiaki of people’s personal information, how can agencies keep track of and communicate how the information in their care is used and the improved outcomes it enables?
Mahitahitanga
How can agencies work together, for example funders and service providers, to improve transparency and provide clear information about and support for choices for all those involved?
How to use Access to Information with the Principles
The Principles can help identify considerations for enabling people to access their information.
He Tāngata
How can service users understand the link between the information stored about them and the ways in which it is intended to be used?
Manaakitanga
How can agencies acknowledge and uphold people’s mana by considering what information is recorded about them, how it is recorded and how they can access it?
Mana Whakahaere
How can people be empowered by ensuring their needs and wishes about accessing their information are understood, captured and addressed?
Kaitiakitanga
How can kaitiaki of the information contribute to service users’ understanding of how information about them is held and enable easy access to their information?
Mahitahitanga
How can agencies work together to enable service users’ rights of access and be responsive to their requests for access and correction?
How to use Sharing Value with the Principles
The Principles can help identify considerations that are relevant to sharing insights with people working on related outcomes, including service users themselves.
He Tāngata
What insights will help to improve outcomes for people?
Manaakitanga
In doing this work, what actions can agencies do to enhance the mana of people involved in the delivery or use of relevant services?
Mana Whakahaere
How can agencies recognise and respect people as the source of information and ensure they understand, and have input into, the value of insights derived from their information?
Kaitiakitanga
As kaitiaki of the data what might the people involved in delivering or using services want from the outputs of the work?
Mahitahitanga
By involving others who work on related outcomes what additional value could be created by working together?
