Ensure people feel safe

The Data Protection and Use Policy (DPUP) focuses on ensuring people understand what’s happening with their personal information. It’s helpful to consider how to ensure people feel safe so they are confident to ask questions when they need to.

Things to consider

• How will you ensure that people feel safe and confident to ask questions, either when information is first collected or at regular intervals?
• Appreciate that people read, hear, learn and understand in different ways. Be prepared to offer choices about how they want to understand things. Adapt information, processes and communication material to meet different service users’ needs. For example, consider their Kaupapa Māori contexts, age, spoken languages and other factors that might suggest necessary alternatives.
• How can you check people’s level of understanding and interest? Thinking about their personal information will not always be their first priority, but it will matter at some stage. Find ways to check they are achieving the required level of understanding. For some groups of service users, this might be achieved through sampling some users to check if the explanations are working for them.
• Consider if timing matters. When personal information is collected, the Privacy Act 2020 requires agencies to tell service users about the matters listed in information privacy principle 3 (IPP3) — about the collection and use of their personal information. If that’s not practical (for example, they are in crisis or there is an emergency), agencies should tell them as soon as possible after that. In some situations, it may be appropriate to explain a minimum amount of information straight away and then follow up with the person with more detailed information later.

IPP3: Collection of information from subject — Office of the Privacy Commissioner