Privacy Policy

Introduction

This policy outlines the commitment of Youth Horizons | Kia Puāwai to protecting the privacy of personal information under the provisions of the Privacy Act 1993. This policy will assist Youth Horizons | Kia Puāwai staff and caregivers to understand how we collect, use and protect personal information.

Scope

This policy applies to all Youth Horizons | Kia Puāwai trustees, staff and caregivers that have or may have access to individuals’ personal information, whether they are employees or contractors, prospective employees or contractors, children, young people and related family members who are clients of Youth Horizons | Kia Puāwai, or other individuals.

Definitions

Policy Statement

Youth Horizons | Kia Puāwai is committed to providing excellence in practice in the delivery of evidence-based and other services to prevent or interrupt the negative impacts of conduct problems on young people, their whānau and the wider community.

Youth Horizons | Kia Puāwai strives for professional excellence. Our organisational values of aroha, whanaungatanga, manaakitanga and wairuatanga guide all decision making and practice to ensure that children, young people and their families, as well as all staff and caregivers are treated with respect. This includes ensuring that the way in which sensitive information is collected, stored and shared is managed in accordance with legislative requirements and upholds the privacy and mana of all individuals.

Implementation

Use of Personal Information

Youth Horizons| Kia Puāwai routinely collects and holds personal information for the following purposes:

• as is necessary for functioning as an employer and other business needs (such as the contracting of caregivers) and / or;
• as is necessary in undertaking our work for children, young people and their families and / or;
• as is necessary to evaluate the impact of our work with children, young people and their families.

Personal information that is collected for one of the above purposes will not be used for any other purpose, unless there are reasonable grounds to believe that the use of the information for that other purpose is necessary to prevent or lessen a serious threat to public health or safety or the health or safety of the individual concerned or another individual.

Collection

Youth Horizons | Kia Puāwai will not collect information through any means which are unlawful, unfair or unreasonably intrusive on the privacy of individuals.

Personal information about current or potential trustees, employees or contractors (including caregivers) of Youth Horizons | Kia Puāwai will, wherever possible, be sought directly from the individual, unless the individual agrees otherwise.

In the case of clients or potential clients of Youth Horizons | Kia Puāwai, in the first instance personal information will be received from the referring agency, as per that agency’s information sharing policies. Additional personal information will be sought, wherever possible, directly from the individual (and their caregivers), unless the individual or their parent or guardian agrees otherwise.

When collecting personal information about clients and related family members, Youth Horizons | Kia Puāwai will take reasonable steps to inform the individual:

• what information is being collected and why;
• who will have access to the information and why;
• what the result will be if the individual fails to supply the information requested; and
• that the individual has the right to have access to and to request corrections to the information.

See the Informed Consent Policy for further information and guidance regarding this process.

Storage and Security

Youth Horizons | Kia Puāwai will take reasonable precautions and utilise security safeguards to protect personal information in its possession and control from loss, theft, misuse, modification, unauthorised or accidental access or disclosure, alteration or destruction. For further detail of such precautions, see the Information Management Policy.   

Personal information collected in hard copy by Youth Horizons | Kia Puāwai (including client and personnel files) will be stored securely in locked cabinets and accessible only to authorised Youth Horizons| Kia Puāwai staff and caregivers. 

Where information is held electronically (within New Zealand, or any other jurisdiction), it must be stored on secure servers which adhere to current privacy and security legislative standards of either NZ or that jurisdiction (whichever is more restrictive).

All Youth Horizons | Kia Puāwai staff have their own individual username and password to ensure users can be identified when accessing the organisation’s computers and electronic data storage systems. Additionally, any information stored in the Healthcare Community (HCC) client management database will track user activity and will be securely backed up off-site. Only authorised staff can access HCC.

Youth Horizons| Kia Puāwai will keep personal information for no longer than is necessary.

Client information will be retained for the minimum retention period. In relation to health information for identifiable individuals a retention period of ten years is required, beginning on the day after the most recent date shown on which Youth Horizons I Kia Puāwai provided services to that individual.

Staff and contractor personal information will be kept for a minimum period of six years from the day after the day the individual ceases to be an employee of or contractor to Youth Horizons| Kia Puāwai.

Pay information will be retained for a minimum of seven years. In such circumstances that the Inland Revenue Department requests that personal information is retained for longer than the above periods, this will be undertaken as per the notice the department provides

All above types of personal information will ordinarily be destroyed after the minimum retention periods have elapsed, except in cases where there is, or is likely to be, an ongoing court case or coronial enquiry in relation to the individual to whom the information relates.

Data Breach

A data breach includes modification, alteration, destruction or loss of personal information, unauthorised or accidental access to or disclosure of personal information.

If client documents are subject to a data breach this must be reported as per the Client Incident Reporting Policy as soon as possible (and recorded as a breach of policy). The severity level of the incident will be determined based on the individual circumstances, including the nature of the information lost and the likely consequences. The individual who is the subject of the data breach must be notified at the earliest possible opportunity and advised of any remedial action taken or planned to rectify or mitigate the breach.

If a data breach occurs in relation to personal information about staff or caregivers, the individual must be notified at the earliest possible opportunity and advised of any remedial action taken or planned to rectify or mitigate the information loss.

Any data breach will be investigated to determine the cause, assess the risks, and make recommendations to prevent a repeat.

Access and Corrections

Individuals have rights of access to, and correction of, their personal information held by Youth Horizons| Kia Puāwai. Upon request, Youth Horizons| Kia Puāwai will grant an individual access to his or her personal information. The individual has the right to request that Youth Horizons| Kia Puāwai corrects any inaccurate or incomplete information.

There may be circumstances where Youth Horizons| Kia Puāwai is unable to provide an individual with access to their personal information. If so, the individual will be provided with written confirmation of the reasons for refusal and information on the complaints process.

Reasons for refusing access to personal information include (but are not limited to):

• where the information is commercially sensitive;
• where access would breach another person’s privacy (including that of a deceased individual) or endanger the safety of another individual;
• where disclosure of the information would be likely to compromise the mental health of the individual;
• in the case of a young person under the age of 16, the disclosure of the information would be contrary to their interests;
• where the information was ‘evaluative material’ about the individual which was supplied in confidence by another person (such as a reference from a former employer);
• where the information consists of confidential communications with legal advisers (or with other persons where legal proceedings are contemplated); and
• where the information is not readily retrievable, does not exist or cannot reasonably be found.

An individual can make a formal request for access to his or her personal information to the Youth Horizons | Kia Puāwai Privacy Officer.

Disclosure

Youth Horizons | Kia Puāwai may only disclose personal information held to third parties where it enables Youth Horizons | Kia Puāwai to function as an employer in accordance with the purposes of collection outlined above; where it is believed on reasonable grounds that the disclosure is directly related to the purposes in connection with which the information was obtained, or where disclosure is reasonably believed likely to prevent or lessen a serious threat to public or individual health or safety.

This includes disclosure to external providers providing services for Youth Horizons | Kia Puāwai (including cloud based and IT service providers), advisers (including legal and marketing organisations), and other parties as required by law, including but not limited to, the Police, the Ministry for Children Oranga Tamariki and District Health Boards.

Youth Horizons | Kia Puāwai will not disclose personal information for any other purpose, other than the purpose for which it was collected, or a directly related secondary purpose, unless the individual otherwise consents to the disclosure.

Responsibilities & Accountabilities

Youth Horizons | Kia Puāwai staff and caregivers are responsible for:

-          ensuring that the contents of this policy are understood and adhered to;

-          making an immediate notification of a breach of privacy as soon as this becomes known;

-          sharing any concerns or issues relevant to the content of this policy with their manager as soon as possible.

Youth Horizons | Kia Puāwai line managers are responsible for:

-          ensuring that this policy is known, understood and adhered by all staff and caregivers.

Youth Horizons | Kia Puāwai Privacy officers are responsible for:

-          encouraging compliance, by the agency, with the information privacy principles;

-          dealing with requests made to the agency pursuant to the Privacy Act;

-          working with the Privacy Commissioner in relation to investigations conducted;

-          where an individual submits a request for any information held to be corrected, undertaking the correction.

References and Documentation Requirements