Disclosing Personal Information about Learners and Staff Policy
To ensure Otago Polytechnic Limited satisfies the requirements of the Privacy Act 2020.
1. The Privacy Act 2020 sets out the principles which form the basis on which all issues regarding privacy of personal information are determined and are to be managed. Everyone who has access to personal information collected or held by Otago Polytechnic Limited must understand and follow these principles. This policy applies to all personal information collected and/or held by Otago Polytechnic Limited about any person and, about people enrolled as learners or employed as staff.
2. Personal information collected and/or held by Otago Polytechnic Limited including information about any identifiable learner or staff member is covered by the principles outlined in the Privacy Act. Staff who have access to personal information about learners and/or staff need to be aware of and follow the procedures set out in this policy to minimize the risk of inadvertent disclosure of personal information.
3. Enrolment and employment forms will include statements regarding the collection and use of personal information and the purpose the information is being collected for under the provisions of the Privacy Act.
4. Such information must be used only for the purpose it is intended.
5. The Public Records Act 2005 requires that certain information be held for specified periods of time.
6. Any information collected and /or held by Otago Polytechnic Limited about learners or staff members, current or past, must be stored either physically or electronically in a secure manner.
7. The Polytechnic appointed Privacy Officer who will deal with any requests under the Privacy Act is the Te Kaihāpai.
8. In the case of official information requests these are dealt with under policy Requests for Official Information.
9. In the case of CCTV footage, this is dealt with under policy CCTV at Otago Polytechnic Limited Sites. (‘CCTV’ means a camera surveillance system which captures images of individuals or information about individuals).
10. Any serious breaches (i.e. That are deemed to have caused serious harm), must be reported to the Privacy Officer, Te Kaihāpai, immediately.
1. Requests for Information
1.1. Learners and staff have the right to request to see, and correct if necessary, information held by the Polytechnic about them other than exclusions that are specified in the Privacy Act, for example confidential referees reports and legally privileged information.
1.2. Enquiries about personal information held by Otago Polytechnic Limited should be referred to Registry in the first instance for learners or to Human Resources for staff. When in doubt, staff must consult with the Privacy Officer (Te Kaihāpai) before disclosing any information.
1.3. Some form of valid ID such as a drivers licence or passport will be required for identification to enable access to an individual’s personal information.
1.4. Some information can be disclosed. This includes the fact that a person is enrolled, or has been enrolled at the Polytechnic, or employed as a staff member, or has been employed as a staff member. As these matters are not private, no special permission is required to make this simple disclosure to a third party, but all other personal information is protected.
1.5. The names of Board Members, Executive Leadership Team, Directors, Heads of College, Programme Heads, and staff are public information and are available on the Polytechnic web site. However, private information such as private addresses cannot be disclosed.
2. Requests from Specific Agencies
2.1. The Polytechnic collects and stores personal information about learners from the enrolment process to comply with the requirements of the Polytechnic in regards to the programmes and courses in which learners enrol as well as to meet the requirements of the Tertiary Education Commission (funding and learner statistical returns), and the Ministry of Social Development (confirmation of enrolment and academic outcomes).
2.2. Also, when required by statute, the Polytechnic releases information to Government agencies such as NZQA, Audit New Zealand, Skill New Zealand, Industry Training Organisations, Industry licensing and registration bodies, other tertiary institutions and providers of work experience for learners in courses, the New Zealand Police, Ministry of Justice, Ministry of Social Development and the Accident Compensation Corporation (ACC).
2.3. In such cases, requests for personal information can be disclosed providing the information is held and is clearly related to the purpose for which the information was collected.
3. Other Requests
3.1. Requests are received from other agencies from time to time and usually these come with a statement that the individual has authorised the request, or a clear statement indicating the enquirer has a statutory right to the information.
3.1.1. In cases where a College regularly receives standard requests for information from a particular agency not covered by clause 2.2, the Privacy Officer may agree a standard procedure with the relevant School for dealing with such requests, without the need for referral of each individual request to the Privacy Officer.
3.2 In any other cases the enquiry should be accepted, but NOT answered immediately. The relevant details including name, organisation, role, or position within that organisation and contact details should be obtained, as well as the details and reason for the request. The information can then be collated, and further advice sought from the Privacy Officer.
4. Requests for Addresses or Other Means of Contact
4.1. From time to time, requests are received from parents, relatives, friends, and others wanting to get in touch with staff or learners. Addresses and other contact details should NOT be disclosed except in emergencies as indicated below. Staff contact details are available on the web and intranet and these can be provided, however learner details are private, and some learners have good reasons for keeping their contact details private. Not all such requests are innocent or well intentioned, for example a company wishing to market to individuals in a personal manner by using their private information.
4.3. Specific enquiries from parents, relatives, or friends can be handled by offering to deliver a message to the person concerned and asking the learner or staff member to contact the person concerned. This can be done by obtaining the contact details of the enquirer and forwarding these to the person concerned.
5. Emergency Messages
5.1. In a “genuine emergency”, messages should be relayed as soon as possible through a senior member of staff such as the Head of College or Programme Head, or a staff member’s manager.
6. Requests from Parents/Caregivers and Employees’ Progress Reports
6.1. Parents and employers have no special right to a child or employee’s personal information; this is irrespective of the fact that they may have paid fees or allowed time off employment to study. In these cases, every effort should be made to persuade parents and children and employees and employers to deal directly with each other. If that is not possible, the learner’s authorisation can be sought either by the parent/employer or by Otago Polytechnic Limited. This should be discussed with the Privacy Officer.
7. Learner Results
7.1. Learner attendance records, grades, marks, assessments, and results are personal information. Care must be taken to ensure these are communicated only to the person concerned, unless there is explicit written authority to disclose them to an authorised party or there is a clear statutory requirement to disclose the information, for example providing results to NZQA. All requests must be in writing and should be actioned by Registry. The request should be in writing and, if it is from an agency other than those noted in section 2 above, the request should be accompanied by authorisation from the learner. All requests will be processed as a Results Notice or an Academic Transcript. Charges will apply for the processing of these requests. Currently these charges are $25.00 for an academic transcript. Refer also to policy Learner Results.
7.2. Display of results is to be avoided as learners can access their results through the learner portal of the learner management system. Any results display must have:
- no names or easily identifiable references such as full learner ID numbers, AND
- a private PIN number such as part of the learner ID, AND
- the order of the results is altered so as not to be in alphabetical order Note that published work, such as theses, is in the public domain.
7.3. Moderation of Results
- Where materials are chosen for moderation purposes, any identifying information should be removed before copying and using the materials, unless the identity of the learner is required for the purpose undertaken.
8. Police Requests
8.1. Requests for personal information from the Police should be referred to the Privacy Officer in the first instance, or the Deputy Chief Executive: People, Culture and Safety. Information privacy principles apply to requests from the Police except in certain circumstances such as the investigation, prevention, detection, or prosecution of an offence against the law.
8.2. While every endeavour is made to cooperate with the Police when they ask to contact a learner or staff member on campus, the following principles must be followed:
- The prior approval of the Privacy Officer or the Chief Executive is required for a learner or staff member to be interviewed on Otago Polytechnic Limited premises.
- Any person being interviewed has the right to be accompanied by another person including a lawyer or learner support person such as an OPSA representative if s/he wants that support.
- Should a Police Officer wish to interview or discuss a matter with a learner or staff member, this should be done in a private room. A staff member should discretely ask the learner to accompany them from the class/office/premises to a suitable venue to meet with the Police Officer.
Dr. Megan Gibbons