This guidance aims to help agencies respond appropriately to requests for personal information about children and young people. The guidance covers:
Information Privacy Principle 6 (IPP 6) of the Privacy Act 2020.
Who can make an IPP 6 request for information about a child or young person.
Requests made by parents, legal guardians or other caregivers, including:
when a parent, legal guardian or caregiver is acting as a representative of the child or young person.
whether the Privacy Act 2020 or the Official Information Act 1982 applies
what other laws may apply.
Requests made by a Lawyer for the Child.
Responsibilities of an agency before giving access to personal information.
Requests made by other agencies.
Applying the guidance in practice- some examples.
Information Privacy Principle (IPP) 6
The Privacy Act applies to any individual regardless of age. A child or young person has the same privacy rights as an adult but sometimes needs the assistance of another person to exercise those rights.
One of those rights is a person’s right to ask for information about themselves, set out in IPP 6.
An agency must respond to the requester within 20 working days and usually has to provide the information, unless one of the refusal grounds applies.
Who can make an IPP 6 request about children and young people?
An IPP 6 request may be made by the child or young person themselves or their representative. A representative is a person who is lawfully acting on the child or young person’s behalf.
Information requests from parents, legal guardians or caregivers
The Privacy Act does not provide an automatic right of access by a parent, legal guardian, or caregiver to their child’s personal information. Assessing and processing a request from a parent, legal guardian or caregiver is a two-step process:
Determine whether the parent, legal guardian or caregiver is a representative.
If yes, then determine whether any of the refusal grounds apply.
In most cases, a parent or legal guardian can be considered a representative, particularly where the child is too young or otherwise not able to act on their own behalf. Where a caregiver is making the request, determining whether they are a representative may not be so clear cut as they won’t have the same legal status as a parent or legal guardian.
The circumstances will be different for each request, so it is important that an agency considers each request on a case-by-case basis before deciding whether the parent, legal guardian or caregiver is acting as a representative of the child or young person.
Step 1: When is a parent, legal guardian or caregiver a representative?
For the purposes of IPP 6, a parent, legal guardian or caregiver may be considered representative of the child where:
the child is too young or otherwise not able to act on their own behalf, or
an older child or young person has authorised them to make the request on their behalf.
Before determining that a parent, legal guardian or caregiver is a representative, agencies should consider:
The age and maturity of the child and whether they are capable of understanding and exercising their rights under the Privacy Act.
Any court orders relating to parental access or responsibility (e.g. protection orders, custody and guardianship orders).
Whether, based on what is known to the agency, it is (or isn’t) likely to be in the best interests of the child or young person for the parent, legal guardian or caregiver requesting the information to be able to exercise their child’s Privacy Act rights on their behalf.
Where there is a family breakdown of some sort such as family harm, a custody or guardianship dispute or where the child is or has experienced abuse, the best interests of the child or young person should be a primary consideration. When determining whether it is in the best interests of the child or young person agencies should consider:
the interests of the parent, legal guardian, caregiver and the child or young person are no longer the same or are in conflict, and/or disclosing the information to the parent/legal guardian would go against the child’s interests.
whether there are reasonable grounds for believing the child or young person does not or would not wish the information to be disclosed.
If any of the factors above exist, an agency may determine that a parent, guardian or caregiver is not acting as representative of the child or young person and the request does not fall under the Privacy Act.
Where a parent, guardian or caregiver is not a representative you can consider the request under the Official Information Act (see table below).
Non-custodial parents
A non-custodial parent is the parent who doesn’t live with their child most of the time. Non-custodial parents with guardianship rights still have legal rights and responsibilities, ensuring they can maintain a relationship with their child. A non-custodial parent has guardianship rights if they meet the test in section 17 of the Care of Children Act 2004 (or are otherwise appointed by the Court).
A non-custodial parent with guardianship rights can exercise their child’s privacy rights in the same way the custodial parent can, taking the wishes of the child into account if expressed or known (for older children or young people).
Where an agency receives an information request from a non-custodial parent with guardianship rights, it should follow the same process for managing a request from a custodial parent or other legal guardian.
Step 2: Decision to release or refuse the request
A representative does not have automatic access to a child or young person’s personal information. An agency still needs to consider whether any of the refusal grounds apply in the circumstances.
In situations where parents are separated, agencies do not need the consent of the other parent (either custodial or non-custodial) to disclose information about the child or young person. However, agencies should consider whether the child or young person’s personal information also reveals personal information about the other parent (e.g., the other parent’s home address or contact details where there is a protection order in place).
When a request for information should be managed as an Official Information Act request
The Official Information Act (OIA) enables an individual to make a request for ‘official information’ (certain information held by public sector agencies). Official information can include personal information about other people, including children and young people.
Where the person requesting the information isn’t the child or young person or a representative, the request should be considered under the OIA.
The following table can help you determine which Act may apply depending on the specific circumstances of the request:
Individual making request
Purpose of request
Applicable Act
Child/young person – capable of making their own request.
Their own personal information
Privacy Act
Parent/legal guardian/caregiver of child/young person who is too young or not capable of exercising their rights.
(Parent/legal guardian/caregiver probably a representative)
Personal information about the child or young person
Privacy Act, unless there are circumstances which suggest the Parent/Legal Guardian/caregiver is not acting on their behalf or in their best interests, then the request should be processed under the OIA
Parent/legal guardian/caregiver of older child or young person capable of making their own request with the older child/young person’s authorisation to make the request on their behalf.
(Parent/legal guardian/caregiver probably a representative)
Personal information about the older child or young person
Privacy Act, unless there are circumstances which suggest the Parent/Legal Guardian/caregiver is not acting on their behalf or in their best interests, then the request should be processed under the OIA
Parent/legal guardian/caregiver of older child capable of making their own request where the older child/young person has made it clear they do not authorise the requestor to make the request on their behalf.(Parent/legal guardian/caregiver is not a representative)
Personal information about the older child or young person
Part 2 OIA/LGOIMA.
All other cases where a parent/legal guardian/caregiver of child/young person is determined not to be a representative.
Personal information about the child or young person
Part 2 OIA/LGOIMA. Subject to eligibility requirements in the OIA (s 12(1)), but not the LGOIMA
Other laws that may apply
Agencies should also consider whether any other laws may apply to requests made by parents, legal guardians or caregivers and proactive disclosures of children and young person’s information. These laws include:
The Health Act 1956 and the Health Information Privacy Code (HIPC) regulate access to “health information” held by a “health agency”. Under the HIPC, parents or guardians of children under 16 years are legally defined as their ‘representatives’, whose access requests are treated as though made by the child themselves. As with any information privacy request, these requests may be refused in certain circumstances (Rule 11(4) HIPC).
Under IPP 11 of the Privacy Act 2020, an agency may disclose personal information to a third party if it believes there are reasonable grounds that one of the exceptions in IPP 11 applies.
For example, this could be when the child or young person authorises the disclosure (IPP11(1)(c)) or where disclosure to parents is one of (or is directly related to) the purposes for which an agency obtained the information (IPP11(1)(a)).
However, unlike IPP 6 and the OIA, IPP 11 does not give a right to access or request information. IPP 11 gives an agency discretion to disclose personal information where that agency considers it is necessary to do so (rather than legally being required to respond to a request for the information). Whether an exception applies will depend on the circumstances.
Information requests from Lawyer for the Child
A Lawyer for the Child is a specialist lawyer appointed by the Family Court to represent the interests of the child or young person in Family Court proceedings involving custody or guardianship disputes, or situations of family harm.
To fulfil their responsibilities, the Lawyer for the Child often needs information about the child or young person held by agencies such as a school or healthcare provider. When making a request for information, the Lawyer for the Child will be acting as a representative for the child or young person.
The Lawyer for the Child should provide evidence of their appointment and brief from the Family Court. (A Lawyer for the Child is appointed by Court Minute and receives their brief by letter from the Court.) If it not clear whether the requestor is acting as the Lawyer for the Child, you should ask them to provide evidence of their appointment before you provide access to any personal information.
Responsibilities of an agency before giving access to personal information
Providing access to personal information to an unauthorised person can cause serious harm to an individual and be a form of notifiable privacy breach – where the personal information is about children and young people the harm can be long lasting and significant.
be satisfied of the identity of the requestor (e.g. the child or young person or the representative)
not provide access to the information if the agency has reasonable grounds to believe that the request is being made under the threat of physical or mental harm (coercion)
ensure that the information intended for the requestor (or their representative) is provided to the right person.
You may need to request additional information from the requestor to satisfy these requirements of the Privacy Act.
Confirming a requestor’s identity
Where additional information is required to confirm a requestor’s identity the agency should inform the requestor what information is required and why. Agencies must also ensure that any identification documentation requested is securely destroyed once confirmation of the requestor’s identity has been made.
Where a decision has been made to grant access to personal information, agencies should confirm with the requestor (or their representative) the method in which they would like to receive the information and double check email, or postal addresses are correct.
Where a request for information about a child or young person is made by another agency other laws may apply. These include:
Section 66C of the Oranga Tamariki Act permits Child Welfare and Protection Agencies to request and share information about children and young people for specified purposes.
Section 20 of the Family Violence Act permits Family Violence Agencies to request and share information about individuals who have been subject to family harm for specified purposes.
Any law that requires the information to be provided to the requestor e.g. section 66 Oranga Tamariki Act, section 11 Social Security Act, section 17 Tax Administration Act.
Where requests for information are made under one of these laws an agency cannot refuse the request under one of the IPP 11 refusal grounds (or a withholding ground under the OIA). An agency should assess the request and decide whether to share the requested information in line with the law under which the request was made.
Children and young people are now connected to the online world more than ever before.
While the online environment offers many educational, entertainment and social connection benefits, it also poses risks to a child or young person’s privacy and their well-being.
Many children and young people are exposed to the online world before they fully understand the risks associated with online interactions. Interactions with the online environment often requires the collection, use and sharing of personal information which in turn can create risks to their privacy online.
These risks include:
overcollection by apps and websites
oversharing on social media
access to inappropriate content, online predators and scams
phishing and malware risks
cyberbullying.
Children and young people
It is essential to take steps to protect your privacy while you are online. We have developed guidance to help yourselves and your information protected while you’re online.
You can use the children and young person online privacy posters to help teach your learners about keeping safe and protecting their information while they are exploring the online work.
Parents
It is essential to be aware of your child’s online activities and be aware of and implement privacy protective controls to help protect your child’s privacy. We have developed guidance to help keep your child and their information safe.
This guidance is designed to help you protect the privacy of children and young people when taking photos and videos (images).
It covers:
While the guidance focuses on images of children and young people, it is also useful for any organisation wanting to improve how it collects, uses, discloses and stores images generally.
In today’s digital age, it has never been easier to take and share images. Nearly everyone has a device capable of taking pictures and videos and the ability to immediately use or share those images with others.
There are many benefits to taking photos or videos, including:
recording a child or young person’s achievements and special moments at events such as a school production or a kids triathlon event
sharing events with a greater number of people through livestreaming videoconferencing, and online environments such as online classrooms.
However, taking and sharing images of children and young people also comes with risks.
These risks include:
Bullying – personal or embarrassing images in the wrong hands can lead to bullying behaviour affecting a child or young person’s confidence and self-esteem
Identity theft – images combined with personal information can be used to create fake online profiles or engage in digital and financial fraud
Child Sexual Abuse Material (CSAM) – with advancements in AI misappropriated images can be used or edited for child sexual abuse material
Grooming and Exploitation – other people may use images, and the personal information revealed in those images to locate and groom children
A general loss of privacy for the child or young person – sharing images online can lead to unwanted attention, intrusion into a child or young person’s privacy or affect education or job opportunities later in life.
It’s important that you are aware of the risks associated with the collection, use and sharing of images of children and young people and do what is necessary to protect their privacy and keep them safe from harm.
Application of the Privacy Act 2020
The Privacy Act sets out certain requirements for collecting, using and sharing of personal information. These requirements are set out in the 13 information privacy principles (known as the IPPs).
An image of a person is personal information about that person, unless there is nothing in the image that could make it possible to identify them. Some images may be classed as sensitive personal information if they reveal more sensitive information about an individual such as their race, ethnicity, religion, or their health.
While the Privacy Act applies to everyone, it requires you to take extra care when collecting personal information about children and young people. The following sections take you through the lifecycle of an image and how the Privacy Act applies at each stage of that lifecycle.
Do you have a lawful purpose and is it necessary to collect the information (IPP 1)?
You can only collect personal information if it is for a lawful purpose connected with the functions or activity of your organisation, and collecting the information is necessary for that purpose.
In practice this means you need to be clear about:
the purpose you are collecting the image for
how that purpose relates to your organisation’s functions
why collecting the image is necessary for that purpose.
Consider what information the image might show
If you’re taking an image of a child or young person, think about what the image will show about them. Images can reveal a lot more information than you might realise.
For example:
An image of a child or young person in their school uniform reveals what school they attend
An image can show their approximate age, gender or sexual orientation.
The background or surrounding details of an image can reveal where they may live, their contact information, and what their interests or beliefs are.
Other people shown in the image can show who they associate with.
It’s not always necessary to take an image of a child or young person directly. There are ways to take images that focus on the activity of the person or group of people (if that is the purpose for which you are taking the images) rather than people’s faces.
Use case – Talented Tutoring
Talented Tutoring provides online tutoring services to small groups of young people aged 12-18. The tutoring sessions are held online. Each session is recorded and later shared with the group (not more widely). At the beginning of each session, the tutor explains that the session is being recorded and will be shared with the group.
The online tutoring sessions are a core part of how the tutoring service works, so Talented Tutoring has a lawful purpose for collecting these images. Students are able to watch the recordings at a later date to assist them with their learning of the subject matter. Also, as part of the ‘virtual classroom’ environment, it is useful for students to be able to see one another. If a student feels uncomfortable with having the camera on (for instance because they do not have a private space to work in), they can ask the tutor whether they can keep the camera off.
Consent to collect images (IPP 2 and 3)
IPP 2 says that personal information, including images, must usually be collected directly from the person.
If you receive images from other sources (for example, people attending your event or parents attending a sports event or school production) you will need to think about whether the child, young person or their parent has provided consent for you to use and share those images.
IPP 3 is usually more relevant. It says that people have to be told why their information is being collected, what is going to happen to it and whether they have a choice about providing that information (including what will happen if they say no).
In practice this means that children, young people or their parents should always know that photography or videoing recording is happening and why it is happening.
Consent is best practice
Unless there’s a law that says the image has to be collected, it’s also nearly always going to be practical to give people the chance to say no to an image being collected, used or shared. So, while there is no specific requirement in the Privacy Act to get consent to collect, use or share images from a child, young person or their parents, it is best practice to do so.
Consent must be informed
Any consent must be informed – that is, you will need to give the child, young person or their parents sufficient information about why the images are being taken, what those images will be used for, and who they may be shared with, so that they can make a choice about what to do. Let them know what measures your organisation takes to protect the privacy of children and young people and protect them from harm.
This can be done either through a consent form (where people specifically choose to being photographed, such as class photos at school) or through an opt out form (where filming is part of an event, but you offer people the choice not to have photos used). If you have a Photography and Filming Policy, you should provide a link to that policy in your consent or opt out form.
People should have the right to withdraw consent at any time, including getting previously published images taken down, as long as that is feasible. Things can change; for example, a photo of a child that was not initially a problem may create safety concerns if it is kept up on a social media site after family circumstances change. Consent is not a ‘once and done’ thing. If it has been sometime since a child, young person or their parent have provided consent for images to be collected, check if they are still comfortable with photography or filming taking place.
Use Case – South Soccer Club
South Soccer Club wants to take photos and videos of the club’s games for the upcoming season to post on social media and share internally within the club. The Club has several teams with ages of members ranging from 5 to 65. Posting photos is a great way to show what the Club does, to celebrate players’ success and to encourage people to join.
At the start of each season new and returning members of South Soccer Club are given the club’s privacy statement, their Photography and Filming policy, and an opt-out form. If anyone – including a young person or a parent of a child in the team – does not want photos taken of them or their child through the season, they can fill out the opt out form.
People can also change their minds at any time and withdraw consent for photos to be shared.
All photos are carefully checked before they are posted on the club’s social media pages to ensure that:
club members who have opted out are not in any of the photos
the photos don’t include identifiable players or spectators from other teams (who haven’t been asked for consent)
none of the photos show players or spectators in an embarrassing situation.
How to inform children, young people and parents (IPP 3)
There are a several ways to inform people that you will be collecting images of them. Use whatever works in your context:
Use consent or opt-out forms.
If you collect and use images regularly, it’s worth having a Photography and Filming Policy that sets out why, when and how your organisation collects images, how it uses images, how it keeps them safe and secure. Make sure the policy is readily accessible. It doesn’t need to be long or legalistic – the purpose of it is to let both photographers and photography subjects know what is expected.
Have signage at events where images of children and young people will be taken, that includes information about what to do if you don’t want a photo taken.
Information about photography should also be included in your organisation’s privacy policy.
All information provided to children, young people and their parents should be clear and written in age-appropriate language.
The Ministry of Tasks have set up a youth advisory group to get a youth perspective on a specific project. The members of the youth group are aged 16-17 years. The youth advisory group will meet in person to provide insights and feedback over a series of three meetings. The Ministry wants to take photos of the youth advisory group meetings and use the images in its internal newsletter to acknowledge and celebrate the contribution of the youth advisory group members.
The Ministry has provided each member of the youth advisory group and their parents a privacy statement that details why photos of the youth advisory group meetings are being taken and what the images will be used for. The youth advisory group meeting privacy statement refers to the Ministry’s general privacy policy and its more specific photography and filming policy. Advisory group members (and their parents) are also provided the opportunity to opt-out of the photos being taken while participating in the meetings.
Keep the best interests of children at the forefront (IPP 4)
IPP 4 says that when collecting images, you must do so in a way that is lawful and seen as fair and not unreasonably intrusive in the circumstances.
What is fair will depend on the circumstances of the individual concerned, such as age or capacity, and the sensitivity of the information. This means that you are required to take particular care to make sure the way you collect images of children and young people is fair and not unreasonably intrusive. The best interests of the child should be a primary consideration (United Nations Convention on the Rights of the Child, Article 3 –in all actions concerning children, the best interests of the child shall be a primary consideration).
Some useful things to think about are:
Where are you taking the image? Is it a relatively private space, or is it more open?
Is it just an image or is there audio? What’s on that audio?
Could the content be embarrassing? Is it something that the child or young person might not want captured for posterity or could cause longer term harm?
Could the content create safety or wellbeing issues for the child or young person?
Does the child or young person know the photography or filming was happening?
Use Case – CCTV in bathrooms
A high school was having trouble with students using school bathrooms to vape and installed CCTV cameras in bathrooms to monitor and discourage the use of vapes. The school completed a Privacy Impact Assessment to ensure they identified all privacy risks associated with installing the cameras.
The cameras are clearly visible with signs warning of their operation, are positioned to face away from areas that may be classed as sensitive, do not record audio, and all camera footage is securely deleted at the end of the day. The school has updated their photography and filming policy and notified all students and parents about the new cameras.
It’s arguable that the way in which those cameras are set up may not be unreasonably intrusive. However, the school should monitor things to see whether the cameras are actually effective. If the cameras don’t solve the problem, then the collection of personal information using CCTV may no longer be considered necessary to achieve the intended purpose (monitor and discourage vape use).
Using or sharing images (IPP 10, 11 and 12)
The use and sharing of images are governed by a range of information privacy principles. These are:
IPP 10, which limits the use of personal information for the purpose it was collected,
IPP 11, which limits the disclosure of personal information for the purpose for which it was collected, and
IPP 12, which sets rules around sending personal information overseas.
Generally, you can only use or share an image for the purpose for which it was collected. For example, if you have collected an image of a child or young person for the purposes of developing an activity progress report you cannot then use that image for an advertising campaign or post it on your organisation’s social media platforms.
There are a few situations in which you can use an image for a purpose that’s different from the original purpose:
The most obvious one will be where the child, young person or their parents’ consent to the image being used for a different purpose. Remember that any consent needs to be ‘informed’.
Another situation would be if you are sharing an image where the child or young person is no longer identifiable (so the image is no longer “personal information”). This goes beyond not showing faces or not including names. Think about whether there are any distinctive features that could identify the child or young person – either in the image itself, or from the context in which it’s taken. Could the person or organisation that you’re sharing the image with pull together other information to find out who it is?
Sometimes, the new purpose may be ‘directly related’ – that is, it is so closely aligned to what you originally intended to do, that people will not be surprised when the image gets used for that reason. For more detailed guidance on ‘directly related’ purpose see: When can I use the directly related purpose exception? | Office of the Privacy Commissioner.
Occasionally, using or sharing an image for a different purpose may be authorised by law. People should usually have been told that it would have to be shared – and who it would be shared with, and why – at the time the image was collected. If they do not already know these things, they will need to be told at the time the sharing happens.
Use case – Phototown
Phototown is a photography organisation that specialises in portraits of children and families. G visited Phototown with her six-year-old L to have a portrait taken.
G was asked to review Phototown’s privacy statement and photography and filming policy. The policy explained that there was no requirement to purchase the portrait and that all photos would be securely deleted if the photos were not purchased by the customer.
After L had their photo taken, G decided not to purchase a portrait. Six months later G saw Phototown was using the portrait of L in an online advertising campaign. As G had not been advised that L’s image may be used for advertising purposes and had not consented to this use this would be considered an unauthorised use of the image by Phototown.
Review your images
Your organisation should have clear guidelines and processes for reviewing images you have collected before you use or share them.
At a minimum you should:
Review who is in the image, including who is in the background. This makes sure that people are not included, if they have asked not to be photographed or shown.
Be particularly careful when publishing images online to a general audience. Try to use images that capture the activity rather than featuring specific children or young people (unless you are completely confident that they and their parents are fine with that image being available to the world at large). Also consider how widely the images may be shared, how long they may remain available and how this may affect the child or young person’s long-term wellbeing.
Make sure the image doesn’t embarrass the child. Think about the clothing that they are wearing, their body positions and facial expressions, and any potential harm that long term exposure of the image could cause them.
Make sure that your intended use of the images aligns with the consent that you obtained e.g. if you collected the images for the purpose of sharing with a specific group of people (e.g. sharing classroom activities with parents of a specific classroom) you will need consent of the learners (or their parents) to use the images in the school newsletter which is distributed to all learners and parents attending the school.
Check that consents to use and share images are recent. For instance, if your consents relate to last year’s sports season, or last year’s school production, check in with the child, young person or their parent to see whether things have changed.
Consider potential cultural impacts of the image. For example, if your images relate to a school kapa haka event, is there tikanga you need to consider before using or sharing the images.
Avoid sharing identifying information with the images, for example, names and ages.
Keeping images safe (IPP 5)
It’s important to keep images of children and young people safe. Stolen or misappropriated images can be used to harm them (for instance, they could be used for bullying, CSAM, or grooming purposes). So, you need to make sure that you have appropriate safeguards in place.
A few key things to remember are:
Just because an image is held by your organisation does not mean it is fair game for anyone who works there. Think about why you got it, who needs to see it, and whether you have been clear about what can be done with it (for example that it’s only for use in a club members newsletter, not for posting on social media).
If you are sending an image somewhere, always make sure it is going to the right recipient, or that it is being posted to the correct online site with the right permissions attached (for instance that it is not made fully public by mistake, if it is only intended to be shared with a specific group).
For online classrooms/video conferencing think about the platform you are using and ensure it is age appropriate. Don’t use personal accounts to set up any online platforms – use your organisation account/credentials.
Before using any AI tools to create, edit or organise images you should carefully consider the privacy risks to children and young people.
Think about whether you can use other security measures as well. For example:
Think about whether you can prevent images from being taken and used by others for their own purposes by adding other features such as watermarks, copyright marks or digital signatures.
Use lower resolution images to make it less likely that a child or young person could be identified or information about them misused.
Disable right click and screenshot capabilities on website and/or social media pages.
Remove embedded material/metadata from the image – this separates or removes the image information (which may say more about the person or the context) from the image itself.
We recommend that you don’t use personal devices to collect images of children and young people for work or event related purposes. Personal devices include phones, laptops or computers, and portable storage devices.
If your organisation doesn’t have a device available for collecting images, clear processes for personal device use should be outlined in a document such as a photography and filming policy.
Images of children and young people taken on personal devices should be transferred to your organisation’s secure environment and then deleted from the personal device as soon as possible.
Use Case – Youth Outdoor Adventure Club
A local youth outdoor adventure club collects images of their outdoor activities to share with parents and the wider youth adventure community. As the club does not have a club device or camera to capture images, the club is reliant on its volunteers to capture images with their own personal devices.
The youth outdoor adventure club develops a photography and filming policy which states that photos taken for the purpose of the club’s outdoor activities are subject to the Privacy Act. The policy requires that all photos or videos taken by volunteers must be securely sent to the club’s email and deleted off personal devices to ensure the club is not in breach of IPP5.
Retention of images (IPP 9)
IPP9 says that you should not keep personal information for longer than it is required for the purpose it may be lawfully used.
There is no minimum timeframe setting out how long you should keep an image. Considerations about retention and disposal are usually connected to the original purpose for collecting the image. As a general rule, if you no longer have a reason to use or share the image you should delete it.
Retaining images for longer than is necessary means there is a greater risk of the images being used or shared for unauthorised purposes down the line. As children and young people get older their likes change – an image that was once cute and funny could be distressing or cause embarrassment if used or shared today.
Document your image retention and disposal process
Creating and documenting your processes for reviewing, retaining and deleting images that your organisation holds is a good way to help you manage the risks associated with retaining images.
Reviewing the information (including images) that your organisation holds on a regular basis helps you know what information you hold, where it is held and whether you still need it. It is a good idea to record when a review was completed and what actions were taken – this can be as simple as recording it in your organisations committee meeting minutes or, for larger organisations, ensuring recording of the review is part of your broader governance assurance processes.
Your review should also include your organisation’s social media posts and webpages where images of children and young people have been used. But remember, removing an image from an online post, or deleting the entire post doesn’t mean the image has been removed from the online environment completely.
Deleting images (IPP 9)
When you are deleting images, you need to ensure they are actually deleted.
While you can shred physical copies of photos, digital images may require a few steps to be permanently deleted – for example, simply moving digital images to a recycling or trash folder does not permanently remove the images from your device.
The most secure way of permanently deleting images from a computer is to use specialised computer software to ensure the image’s data is overwritten. Permanent means permanent – so if you choose to use this type of software make sure you check and double check you are deleting the correct files.
Use case – local volunteer organisation
V runs a local youth volunteer organisation. The organisation has photos of its volunteers going back 20 years but does not know what to do with them. While some of the photos are important to retain, V does not think it is necessary to keep all the photos.
V decides to develop an image review process for the organisation. The image review process sets out:
the purposes for which the organisation collects photo
a reasonable time period that the photos should be retained for each purpose
the process by which the images are deleted
how often the review process should take place and
who within the organisation should undertake the review.
Using the newly created image review process, V identifies a number of photos that are no longer necessary or relevant for the organisation’s purposes. V securely deletes these images using software that permanently deletes the images from the organisation’s computer.
Consider creating a Photography and Filming Policy
It is good practice to have a written photography and filming policy that sets out your processes and practices for taking and using and sharing images taken of children and young people during events and activities.
Your policy should document how your organisation:
collects images (for example whether consent is required and how consent is obtained) including what devices can be used to collect images
uses and shares images, including any processes for review of images before using and sharing them with others or online
keeps images secure
ensure images aren’t retained longer than is necessary
manages the risks associated with using and sharing images of children and young people, particularly online
Children, young people, parents, staff and volunteers should know about your policy and understand how images are collected, used and shared. Providing your photography and filming policy as part of your consent process can help children, young people and their parents make an informed decision about consenting to images being taken, use and shared.
How to manage filming/photography by others
People (parents, family, spectators and other children and young people) attending an event may want to take images or livestream the event which may include images of children and young people who do not know the images are being taken. In most cases, this will be difficult to prevent.
However, there are some measures you can take to ensure that everyone is aware of the risks of taking and sharing images of children and young people, and act in ways that best protects the privacy of the children and young people participating in the event.
It is always good practice to inform people of your organisation’s photography and filming policy (if you have one) or remind people to be mindful when taking and sharing images of children and young people when they are entering or signing up to participate in an event. It’s okay to tell people attending your event that they should get consent before taking and sharing images of children and young people.
You can also have signs at your event to remind people about taking and sharing images of children and young people and have a process in place where people can raise any concerns about images taken and shared after the event.
In a school environment, if students have access to devices, a clear policy around taking and sharing images of other students and teachers should be made available to all students.
Using Professional Photographers
You may choose to use a professional photography or videography service to record events. If you do, you should ensure that children, young people and parents are informed and consent to their child being photographed or filmed.
Ensure that your photographer understands the specific purposes for which the images are being taken. They will also need to be aware of the children and young people for whom consent has not been obtained. How you do this will depend on the circumstances, but you will need to ensure that the children and young people do not feel singled out or isolated.
Use case – North High School
North High School provides devices for their learners to use. The devices are capable of recording video and are connected to the school’s internet. Every learner is given a device Code of Conduct (the Code) which clearly outlines what they can and cannot use their devices for, and the consequences if the learner breaches the Code. The Code is also provided to all parents. The Code provides a link to the school’s privacy statement and photography and filming policy.
The school’s Code is clear that learners cannot use their devices to take or record images of other learners (both on and off school grounds). The Code also provides that a learner cannot use their devices to access and use Facebook or other social media sites. The school’s Photography and Filming policy sets out what actions the school will take to remove images posted to social media or shared with others that go against the Code.
Having the Code and the Photography and Filming policy in place will help:
mitigate the risk of images of learners being shared inappropriately
enable the school to act quickly and effectively to reduce harm to the learner from the image being posted or shared with others
give learners and their parents confidence that the school has robust policies and procedures in place to protect a learner from unauthorised collection, use and sharing of their images.
Use case – Kids Triathlon Event
XYZ Limited is organising a kids triathlon event. The event is open to children and young people aged between 10 and 17 years old. XYZ Limited has arranged for a professional photographer to take photos of the event.
Parents are provided with information about the photographer, why the photos are being taken and what they will be used for. Parents are asked to read through the information and then complete an image consent form when registering their child.
When registrations close, XYZ Limited provides the photographer with the list of race numbers that belong to children for which consent to take images has been provided. At the completion of the event the photographer will review all the photos and check that only participants that have provided consent have been captured. If an image contains a child or young person who has not consented, those images will be permanently deleted. XYZ Limited will also review all images before they are shared onto social media accounts or other online platforms to ensure consent exists to share the images.
When registering for the event parents are also advised to be mindful when taking images of their child and to consider other children and young people who may be in the images before posting them to social media accounts. XYZ Limited also has signs that will be erected around the course to remind parents to be careful when sharing images of children and young people participating in the triathlon.
Guidance to help organisations protect and respect children and young people’s privacy has just been released.
“We all have a role in protecting children and their personal information. This guidance on photography and filming will help to empower them, and their parents and caregivers to understand and exercise their privacy rights effectively, Privacy Commissioner Michael Webster says.
“Taking and sharing images of children and young people helps record their achievements and special moments. But it’s also important people are aware of the risks associated with the collection, use and sharing of these images and do what’s necessary to protect their privacy and keep them safe from harm.”
While the Privacy Act applies to everyone, it requires people to take extra care when collecting personal information about children and young people. The Privacy Act also covers the use and sharing of images.
“As a rule, it’s good to ask, why am I collecting this image and is it necessary? How am I using and sharing these images and with who? Retention and deletion are also important as children change as they age; they also move schools and then finish their education.
“An image that was once cute and funny could be distressing or cause embarrassment if used or shared today. Consent is best practice; children, young people or their parents should always know that photography or videoing recording is happening and why, and they should also have the right to withdraw their consent at any time.
“If you’re taking an image of a child or young person, think about what the image will show about them. Images can reveal a lot more information than you might realise such as their school, approximate age, gender or sexual orientation, where they may live and other people they associate with.”
OPC has also developed other guidance to help those working in the children’s sector, including how to apply best practice privacy when responding to requests for a child or young person’s personal information, and how to help children, young people and their parents protect their privacy while exploring the online world.
“Children and young people’s privacy is a priority area for my office. It’s also an important area with the public, with our recent privacy survey recording the highest level of concern (67%) for children’s privacy.
“Understanding how to protect and respect a child or young person’s personal information and implementing good privacy practices will ensure all children have positive privacy experiences throughout their journey to adulthood”, Mr Webster says.
Further guidance, including detailed privacy guidance for the education sector, will be released later in the year.
Vocational Education Minister Penny Simmonds has announced the appointment of Dr Alan Bollard CNZM as Chair and Mr Robin Hapi CNZM as Deputy Chair of the Board of the Tertiary Education Commission (TEC).
“I am pleased to confirm the appointment of Dr Bollard and Mr Hapi to these roles. They will provide strong leadership drawing on their considerable skills and experience,” Ms Simmonds says.
“Dr Bollard has been acting Chair since 26 March 2025. He is an experienced public sector leader and Chair, with exemplary governance and machinery of government knowledge, financial acumen and economic expertise.
“He was appointed to the TEC Board in November 2024 and brings extensive leadership experience, including as Governor of the Reserve Bank, Secretary to the Treasury, and Executive Director of the Asia-Pacific Economic Cooperation Secretariat.”
Mr Hapi was appointed to the TEC Board in February 2025 and now takes on the role of Deputy Chair.
“Mr Hapi is a highly respected director and leader, with a strong record across multiple boards under successive governments,” Ms Simmonds says.
“His extensive knowledge of the education system, including wānanga and university
leadership, commercial experience, and deep understanding of te ao Māori, is invaluable.
“These appointments support continuity on the Board and will ensure that the Board can utilise Dr Bollard’s and Mr Hapi’s extensive skills and experience in these leadership roles.
“This is critical as the TEC leads significant changes to the tertiary education and training system.”
The appointments are effective immediately and run through to 31 October 2027.
In April, the Marine Environment Protection Committee (MEPC 83) agreed on draft measures to price greenhouse gas emissions from shipping.
The International Maritime Organization (IMO) Net-zero Framework will require ships to comply with emissions targets or pay financial penalties for extra emissions.
Farmers and growers will have faster access to new agriculture and horticulture products because innovation drives success, says Regulation Minister David Seymour, Environment Minister Penny Simmonds and Food Safety Minister Andrew Hoggard.
“The changes announced today show the power of a sector review,” Mr Seymour says.
“Agriculture and horticulture products are integral to the largest sector of New Zealand’s tradeable economy, the primary sector. It’s important to ensure regulatory settings give the sector the best chance at success.
Cabinet accepted all of the Ministry for Regulation’s 16 recommendations to improve the new agriculture and horticulture product approval pathway.
“The changes will speed up the application process, make it clearer and more transparent, and ensure existing international research is utilised. It is estimated that reducing the current approval times for new products by half could generate benefits of about $272 million over 20 years,” Mr Seymour says.
“The seeds of innovation are sown and it’s officially the season for growth. The Minister for Food Safety and the Minister for the Environment will action these changes to streamline the product approval pathway. This means farmers and growers can utilise newer and better products faster.
Joint Ministers will be responsible for progressing an Omnibus Bill to provide legislative support and accelerate improvements.
Minister for the Environment Penny Simmonds says the Environmental Protection Authority (EPA) has been and will continue to work on improving the Hazardous Substances and New Organisms (HSNO) system.
“I have set a 10% reduction target for the HSNO queue in 2025/2026 and will set a more ambitious target in the next three months now that additional staff have been appointed for this work through reprioritisation of funding,” Ms Simmonds says.
“I have directed the Ministry for Primary Industries (MPI) to improve Agricultural Compounds and Veterinary Medicines (ACVM) assessment processes”, Mr Hoggard says.
“I want a 20% queue reduction for ACVM products compared to the queues in October 2024, by the end of June 2025. By the end of June 2026 I want to see queues reduce by a further 30%.”
“In a high-cost economy, regulation isn’t neutral. It’s a tax on growth. Every completed review makes it easier to do business, access services, and innovate in New Zealand. The Hairdressers and Barbers Sector Review is another example of what smarter regulation looks like in action,” Mr Seymour says.
Agricultural and Horticultural Products Regulatory Review Report: https://www.regulation.govt.nz/assets/Publication-Documents/Agricultural-Horticultural-Products-Regulatory-Review-full-report.pdf
Agricultural and Horticultural Products Regulatory Review Summary Report: https://www.regulation.govt.nz/assets/Publication-Documents/Agricultural-Horticultural-Products-Regulatory-Review-summary-report.pdf
Other information about the review can be found on the Ministry for Regulation’s website: Agricultural and horticultural products regulatory review | Ministry for Regulation
The Government is strengthening the market governance of New Zealand’s Emissions Trading Scheme (ETS), Climate Change Minister Simon Watts says.
“A credible ETS is our most powerful and cost-effective tool to drive down net emissions across the economy. But to do its job, the ETS must have good market governance in place. That’s exactly what these changes are about.
“Talk about changing market governance settings has been happening for years. This Government is committed to a credible ETS-led approach to reducing emissions, so is now turning talk into actions.”
Key changes include:
Requiring trading platforms to report and record price and volume data to the Ministry for the Environment.
Requiring market participants to record trading information into the ETS Register.
Introducing market conduct obligations into the Climate Change Response Act, prohibiting price manipulation and misleading conduct.
Allowing monitoring agencies to obtain information from market participants and share relevant information with each other.
“These changes have been carefully designed to address risks without adding unnecessary costs or red tape. We’ve deliberately avoided more expensive options like creating a government-run exchange or clearing house which was considered by the last Government,” Mr Watts says.
“New Zealand is lagging behind other countries with an ETS when it comes to market oversight.
“Right now, there is limited visibility to much of our ETS trading. This makes our market vulnerable to market misconduct risks such as price manipulation.
“These changes will help align us with our international peers but won’t disrupt New Zealand’s established ETS market practices.”
The changes will be likely introduced alongside other potential amendments to the Climate Change Response Act before the end of the year.
Final-year Fees Free entitlement is for the final year of the first provider-based qualification or work-based programme a learner completes from 1 January 2025, if that programme meets the qualification and programme eligibility criteria.
Learners starting study or training for the first time on or after 1 January 2025 can receive Fees Free for the final year of the first eligible qualification they complete.
Learners may still be able to claim Fees Free for a qualification or programme that is not the first qualification or programme they have completed on or after 1 January 2025. Refer to the prior study and training criteria.
Learners can’t choose which qualification or programme they use final-year Fees Free for.
Entitlement is to be used for one provider-based qualification or work-based programme.
Fees will not be covered for study or training undertaken prior to 1 January 2025.
Provider-based study and work-based learning each have their own definition of the “final year”, and what fees final-year Fees Free entitlement covers.
Final year of provider-based study
The “final year” of provider-based study covers up to 1 EFTS, or up to $12,000 including GST (whichever the learner reaches first).
Learners can study either part time or full time.
Final-year Fees Free covers tuition fees, compulsory course costs and student services fees for provider-based learners. No other fees, such as administration fees from StudyLink, will be covered.
The “final year” of study may also be the first year of study for provider-based qualifications that are only 1 equivalent full-time student (EFTS).
Final year of work-based study
The “final year” of work-based learning covers up to 24 months, or up to $12,000 including GST (whichever the learner reaches first).
Learners can study either part time or full time.
Final-year Fees Free covers all fees for training and assessment charged to eligible work-based learners and their employers, including fees paid to tertiary education organisations funded from the Delivery at Levels 3–7 (non-degree) on the New Zealand Qualifications and Credentials Framework and all industry training (DQ3-7) Fund, or directly to training and assessment providers.
Entitlement cannot be carried over
Entitlement must be used for the final year of one provider-based qualification or work-based programme. Entitlement cannot be carried over to another qualification or programme if the learner does not reach 1 EFTS, 24 months, or $12,000 including GST for their first qualification or programme.
Limit on calculating total fees
There is a 5-year limit on how we will calculate the total fees for the final year of study or training. Fees will not be covered for study or training undertaken more than 5 years before qualification or programme completion. For example, a learner who starts their final year, takes a break from study and then returns to complete their study more than 5 years later will only be covered for their final year of study within the 5-year period.
Training Incentive Allowance
Learners who use the Training Incentive Allowance (TIA) to cover some or all of their course fees during their final calendar year of their qualification will not be able to access Fees Free for the same course fees.
A learner may still use TIA to cover other costs, such as childcare or transport, during their final year and still receive Fees Free for their tuition, compulsory course costs, and student services fees. TIA used for fees in earlier years doesn’t impact eligibility for Fees Free in the learner’s final year.
Learners who opt to use TIA for course fees in their final year of an eligible qualification that they complete will not be eligible to receive Fees Free for the final year of a second eligible qualification.
The Ministry of Social Development will work with those applying for the TIA to help them make an informed decision on their use of the TIA and Fees Free.
Training Incentive Allowance – Work and Income
Mana in Mahi
Learners who trained at Level 3 or above and had their fees covered by an employer through the Mana in Mahi – Strength in Work programme will not be able to access Fees Free for final-year fees.
Receiving entitlement
From 2026, after completing their first provider-based qualification or work-based programme, learners will log in to myIR on Inland Revenue’s website to confirm their eligibility and claim their final-year Fees Free entitlement. The first payments for completed qualifications and programmes will be made in early 2026.
Learners have 12 months to claim their entitlement once they have completed their qualification or programme. Learners that complete their first qualification in 2025, before the claim process is available, will have until the end of 2026.
If eligible, the entitlement will either be paid against the learner’s student loan balance if they have one or, if not, will be paid to the learner’s nominated bank account. The first payments for completed qualifications will be made in early 2026.
Only learners can claim their Fees Free entitlement. Employers that have paid learners’ fees may consider if it is appropriate to update employment agreements and/or arrangements with their employees.
Changing TEOs part way through study or training
Fees Free entitlement will only be for the final year of the first completed eligible provider-based qualification or work-based programme.
Generally, when cross-crediting from different qualifications or programmes, learners will not be able to claim Fees Free for the study undertaken towards another qualification or programme that they did not complete.
Where a learner changes their TEO but continues in the same qualification or programme, Fees Free will cover the final year of that qualification or programme across both TEOs.
Exit qualifications
For acceptance of a provider-based qualification at a lower level of the NZQCF, or an “exit qualification”, learners will be able to claim Fees Free for the final 1 EFTS or $12,000 of the qualification they were enrolled in prior to being awarded the exit qualification. In these circumstances, and where the learner’s qualification expires during their final year, TEC will need to collect additional data from provider-based TEOs to accurately calculate the learner’s entitlement.
Overseas exchange programmes
Learners undertaking the final year of their qualification on a formal overseas exchange arranged through their domestic provider are entitled to Fees Free.
Learners’ entitlement will be calculated on their last 1 EFTS or $12,000 of study or training (whichever occurs first) that they undertook at their domestic provider. For example, if a student goes on exchange for the last year of their study, their eligibility will be calculated based on their second to last year of study.
Learners who go overseas and study abroad in their final year (ie, they are not on a formal exchange programme) are not eligible for final-year Fees Free.