Category: MIL-OSI

If you believe that a child or young person has been or is likely to be harmed, ill-treated, abused, neglected, or deprived or you have concerns about the wellbeing of a child or young person, section 15 permits you to share information about your concerns directly with Oranga Tamariki or the Police. 

Section 66 enables Oranga Tamariki or Police to require any agency or individual to provide relevant information if that information is required:

• to determine whether the child or young person needs care or protection or assistance, or
• for any proceedings under Part 2 of the Oranga Tamariki Act (including a Family Group Conference).

When you receive a section 66 request from Oranga Tamariki or Police you must provide the information specified in the request (unless the information is covered by legal professional privilege). You do not need to consent or consult with the child or young person (or their parents, legal guardian or caregiver) before you provide the information requested. 

If you are unsure whether the request is a section 66 request, or what the purpose of the request is, you should ask the requestor for this information before you share the information with them. 

Section 66C of the Oranga Tamariki Act permits the sharing of information about a child or young person for specified wellbeing and safety purposes. 

Under section 66C you can proactively share information, or you can share information in response to a request. 

Section 66C of the Oranga Tamariki Act permits Child Welfare and Protection Agencies (CWPAs) or Independent Persons to share information about a child or young person with other CWPAs or Independent Persons for specified wellbeing and safety purposes. 

Child Welfare and Protection Agencies (CWPAs) are a group of organisations, and therefore their employees, or volunteers including:

• Any social, family and community service that provides services under section 396 of the Oranga Tamariki Act.
• Any person, body or organisation that provides regulated services under schedule 1 of the Children’s Act 2014.
• Housing New Zealand Corporation.
• Ministry of Education, schools and early childhood education services.
• Ministry of Health, Health NZ and health providers.
• Ministry of Justice.
• Department of Corrections.
• Ministry of Social Development.
• Oranga Tamariki – Ministry for Children.
• New Zealand Police.

Independent Persons are professionals or people including:

• A practitioner under the Health Practitioners Competence Assurance Act 2003 who provides health or disability support services.
• A Children’s Worker (under section 23(1) of the Children’s Act).
• A person or class of persons designated as an independent person by regulations made under section 447(1)(ga)(ii) of the Oranga Tamariki Act.

Section 66C enables information about a child or young person to be shared for specified purposes, including:

• preventing harm or neglect to a child or young person
• for Family Group Conferences and other Care and Protection work
• making, carrying out, or reviewing a risk assessment, needs assessment, prevention plan or support plan for a child or young person
• external services facilitated by Oranga Tamariki for a child or young person and their family or whānau.

If you receive a section 66C request for information and the purpose of the request is unclear, you should clarify the request with the requestor. If you are unsure why the information is being requested, you won’t be able to determine whether one of the purposes set out in section 66C applies, or what information may be relevant to share with the requestor. 

Wellbeing of a child or young person includes:

• strong positive whānau relationships
• spiritual and cultural connections
• having their developmental needs met and supported – education, behaviour, life skills and self-care skills
• emotional resilience and support
• social and peer groups that are supportive, caring and positive
• physical and mental wellness
• security – being safe from harm, living in a safe community, having a warm dry home, having enough food. 

Safety concerns include:

• physical, emotional, sexual abuse, deprivation, neglect, and ill-treatment
• situations where parents or caregivers aren’t willing or able to care for the child, where a child is subject to family harm (including where they are exposed to it)
• and where the development of a child or their physical, mental or emotional wellbeing is likely to be impaired or neglected in a way that is avoidable.

You can  share information that you believe is relevant to help achieve one or more of the purposes set out in section 66C. Deciding what information is relevant will often be a judgement call and depend on the circumstances of each situation. 

Things to consider when deciding whether information is relevant include:

• your knowledge of the child or young person and their circumstances including information about:
  • the child or young person themselves
  • their home environment
  • their needs, aspirations, strengths
  • challenges they are experiencing (financial pressures, housing, family harm, health, access to education and learning difficulties)
  • support they have or are receiving – what worked well, what didn’t work well and why
  • information about other people they have a relationship with such as their parents, wider family and whānau, teachers, doctors, sports coaches.
• the person making the request, the purpose for which they are requesting the information and what they will be able to do with the information to support the child or young person
• the age of the information – older information may be out of date and therefore less relevant to the current circumstances or needs of the child or young person.
• the context of the information – could the information be misinterpreted by the recipient without additional context?

There aren’t any limits on who the information can be about. You can share information about a child or young person, their family or other people they have a relationship with if you believe it is relevant to protecting their wellbeing or keeping them safe.

You do not need to obtain the consent of the child or young person (or their parents or legal guardian where appropriate) to share their information under section 66C.

Section 66K of the Oranga Tamariki Act requires you to consult with the child or young person either before, or as soon as possible after, you share their information where it is practicable or appropriate to do so. Where a child or young person is very young or may not be able to understand why you want to share their information, you should consult with their parents or legal guardian if it is appropriate and safe to do so.

This ensures that the child or young person is aware that their information is being shared, with whom, and what that person is going to do with their information. It also gives them the ability to share any concerns they may have about their information being shared. 

You are required to consider their views before you share their information. While you can still share information if they strongly disagree, if their concerns relate to their wellbeing or safety, you should consider whether sharing the information with the requestor is in the child or young person’s best interests at that time. You may need to advise the requestor of the wellbeing or safety concerns the child or young person has raised to ensure the sharing of the information doesn’t place the child or young person at risk of further harm. 

Examples of when it may not be practicable or appropriate to consult with a child or young person include:

• they are not developmentally able to understand (remember even young children can understand sharing information if you talk to them in an age-appropriate way)
• it might put them or someone else at risk of harm
• it might distress or upset them, or have a negative impact on their wellbeing
• it could get in the way of a Police investigation or prosecution
• you need to share information quickly because tamariki might be harmed otherwise
• after making reasonable efforts you, or another professional, can’t get in touch with them, and you still think sharing is important to protect tamariki from harm.

You should always record the reasons why you decided not to consult with the child or young person. 

When sharing information about multiple children or young people (e.g. sharing datasets or sharing information at multi-agency meetings), you are still required to consult with each individual child or young person prior to sharing their information where it is practicable or appropriate to do so. 

Just like when sharing information about a single child or young person, whether it is impracticable or inappropriate to consult should be considered when you are developing the dataset or setting up your multi-agency meeting. For multi-agency meetings, each meeting participant will need to determine whether it is impracticable or inappropriate to consult with the child or young person.

You should always record the reasons why you decided not to consult with the child or young person when sharing datasets or sharing their information at multi-agency meetings. 

Sharing information under section 66C requires you to make a judgement call. Every circumstance will be different – in some cases you might decide to share, in others you might not. When you are under pressure, and a child or young person may be at risk, making these judgement calls can feel overwhelming. 

The Oranga Tamariki Act provides protection from civil, criminal and disciplinary proceedings when you share information under section 66C unless you have shared in bad faith. Bad faith includes sharing information when you know you shouldn’t. 

Acting in good faith means you have:

• made your best effort to share in line with the relevant statutory provisions  
• checked that the information you intend to share is relevant, accurate, up to date complete and not misleading
• undertaken measures to ensure the information is shared safely with the right person in the right role
• consulted with the child or young person (or their parents/legal guardian/caregiver) if it is safe and appropriate to do so.

Obligations of confidence protect information deemed to be confidential from unauthorised access and disclosure. However, obligations of confidence are subject to exceptions which include situations where a child or young person’s wellbeing or safety is at risk.

You can consider sharing confidential information when sharing information under section 66C. However, you will need to ensure that:

• you are sharing for a purpose set out in section 66C
• the confidential information is relevant to that purpose
• you have consulted with the child or young person before you share their information.

Your professional code of ethics, industry code of conduct or employment agreement will set out what information is considered confidential, under what circumstances that information may be shared and what you need to advise the child or young person when you are collecting their information.

If you determine that the requirements of section 66C have not been met, you can consider whether one of the following applies in the circumstances:

It is good practice to keep good records of your information sharing activities. 

At a minimum you should record:

• the request you received and from whom (including receipt and response date)
• any additional information you requested from the requestor
• your decision whether, or not, to share the information requested
• the specified purpose for which you shared the information
• whether you consulted with the child or young person, any views they shared with you, or the reasons why you didn’t consult them
• the information that you shared.

An easy way to do this is to create an Information Sharing Register. This can be as simple as an excel spreadsheet. Registers will contain personal information, and in some cases sensitive information. It is important to keep your Register secure and limit access to only those that need to have access.

The following examples work through the application of section 66C of the Oranga Tamariki Act.

An ECE service manager receives an email request from a social worker working for a Non-Government Organisation (NGO) that provides support services to families in need. The social worker states that the request is being made under section 66C of the Oranga Tamariki Act. 

The social worker is requesting information about a 3-year-old who is enrolled at the ECE service. The information requested includes parent contact details, attendance records, and any behaviour related incident reports over the last 12 months. The social worker advises that the information is required to complete a needs assessment and identify appropriate supports for the child. 

Can the ECE service manager share the information with the social worker?

To use section 66C both parties must be a Child Welfare and Protection Agency (CWPA) or an Independent Person. The ECE service is a CWPA but should confirm with the social worker that either the NGO they work for is a CWPA or they are an Independent Person. 

Information can be shared if the information will be used for one of the purposes set out in section 66C. In this case, the social worker has stated the information will be used to complete a needs assessment for the child, which is a purpose under section 66C.

The ECE service manager should ensure that the information they share with the social worker is relevant to purpose of completing a needs assessment and is accurate and up to date.

The social worker has requested information covering the last 12 months. If there is older information that the manager believes is relevant to the needs assessment, they can share that information also.

If the manager is unsure whether the older information is relevant, they could contact the social worker and talk to them. 

The ECE service manager doesn’t need the consent of the child’s parents to share the information, but they must consult with the child (unless it is not practical or appropriate to do so). At 3 years old, the child is too young to understand the request and share their views. As such, the ECE service manager should consider consulting with the child’s parents if it is practical and appropriate to do so. 

While section 66C provides the legal authority to share the information, the ECE service manager must still comply with IPP 5 (security and storage) and IPP 8 (accuracy) when considering what and how to share the information requested. 

The ECE service manager should record the request, the date of the request, the information they shared with the social worker, and the views of the child’s parents if it was practical and appropriate to consult with them. 

A group of government agencies and local non-government organisations want to meet on a regular basis to discuss children and young people in their local area that are not attending school regularly. The purpose of the meeting is to identify appropriate supports for learners with complex needs and their family and whānau to reengage them with education. 

Can the meeting participants share information?

To use section 66C all meeting participants must be a Child Welfare and Protection Agency (CWPA) or an Independent Person (IP). The organiser of the multi-agency meeting should check that the intended meeting participants are from a Child Welfare and Protection Agency or an Independent Person before they are invited to the meeting. 

Information can be shared for one of the purposes set out in section 66C. In this case, the purpose of the meeting is to share information to enable the meeting participants to undertake an in-depth needs assessment to identify appropriate support and who is best placed to provide that support to the child and their family and whānau. Sharing for the purposes of undertaking a needs or risk assessment is one of the purposes of section 66C. 

Meeting participants do not need to obtain the consent of the child, young person or their parents but they must consult with the child or young person before they share their information with other CWPAs or IPs attending the meeting (unless it is not practical or appropriate to do so). 

In this case, the meeting participants could decide it is not practical to consult as they would need to dedicate significant resource to consulting with each child and young person (or their parent) which would be direct resources away from their primary function of providing services. Meeting participants consulting with each child prior to sharing relevant information they hold about the child would also likely result in children and young people being contacted by multiple different agencies. Instead, each agency should make sure their privacy policies are up to date and include an explanation that individuals’ personal information may be shared with relevant agencies for risk or needs assessments. Where multi-agency meetings are ongoing, a decision not to consult should also be regularly reviewed.

While section 66C provides the legal authority to share the information, the meeting participants must still comply with other relevant IPPs when considering what and how to share the information between agencies. For example, they must consider how to manage the information they have received, which will be subject to IPP 1 and 4 (lawful purpose for collection, necessity, method of collection), IPP 5 (security and storage), IPP 6 and 7 (access and correction rights), IPP 8 (accuracy), IPP 9 (how long they will retain the information) and IPP 13 (unique identifiers). 

For regular multi-agency meetings, we recommend creating an Information Sharing Protocol that sets out the purpose of the meetings, what information can be shared at the meeting, and how that information will be used by the meeting participants. The agreement can also set out the methods by which the information will be shared and how it will be kept safe and secure. This ensures personal information about children and young people is shared in a way that is privacy protective.

A General Practitioner (GP) is treating a six-year-old child with on-going respiratory concerns. The child and their family currently live in emergency housing. The GP is concerned that the child’s living conditions may be contributing to their health issues. 

Can the GP request housing information from a social housing provider?

The GP is an Independent Person. The social housing services being provided to the young person is a regulated service (Schedule 1 of the Children’s Act) which means the social housing provider is child welfare and protection agency. Therefore, the GP and the social housing provider can share information under section 66C of the Oranga Tamariki Act.

Information can be shared between the GP and the social housing provider for one of the purposes set out in section 66C. In this case, the GP can request, and the social housing provider can consider sharing, relevant information to enable the GP to complete a risk or needs assessment – an assessment of what factors, including environmental factors, are contributing to the child’s on-going health issues. 

Before disclosing the information, the social housing provider contacts the child’s parent to seek their views on disclosure, as the child is too young to understand the request. The parent wants to get to the bottom of their child’s health issues and is happy for the information to be shared with the GP. 

A young person has been receiving support from a youth mentoring service. The young person was referred to the mentoring service after some low-level offending in the community. The young person meets with their mentor on a regular basis. Together they focus on developing positive relationships and setting education and career goals. 

A local constable has been involved with the young person and is aware they are receiving mentoring support. One day the constable sees the young person hanging around with a group of youth known to associate with a gang. The constable is concerned that this association may indicate the young person is returning to prior anti-social behaviours and may require additional supports.

Can the constable share information with the young person’s mentor?

Police is a child welfare and protection agency, and the mentoring service being provided to the young person is a regulated service (Schedule 1 of the Children’s Act). Therefore, both the constable and the mentor are child welfare and protection agencies and can share information under section 66C of the Oranga Tamariki Act.

Information can be shared between the constable and the mentor for one of the purposes set out in section 66C. In this case, if the constable reasonably believes that sharing the information with the young person’s mentor will assist the mentor to prevent or reduce the risk of harm to the young person or assist the mentor in undertaking or updating a needs or risk assessment, then they can share the information under section 66C.

The constable consults with the young person about sharing their information with the young person’s mentor, and the young person tells the constable that they do not want their information shared. The constable considers their views but ultimately decides it is in the young person’s best interests to inform the mentor to ensure they are being supported. They record this decision and disclose the information.  

While section 66C provides the legal authority to share the information, the constable must still comply with IPP 5 (security and storage) and IPP 8 (accuracy) when considering what and how to share the information with the young person’s mentor.  That mentor will also need to consider how to manage the information they have received, which will be subject to IPP 1 and 4 (lawful purpose for collection, necessity, method of collection), IPP 5 (security and storage), IPP 6 and 7 (access and correction rights), IPP 8 (accuracy), IPP 9 (retention) and IPP 13 (unique identifiers). 

Information Privacy Principle (IPP) 11 enables you to share personal information (either proactively or on request) with another agency or person in certain circumstances (exceptions).  

IPP 11 requires that an agency believes on reasonable grounds that one of the listed exceptions applies.

IPP 11 contains a number of exceptions. The exceptions that commonly apply within the children’s sector include:

• the purpose for sharing is one of the purposes, or directly related to one of the purposes, for which the information was obtained
• the child or young person (or their parent where appropriate) has authorised the sharing of their information
• the information being shared is being used in a way that does not identify the child or young person
• the information is required by law (e.g. section 66 of the Oranga Tamariki Act)
• sharing the information is necessary to prevent or lessen a serious threat to the child or young person’s life or health, or public health and safety more broadly
• sharing the information about the child or young person is necessary to uphold or enforce the law.

When deciding whether an IPP 11 exception applies, the following considerations are important:

• are there reasonable grounds to believe that the exception applies in the circumstances?
• is sharing of the information necessary to achieve the purpose of the exception?
• could harm result from sharing, or not sharing, the information?
• is the recipient the appropriate agency or person to share the information with?
• is the information being shared particularly sensitive in nature?
• is the information you are intending to share current and up to date?
• is sharing the information is in the best interests of the child or young person at this time?

To rely on an IPP 11 exception, you must:

• believe that the exception applies at the time you are sharing the information 
  and
• your belief must be reasonably held.

The means you need to consider whether the exception applies before you share the information, and you must have properly considered all the relevant information in the circumstances.

• Whether there is a reasonable basis will depend on:
  • what you know about the circumstances of the child or young person
  • what you have been told by the requestor about why the information is required
  • what the requestor can do with the information
  • what information is being requested about the child or young person. 

When you are sharing a child or young person’s information in response to a request, the requestor advising you that an exception applies is not sufficient for believing on reasonable grounds that an exception applies – you need to come to reasonable belief yourself.

If you do not have enough information to decide whether the IPP 11 exception applies you should ask the requestor for additional information. If there is some urgency to the request, it might be quicker to call the requestor and seek the additional information over the phone. 

The IPP 11 exceptions for upholding or enforcing the law and preventing or lessening a serious threat also require you to consider whether sharing of the information is necessary in those specific circumstances. 

Whether the sharing of the information is necessary is a relatively low threshold – is it needed or required in the circumstances, or required for a given situation? 

To help determine whether the sharing of information is necessary you should consider whether not sharing the information could, in the circumstances:

• increase the likelihood of the serious threat occurring (serious threat exception)
  or
• compromise an agency’s ability to uphold or enforce the law (maintenance of the law exception). 

Care should be taken when sharing intimate or particularly sensitive personal information about a child or young person. Sensitive information is information that has some real significance to the child or young person, is revealing, or generally relates to matters they might wish to keep private. 

However, there may be situations where the sharing of sensitive information is necessary – for example, when there is a serious threat to a child or young person’s life or health. The relative sensitivity of the information, and whether it is in the best interests of the child or young person, will be an important consideration when thinking about sharing sensitive information under an IPP 11 exception. 

In some cases, some of information being requested may include information of such a sensitive nature that it would be appropriate for that information to be requested using a production order or a search warrant. A production order or search warrant provides assurance that the sensitive information is relevant and necessary for the purposes for which it is being requested and shared. 

IPP 8 requires that you take reasonable steps to ensure information is accurate, up to date, complete, relevant, and not misleading before you share it with another agency or person. 

Sharing inaccurate, out of date, incomplete, irrelevant or misleading information can result in prejudicial information about the child or young person being used to make decisions about them. This can have significant short- and long-term impacts for them and potentially their family or whānau.

Make sure you take the time to review the information and actively assess whether it is accurate, up to date, complete, relevant and not misleading before you share it. 

One of the IPP 11 exceptions is the authorisation (consent) of the individual. This means that you can obtain the authorisation (consent) of the learner (or their parents where appropriate) to share their personal information for a secondary purpose.

When relying on another IPP 11 exception, you do not need the consent of the learner (or their parent where appropriate) to share their information.

If, after considering the circumstances of the request, you are not satisfied that there are reasonable grounds to share the information under one of the IPP 11 exceptions, you should decline the request. 

However, there may be another legal authority that permits you to share the information (e.g. section 66C of the Oranga Tamariki Act 1989 or section 20 of the Family Violence Act 2018). You should always consider whether these provisions apply in the circumstances, especially when the purpose for sharing the information is to keep a child or young person safe.

While an IPP 11 exception may permit you to share a child or young person’s personal information that doesn’t always mean you should. You can also decline the request to share information for other reasons, such as:

• sharing at this time may not be in the best interests of the child or young person (sharing the information may put them at risk of harm)
• you may have assured the child or young person (and/or their parents where appropriate) that you will keep their information confidential 
• you may be subject to other legal, ethical or professional standards that require you to maintain confidentiality. 

When you decide to decline a request, you should record your reasons. It is also helpful to explain to the requestor why you are declining the request. 

Obligations of confidence protect information deemed to be confidential from unauthorised access and disclosure. 

Obligations of confidentiality may restrict access to, and disclosure of, confidential information further than the exceptions set out in the Privacy Act 2020 (IPP 11). 

Common exceptions to confidentiality include:

• where there is a risk to a child or young person’s health or life
• where the information is required by law
• where the child or young person has authorised (consented) to the sharing.

Your professional code of ethics, industry code of conduct or employment agreement will set out what information is considered confidential, under what circumstances that information may be shared and what you need to advise the child or young person when you are collecting their information.

It is good practice to keep good records of your information sharing activities. 

At a minimum you should record:

• the request you received and from whom (including receipt and response date)
• any additional information you requested from the requestor
• your decision whether, or not, to share the information requested
• the IPP 11 exception you relied on to share the information, including the information you considered to form the reasonable belief that the exception applied in the circumstances
• the information that you shared.

An easy way to do this is to create an Information Sharing Register. This can be as simple as an excel spreadsheet. Registers will contain personal information, and in some cases sensitive information. It is important to keep your Register secure and limit access to only those that need to have access.

This section provides some examples of sharing a child or young person’s personal information for wellbeing and safety purposes using the following Privacy Act IPP 11 exceptions:

• Authorisation (consent).
• Serious threat.
• Maintenance of the law.

IPP 11 provides an exception where personal information held about a child or young person can be shared if the child or young person (or their parent where appropriate) provides authorisation.

For a child or young person (or their parent or legal guardian where appropriate) to provide authorisation to share their personal information you will need to ensure that they have sufficient information to make an informed decision. 

Obtaining authorisation can be done through:

• a consent form (where a child or young person or their parent where appropriate can explicitly authorise (consent to) the intended sharing) or
• an opt out form (where information about a child or young person will be shared for a specified purpose unless the child or young person (or their parents where appropriate) opts out). 

You should attach the collection privacy statement to the consent or opt out form. The privacy statement will provide the child or young person (or their parents where appropriate) with the information they need to make an informed decision to authorise the sharing of their information. You should also provide a link to your privacy policy in your consent or opt out form so that child or young person (or their parents where appropriate) can have confidence in how you collect, use, share and protect personal information more generally. 

Authorisation is not a ‘one and done’ thing. If it has been some time since the they have provided authorisation for their information to be shared you should check whether they are still comfortable with the information being shared for that purpose. Where authorisation has been provided, a child or young person (or their parent where appropriate) can withdraw that authorisation at any time. 

A child or young person (or their parent or legal guardian where appropriate) can withdraw authorisation they have previously provided for their information to be shared for specified purposes. 

When a previously provided authorisation is withdrawn, you must stop sharing their information for the purpose to which the authorisation applied. For example, due to a change in family circumstances, a child or young person (or their parent or legal guardian where appropriate) may withdraw authorisation for their information to be shared with a healthcare provider for the purpose of providing counselling services. 

To rely on the serious threat exception, you must be satisfied that a serious threat exists and believe on reasonable grounds that the information requested is necessary to prevent or lessen that threat. 

The exception provides for two types of threats:
•    to public health or safety
or
•    the life or health of a child or young person or another person

There are three factors that need to be considered when deciding whether a threat is serious:

• the likelihood of the threat occurring
• the severity of the consequences if the threat occurs
• the time at which the threat might occur

All three factors don’t need to be present to reach the threshold of serious threat. For example, if there is a high likelihood of the threat occurring and the severity of the consequences are significant (factors 1 and 2), but it is unclear when the threat may eventuate (factor 3), the serious threat threshold will likely be met. The test is what a reasonable person would consider to be serious in the circumstances.

A serious threat assessment will be situation specific and should consider all relevant circumstances, including those of the child or young person concerned. A serious threat can arise for one child or young person based on the relevant risk factors to them but may not meet the threshold in relation to a different child or young person. 

For example, a threat of harm to a child or young person may more readily meet the threshold of serious harm due to their age or ability to act independently and make their own decisions.

Once you have decided that a serious threat exists, you need to determine whether sharing the child or young person’s personal information is necessary to prevent or lessen that threat. You should ask yourself whether not sharing the information requested would increase the likelihood of the serious threat occurring – for example:

• is the information requested relevant or needed to address and lessen the serious threat?
• how will sharing the information do this?
• is the person receiving the information in a position to use the information to respond to and lessen the serious threat? 

For more information about using the Privacy Act to share information with Police or other law enforcement agencies see:

An outbreak of measles has been declared by Health NZ in a region of New Zealand. There are several children and young people who have contracted measles within the regions, all of whom were attending school or an early learning centre. 

The National Public Health Service (NPHS) is contacting all schools and ECE services within the region requesting the names, dates of birth and immunisation information of all learners currently enrolled. The NPHS has advised the schools and ECE services that the enrolment information will be used for the purposes of identifying the number of vaccinated and unvaccinated children and young people. This information will assist the NPHS determine the level of risk in the community and ensure prevention and containment resources are allocated effectively and in a timely manner. 

Can the schools or ECE services share the information with the NPHS?

Measles is a highly contagious disease that can cause harm to the health of children and young people. When an outbreak is declared by Health NZ it confirms that measles has been circulating in the community creating a serious threat to the health of individuals, particularly children and young people. Therefore, the threat is already occurring (factors 1 and 3), and the severity of the consequences are high (factor 2). In this case, a serious threat exists. 

When there is a declared outbreak, local health authorities need to take actions to prevent or lessen the spread of the disease. To do that, they need information about children in the affected area, including immunisation information. Obtaining names and dates of birth of children attending the schools and ECE services in the affected area will enable NPHS to match the information against the immunisation register. This information will help them determine the level of risk across the community and ensure appropriate containment and prevention measures are implemented. 

In this situation, the serious threat threshold has been met. There are reasonable grounds to believe that sharing the names and dates of birth of children in the affected area is necessary to help prevent or lessen the serious threat, and the NPHS (the requestor) is able to use the information to prevent or lessen that threat. 

The Police are trying to locate a year 10 child who has been reported missing by their family after failing to return home from school. The child has a history of mental health challenges and has been missing over 48 hours. They do not have their phone with them, so Police have been unable to obtain location data from the telecommunications provider. 

The child’s school has an online learning platform which enables learners to message each other and their teachers. The missing child also has a school email address which they use as their main email account. Police make a request to the missing child’s school principal for the learner’s messaging and email history over the last month. The Police advise the principal that the email and messaging history will help them to determine where the missing child might be.  The Police have made the request to the school relying on IPP 11(1)(f)(ii) – serious threat to an individual. 

Can the school principal release this information to the Police?

While the Police have advised the request is being made under the IPP 11(1)(f)(ii) of the Privacy Act, it is for the school principal to determine whether the information requested is necessary for that purpose – preventing or lessening a serious threat to the life or health of the missing child.

To rely on the serious threat exception, the school principal needs to have a reasonable belief that there is a serious threat to the missing child’s life or health and that the sharing of the information is necessary to prevent or lessen that threat. To do that the principal first needs to determine whether there is a serious threat by considering the likelihood of the threat occurring, the severity of the consequences if the threat occurs, and the time at which the threat might occur.

Given the missing child’s age, the mental health concerns and the length of time they have been missing, there are reasonable grounds to believe that there is a serious threat to their life or health if they cannot be located. 

Next, the school needs to determine whether sharing this missing child’s email and messaging information is necessary to prevent or lessen that threat. The emails and messages may provide information about why the child has not returned home, and where they may be. This information could help Police locate them. The request is also limited to emails and messages in the previous month – recent emails and messages are likely to be more relevant to locating the child. Not sharing the information could delay the Police locating the missing child which could lead to serious harm to their health and safety.

In this case, it would be reasonable for the school principal to rely on the serious threat exception to share the missing child’s emails and messaging from the past month with Police.

To rely on the maintenance of the law exception, you must believe on reasonable grounds that sharing information is necessary to avoid prejudice to the maintenance of the law including prevention, detection, investigation, prosecution and punishment of offences.

This exception supports the maintenance of criminal and regulatory enforcement processes. It does not give Police or other law enforcement agencies the right to access just any information. The exception applies to situations where not providing specific and relevant information would prejudice or be detrimental to maintaining the law.

In the early stages of an investigation into an offence, Police or a law enforcement agency may not have sufficient information to apply for a production order or a search warrant. This can make it difficult to progress a criminal or regulatory investigation. A request for information using the maintenance of the law exception may be the only practical means of obtaining the information necessary to effectively investigate the offending, particularly during the initial stages of an investigation. 

Police or a law enforcement agency requesting information must show a link between the offence(s) being investigated and the relevance of the information being requested – simply asserting that the information is needed for an investigation is not sufficient. Without this information, you will not be able determine that the maintenance of the law exception applies. 

To help decide whether sharing the information is necessary, you should ask yourself what the effect would be if the information requested by the Police or law enforcement agency was not provided – for example, would not sharing the information compromise the ability of the Police or law enforcement agency to do their job?

A mental health counsellor receives an email from Constable A from the local police station requesting the home address and parent contact details for a child they are providing services to. The email has come from Constable A’s police email address. Constable A advises that the information is being requested under IPP 11(1)(e)(i) of the Privacy Act (the law enforcement exception). 

Can the counsellor share the information requested with the Constable?

While Constable A has advised the request is being made under the IPP 11(1)(e)(i) of the Privacy Act, it is for the counsellor to determine whether the information requested is necessary for the purpose under IPP 11(1)(e)(i) – upholding or enforcing the law. 

In this case, Constable A has not provided sufficient information about the offence being investigated and the relevance of the information being requested to investigating that offence. Without this information, the counsellor cannot be satisfied that the information is necessary for upholding or enforcing the law. 

The counsellor should ask the Constable for more information to help them determine whether the law enforcement exception applies in the circumstances. For example, they could ask what offending is being investigated, and why the home address and contact details of the child’s parents are relevant and necessary for purposes of investigating that offence. 

Once the counsellor has received this information, they will then be able to determine whether not sharing the information requested would prevent the investigation into the offence(s) commencing or continuing. Police do have an information request form that includes all relevant information to support the request – if they haven’t provided the form, the counsellor could ask them to do so. 

If the Constable advises that Police are investigating on-going thefts of vehicles in the area by a group of youth, and up to date address and contact information for the child’s parents is necessary to enable Police to contact the parents as part of the investigation, it would be reasonable for the counsellor to rely on the law enforcement exception to share that information with the Constable. Not providing the information would impact Police being able to continue its investigation into the offending. 

Section 24 of the Family Violence Act requires that you actively consider sharing information about a victim or perpetrator of family violence to another FVA or SSP if you:

• believe on reasonable grounds that the sharing of information to that FVA or SSP will or may help ensure that a victim is protected from family violence
• receive a request from a FVA or SSP to share information for one or more of the purposes set out in section 20.

Section 20 of the Family Violence Act 2018 permits the sharing of personal information when the child or young person is or has been subject to family harm.

Under section 20 you can proactively share information, or you can share information in response to a request. 

Section 20 of the Family Violence Act 2018 permits the sharing of personal information between Family Violence Agencies (FVAs) and Social Sector Practitioners (SSPs). 

Family Violence Agencies (FVAs) are a group of organisations, and therefore their employees, or volunteers including:

Section 20 enables sharing information about a child who has been a victim of family violence where you reasonably believe that sharing the information will help the other FVA or SPP achieve one or more the following purposes:

• to help ensure that a victim is protected from family violence
• to make or contribute to a family violence risk or need assessment
• to make, or contribute to the making or carrying out of, a decision or plan relating or responding to family violence.

If you receive a section 20 request for information and the purpose of the request is unclear, you should clarify the request with the requestor. If you are unsure why the information is being requested, you won’t be able to determine whether one of the purposes set out in section 20 applies, or what information may be relevant to share with the requestor. 

You can share information that you believe is relevant to help achieve one or more of the purposes set out in section 20. Deciding what information is relevant will often be a judgment call and depend on the circumstances of each situation.

Things to consider when deciding whether information is relevant include:

• your knowledge of the child or young person and their circumstances
  • the person making the request, the purpose for which they are requesting the information and what they will be able to do with the information to support the child or young person
  • the age of the information – older information may be out of date and therefore less relevant to the current circumstances or needs of the child or young person
  • the context of the information – could the information be misinterpreted without additional context?

If you are unsure whether information you hold may be relevant, talk to the requestor or the person you want to share the information with. Together you may be able to identify what information is relevant in the circumstances. 

You do not need to obtain the consent of, or consult with, the child (or their parents, legal guardians or caregivers where appropriate) to share their information under section 20. 

You should, however, consider the best interests of the child – in some cases it may be in their best interests to let them know you are sharing their information, in other cases it could expose them to additional risk and harm. 

Talking with the child or young person (or the parents, legal guardians or caregivers where appropriate) can also help inform your decision about whether it is in their best interests to share their information in the circumstances. 

Sharing information under section 20 requires you to make a judgement call. Every circumstance will be different – in some cases you might decide to share, in others you might not. When you are under pressure, and a child or young person may be at risk, making these judgement calls can feel overwhelming. 

The Family Violence Act provides protection from civil, criminal and disciplinary proceedings when you share information under section 20 unless you have shared in bad faith. Bad faith includes when you don’t attempt to comply with the provision, or when you act carelessly or recklessly with information. 

Acting in good faith means you have:

• made your best effort to share in line with the relevant statutory provisions  
• checked that the information you intend to share is relevant, accurate, up to date complete and not misleading
• undertaken measures to ensure the information is shared safely with the right person in the right role.

Obligations of confidence protect information deemed to be confidential from unauthorised access and disclosure. However, obligations of confidence are subject to exceptions which include situations where a child or young person’s wellbeing or safety is at risk.

The Family Violence Act provides an exception to an obligation of confidence. The Act requires you to consider the principle that helping to ensure a victim is protected from family harm should usually take precedence over any applicable obligation to keep the information confidential.

However, you will need to ensure that:

• you are sharing for a purpose set out in section 20
• the confidential information is relevant to that purpose.

Your professional code of ethics, industry code of conduct or employment agreement will set out what information is considered confidential, under what circumstances that information may be shared and what you need to advise the child or young person when you are collecting their information.

If you determine that the requirements of section 20 have not been met, you can consider whether one of the following applies in the circumstances:

It is good practice to keep good records of your information sharing activities. 

At a minimum you should record:

• the request you received and from whom (including receipt and response date)
• any additional information you requested from the requestor
• your decision whether, or not, to share the information requested
• the specified purpose you shared the information
• the information that you shared.

An easy way to do this is to create an Information Sharing Register. This can be as simple as an excel spreadsheet. Registers will contain personal information, and in some cases sensitive information. It is important to keep your Register secure and limit access to only those that need to have access.

Section 20 authorises the sharing of personal information for specific purposes related to family violence. This means that you don’t need to rely on one of the exceptions to Information Privacy Principle (IPP) 11 to share the information with another FVA or SSP. 

However, you still need to comply with the other Information Privacy Principles (IPPs) in the Privacy Act. 

In practice, this means when you are sharing information under section 20 of the Family Violence Act, you must ensure you:

• share information in a safe and secure way and protect it from unauthorised access, use and disclosure (IPP 5)
• have taken reasonable steps to ensure the information is accurate, up to date, relevant, complete and not misleading information (IPP 8)
• are mindful about sharing unique identifiers (IPP 13).

When you are receiving information requested or provided under section 20 of the Family Violence Act, you must ensure you:

• are requesting the information necessary for a lawful purpose of your agency
• meet your notification requirements (IPP 3A after 1 May 2026)
• receive the information:
  • in a safe and secure way and protect it from unauthorised access, use and disclosure (IPP 5)
  • only retain the information for as long as it is necessary to do so (IPP 9).

Children and their representatives have the right to request access to and correction of their personal information under IPP 6 and 7. If you correct personal information or attach a statement of correction to personal information that is also information that you have shared under the Family Violence Act, you must, so far as is reasonably practicable, inform that FVA or SSP of the correction. 

The following examples work through the application of section 20 of the Family Violence Act.

Under the School Alerts programme schools can receive alerts about their learners who have been involved in a family harm episode in the last 24 hours. Names of the learners are provided to a participating school so they are aware of the incident, enabling them to identify and provide any additional supports learners may need while at school.

The legal authority for sharing the information with the participating school is section 20 of the Family Violence Act 2018. The information is proactively shared to a school for the purpose of helping to ensure that a victim is protected from or supported when they are experiencing family violence. Section 20 also provides the legal authority for the school principal to share the information with a learner’s teacher so that the teacher is aware and can contribute to the development of a support plan if one is required. 

If a school requires further information about the learner and the circumstances of the family harm incident, it can use section 20 to request additional information from a relevant FVA or an SSP. The school must, however, be requesting the additional information for one of the purposes in section 20.

A group of government agencies and local non-government organisations want to meet on a regular basis to discuss children and young people in their local area that have been subject to family harm. The purpose of the meeting is to identify and deliver appropriate interventions and supports for the children and young people and their family and whānau. 

Can the meeting participants share information?

To use section 20 all meeting participants must be a Family Violence Agency or a Social Services Practitioner. The organiser of the multi-agency meeting should check that the intended meeting participants are from a Family Violence Agency or a Social Services Practitioner before they are invited to the meeting.

Information can be shared for one of the purposes set out in section 20C. In this case, the purpose of the meeting is to share information to enable the meeting participants to undertake an in-depth needs assessment to identify appropriate interventions and supports and who is best placed to provide those to the child and their family and whānau.

Sharing for the purposes of undertaking a risk or need assessment, and making, or contributing to the making or carrying out of, a decision or plan relating or responding to family violence are two of the purposes of section 20. 

While section 20 provides the legal authority to share the information, the meeting participants must still comply with IPP 5 (security and storage) and IPP 8 (accuracy) requirements when considering what and how to share the information between agencies.  They will also need to consider how to manage any personal information they have received, which will be subject to IPP 1 and 4 (lawful purpose for collection, necessity, method of collection), IPP 5 (security and storage), IPP 6 and 7 (access and correction rights), IPP 8 (accuracy), IPP 9 (retention), and IPP 13 (unique identifiers). 

For regular multi-agency meetings, we recommend creating an Information Sharing Protocol that sets out the purpose of the meetings, what information can be shared at the meeting, and how that information will be used by the meeting participants. The agreement can also set out the methods by which the information will be shared and how it will be kept safe and secure. This ensures personal information about children and young people is shared in a way that is privacy protective.

A mental health counsellor has been working with a young child. Over the last few sessions, the counsellor has observed bruising on the child’s legs and arms and has noticed some behaviour changes indicating the child may be experiencing physical harm. The counsellor wants to share this information with Police.

Can the counsellor share that information? 

As the counsellor is a Social Services Practitioner, and the Police is a Family Violence Agency the counsellor is able to use section 20 of the Family Violence Act to share relevant information with the Police. In this case, the purpose for sharing the information is to ensure the young person is protected from family violence. 

Not all the information the counsellor holds about the young person will be relevant to the purpose of protecting them from family violence. The relevant information will be that which relates to the bruising and behaviours that have led to the counsellor suspecting family violence is occurring. 

The counsellor is likely to have a professional duty to ensure the confidentiality of any information the young person has shared with them during the counselling sessions. However, the guiding principle for sharing information under section 20 is that helping to ensure a victim is protected from family violence should usually take precedence of any duty to keep information confidential. This means that the counsellor can share relevant information with the Police, even if where a duty of confidence may exist.