Privacy Policy for Massey Community Trust

INTRODUCTION

Massey Community Trust complies with the New Zealand Privacy Act 2020 when dealing with personal information and is committed to protecting the privacy of personal information that the organisation collects, holds, and administers.

Personal information is information that directly or indirectly identifies a person.

PURPOSE

This policy sets out how we will collect, use, disclose, and protect your personal information.

This policy does not limit or exclude any of your rights under the Act. If you wish to seek further information on the Privacy Act, see www.privacy.org.nz. 

DEFINITIONS

  • Client = Program participant

  • MCT = Massey Community Trust

RESPONSIBILITIES 

Our designated Privacy Officer is the Massey Community Trust Chairperson. 

The privacy officer is responsible for ensuring our policies align with the Privacy Act 2020 and is kept up to date with changes in privacy legislation, for advising on the need to review or revise this policy when the need arises and for training all staff on the Trusts Privacy policy and procedures.

POLICY

Massey Community Trust collects and manages a range of personal information for the purpose of providing clients with a service. The organisation is committed to protecting the privacy of the personal information it collects, holds, and administers.

MCT recognises the fundamental right of individuals to have their information protected and made accessible to them when requested. 

MCT is bound by laws that impose specific obligations when it comes to handling information. The organisation has adopted the following principles contained as minimum standards in relation to handling personal information.

MCT has a responsibility to inform all clients and staff of the responsibility and limitations of confidentiality. 

Massey Community Trust will in accordance with the Privacy Act 2020:

  • Collect only information that the organisation requires for its primary function.

  • Ensure that clients are informed as to why we collect the information and how we administer the information gathered.

  • Use and disclose personal information only for our primary functions, a directly related purpose, or another purpose with the person’s consent.

  • Store personal information securely, protecting it from unauthorised access.

  • Provide clients with access to their own information, and the right to seek its correction when requested.

 

COLLECTION OF PERSONAL INFORMATION

Massey Community Trust will in accordance with the Privacy Act 2020:

  • Only collect information that is necessary for the performance and primary function of our services.

  • Collect personal information only by lawful and fair means and not in an unreasonably intrusive way.

  • Notify clients about why we collect the information and how it is managed.

  • notify clients that this information is accessible to them.

  • Collect personal information from the person themselves wherever possible.

  • Collect personal information from a third party when you have authorised this, and/or be able to advise the person whom the information concerns, from whom their personal information has been collected.

  • Collect sensitive information only with the person’s consent or if required by law (sensitive information includes health information and information about religious beliefs, race, gender, and others).

  • MCT will also collect sensitive information about an individual if such collection is necessary to prevent or lessen a serious and imminent threat to the life or health of any individual.

  • If MCT collects information during the course of the activities of its services, the following conditions must be satisfied:

o   the information relates solely to the members of the organisation or to individuals who have regular contact with it in connection with its activities;

o    at or before the time of collecting the information, MCT informs the individual who the information concerns that it will not disclose the information without the individual’s consent; and

o   the collection must be necessary for the establishment, exercise, or defense of a legal or equitable claim.

  • MCT will collect health information about an individual if:

o   the information is necessary to provide a health service to the individual.

USE AND DISCLOSURE

Massey Community Trust will in accordance with the Privacy Act 2020:

  • Only use or disclose information for the primary purpose for which it was collected or a directly related secondary purpose. 

  • For other uses, MCT will obtain consent from the affected person.

  • In relation to a secondary purpose, use or disclose personal information only where:

o   a secondary purpose is related to the primary purpose and the individual would reasonably have expected us to use it for purposes; or

o   the person has consented; or

o   certain other legal reasons exist, or disclosure is required to prevent a serious and imminent threat to life, health, or safety. 

  • Provide all individuals access to their personal information except where it is a breach of someone else’s privacy, a threat to life or health or it is authorised by law to refuse and, if a person can establish that the personal information is not accurate, then MCT must take steps to correct it. MCT may allow a person to attach a statement to their information if MCT disagrees it is inaccurate.

  • Make no charge for making a request for personal information, correcting the information, or associating a statement regarding accuracy with the personal information.


If Massey Community Trust has sufficient reasons to believe that an unlawful activity has been, is being, or may be engaged in, and the disclosure of personal information becomes a necessary part of its investigation of the matter or in reporting its concerns to relevant persons or authorities, the organisation may make such disclosures. MCT may further disclose personal information if it is mandated by an enforcement body.

LIMIT TO CONFIDENTIALITY

Massey Community Trust has a responsibility to inform all clients about confidentiality, including all limits to confidentiality. 

Any information shared with MCT will stay within MCT, except where: 

  • Information provided indicates there is a risk to the safety of a client or others. 

  • If a client indicates that they are at-risk of harm, discloses that a third party is at-risk of harm, or that the client intends to cause harm, than MCT has a responsibility to keep everyone safe and may be required to inform relevant people in order to ensure safety (this could include whānau, emergency services, other relevant support services).

The Individual disclosing the information should be informed of the decisions to disclosure information at the time the concern is raised, wherever this is possible the individual should be involved in the process going forward 

  • The exception to this is where it is not safe for MCT to notify client of their concerns, or if the concern is identified after the initial conversation and MCT are unable to make contact with the client within an appropriate period of time. 

  • At that point, in order to ensure everyone's safety, information may be provided with relevant agencies or individuals who can be involved in mitigating harm.

MCT may also work with a range of community agencies to ensure our clients get the best support possible. However the client should always be in control of what information is shared and with who (with the only exceptions being those outlined above).

All clients should be informed of MCT privacy policy prior to accepting service, they should be provided with an explanation in person and opportunities to ask questions, they should also receive documents in writing which should be signed and saved on their file.

INTERNET

While we take reasonable steps to maintain secure internet connections, if the client provides us with personal information over the internet, the provision of that information is at your own risk.

STORAGE

Massey Community Trust will:

  • Implement and maintain steps to ensure that personal information is protected from misuse and loss, unauthorised access, interference, unauthorised modification, or disclosure.

  • Have systems which provide sufficient security.

  • Ensure that it is up-to-date, accurate, and complete.

Measures will include:

  • Lockable shelving for confidential documents

  • Virus software/firewalls/encrypted files/password protection

  • Regular reviewing of passwords and system access

  • Restricted access of private information to relevant people only

 

DESTRUCTION

Massey Community Trust will:

  • Destroy personal information once is not required to be kept for the purpose for which it was collected, including from decommissioned laptops and mobile phones.


OPENNESS

Massey Community Trust will:

  • Ensure parties are aware of MCT’s Privacy Policy and its purposes.  

  • Make this information freely available in relevant publications and on the organisation’s website.

  • On request, take reasonable steps to let the person know what sort of personal information it holds, for what purposes, and how it collects, holds, uses, and discloses that information.

 

ACCESS AND CORRECTION

Massey Community Trust will ensure individuals have a right to seek access to information held about them and to correct it if it is inaccurate, incomplete, misleading, or not up to date.

If the individual and MCT disagree about whether the information is accurate, complete and up to date, and the individual asks MCT to associate with the information a statement claiming that the information is not accurate, complete or up to date, the Trust will take reasonable steps to do so

MCT will provide to the individual its reasons for denial of access or a refusal to correct personal information.

MCT can withhold access to an individual’s information if: 

  • Providing access would pose a serious and imminent threat to the life or health of any individual.

  • Providing access would breach the privacy of others.

  • The request for access is trivial or vexatious.

  • It isn't readily retrievable or you don’t have it.

  • Releasing it could negatively affect the requestor’s mental health.

  • It was provided in confidence.

  • Disclosure of the information would be likely to prejudice the maintenance of the law.

  • The disclosure of the information would breach legal professional privilege.

This is not an exhaustive list of reasons that MCT can withhold access to information, for a comprehensive list of permitted reasons to refuse access to personal information, See sections 49 – 53 of the Privacy Act 2020.

 

If MCT decides not to provide the individual with access to the information based on lawful reasons, MCT will consider whether the use of mutually agreed intermediaries would allow sufficient access to meet the needs of both parties.

 

IDENTIFIERS

  • MCT will not adopt its own unique identifier of an individual or an identifier that any third party has assigned. 

  • It may however use a person’s unique identifier so that they can communicate with another organisation about the individual.

  • MCT will not use or disclose the identifier assigned to an individual by a third party unless:

    • the use or disclosure is necessary for the organisation to fulfill its obligations to the agency, or

    • the use or disclosure is by a prescribed and verified organisation.

MAKING INFORMATION AVAILABLE TO OTHER ORGANISATIONS

Massey Community Trust can:

  • Release information to third parties where it is requested (and granted in writing) by the person to whom said information pertains.

 

RELATED INFORMATION

https://www.privacy.org.nz/privacy-act-2020/privacy-principles/

https://www.legislation.govt.nz/act/public/2020/0031/latest/whole.html#LMS23392

www.privacy.org.nz.