Unit 10 of 12
Using and sharing information
Use and share information only for the purpose it was collected — with limited exceptions, and extra rules for sending it overseas.
Use it for the purpose you collected it
Generally, the school may only use personal information for the purpose it told people about when it was collected. There are limited exceptions — for example, where there is a genuine safety risk.
A familiar example
Recall Admissions from Unit 3. The school collects family contact details so it can communicate with families about their daughter's education and welfare. That stated purpose is the boundary for how those details may be used.
The stated purpose was "to contact families about their daughter's education and welfare." Is each use permitted?
The school emails families to tell them about a change to the term calendar and a new co-curricular option.
A uniform supplier the school uses asks for the family contact list so it can market directly to parents.
The exceptions
Information may sometimes be used or shared for another reason, including when:
- Someone's life or health is at serious risk.
- The information came from a genuinely public source.
- It is used in a form that cannot identify any individual.
Is the use permitted?
The health centre learns a batch of medication issued to several boarders may be faulty and they need to be seen urgently. Can it use the contact list to reach those families straight away?
Is the disclosure permitted?
An education researcher asks the school how many boarders it has, derived from the count of family records. Can the school share that number?
The same researcher then asks for the underlying list of boarders and their family details to build their own database. Can the school share that?
Sending information overseas
Under IPP 12, if the school sends personal information to someone overseas, it generally needs to be satisfied of one of the following before doing so:
- The overseas recipient is subject to privacy laws comparable to New Zealand's, OR
- The recipient has agreed to comparable safeguards (for example, by contract or a binding scheme), OR
- The individual is fully informed and authorises the disclosure anyway.