sharing information
how to protect information about young people enrolled in youth service
It's important that you understand your responsibilities when collecting, using, storing, sharing and protecting this information. Doing so helps protect young people, your organisation and MSD.
sharing information about a young person
You must follow this guidance whenever you collect, use, receive or share information about a young person.
You may only collect, use or share information where this is necessary to deliver Youth Service, support the young person, or meet another lawful purpose.
Schedule 6, clause 17 of the Social Security Act 2018 explains the purpose of clause 18. Clause 18 allows local agencies to disclose relevant personal information about a young person to MSD or a contracted service provider where the agency considers the information relevant to carrying out duties, functions or powers under the Act.
Examples of local agencies include schools, primary health organisations and New Zealand Police. These examples aren’t a complete list.
Schedule 6, clause 17 and 18 | Social Security Act 2018 | New Zealand Legislation
You may also share information with another organisation where the young person has given informed consent or another lawful basis for sharing the information applies.
Information provided by MSD must only be used for delivering Youth Service and for the purpose it was provided. Any other use or disclosure may breach your agreement with MSD and your obligations under the Privacy Act 2020. You are responsible for making sure the information is handled appropriately.
Some young people may be referred to you while they’re in the care of Oranga Tamariki or involved with Youth Justice. You must follow the processes on the Oranga Tamariki Transition Service and Youth Service page.
youth service referrals
MSD will send you information about young people applying for Youth Payment, Young Parent Payment or the NEET Service. You are responsible for contacting and providing these young people with the relevant services.
MSD will send this information through ART or other secure methods. Once you receive it, you must ensure it is used, stored, shared, and disposed of properly.
neet referrals
You will need written consent to enrol young people in the NEET service. The information MSD provides can only be used to contact the young person and invite them to enrol. You must not use the information for any other purpose.
You can choose how to contact the young person and invite them to participate in the service. When contacting them, you should only have detailed discussions with the young person themselves. For example, if you first reach a relative, you can introduce yourself and your organisation but cannot share any information about the young person.
Once you’ve contacted the young person, you must get their consent to involve them in the service. To do this, use the NEET enrolment form.
NEET Consent Form | Youth Service providers
You are responsible for ensuring the young person gives informed consent, meaning they understand what signing the enrolment form involves. Ensure they know that their personal information might be shared with MSD or other organisations (like health providers or the New Zealand Police) and that they can leave the service anytime.
You also need to let them know they can complain to the Privacy Commissioner if they are worried about their personal information being used or protected.
If the young person decides not to enrol in the NEET service, you must stop contacting them and only keep the information necessary to comply with the Public Records Act 2005. You must also inform MSD as soon as possible if the young person declines to enrol in the NEET service.
Public Records Act 2005 | New Zealand Legislation
If the young person agrees to participate in the Youth Service, you must scan a copy of the enrolment form into ART.
referrals of young people who receive payments
Young people receiving Youth Payment, Young Parent Payment and young partners must participate in Youth Service to meet their youth activity obligations so that they can continue to receive payments. The young person does not need to complete the NEET enrolment form.
If a young person refuses to engage with you, you must inform them that they may not be eligible to receive their benefit payments. You will then notify MSD via ART.
collecting information
Once a young person is fully enrolled in the NEET service (including the enrolment form being uploaded to ART), you can request additional information from YSSU. For young people receiving Youth Payment or Young Parent Payment, you will receive additional information when you first get their details.
Once the young person is in your service, you will collect information directly from them.
If a young person has been or is currently involved with Oranga Tamariki, and you decide to contact Oranga Tamariki to discuss their past or current situation, you should follow the process outlined on the Oranga Tamariki Transition Service & Youth Service page.
oranga tamariki & youth service | Youth Service providers
Collecting additional information about a young person helps you tailor the service to meet their specific needs and circumstances. You may only request information relevant to those purposes, and you must inform the young person about why you are collecting it.
request for information from another agency
You must contact MSD to get authorisation before disclosing any information to other agencies, organisations or individuals.
requesting information from another agency
When another agency holds information relevant to the support you are providing to a young person, your first step should be to ask the young person for the information.
You may seek information from another agency where:
- the young person refuses to provide information that is relevant to the support being provided
- you have concerns about the accuracy of the information provided
- the young person does not know the information.
If the agency refuses to provide the information requested, you can refer the matter to MSD so it can consider whether it is appropriate to seek the information using its own information-gathering powers.
information gathering, disclosure, and matching under the social security act
Schedule 6, Clauses 17 and 18 of the Social Security Act 2018 allow local agencies to disclose relevant personal information about a young person to MSD or a contracted service provider where the agency considers the information relevant to the administration of the Act.When requesting information, you should:
- clearly explain what information you are seeking
- explain why the information is relevant to the support being provided to the young person
- explain how the information will be used and protected
- ensure the information requested relates only to the young person and the services being provided.
The information requested must:
- be relevant to the support you are providing to the young person
- relate specifically to the young person.
Schedule 6, Clause 18 authorises disclosure in appropriate circumstances but does not require an agency to share information. The decision to disclose information remains with the agency holding the information.
If an agency is uncertain about whether it can disclose information, you may refer them to MSD for further advice.
information from an agency not listed under clause 18
You can still request information from agencies that are not acting under Schedule 6, Clauses 17 and 18 of the Social Security Act 2018.
In these situations, the agency will generally need to rely on another lawful basis for disclosure, which may include the young person's consent or another applicable provision of the Privacy Act 2020.
requesting information about a family member or associate
Where information relates to a family member or associate rather than the young person, you should obtain the consent of the family member or associate before requesting the information, unless another lawful basis for collecting or sharing the information applies.
privacy and it security breach
Privacy breaches involve unauthorised or accidental access, disclosure, alteration, loss, or destruction of personal information. An example is sending an email containing a young person's information to the wrong person.
An IT security breach is an event that may indicate that networks, systems, or data have been compromised or that protection measures have failed. Examples include losing or having a laptop stolen, or a phishing attack on the network.
It doesn’t matter if a Youth Service provider, MSD, a young person, or someone else caused the breach. Any privacy or IT security breaches must be reported to MSD immediately and managed appropriately. Acting quickly will prevent or lessen the chances of harm to people and help find ways to prevent mistakes in the future.
If you think a breach has occurred, you must gather as much information as possible and notify MSD immediately.