sharing information

sharing information about a young person

You must follow these guidelines when you share or receive information about a young person with MSD or another organisation.

You can only share information about a young person if it's necessary for Youth Service. You can share information with MSD or authorised agencies and organisations listed in the Social Security (Youth Support – Authorised Agencies) Order 2012 or other organisations with the young person's consent.

All information provided by MSD that is received and accessed by you must only be used for the purpose of delivering the Youth Service. Any other use or disclosure of information provided by MSD is a breach of the terms of your contract and potentially the Privacy Act. You are responsible for any violations made on your part.

Some young people may be referred to you while they are in the care of Oranga Tamariki or engaged with Youth Justice. These young people will be identified by a flag in ART. You must follow the processes outlined under the Oranga Tamariki Transition Service & Youth Service.

neet referrals

You will need written consent to enrol young people in the NEET service. The information MSD provides can only be used to contact the young person and invite them to enrol. You must not use the information for any other purpose.

You can choose how to contact the young person and invite them to participate in the service. When contacting them, you should only have detailed discussions with the young person themselves. For example, if you first reach a relative, you can introduce yourself and your organisation but cannot share any information about the young person.

Once you’ve contacted the young person, you must get their consent to involve them in the service. To do this, use the enrolment form.

You are responsible for ensuring the young person gives informed consent, meaning they understand what signing the enrolment form involves. Ensure they know that their personal information might be shared with MSD or other organisations (like health providers or the New Zealand Police) and that they can leave the service anytime.

You also need to let them know they can complain to the Privacy Commissioner if they are worried about their personal information being used or protected.

If the young person decides not to enrol in the NEET service, you must stop contacting them and only keep the information necessary to comply with the Public Records Act 2005. You must also inform MSD as soon as possible if the young person declines to enrol in NEET.

If the young person agrees to participate in the Youth Service, you must scan a copy of the enrolment form into ART.

collecting information

Once a young person is fully enrolled in the NEET service (including the enrolment form being uploaded to ART), you can request additional information from YSSU. For young people enrolled in the YP or YPP service, you will receive additional information when you first get their details.

Once the young person is in your service, you will collect information directly from them.

If a young person has been or is currently involved with Oranga Tamariki, and you decide to contact Oranga Tamariki to discuss their past or current situation, you should follow the process outlined in the Oranga Tamariki Transition Service & Youth Service.

Collecting additional information about a young person helps you tailor the service to meet their specific needs and circumstances.

You may only request information relevant to those purposes, and you must inform the young person about why you are collecting it.

requesting information from another agency

When a third-party agency or organisation holds information relevant to the services you're providing to a young person, your first step should always be to ask the young person for the information you need. However, if the young person refuses to provide relevant information, if you’re concerned the information isn’t accurate, or if they don’t know it, you can request the information from other agencies that might have it.

You can make these requests in two ways, depending on whether or not the agency is listed in the Order in Council.

In either case, if the agency refuses to share the information you’ve requested, you can refer the matter to MSD so they can consider whether it’s appropriate for them to request the information under their specific information collection powers.

sharing information from an agency not listed in the order in council

When the agency you request information from is not listed in the Order in Council, you can still ask for it. However, the agency has no additional authority to rely on when disclosing it. This means the disclosure must comply with the Privacy Act 2020, which will involve getting the young person's consent.

When sharing information, with the young person’s consent, it can be done electronically if it is done securely. This means the information is password-protected or sent using a system approved by MSD.

privacy and it security breach

Privacy breaches involve unauthorised or accidental access, disclosure, alteration, loss, or destruction of personal information. An example is sending an email containing a young person's information to the wrong person.

An IT security breach is an event that may indicate that networks, systems, or data have been compromised or that protection measures have failed. Examples include losing or having a laptop stolen or a phishing attack on the network.

It doesn’t matter if a Youth Service provider, MSD, a young person, or someone else caused the breach. Any privacy or IT security breaches must be reported to MSD immediately and managed appropriately. Acting quickly will prevent or lessen the chances of harm to people and help find ways to prevent mistakes in the future.

If you think a breach has occurred, you must gather as much information as possible and notify MSD immediately.