Aislinn Molloy | Cooney Lees Morgan

Charities collect personal information every day. This can include details about donors, volunteers, funding applicants and the people they help. Especially when the information is sensitive, an organisation needs to ensure that its staff members and volunteers know how to appropriately handle the information they are entrusted with. 

The Privacy Act 2020 sets out the obligations of an organisation when it collects or holds personal information. A simple test is to consider how someone would react if they learnt your organisation had their personal information and how it was using this information. If you think they would be surprised, this may be a sign that your organisation is not complying with its obligations. 

Collect only what you need

Any information about a living person who can be identified counts as personal information. This includes details such as a name, address or phone number, as well as other information that could reveal who the person is.

Personal information should only be collected when an organisation needs it for a lawful purpose. For example, you may need contact details to provide support, donor details to issue receipts or vetting information for volunteers who work with vulnerable people. Information should not be collected just because it may be useful later.

Tell people what you are collecting

Where possible, collect information directly from the person. Tell them why you need it, who may receive it, whether they have to provide it, what may happen if they do not, and how they can ask to see or correct it.

If you get information from a third party, you need to take reasonable steps to tell the person it is about. You need to inform them on what you collected, why you collected it, who holds it, who may receive it, whether the law allows or requires the collection, and how the person can ask to see or correct it.

Use and share information carefully

Usually, you should only use personal information for the reason you collected it. If you collect information for purpose A, you should not then use the information for purpose B, unless you made this clear at the time or the law allows it.

Think carefully before sharing information with another organisation. Check that you are allowed to share it, that sharing is necessary and that you are not sharing more than needed. Where possible, remove identifying details or provide summary information instead. If you are ever in doubt, contact the person it relates to and get their consent. 

If you use cloud storage, donor platforms, email marketing tools or software based overseas, you need to take reasonable steps to make sure information sent overseas is protected in a similar way to information held in New Zealand.

Take extra care with sensitive information

Only give people access to sensitive information when they need it for a specific lawful purpose. Limit access to staff, trustees and volunteers who need the information for their role. Use secure systems, strong passwords, multi-factor authentication where practical, locked filing cabinets and clear rules for email and personal devices.

Take care with photos, personal stories and case studies. Removing a name may not protect a person if other details identify them. Before publishing, ask whether publication is necessary, whether you can remove identifying details, whether the person understands and agrees to publication, and whether it could create embarrassment, stigma, discrimination or safety risks.

Respect access and correction rights

People can usually ask whether you hold information about them, ask to see it and ask you to correct it. Have a simple process for handling these requests. If you want to refuse access, get legal advice before doing so.

Have a plan for privacy breaches

A privacy breach happens when personal information is lost, changed, destroyed, accessed or shared by mistake or without permission. Examples include emailing the wrong person, losing a device or paper file, a cyberattack, unauthorised access by a volunteer, or publishing identifying details without proper consent.

If a breach has caused, or is likely to cause, serious harm, tell the Privacy Commissioner and the affected people as soon as reasonably possible. Serious harm is more likely when the information is sensitive, the people affected are vulnerable, the information could be misused, or there is a risk of financial, physical, emotional, reputational or cultural harm.

If a privacy breach happens:

1. Contain it: recover the information, block access, reset passwords or remove published material.
2. Assess the risk: identify the information involved, who is affected and the possible harm.
3. Notify if required: contact the Privacy Commissioner and affected people.
4. Support affected people: explain what happened and what you have done.
5. Prevent a repeat: record the breach and fix its cause.

Good privacy practice is not just about following the law. It helps a charity keep the trust of donors, volunteers, and clients, and reduces risk for the charity and the people it helps.

This article gives general information, not legal advice. An organisation should seek advice about its own situation, especially if it handles sensitive information, works with children or vulnerable people, and/or has a serious privacy breach.