Secondary legislation
Made under section 49 of the Oversight of Oranga Tamariki System Act 2022
Secondary legislation
- The role of the Independent Monitor of the oranga tamariki system (the Monitor) is to oversee the oranga tamariki system, defined as the system that is responsible for providing services or support to children, young people, and their families and under, or in connection with, the Oranga Tamariki Act 1989 including national care standards regulations, and other regulations and standards made under that Act by the chief executive of Oranga Tamariki and approved providers.
- The Monitor is the board of the Independent Monitor of the oranga tamariki system. That agency is an independent Crown entity.
- Section 49 of the Act requires the Monitor to make rules relating to the Monitor’s collection, use, and disclosure of information. The purpose of such rules is to protect the privacy of people’s Personal Information and the confidentiality of other information. The rules need to support the Monitor’s monitoring function and protect the privacy of children, young people, and their families and whānau.
- These Information Rules are the rules required by the Act. They apply to both Personal Information and Non-Personal Information (each as defined in rule 1 below). This reflects the approach to the information provisions in the Act. The Rules distinguish between Personal Information and Non-Personal Information where it’s necessary or desirable to do so.
- When making these Information Rules, the Monitor consulted a range of people and organisations, as required by section 49(4) of the Act. The Data Protection and Use Policy and the Algorithm Charter for New Zealand were also taken into account.
1.1 Defined terms
The following terms have the following meanings:
- Act
- means the Oversight of Oranga Tamariki System Act 2022;
- Agency
- in the oranga tamariki system means an agency that delivers services or support to children, young persons, and their family and through the oranga tamariki system;
- Algorithm Charter
- for New Zealand means the charter by that name available at https://data.govt.nz/ or successor URL, or any replacement of that charter;
- Code of Ethics
- means the code of ethics that section 21 of the Act requires the Monitor to have;
- Data Protection and Use Policy
- means the policy by that name available at https://www.digital.govt.nz/ or successor URL, or any replacement of that policy;
- Information Rules
- means these information rules;
- IPP
- means an information privacy principle in the Privacy Act 2020;
- Legal Professional Privilege
- means the protection that applies to confidential communications between a lawyer and a client, taking the form of either:
- solicitor/client privilege, which applies to communications between a lawyer and a client, where the lawyer is acting in their professional capacity, the communication is intended to be confidential, and the communication is for the purpose of obtaining legal advice; or
- litigation privilege, which applies to communications or information compiled for the dominant purpose of preparing for a proceeding or an apprehended proceeding;
- Monitor
- means the Independent Monitor of the oranga tamariki system which is the independent Crown entity named in Schedule 1 of the Crown Entities Act 2004 that supports the Monitor in the performance or exercise of their functions, duties, and powers under the Act;
- means the Oranga Tamariki (National Care Standards and Related Matters) Regulations 2018;
- Non-Personal Information
- means any information that is not Personal Information;
- Personal Information
- has the same meaning as in section 7(1) of the Privacy Act 2020;
- Privacy Act
- means the Privacy Act 2020;
- Public Record
- has the meaning in section 4 of the Public Records Act 2005;
- Staff
- includes employees, officers, and contractors;
- Third Party Source
- has the meaning in rule 2.8;
- Whānau
- means a member of a child or young person’s whānau, , , or family group with a whakapapa connection.
1.2 Interpretation
- In these Information Rules, unless the context indicates otherwise:
- references to “agency” are references to any agency as defined in section 8(1) of the Act, that is, any person or body of persons, whether corporate or unincorporate, and whether in the public sector or the private sector, including an individual delivering services or support to children and young people through the oranga tamariki system independently of any other agency (but excluding the entities listed in section 8(1)(d));
- references to “individual” refer to a natural person, other than a deceased natural person;
- references to the “Monitor” include Staff of the Independent Monitoring Agency when acting on behalf of the Monitor or performing functions or duties of the Monitor;
- references to “rules” are to rules in these Information Rules;
- references to sections are to sections of the Act;
- references to the relationship between certain provisions of the Act and certain IPPs in the Privacy Act are intended to declare the existing position under the Act; and
- terms defined in the Act have the same meaning when used in these Information Rules.
- If there is any inconsistency between the Act and these rules, the Act will prevail to the extent of the inconsistency.
2.1 Purpose
The Monitor may only collect information (whether Non-Personal Information or Personal Information) in accordance with section 44 of the Act, that is to say, to:
- enable the Monitor to fulfil their objectives and (as applicable) perform or exercise their functions, duties, or powers; or
- as otherwise provided under the Act.
2.2 Personal Information – identifiers
- Where the Monitor does not need to collect an individual’s Identifying Information for the purposes described in rule 2.1, the Monitor must not seek to require or otherwise collect the individual’s Identifying Information. In this rule, 2.2(a), Identifying Information means personal identifiers, such as name and residential address, from which a person can be or is likely to be able to be identified.
- Rule 2.2(a) does not limit the Monitor’s ability to collect and record unique identifiers or other alpha-numeric identifiers that a Third Party Source has assigned to or associated with individuals to whom the Personal Information that the Monitor is collecting relates.
2.3 Personal Information – additional considerations
Without limiting rule 2.2, when the Monitor is considering the purposes for collecting Personal Information and how much Personal Information to collect, the Monitor must take reasonable steps in the circumstances (if any) to consider:
- the outcomes to which the collection of the Personal Information is intended to contribute;
- how the Monitor will use or process the information;
- the sensitivity of the Personal Information that will be collected; and
- where the collection will be from a Third Party Source that collected the Personal Information from the individuals concerned, the potential impact (if any) on the trust relationships between the Third Party Source and those individuals, taking into account the likely purposes for which the Personal Information was originally collected.
2.4 Source of information
- The Monitor may elect to collect Personal Information or Non-Personal Information from:
- individuals to whom the information relates, as long as it complies with rules 2.5 (if applicable) and 2.9;
- the Agencies in the Oranga Tamariki System, as long as it complies with rules 2.8–2.9;
- an Ombudsman, as long as it complies with rule 2.7; or
- another Third Party Source, as long as it complies with rules 2.8–2.9.
- To avoid doubt, rule 2.4(a) does not restrict the Monitor’s ability to:
- undertake research;
- receive unsolicited information; or
- obtain by lawful means information from any other source not referred to in rule 2.4(a).
2.5 Collection of information from children and young people
- The Monitor may only collect information from a child or young person (whether Personal Information or Non-Personal Information) in accordance with section 46 of the Act, that is to say, if:
- the Monitor obtains informed consent from the child or young person; or
- if the child or young person does not have capacity to consent, the Monitor has obtained informed consent from the child or young person’s caregiver; and
- the Monitor complies with the Code of Ethics.
- If the child or young person or (if applicable) their caregiver withdraws consent, the Monitor must cease collecting any information from the child or young person or (if applicable) their caregiver, and where practicable will dispose of any information already collected from the child or young person or (if applicable) their caregiver.
- Nothing in this rule 2.5 or the Code of Ethics limits the Monitor’s obligation to comply with the Privacy Act’s IPP3 (Collection of information from subject).
2.6 Collection of Personal Information from Agencies in the oranga tamariki system
- If the Monitor collects Personal Information from an Agency in the oranga tamariki system:
- in reliance on the Monitor’s power in section 45 of the Act to require information, the Monitor does not need to comply with the Privacy Act’s IPP2 and, to the extent there is any inconsistency between IPP1(1) and sections 44–45, sections 44–45 prevail;
- not in reliance on section 45 (such that the Agency in the oranga tamariki system’s provision of information is voluntary), the Monitor does need to comply with the Privacy Act’s IPP2 and, to the extent there is any inconsistency between IPP1(1) and section 44, section 44 prevails.
- In either case, the Monitor will inform the Agency in the oranga tamariki system of the matters listed in rule 2.8(c)(i)–(v).
2.7 Collection of information from Ombudsman
- The Monitor may collect information (Personal Information and Non-Personal Information) from an Ombudsman in accordance with section 51 of the Act, that is to say, if the Ombudsman believes:
- the sharing of the information would minimise the burden on individuals or agencies; and/or
- the sharing of the information would assist the Monitor or an Ombudsman in the performance or exercise of their functions, duties, or powers.
- The Ombudsman is not required to provide information to the Monitor.
2.8 Collection of Personal Information and Non-Personal Information from other Third Party Sources
- This rule applies if the Monitor wishes to collect Personal Information or Non-Personal Information from any:
- individual (other than the individual to whom the information relates); or
- agency or organisation not referred to in rules 2.5–2.7 (each a Third Party Source).
- In relation to the collection of Personal Information from a Third Party Source:
- the Monitor must comply with IPP2; and
- to the extent there is any inconsistency between IPP1(1) and section 44, section 44 prevails.
- If collection from the Third Party Source is permissible, the Monitor must inform the Third Party Source in writing of:
- the purpose or purposes for which the Monitor wishes to collect the information;
- the date by which, and the manner by which:
- the information needs to be provided (if the Monitor is relying on its requisition power in section 45); or
- the Monitor would like the information to be provided (if the Monitor is not relying on section 45);
- whether the Third Party Source’s provision of the information is mandatory (under section 45, if applicable) or voluntary;
- if provision of the information is mandatory, the consequences of not providing the information; and
- who, other than the Monitor (if anyone), is likely to receive the information (to the extent the Monitor is able to determine this at the time of collection).
2.9 Methods of collection
- The method(s) by which the Monitor collects information must:
- in relation to Personal Information, comply with the Privacy Act’s IPP4 (Manner of collection of Personal Information); and
- be in accordance with the Monitor’s Code of Ethics.
- Without limiting rule 2.9(a), the Monitor may collect information by or through:
- written or oral requests for information to be provided orally or in writing or other documentary form (including by electronic means);
- discussions between the Monitor and agencies or organisations (such as Agencies in the oranga tamariki system);
- the Monitor making visits to sites controlled by an Agency in the oranga tamariki system or its contracted partners or subcontractors; and
- any other lawful means.
- When deciding upon a method of collection of information, the Monitor must, to the extent relevant:
- take reasonable steps to ensure that the collection will be effected by secure means; and
- consider the sensitivity of the information to be collected.
2.10 Provision of information to Monitor following request
- Where the Monitor requires information from an Agency in the oranga tamariki system under section 45 of the Act, section 45 obliges the Agency to comply with the requirement, except as stated otherwise in the section. Under section 45(4), information that is subject to Legal Professional Privilege does not need to be provided.
- Where the Monitor requests information from an individual, agency or organisation and the request is not made under or in reliance on:
- section 45; or
- another statutory power that authorises the compulsory collection of information (if any),
- If the Monitor requests information from an Agency in the oranga tamariki system that the Agency considers to be particularly sensitive, the Agency may, and is encouraged, to inform the Monitor of that sensitivity and, if not already apparent, the reasons for it.
3.1 Security
The Monitor must take reasonable steps to safeguard the information it collects, accesses, generates and is provided, from unauthorised access or use. These measures must include periodic assurance activity such as the maintenance and checking of access logs.
3.2 Storage and access
- Without limiting rule 3.1, the Monitor will store the information it collects or is provided in secured systems that are accessible only by:
- authorised Staff of the Monitor who require access to carry out their functions on behalf of the Monitor; and
- one or more system/database administrators acting for or on behalf of the Monitor (who are subject to strict obligations of confidentiality).
- The Monitor must take reasonable steps to ensure that the information it collects and holds is not shared with or accessible by Staff of the Monitor who do not need to see it to perform their roles for the Monitor.
4.1 Purpose
The Monitor may only use the information it collects and holds in accordance with section 44 of the Act, that is to say, to:
- enable the Monitor to fulfil their objectives and (as applicable) perform or exercise their functions, duties, or powers; or
- as otherwise provided under the Act.
4.2 Use only by approved Staff
The Monitor must take reasonable steps to ensure that information it holds relating to children, young persons, their , their family, their caregivers or, where relevant, alleged perpetrators of abuse or neglect, is:
- used by authorised Staff only; and
- only in accordance with rule 4.1.
5.1 Monitor to take reasonable steps to check accuracy
The Monitor must not use information it holds without taking steps that are, in the circumstances, reasonable (if any) to ensure that the information is accurate, up to date, complete, relevant, and not misleading.
5.2 Assessing accuracy and completeness
In assessing the accuracy and completeness of information on which it relies, the Monitor may engage with persons and organisations, and take into account various information sources, provided that, in doing so, it complies with the Act, regulations under the Act, these Information Rules, and any other applicable law, including IPPs in the Privacy Act to the extent they apply.
5.3 Monitor to inform Agency of inaccuracy
If the Monitor discovers or considers that information it obtains from an Agency in the Oranga Tamariki System is inaccurate, out of date, incomplete or misleading, the Monitor will take reasonable steps to inform the Agency of the respects in which the information is inaccurate, out of date, incomplete or misleading.
5.4 No limitation to IPPs 7 and 8
To avoid doubt, nothing in this rule 5 limits IPP7 or IPP8 of the Privacy Act.
6.1 Limited sharing
- The Monitor may only share information it holds or obtains under or in connection with the performance of its functions, duties and powers under the Act, with other agencies and individuals, to the extent permitted by rule 6.2.
- To avoid doubt, nothing in these Information Rules prevents the Monitor from using appropriately secured information and communications technology and infrastructure provided by another public service agency or third party (to which, in any case, rule 3 (Security and storage of information) applies).
6.2 Permitted sharing
The Monitor may only share information that the Monitor has collected under the Act to the extent permitted by section 48 of the Act, that is to say, the Monitor:
- Ombudsman and Mokopuna – Children’s Commissioner: may share Personal Information or Non-Personal Information with the Ombudsman and the Mana Mokopuna – Children’s Commissioner, for the purpose of working together in a comprehensive, cohesive, and efficient way with each other;
- Arrangements with , and Māori organisations: may share information with hapū, iwi and Māori organisations, in accordance with arrangements made with them for the purposes of:
- providing opportunities to, and inviting proposals on how to, improve oversight of the oranga tamariki system; and
- sharing information under the Act,
- Ombudsman: may share information with an Ombudsman if the Monitor believes:
- the sharing of the information would minimise the burden on individuals or agencies; and/or
- the sharing of the information would assist the Monitor or an Ombudsman in the performance or exercise of their functions, duties, or powers;
- Referral: may share information with a person or body listed in section 56(5) for a referral to that person or body in accordance with section 56;
- Publicly available: may share information if the information is:
- available to the public under the Act; or
- publicly available and, in the case of any personal information, it would not be unfair or unreasonable to disclose the information;
- Publication of non-personal information for objectives: may disclose Non-Personal Information included in materials proposed to be published by the Monitor and the disclosure is for the purpose of any 1 or more of the Monitor’s objectives set out in section 13;
- Statistical or research purposes: may disclose Non-Personal Information if the Monitor believes on reasonable grounds that the disclosure is for statistical or research purposes and the information will not be used in a form that could reasonably be expected to identify any individual;
- Law: may disclose information if the disclosure is:
- made under the Act or its regulations, or is otherwise required by or under law; or
- permitted by section 33 of the Mana Mokopuna – Children’s Commissioner Act 2022 (Sharing of information with Monitor and Ombudsman); or
- made in accordance with section 15 of the Oranga Tamariki Act 1989 (which provides for reporting concerns to the chief executive of Oranga Tamariki or a constable);
- Consent: may disclose information if the disclosure is with the consent of the person to whom the information relates or to whom the information is confidential;
- Harm or serious threat: may disclose information if the Monitor believes on reasonable grounds that the disclosure is reasonably necessary:
- to protect a person from harm; or
- to prevent or lessen a serious threat (as defined in section 48(2)) to public health or safety or to the life or health of any person.
6.3 IPP11 does not apply
To avoid doubt, section 48 of the Act prevails over and applies to the exclusion of the Privacy Act’s IPP11. This means, in particular (and without limitation), that the Monitor may not, in reliance on IPP11(1)(h)(ii), allow researchers or analysts from other agencies or organisations to access Personal Information about or relating to:
- children or young persons; or
- their family, or caregiving family; or
- perpetrators or alleged perpetrators of abuse, neglect or other harm to children or young persons,
for statistical or research purposes, regardless of whether the information will not be published in a form that could reasonably be expected to identify the individuals concerned.
6.4 Secure sharing
Where the Monitor shares Personal Information or other classified or confidential information with another individual, agency or organisation, the Monitor must take all reasonable steps to ensure that it does so by reasonably secure means.
6.5 Sharing of information with hapū, iwi, and Māori organisations
- This rule 6.5 applies in relation to the Monitor’s obligation in section 19(1) of the Act to make reasonable efforts to develop arrangements with hapū, iwi, and Māori organisations for the purposes of:
- providing opportunities to, and inviting proposals on how to improve oversight of the oranga tamariki system; and
- sharing information under the Act.
- Without limitation to section 19(1), the Monitor will use reasonable efforts to engage with representative hapū, iwi, and Māori organisations to:
- better understand the context, from their perspective, in which information may be exchanged between the Monitor, and hapū, iwi, and Māori organisations, including any concerns they may have in relation to the protection of such information;
- identify opportunities for involving hapū, iwi, and Māori organisations in the collection and/or interpretation of information that may yield insights that are beneficial to their local communities; and
- ascertain the kinds of information they and the Monitor would find helpful.
- The Monitor will also use reasonable efforts to:
- make it clear during the engagement referred to in clause 6.5(b) that the Monitor will not be disclosing Personal Information to hapū, iwi, or Māori organisations;
- ensure that arrangements with hapū, iwi and Māori organisations contain a prohibition on the recipient endeavouring to re-identify individuals;
- consider what other protections the arrangements may need to contain and include such other protections as the Monitor considers appropriate;
- take all reasonable steps to ensure that the information it shares is fully de-identified, or confidentialised, with the aim of preventing particular individuals being identifiable from the information (either alone or in conjunction with other information); and
- keep in contact with the hapū, iwi, and Māori organisations with whom the Monitor is sharing information to verify that the sharing is of value to them and to identify any learnings from them that may be relevant to ongoing performance of the Monitor’s functions and the future sharing of information with them.
6.6 No publication of identifying information
Except as permitted by section 32 of the Act (Duty to protect individuals’ privacy in relation to reports), the Monitor must not publish any information that is reasonably capable of identifying an individual (either alone or in conjunction with other readily accessible information).
6.7 Minimising risk of self-identification
The Monitor must take reasonable steps:
- to minimise the risk of individuals identifying themselves from apparently fully de-identified information that is to be published in a report or other material; and
- if a significant risk remains, to obtain the individuals’ consent before including the information in the report or other material.
7.1 To the extent that the Monitor uses data analytics techniques to identify trends or metrics, or suggestions for reform or interventions, the Monitor will take reasonable steps to ensure that:
- the techniques are ethical; and
- the input data and the techniques being used are fit for purpose and will not produce biased or discriminatory results.
7.2 The Monitor will not implement any algorithm (other than for the purpose of de-identifying information) or predictive modelling in connection with the performance of its functions without:
- first consulting representative agencies and organisations with an interest in, or who could be affected by, the use of the algorithm or modelling; and
- complying with the Algorithm Charter for New Zealand.
- considering the Algorithm Impact Assessment process and applying the Algorithm Impact Assessment toolkit.
7.3 The consultees referred to in rule 7.2(a):
- must include the Office of the Privacy Commissioner, Te Puni Kōkiri, StatsNZ, Oranga Tamariki, Mokopuna – Children’s Commissioner, and the Centre for Data Ethics and Innovation; and
- may include such other individuals, agencies and organisations as the Monitor considers appropriate (including representatives of, for example, communities, cultural groups or children or young persons).
7.4 The Monitor may contract a third party agency or organisation (not acting as member of the Monitor’s Staff) to assist the Monitor with data analysis but only if the Monitor:
- has assessed the privacy and ethical issues associated with doing so;
- has taken reasonable steps to check that the third party agency or organisation has appropriate security controls in place to protect and limit access to any information the Monitor may provide to it;
- includes requirements in its contract with the third party agency or organisation relating to the existence and maintenance of such security controls;
- has consulted with the main provider(s) of the data that the Monitor proposes to have analysed;
- takes all reasonable steps to:
- minimise the amount of Personal Information (if any) that is to be provided to the third party agency or organisation; and
- protect the confidentiality of the information to be provided to the third party agency or organisation; and
- complies with all applicable law.
8.1 The Monitor:
- must retain the Public Records it creates or receives in accordance with the Public Records Act 2005;
- may dispose of such Public Records if authorised to do so by a disposal authority given under that Act; and
- when Public Records in the possession of the Monitor:
- contain Personal Information; and
- can be disposed of under such a disposal authority,
8.2 To the extent that the Monitor obtains Personal Information that does not comprise or form part of a Public Record, the Monitor must not keep that information for longer than is required for the purposes for which the information may lawfully be used.
8.3 To avoid doubt, if the Monitor needs to retain information for periodic audit purposes, it may do so but, where rule 8.1(c) or 8.2 applies, only for as long as it is required for those purposes.
This secondary legislation is made at Wellington on 20 October 2025
Dr Ang Jury [signed]
Board Chair
Aroturuki | Independent Children’s Monitor