Source: Privacy Commissioner
The Privacy Act applies to any person, organisation, or business that collects and holds personal information about other people. This includes social clubs, charities, societies, and community groups regardless of the age of its members.
Personal information held by these clubs needs to be collected, stored, and used in a way that is lawful, even if you’re a voluntary organisation. Personal information includes names, addresses, phone numbers, email addresses, offices held, awards, skills, references, recordings and photographs – essentially any information that identifies people.
This information could be about members and former members, but also about employees, contractors, people working at stalls, and service providers who’ve helped with things like training or coaching, IT, marketing, administration, financial assistance, or maintenance and repairs.
It can be held in minutes of meetings, newsletters and correspondence, on membership databases, and websites. It includes information in hard copy or electronic form and if it’s collected by a person taking sign-ups for an event, a digital camera, or a biometric scanner.
People who have access to this personal information, including volunteers, will also need to be aware of their privacy responsibilities and need to comply with the law.
Your responsibilities
Like all agencies in New Zealand, clubs and societies should only collect the personal information about the club’s volunteers and members that is necessary. Tell people why their information is needed and get their permission to share the information where it needs to be shared. Keep it safe. Don’t give it out without permission. Don’t keep it longer than necessary.
You also need to appoint someone as your Privacy Officer, whose role it is to make sure the club complies with the Privacy Act. They can be a volunteer or member of your club.
Privacy rules
The Privacy Act has 13 Information Privacy Principles (IPPs) that govern how you should collect, handle, and use personal information. These include rules for collecting, holding, and using personal information. Our Privacy ABC Course is a great way to learn about these.
Collecting personal information
If you’re thinking about collecting personal information, the first thing you should consider is why you’re collecting it.
Only collect what you need. Generally, you should collect information directly from the person it’s about and tell them what you’re doing and why. The best way to do this is usually with a clear privacy statement. Our Privacy Statement Generator makes writing that easier.
Holding personal information
You must keep the personal information you hold safe and secure. You may need a locked cabinet for physical documents, or password protection for electronic files. Make sure only appropriate people can access the information and that you know who they are and that they’re current members of the club.
By law, you must give people access to the information you hold about them if they ask for it and take reasonable steps to correct their information if it’s wrong.
People have a right to access information about themselves. This includes material like:
- references to that person in minutes of a meeting
- correspondence that the person has had with the society
- decisions made about the person
- details of complaints made about the person
- material from their personal file, if they work for the society.
Using and disclosing personal information
Before you use personal information, check that it’s accurate, up-to-date, complete, relevant and not misleading.
The Privacy Act doesn’t specify how long you can keep personal information – only that agencies shouldn’t keep information for longer than they need it.
Only use information for the purpose you collected it. If you’ve told people what their information will be used for, and who it may be disclosed to, you will generally be able to use and disclose it in those ways without a problem. For example, if you collected a person’s email address to send out notices of meetings then you can’t give it to another club in town to recruit for members.
Be careful about who you disclose (share) information to, both within and outside your organisation. This usually means having the permission of the person involved.
You also need to dispose of personal information securely so one else can retrieve it.
Good privacy tips
- Consider who will be able to see any of the personal information collected and held by the organisation, for example, membership lists.
- A common way for a society to ensure that it has accurate information is to use annual subscription notices to encourage members to check their details and send in corrections, updates, or changes of address.
- Check with people if you’re using information in a new way, for example, putting a team photo on the internet (including social media) may still technically be within the purpose for which it was taken, but it’s still best to check that members are happy with this new use of the information. Not everyone wants their photograph or their name on the internet.
- If your club has a privacy breach that could cause serious harm, you will need to report that to our Office. We have a tool that will help you assess whether a breach needs to be notified, which you can find here.
Relevant examples
We’re here to help you
We understand that whether playing petanque, softball or canasta, you’re not thinking much about how to keep people’s personal information safe and secure, and it may be your first time dealing with our office.
If you have any questions, you can ask us for help. You don’t need to engage a lawyer. We are here to try and assist clubs to remedy a privacy issue and come to a resolution.
While we can’t give specific legal advice on individual problems, we are happy to help by giving general advice, for example, about how the Privacy Act works.
We have an enquiries service on 0800 803 909, or email enquiries@privacy.org.nz.
If you think your club or society needs a privacy statement, you can create one using our Priv-o-matic privacy statement generator. It is free to use and only takes a few minutes.
We also have answers to over 600 questions on the AskUs facility on our website, which you might find helpful.
There are also free privacy training modules to help you learn more. These modules are a great way to start learning about privacy. They will take you less than an hour to complete, and they cover the basic principles of each topic. If you just want to learn general privacy knowledge, or you don’t know where to start, we recommend starting with an ABC module.
