Sharing personal information

Your group is sharing personal information if you're discussing individual children and young people.

What is personal information

Personal information is information that can identify a person. A child’s name, contact details, behaviours, attendance record, and achievement record are all examples of personal information.

Ask: "Could someone identify an individual based on the information I am providing?"

If the answer is yes, it's personal information.

Even if you don’t use a child’s full name, any information that provides enough detail for someone to work out or guess their identity is personal information.

Examples include providing National Student Numbers (NSNs) or initials alongside other specific details about them or doing a case study that contains too much detail so that the individual can be identified.

Types of personal information you can share

Sometimes personal information will be formally recorded in a register, database or other format. At other times people may bring it to the table for discussion.

It is important that you share only relevant information when considering what learning support a child or young person needs. The types of information you may need to make decisions about appropriate support could include:

  • name, gender and ethnicity, to identify support that reflects the child’s identity and culture
  • date of birth and/or year level, to identify support that is appropriate to their age
  • family circumstances, but only where these are directly relevant to the child’s learning support needs
  • the kind of support required
  • current services and supports being provided
  • additional learning needs e.g. dyslexia, autism spectrum.

If you want to share personal information, you need to seek agreement

You can share personal information if you have the person’s agreement or their parent’s or guardian’s if they are unable to give it themselves. The exception is if there's an immediate risk of harm.

Where appropriate, you should also consider the young person’s own views. There's no legal age at which you must seek consent directly from the young person, but you should think about whether or not they're capable of deciding for themselves.

When you're seeking agreement you should inform the person:

  • why you want to share information (the purpose)
  • what information you plan to share
  • who you plan to share it with
  • how you'll keep it safe.

If any of this changes, you should go back again to get their agreement to share their information.

Let the person know if you have agreed as a group that we may use information on the register for the purpose of administration and analysis, for example to find out about the overall numbers of children requiring specific types of support.

This will allow us to plan ahead for numbers of staff and specialists, and other services and types of support.

Consent does not need to be written, but you'll need to record that it's been given and note any specific views about how information is shared, for example if there are specific people or organisations the information should not be shared with.

Someone can withdraw consent at any time. You'll need to make sure that you can respond quickly to remove the information.

Checklist for seeking agreement [PDF, 160 KB]

Example consent form [DOCX, 58 KB]

Protocol template for sharing personal information [DOCX, 55 KB]

Personal information needs to be protected

If you're sharing personal information, it's vital that everyone who has access to it takes steps to keep the information safe and secure.

Here are some suggestions for how to protect the personal information:

  • Restrict access to the information to people who need to see it.
  • If information needs to be discussed in a meeting, take copies along rather than sending them in advance. Collect them in at the end and ensure they are destroyed (for example, shredded or put in a secure document destruction bin).
  • Password-protect all files emailed or uploaded to shared drives.
  • Provide the password for protected files separately (over the phone, via text message or in person).
  • Use a password-protected (encrypted) USB stick or an iron key if you are transporting personal information.
  • Do not talk about personal information with or within hearing range of people who shouldn’t know about it.
  • Do not leave printed material or laptops with personal information unattended.

What happens if a service needs to be offered

In some cases, the group will decide that a service is the best response for an individual child or a group of children. Then, the organisation who provides this service, eg the Ministry of Education, needs to seek informed consent to that service being provided.

There are governing codes that professionals in this situation need to be aware of. If the service is a health service, it falls under the Health Information Privacy Code and the Code of Health and Disability Consumers’ Rights.

Professionals such as psychologists and speech language therapists also have professional codes of ethics that include privacy and confidentiality and will guide how they deal with personal information.

Last reviewed: Has this been useful? Give us your feedback