Platform: online remote participation, for example Microsoft Teams, Cisco Jabber, Zoom or in person.
Time: 60 to 90 minutes
Key roles:
Facilitator and / or host — oversees remote waiting room (if online and enabled), creates a safe space, facilitates introductions, shares slides, keeps time, introduces presenters, ensures that the discussion flows evenly and to the stated purpose and agenda.
Presenters — present their content, answer questions on their topic.
Assumption: Participants have viewed the Introduction to DPUP video ahead of the workshop.
Open workshop in an appropriate way for the environment allowing presenter and participants to introduce themselves, where they’re from, their role and what they know about DPUP.
Focus topic: What we will cover today
Slide: 1
Time: 5 minutes
Role: Host
Go through the agenda at a high level:
Talk about the ‘why’.
Touch on the background behind DPUP and its creation.
Look at what it means for this organisation.
Go through the DPUP detail and adoption approach.
Finish with a short quiz, followed by time for questions.
Outline the workshop approach:
The goal is to introduce participants to DPUP and its relevance to them but it’s not designed to be an in-depth or practical application workshop (but it will talk about where to go for this)
Participants are encouraged to ask questions verbally or by Chat (if functionality available).
Focus topic: Overview — why DPUP?
Slides: 2–4
Time: 10 minutes
Role: Presenter
In short (slide 2)
Check whether they have watched the Introduction to DPUP video. If not and there is time, play the video then go through bullet points below.
DPUP was developed by the social sector for the social sector for government as well as non-governmental organisations.
It’s relevant whenever we collect or use any kind of data or information from or about service users.
Recommendations go beyond the law, and are clear when they do so and why.
It’s a guide for doing this in the most respectful, transparent and trustworthy way we can and in a way that makes sense in the context you’re operating within.
It focuses more on relationships, values and behaviours and less on prescriptive rules.
This workshop will explore these points in more detail.
Some key points to note:
DPUP does not suggest or advise anything that contradicts the Privacy Act 2020 but does suggest things we should do beyond the Privacy Act to be as transparent, respectful and trustworthy as possible.
DPUP is not just for data people — information or data from or about service users can be used by all sorts of people in all sorts of roles, from making a referral to another service to contract reporting or working on a new programme or policy.
The power of data (slide 3)
Think about a time either professionally or personally when you have been asked for your information and felt uncomfortable about this. Can you remember if you were provided with ‘why’ it was needed and what would be done with it? Ask a couple of people to share.
Data and information can be powerful because they can:
determine if someone receives a service or not
help shape government policy and funding
inform research into what the circumstances are for service users and communities, for example, their needs, resilience, experiences
influence the creation of new services or programmes
tell someone or a group’s very sensitive, personal and emotional story or experience.
When we talk about data and information — think inclusively. Data can be numbers, stories and experiences and can be from or about the people we serve.
As with any power, if data and information are misused, misunderstood or not cared for, it has the potential to create harmful consequences for the people it is about. Because data can be powerful, we have a responsibility to be responsible, respectful and transparent.
It all starts with ‘why’ (slide 4)
Why should you learn about DPUP?
Because it’s about people (he tāngata).
Because data and information are powerful.
DPUP will help you:
use data and information in the most respectful, trustworthy and transparent way
use data and information to grow the knowledge about how best to support people’s wellbeing
build trust with service users in how you care for their information.
Focus topic: The journey — timeline, engagement and policy development
Slides: 5–10
Time: 10 minutes
Role: Presenter
The journey (slide 5)
It’s important to understand the history behind DPUP because that influenced its development and the final policy.
Before DPUP was developed, there was some guidance and law around the collection and use of people’s data and information. For example:
the Privacy Act 2020
the Health and Disability Code.
During the development of DPUP further things came into effect like:
the Oranga Tamariki Information Sharing requirements
the Family Violence information sharing guidance
the Algorithm Charter for Aotearoa NZ.
So why and how is DPUP relevant? Why do we need it?
The journey (slide 6)
In 2016, the Ministry of Social Development (MSD) asked non-governmental organisations (NGOs) to provide individual client level data (ICLD) about their clients as a general condition of contracting with them. ICLD is information that identifies who people are. There were lots of reasons this was a concern for many people, for example:
it was not clear why the information was needed
it was not clear how the information would be used once it was given to MSD
it did not help create a culture of respect and care
people might be too scared to go to or use services if their name and details were shared with MSD — potentially putting people at risk.
In 2017 the Office of the Privacy Commissioner (OPC) completed an inquiry following complaints about the request.
The OPC inquiry found the proposal was not justified or proportionate and there was:
no clear and defined purpose for ICLD
not enough consideration of privacy risks
not enough consideration of concerns raised.
Following the OPC findings, the government asked for a discussion on the use of service user data and information in the social sector. This was led by the Social Wellbeing Agency.
While general guidance is provided by the Privacy Act 2020, there are many aspects of the wider social sector that make it less easy for everyone to understand what’s reasonable, and what’s not, when dealing with people’s information.
Key points to note:
No conflict with law — DPUP was developed to work alongside and not conflict with the various laws, guidelines, and so on.
Goes beyond the law in places — DPUP has been carefully mapped against the Privacy Act and does not contradict it.
In places, DPUP advises actions and behaviours that go beyond what the law requires.
DPUP is based on the collective ideas of the sector about what it looks like to be a respectful, transparent and trusted organisation in relation to people’s information.
DPUP is about both personal and non-personal information — for example, DPUP is not only about personal information but has advice about non-personal information. Engagement participants were clear that even when information cannot identify them, it can still be ‘personal’ to them and the communities they are a part of.
In November 2019, Cabinet endorsed DPUP and named 5 foundational agencies to lead the implementation.
Ministry of Social Development
Oranga Tamariki
Ministry of Education
Ministry of Health
Social Wellbeing Agency.
Engagement: Your voice, your data, your say (slide 7)
During 2018, the Social Wellbeing Agency asked people for their thoughts about the investing for social wellbeing approach and what was reasonable (or not) when using people’s information.
Over 1,000 people attended the workshops, with 800 online submissions, and almost 200 service users interviews (done through trusted brokers).
There were dedicated engagement streams for Māori, Pacific peoples and disabled people.
What would you say? (slide 8)
These are some of the questions that were asked (allow the group to read through the slide themselves and ask a couple of people to share what they would say).
What people said (slide 9)
This was some of the feedback received during the engagement (allow the group to read through the slide themselves and ask if any stand out and discuss — this can be done in breakout groups if time and platform allow).
Note that the core themes were about inclusion and transparency, significantly greater focus on the ‘why’, and clarity about how using people’s information actually leads to better outcomes for them, their whānau and communities.
From voices to policy (slide 10)
The findings of the ‘Your voice, your data, your say’ engagement on social wellbeing and the protection and use of data (called ‘What you told us’) was instrumental in developing DPUP and the toolkit.
Developed for the sector by the sector (refer to groups noted on the slide, that is Design Reference Group, Ministerial Working Group and those who participated in the original engagement).
Cabinet endorsement of DPUP in November 2019 enabled a green light for the sector to start using it, led by the 5 foundational agencies.
DPUP was made publicly available in January 2020 and work began on the toolkit.
Focus topic: The journey — timeline, engagement and policy development
Slides: 11–14
Time: 20 minutes
Role: Presenter
The Data Protection and Use Policy (DPUP) (slide 11)
Now we turn to DPUP itself — keep in mind the journey so far because you will see how DPUP reflects the involvement and voices of the sector.
The structure (slide 12)
DPUP describes values and behaviours that, when applied, will build trust and help to ensure that data practices are focused on the wellbeing of people and communities.
These values and behaviours are represented as 5 Principles that have people and their wellbeing at the centre.
DPUP then provides good practice guidance on how to uphold these Principles in key areas through 4 Guidelines, which help agencies to understand how to apply DPUP.
The Principles are at the heart of DPUP and are about values and behaviours.
No law, policy or guideline can give step-by-step instructions for what to do in every situation that will occur.
The Principles are there to guide us, to act as a compass that shows us the direction we should head in, even if we do not have the detailed map.
They capture the overall beliefs of those who were involved in developing them around how people’s data and information should be treated and how the people the information is about should be respected.
He Tāngata
The He Tāngata Principle has a special role. It wraps around the Data Protection and Use Policy as a whole. It reminds us that everything we do with data should be with the following question in mind: “How does this contribute toward the wellbeing of the individual or community?”.
It talks about the importance of involving others as we develop new ideas to use people’s information.
Any collection, use or sharing of data and information must be for a reasonable and well-defined purpose.
There should be an easy to understand, tangible link between the purpose for which data or information is collected, used or shared, and the benefits for people. The benefit might be for certain individuals, whānau, a community or iwi, or the benefit may be a public good.
Because actions and outcomes are not always clear cut, risks and potential negative outcomes should be assessed so it’s clear how these balance against positive outcomes.
Data and information exist in many different forms. Some are more suitable and acceptable for certain purposes than others. For example, narrative (qualitative) information can be really helpful to describe the challenges people face so that we can think more clearly about what kinds of services will work for them, while numerical information (quantitative) can be really useful to get a sense of how busy a service is, how many people are using it, and how frequently.
In every case it helps to think about the link between what it is we’re trying to understand, what the best information would be to do that, and involving others to help with the thinking.
Some purposes need more oversight and checks than others to make sure they are well-defined and reasonable. Only the minimum information needed to achieve the outcome should be collected, used or shared.
Manaakitanga
Respect and uphold the mana and dignity of the people, whānau, communities or groups who share their data and information.
The Manaakitanga Principle reminds us that it’s not only what we do, but how we do it.
When we’re asking people to share their information, thinking about how we might use it, or explaining to people what will or might happen with it, we need to ensure that the way we do this focuses on contributing to their wellbeing and respecting them (as we would wish to be respected).
Recognising and incorporating diverse cultural interests, worldviews, perspectives and needs is key as well as considering service user and community views like what they think about why and how their data and information is collected, used or shared.
Different groups and people may value qualitative and quantitative information about themselves differently — it's important to recognise these different values when deciding what information to collect and to use when developing insights.
For Māori, this means upholding their rights as Treaty partners and focusing on the collective and whānau outcomes of any work.
For Pacific peoples, this means considering the distinct views and thoughts of their diverse communities.
For children and young people, this means supporting their right to participate, communicating with them in appropriate ways and at the appropriate level, and acknowledging what they have to say is valuable.
For disabled people, this means considering accessibility issues, focusing on what works well for them, understanding their achievements and contributions, and making sure they are not invisible in data and information.
Other people and groups are likely to have their own specific needs and priorities. It is important to be proactive in identifying and addressing those needs and priorities.
Mana Whakahaere
Empower people by giving them choice and enabling their access to, and use of, their data and information.
The Mana Whakahaere Principle is about ensuring as much as possible that people get a good understanding about their data.
Offer them choices wherever possible and make sure they know what their rights are to access their information and that doing so is made easy for them.
Tell people, in a way that makes sense to them, what data or information is collected about them, how it’s used, who it’s shared with, and why (even if it’s aggregated or de-identified). There will be situations where there are good reasons not to tell them. For example, if a person is significantly stressed and in need of urgent assistance, then a conversation about data could be unhelpful. Or, if the information is needed to support a legitimate legal process that would be undermined by telling the person.
Take extra care when deciding not to give people choices or not to explain to them how their information will be used and why.
It's not appropriate to rely on broad or future-proofing purpose statements or consents for potential uses that are loosely defined.
Even when there is no legal requirement to tell people, transparency is important for trust and respect, and recognising people’s mana.
If it’s not timely or appropriate to tell them beforehand, tell them afterwards — unless there’s good reason not to.
When communicating with children and young people, consider their vulnerability and the roles that their parents, guardians or wider whānau may play in supporting them.
Kaitiakitanga
Act as a steward in a way that people understand and trust.
The Kaitiakitanga Principle has 2 meanings in DPUP:
Not only should we ensure that the information that people have shared with us is kept safe and protected from misuse, but also that it is available for others to use the (de-identified) data in the interests of their own communities.
If data and information are valuable to improve people’s wellbeing (as the He Tāngata Principle asks), then we should ensure that it’s available for others to use it.
Those who collect, use, share and store data and information are stewards and caretakers, not owners, of that data and information. That data and information should only be retained for as long as it remains necessary, relevant and useful.
Mahitahitanga
Work as equals to create and share valuable knowledge.
The Mahitahitanga Principle reminds us that the work of any agency rarely stands alone.
The way that we work together every day, for the shared outcome of improving the wellbeing of people, whānau and communities, is what this Principle is all about.
Those who hold people's information are in a position to grow its value and they may do this by creating and sharing insights, or by returning collective, non-personal data back to the people and community it came from for their use.
A 2-way street of sharing (de-identified) data, analysis, results and research findings will grow collective knowledge and improve services.
When doing so, we must take care to comply with the law, protect people’s privacy and maintain people's trust and confidence.
The 4 Guidelines (slide 14)
There is no one way to use DPUP.
Agencies can apply it in the most sensible way for their work, the kind of data or information they collect or use and the circumstances of the service users it’s about.
The Guidelines help us to do that.
As we go through the Guidelines, think about what this might mean for your role. It might be that in your role, there is something that you can do directly or that you can influence or it might be something that should be part of organisational policies and practices. At the end we will ask you to share something that you do, or will do going forward, that aligns with the Guidelines.
Let’s go through each of the Guidelines, noting that Purpose Matters is an overarching guideline.
Afterwards, share — what do you do, or will you do going forward, that aligns with any of these Guidelines?
Purpose Matters Guideline
Play the Purpose Matters Guideline video, then go back to the slide pack and bring up the Purpose Matters key points and go through the following bullet points.
This Guideline is the most important one in DPUP and should be used when an agency is deciding whether to collect or use information that is, or was, about people.
Clarity of purpose is vital to determining whether, in a given context, an agency needs to collect personal information and, if so, how much.
It is also vital to determining whether the uses of that information are lawful and appropriate (so the word ‘appropriate’ signals that in places the guidelines go beyond the law). For example, if you do not know why you hold information (the original purpose behind its collection), then you actually do not know if or how you can reuse it.
It can also determine if the proposed sharing of someone’s personal information with another agency is lawful and appropriate.
There’s a duty to ensure that you only reuse information in way that’s directly consistent with its original purposes of collection and that if you do reuse it, it’s the right kind of information for that intended use (right can mean accurate, appropriate, relevant, meaningful, and so on).
Transparency and Choice
Play the Transparency and Choice Guideline video, then go back to the slide pack and bring up the Transparency and Choice key points and go through the following bullet points.
People want a good understanding of why their information is needed.
When they’re unclear about it, this can cause anxiety, especially if their current situation is already a difficult one.
Help them understand why it’s being collected, how that might help them or people in similar circumstances, and what rights they have to access and request changes. Provide
them with choices whenever possible.
Key points — consent:
This Guideline uses the language of ‘choice’ rather than ‘consent’.
Consent is given when a person voluntarily agrees to something based on a good understanding of the consequences.
The language of consent is often used, but without common agreement about what it means (it can have specific definitions in fields such as medicine, research and law) and often in circumstances where people who want to access a service won't receive the help they need if they don’t provide the information requested.
For this reason, DPUP uses a plainer word — choice — and focuses (in part) on the processes that help give people choices and enable them to act on those choices.
Key points — context:
The context of the individual is important in ensuring understanding and choice. For example, age, cultural, language and literacy must be considered, and any other circumstance of the individual that is relevant to respecting mana and enabling understanding of their choices.
Māori providers and other Māori / iwi groups want te ao Māori considered when Māori communities are a key focus.
Pacific peoples are looking for clear and simple explanations about why their personal information is being collected and how it will be used, and greater accountability to families and communities on how their data is used.
Disabled people also highlight the need for clear information about what information is being collected, for what purpose and a greater understanding of people’s situations when asking for identification information (for example, some disabled people do not have a driver licence).
This Guideline helps agencies facilitate service users' understanding of and, where feasible, having choices about, when and how their information is collected and used.
Access to Information
Play the Access to Information Guideline video, then go back to the slide pack and bring up the Access to Information key points and go through the following bullet points.
People may not understand what rights they have to see the personal information that has been collected about them or is about them, to ask for that information to be corrected, or to express a preference as to how they’d like to access their information. Understanding these rights is important.
People sometimes assume that government agencies can share, access and exchange information about them without constraint.
If people are unsure about what is recorded about them, or if it is accurate or up to date, that can affect their trust or confidence in how it’s used. That uncertainty may deter them from providing the information in the first place, or from opting to receive a service they need.
Conversely, the more proactive an agency is and the easier it makes the process, the more empowered service users will be. Their confidence that correct information will be used for the purpose for which it was collected will also be greater.
This Guideline recommends a proactive and pragmatic approach to ensuring that people understand and can exercise the options they have to access their information, request corrections to it, or in some cases change it themselves.
Sharing Value
Play the Sharing Value Guideline video, then go back to the slide pack and bring up the Sharing Value key points and go through the following bullet points.
insights means non-personal information, including data and data sets, analysis, qualitative or quantitative information, statistics, research, reports or studies, that may support improved decision-making
non-personal information is information that does not identify individual people
sensitive information is used to describe information that could be misunderstood or misused, resulting in harm or embarrassment to a group or community.
Key points:
It’s important to develop and share the value of information and insights among those involved in the delivery of services in an inclusive, useful, respectful and valuable way.
A collaborative approach involves exploring the objectives of information collection and analysis (the desired insights) before information is collected or before analytical activities are carried out, and what insights will be most helpful to people and agencies working on related outcomes.
Service providers are often required to share information they collect with other agencies for the purposes of accountability, research and analysis, and planning.
Many people (decision-makers, government, NGOs, communities and service users) are likely to benefit from the sharing of insights derived from information collected from or about people. Such insights are valuable for supporting robust decision-making and better delivery of services that support positive outcomes.
Service providers and service users want to be involved at the beginning of the process of information collection and throughout the process of developing insights based on that information, so that they can contribute their perspectives, expertise and suggestions, and have opportunities to understand, access, and apply those insights.
The recommended actions in this Guideline are not only about the development and sharing of insights from new data, but also apply to insights developed from existing collections of data. These actions are not required by law but are common to many respected codes of practice.
Focus topic: DPUP Toolkit
Slide: 15
Time: 5 minutes
Role: Presenter
DPUP is supported by an online toolkit of resources about how it can be used in day-to-day work.
The toolkit has videos, checklists, summaries of important information for people working in different roles, workshop material, case studies and examples.
The toolkit has information for different roles from frontline workers to data scientists.
Different tools can be used at different stages in a process or service, such as developing your work programme, to policy or service design or research and evaluation, through to service delivery.
Focus topic: What it means for [Agency name]
Slide: 16
Time: 5 minutes
Role: Host
The Ministry has committed to lifting trust and confidence in its use of information — with some of the initiatives being:
Example
Example:
example.
Focus topic: Quiz
Slides: 17–28
Time: 10 minutes
Role: Facilitator / Presenter
Go through a short quiz to run through DPUP’s key points.
Say the answer or send it in Chat (if function available).
Focus topic: Questions, where to go for more information and close
Encourage participants to talk to others about what they learnt and how they might apply it in their day-to-day lives — both personally and professionally.
