DPUP — summary for funding, contracting or partnering
Contracts, funding or partnership agreements and other agreements between agencies can involve collection and sharing of data or information from or about service users, whānau and communities between agencies.
If you’re involved in deciding what, how and why people’s information gets collected, used or shared in those situations, then you have an obligation to act as a kaitiaki. Even if you never meet services users you can still support the Manaakitanga and Mana Whakahaere Principles.
You can play a key role in bringing people together to ensure that decisions are respectful, trusted and transparent.
‘Data and information’ can mean many things: someone's phone number, a record showing that they enrolled in a course, or a spreadsheet showing who was involved in a service, and many other forms of information from or about service users.
Keep in mind that people can think of their information as being about them even if it doesn’t identify them.
It’s good practice to be clear and transparent about purpose with all involved, especially service users, and offer choice even if information is collected or used in ways that do not or cannot identify people. For example, to understand or research a topic about them or their experiences.
The DPUP Principles
The Principles are values and behaviours that underpin respectful, transparent and trusted use of data and information:
- He Tāngata — improve outcomes for service users, whānau and communities
- Manaakitanga — uphold the mana and dignity of those who share their data and information
- Mana Whakahaere — empower people: include them and enable their choices
- Kaitiakitanga — act as a steward in a way that’s transparent, understood and trusted
- Mahitahitanga — work as equals to create and share valuable knowledge.
Work as equal partners
The Mahitahitanga Principle is about working as partners in a way that reflects a joint responsibility to be respectful, transparent and trustworthy when collecting or using people’s data or information. Work together to decide what data or information is collected, who it’s shared with and how it will be used. Involve service users or their representatives in those decisions.
Agencies can involve each other in any analysis, research or ‘sense making’ of data or information. The more points of view that are included, the more accurate the interpretation of data can be.
If a service provider is required to collect or share data or information, then consider how the infrastructure and time for collection, storage and management will be resourced.
Be clear about the purpose
There may be lots of reasons for collecting or sharing data and information. Showing how a service was delivered is often the main reason for sharing data or information with a funder.
Partnering agreements might involve sharing data for research. Personal information might be shared to check if service users are receiving the supports they should.
It’s vital to be clear about the purpose so you can be transparent, ethical and follow legal requirements.
Read the Purpose Matters Guideline to understand more.
Keep focused on the He Tāngata Principle.
Make sure it’s clear how any collection or use of data or information will benefit service users, people in similar situations or the wider community.
- If you decide what to collect and why, get a wide range of views, including from service users, about what is fair and reasonable to do for this purpose.
- If you do not know why you’re asking for information, or why you’ve been asked for it, then find out. No one should collect or share without being clear about why.
- The Privacy Commissioner has said it’s not okay to automatically require individual client level data (information that identifies people) about all service users to be shared with a funder of services as a matter of course.
- If data or information is collected through contract reporting or similar but is used for something else (such as research), then this should be clearly explained, agreed between partners and communicated to service users. It is not okay to collect information ‘just in case’.
- If there is a plan to share information that identifies people, the purpose must be absolutely clear, understood by all involved and checked carefully.
- If you’re part of a funding agency, take care not to collect more information than is needed for your purpose.
Be transparent and support choices
Funders, contractors or anyone who requires data or information need to be transparent with service providers about why it’s needed and how it will be used. They can then be transparent with service users. People should also have as many choices as possible about what they provide, how it’s provided, recorded or shared and who gets to see or use it.
Where possible, this includes choices about what’s shared for funding or contracting requirements, or through partnering agreements or contracts. Keep in mind that just because data or information does not identify them, does not mean they will not want a say in who uses it or why it’s used.
There may be times when it’s not safe or appropriate to offer choices.
Consult with others and think carefully as not being transparent or giving choices can have negative effects on people’s trust and engagement.
What service users should know
Collection and use
- What’s collected or used.
- Why it’s needed, how it’ll be used, how that will help them or others.
- What it will not be used for and who will not see it.
- What laws allow the collection or use.
- If and why it will be shared with other agencies or professionals.
- If and why it will be linked with other information about them.
Access and corrections
-
Their right to access their personal data or information and ask for corrections to be made.
-
What will happen if the information will not be changed in response to their request.
Choices
- What choices they have about who sees it or how it’s used.
- If they don’t have a choice, why.
- How they can be involved in decisions around the use of their data or information.
Be proactive about access and correction
People have a legal right to access their personal information (that does or could identify them) and ask for corrections to be made (except in specific situations covered by the Privacy Act 2020).
See the Access to Information Guideline for more information.
If identifiable data or information is shared as part of contracts, agreements and so on, think about how access and correction will work. Recognise the person behind the data — access is part of upholding their mana and dignity.
- Set up collection and storage to make access as easy as possible.
- Agree a process for responding to requests for access and correction.
- Make it easy for service users to track where their information has gone and how to access it.
- What capability or infrastructure needs to be considered and potentially funded to support safe and easy access so when people ask for their information it’s easy to support their rights?
Sharing value
Sharing value is about sharing the knowledge created using people’s information. It’s about the Mahitahitanga Principle.
If your agency uses information about service users for analysis, research or evaluation, then advocate for service providers and service users to be involved in the process.
Include in agreements or contracts how partners will work together to use the information to create insights and how any insights will be shared. Look for opportunities to collaborate.
Think about how funding or support arrangements could grow Kaupapa Māori, ‘by Pacific peoples for Pacific peoples’ research, or ownership of research by those it affects.
Read the Privacy Commissioner’s report about the collection of identifiable information though contracts
Commissioner inquiries — Office of the Privacy CommissionerLast updated
