DPUP — writing purpose statements

A purpose statement explains why you need to collect or use someone’s information. They’re a key building block for a number of things:

• Explaining to service users what you’re asking them for and why.
• Making sure that the most relevant information is collected and used in the most trustworthy way.
• Making sure you collect / use only what you need, for example, only collect and use personal information (that does, or can, identify someone) if you really need to.
• Capturing your thinking as it develops, so that a wider range of people can contribute their ideas and suggestions, and check the thinking.
• Record the thinking in a way that can be re-used for other tasks, such as ensuring that those who actually collect the information know why (see the Transparency and Choice Guideline).
• Making sure you apply the He Tāngata Principle.

Where else does a purpose statement get used?

The information in a purpose statement is often reused in:

• privacy statements
• consent forms
• privacy impact assessments
• leaflets for service users
• partnering agreements and contracts.

This guide shows you how to develop a purpose statement and write it clearly to support transparency for others.

For a deeper understanding about why it’s so important to think through purpose clearly, see the full Purpose Matters Guideline.

If you want to extend your purpose statement into a more extensive privacy statement, the Office of the Privacy Commissioner has a tool for building privacy statements. It’s designed for small to medium organisations.

Privacy statement generator — Office of the Privacy Commissioner

A good purpose statement is based on getting 3 things clear

It does not just say what is collected, but it connects the dots so others can see why that information is needed and how it relates to improvements for he tāngata.

Purpose statements should assume that others (organisations, professionals, service users) will be interested to understand the what, why and how.

1. What

• This defines the data or information that you will collect or use.
• “We need to collect the following information …”
• Check: is all this information necessary for this purpose? Is there a different way that needs less information?

• This defines the purpose. It is what you will directly achieve by collecting or using this information in this way.
• “Which means that we can … decide / check / understand …”
• Check: is this purpose a reasonable one that is part of your work? Will service users see that too?

3. How

• This is the outcome. It explains the connection between achieving the purpose and how it will make a difference to people, whānau or communities.
• “So that we can improve the wellbeing of ... by …”
• Check: if there’s doubt (it might, possibly or maybe), then think carefully if the purpose really works.

Why this purpose matters

• What are the outcomes meant to be? What is the effect of this on the social sector or for service users, whānau and communities?
• How those outcomes will help improve people’s wellbeing?
• Is it going to directly help individuals, their communities or people in similar situations to them? Or will it help people in some other way? The effects or outcomes can be about particular people, or it can be a public good.
• For example, is it helping because it:
  
  • makes it easier for whānau to get the help they need from a range of places
  • helps a service provider know what training their staff need to support people
  • means the service provider can deliver the service in a consistent and helpful way
  • helps government make informed decisions about what kinds of services are needed
  • means researchers can understand something to improve how we support people?

What is the purpose

• Why is this particular data or information needed?
• Who will use it and how to make what kind of change?
• Some helpful ways to outline the purpose are:
  
  • “The questions this will answer are …”
  • “The information will tell us …”
  • “The data will enable …”
  • “The data is evidence of …”
  • “This information makes it possible to do ...”
• Saying that data or information will be used for ‘research or statistical purposes’ isn’t clear enough to define a purpose.
  
  • What kinds of research answers what questions?
  • What does ‘statistical use’ really mean?
  • What is the result of ‘research or statistical use’?
  • Does this mean it’s used once or multiple times?

Keep in mind

• ‘Just in case’, ‘Could be interesting’ or ‘We have it so let’s use it’ aren’t good for purpose statements.
• If there’s more than one purpose (even if for the same information), then define and capture them separately.
• Think about what will not happen and who will not see it. Write this down. People can often be anxious due to wrong assumptions about who might see their information or what it might be used for. Capture these limits and boundaries as you go. It can contribute significantly to people’s sense of comfort and trust. Consider the Manaakitanga Principle.

When it comes to data or information that does or can identify someone (personal), the Privacy Act 2020 is clear that any purpose should relate to the role of the agency or organisation and its functions.

Consider being specific about what data or information will not be used for.

If you’re reusing information you’ve already collected, why was it originally collected? If the 2 things don’t match up, get advice. You may not be able to do what you’re planning to do.

What is needed for this purpose

• What information or data is needed — be as specific as possible:
  
  • Is it data or information that does or can identify someone (personal) or that cannot and will not (non-personal or de-identified)?
  • Who is it needed from — everyone or just a sample of people, services or communities?
  • Is it information that describes people’s circumstances, their experiences, their engagement or progress with a service, their home life, their wellbeing?
  • What services, programmes, interventions or organisations will already have this information — are they able to share it?
  • Being specific does not mean you have to write out a full list of every single data point or details of a methodology. It explains enough so that no one would be surprised if they did see the full list of every variable or single piece of information.
• Think critically about the information or data that you think you might need, for example:
  
  • If ethnicity doesn’t matter, it should not be collected. If it does matter, what exactly will be collected and how will it be categorised?
  • If gender will be collected, what categories will be used?
  • Is date of birth really needed or will year of birth or age be enough?
  • If information about success or progress in a service or programme is going to be used, who will decide what success or progress looks like and how it will be measured?
  • What are the possible unintended consequences of misinterpreting or misusing this data or information? Who needs to be involved in making sense of it to avoid that?
• Keep in mind that information you think does not or will not identify someone, might possibly be able to do that if used in certain ways or combined with other information. Check your thinking.
• Outline any data matching or linking that needs to be done to achieve the purpose:
  
  • What will be matched?
  • What other data or information will it be matched to?
  • Why is matching needed?
  • What will happen with the matched data or information?
  • Can you explain this to service users, so that it makes sense to them?
• When it comes to data or information that does or can identify someone (personal information), the Privacy Act is clear that only what is “reasonably necessary for the purpose” can be collected or used.
• Aim for minimum necessary, not maximum possible, when it comes to collecting or using data or information. If identifying information isn’t needed, do not ask for it.

Who will see it

• Who will see it:
  
  • People at the agency collecting it?
  • If it will be shared with any other agency or organisation, what will they use and who will see it?
  • How will people use it or see it? Will it be anonymised or de-identified? Will they only use some of the information, or all of it? Focus on each separate purpose individually.
• Get as specific as you can:
  
  • It may be reasonable to name people (for example, “your case worker”).
  • Use titles or job descriptions (for example, “administrative workers will only see X so that they can …,” “analysts at Ministry Y, in order to understand topic T ...”).

What laws allow this

• What laws allow the information to be collected or used in this way. For example:
  
  • When it comes to personal information, the Privacy Act 2020 is likely to matter.
  • Other laws, such as information sharing provisions under the Privacy Act 2020.
    Information sharing — Office of the Privacy Commissioner
  • Keep in mind that some laws apply over and above the Privacy Act 2020.
• If it’s not clear what law allows this data or information to be collected or used for this purpose, then the work should not move forward.

Choices and circumstances

• Are there particular circumstances or situations for the people whose information is being used that need to be taken into account and explained in the purpose statement? For example:
  
  • If the information is culturally sensitive, then who will advise on its use?
  • Is the information collected from people at a time of crisis? What steps need to be taken so they can understand what happens with their information at a time that makes sense for them?
  • Is the information about children, marginalised people or people at greater risk of harm, and people whose information needs greater protection?
  • Did the service users provide the information directly to your organisation? Or did it come from another organisation? Do you know what the service users were told about use?
  • Did the information come from people who self-referred to a service or were referred by another organisation? What does that mean for information use?
• Service users should have as many choices as possible about their data and information, even if it does not or cannot identify them. Take a close look at the purpose to check what choices can be offered.
• The Privacy Act 2020 requires service users to be told what information is compulsory and what is voluntary and the consequences of not providing it.
• A purpose statement should outline any specific decisions around choices for this purpose. If service users do not have a choice, then say that clearly. Keep in mind that any decision not to give choices should be thought through carefully and checked with appropriate people to make sure it’s fair, reasonable and respectful as well as legal.
• Think about choices as part of deciding what to collect or use and why, and how reasonable it is. A purpose statement should explain these.
• There might be other, better ways to explain and discuss choices with service users, whānau or communities, other then giving them a direct copy of a purpose statement.

Be clear

Even though there is a lot in this section, purpose statements themselves do not have to be long and complicated. In fact, succinct is better.There is no single way to write a purpose statement. Here are some tips and things to keep in mind.

Straightforward, direct and understandable

• Avoid jargon (words that only mean something to specific people), labels, shorthand words, or overly technical words.
• Describe exactly what you mean, be specific. Aim for plain English (shorter sentences, active verbs).
• Use lists to make it easy to read things like the different types of data or information.
• Consider the audience:
  
  • How much do they already know and what might they need to know?
  • What role will they have in collecting or using the data or information?
  • Would diagrams or pictures be a useful way to explain the purpose?
  • How could or might this information get to service users in a way that works for them?

Easy to use in a number of different situations

Create purpose statements that can be used:in online or in off-line forms

• in partnering agreements and contracts
• in presentations and workshops
• in face-to-face conversations.

Layered purpose statements

Some organisations use layered privacy statements where different layers have different amounts of detail. This is useful on a web page where people can click into further detail.

This can work with purpose statements too. Keep in mind that the top layer should still cover off everything it needs to. If explanations are summarised poorly, they may can be unclear or unhelpful. Do not rely on websites as the only way of communicating. Not everyone will find this an easy way to get what they need.

Best practices in drafting plain language — International Association of Privacy Professionals

Think carefully about what people will need or ask

Imagine you’re chatting with a service user, asking them for information. Imagine they’re your mum, your partner or your teenager.

• What questions would they ask?
• What would you say to make them feel comfortable about asking what’s happening with their information?
• What do you need to say to feel confident you’ve been honest, open and as complete as they'd want you to be?
• How will they feel when their information is collected? Are they scared or anxious?
• Is English a second language for them?
• Do they need to have things communicated in a certain way to make it easy for them?

Multiple purpose statements

A clear, concise, easily understandable purpose statement should work for many audiences.

However, there may be a reason to create different versions of the purpose statement for different groups. For example, technical specialists may want or need more detail about exactly what data or information is involved. Someone else may be more interested in detail around what the intended outcome is.

If you take this approach, be careful to make sure everyone still knows everything they should. There is a risk that differing groups will understand or interpret the purposes in different ways and get confused or make wrong assumptions. If different versions inadvertently contradict each other, this can lead to both privacy and ethical issues that can sometimes become significant problems.