Managing Privacy

The information held in Te Rito is subject to the Privacy Act 2020.

This means:

• Personal information can only be collected in Te Rito if it is for a lawful purpose connected with functions or activities that relate to education, and if the information is necessary for that purpose.
• Personal information must be safeguarded from loss and unauthorised access, use, and modification or disclosure.
• Ākonga, learners and their parents or legal guardians must know about the information being collected and why it is being collected. The content on this website helps with this and is in addition to specific school communications.
• Ākonga, learners and their parents or legal guardians have a right to see the information about them held in school systems including Te Rito and correct it if it is not accurate.
• Personal information should only be used for the reason it was collected and it must be disposed of when no longer needed. It should not be shared unless there is a good reason.

Users of Te Rito should understand what their kura or schools' privacy statement says, and also what the Te Rito privacy statement says. We have written the Te Rito Privacy Statement in plain language to help make it easily understandable. 

Users of Te Rito should understand their responsibilities when using Te Rito, which are also provided plain language in the Te Rito Terms of Use.

All kura, schools and early learning services should have a privacy statement and privacy policies outlining ākonga, learner and parent or legal guardian rights under the Privacy Act 2020.

These should cover:

• why information is being collected
• who is going to see the information
• the legal basis for collecting information
• whether providing the information is mandatory or voluntary
• that ākonga, learners and parents or guardians have the rights of access to, and correction of, their personal information.

Before connecting to Te Rito, kura and schools should review their enrolment forms, privacy statement or policies to ensure they're up-to-date and fit for purpose.

The sharing of ākonga and learner information with the next kura or school, so that it follows them throughout their education, is the focus for Te Rito. Kura and school enrolment forms should request explicit consent to share ākonga and learner information with their next kura or school.

If it's not on an enrolment form, the kura or school's privacy statement should make it clear that one purpose for collecting ākonga and learner information is to share that information with the next kura or school, or via Te Rito.

Ākonga, learners, whānau, parents and guardians can request privacy statements or privacy policies at any time.

As authorised under the Education Act or other legislation, kura or schools do not need consent to use Te Rito to support ākonga and learners with their education, but it is good practice to let ākonga, learners, their whānau and families know what information they will be collecting and how they are going to use it.

Kura, schools and the Ministry share responsibility for ensuring the protection of information held in Te Rito by only allowing people who are authorised to access it. Kaimahi are only able to see the information they need to do their jobs.

The Ministry has completed a Privacy Impact Assessment (PIA) to identify and mitigate potential privacy risks associated with Te Rito. The PIA was developed in consultation with multiple stakeholders including the Office of the Privacy Commissioner. The PIA will be proactively released along with a plain language summary to make it easy for teachers, students and their whānau to understand the privacy protections built into Te Rito.

In addition to these measures, the Te Rito Data Kaitiakitanga Group is an independent, cross-sector data stewardship group whose role is to provide trusted, transparent and equitable oversight of data held in Te Rito.

You can find out more about the Data Kaitiakitanga Group here.

Help protect ākonga and learner information by understanding the Privacy ABCs for Schools.

This online training from the Office of the Privacy Commissioner is split in to twelve modules that take just five minutes each, and can be completed at your own pace. The training gives practical tips for school kaimahi who deal with personal information and will help to understand the obligations of kura and schools under the Privacy Act 2020.

You can access the module from the Education Learning Management System here.

Sharing any personal information you have collected requires consent. For example, if parents, guardians, ākonga  or learners do not give consent for learning support information to be shared, no data about their tamaiti or child will appear - apart from demographic information which will be pulled from the kura or school's SMS.

There are also separate consents required for sharing personal learning support information across a learning support cluster, using the cluster register/

Consents should be reviewed as ākonga and learners move through their education journey. For example, when tamariki and children move from an early learning service to a kura or school. The ākonga or learner, or their parent or guardian may want to consider changes to their situation, including decisions about who has access to their information and what information should be shared.