Source: Office of the Privacy Commissioner
A compliance notice has been issued to Oranga Tamariki for failing to comply with the requirements of the Privacy Act. The Privacy Commissioner has also taken the step of publicly releasing the Compliance Notice itself.
Privacy Commissioner Michael Webster says while Oranga Tamariki has taken positive steps to improve its privacy practices, considerably more improvement is needed.
“Oranga Tamariki has one of the most important roles in New Zealand – to help safeguard the wellbeing of our children, particularly those children in their care. Improving its privacy practices will contribute to the safety and wellbeing of children, their whānau, caregivers, and foster parents
Transparency about the nature of the Compliance Notice requirements is in the public interest and is an important accountability mechanism. We all have a stake in ensuring Oranga Tamariki improves its privacy performance.”
The notice has been issued in response to a series of privacy breaches reported to the Commissioner that have caused serious harm to whānau and tamariki. It relates to the storage and security of personal information, and its unauthorised disclosure.
Under the compliance notice, Oranga Tamariki will need to make privacy improvements including improving staff skills and capability, and strengthening three areas:
1. Information access settings
2. Oversight of service providers
3. Accountability and reporting of privacy incidents.
These improvements will need to be completed by 31 March 2026.
“I consider the notifiable privacy breaches reported to my Office and the systemic privacy issues identified in an independent review to be significant. This is because the sensitivity of the personal information involved and the vulnerability of the individuals the information relates to is at the high end of seriousness”, Mr Webster says.
“Oranga Tamariki currently doesn’t have sufficiently robust systems and practices in place to appropriately protect the personal information it holds, as required under the Privacy Act, and there is ongoing likelihood of further privacy breaches.”
OPC began an investigation into the privacy practices and culture at Oranga Tamariki in 2022, and in May 2023 recommended it commission an independent review of its privacy practice and culture.
“That report was completed in April 2024 and confirmed our concerns about systemic failures in protecting sensitive personal information that Oranga Tamariki holds.
“In response to that review, Oranga Tamariki has taken steps to improve their privacy practices, including undertaking a privacy improvement plan, and this is a positive move towards helping keep sensitive information about the children they care for safe”.
“This is a good step forward. However, there is still a considerable amount of work for Oranga Tamariki to do to improve their privacy practices that goes beyond this plan to address the ongoing risk of further serious privacy breaches resulting in harm to individuals.”
Issuing a Compliance Notice, and publicly releasing it, will ensure Oranga Tamariki takes the steps necessary. “We are all invested in the safety of the children in Oranga Tamariki’s care, and keeping sensitive information about children safe is critical.”
Notes