link to page 1 link to page 3 link to page 4 link to page 5 link to page 3 link to page 3

Policy
Privacy
Introduction
When to use
This policy sets out expectations for those that handle personal information so that
Fire and Emergency New Zealand complies with the responsibilities set out in the
Privacy Act 2020. That is, we treat the personal information we hold lawfully,
respectful y and with care. This purpose of this policy is also to ensure that privacy
incidents and complaints are managed appropriately.
It is important to read this policy when managing any privacy incident or making a
privacy complaint. (See Managing privacy incidents guidelines or Making privacy
complaints guidelines.)
Note: You should read this policy in conjunction with the Code of Behaviour.
Contents
This policy contains the fol owing content:
About this policy
Policy statements
Definitions
Related information
About this policy
Purpose
This purpose of this policy is to set expectations for ensuring personal information
that Fire and Emergency New Zealand collects and holds is not used for
unauthorised purposes. It is also to ensure individuals are protected from any
harm that could result from breaches of the Privacy Act 2020.
Who it applies to
We expect the fol owing groups of people to comply with this policy:
• permanent and temporary employees
• casual employees
• volunteers
• contractors (individuals, employees of contractors, subcontractors, or persons
affiliated with third parties)
under the Official Information Act 1982
• anyone working on behalf of Fire and Emergency (e.g. service providers).
In some cases, our providers will have their own privacy policy, however, when
these providers are delivering services on our behalf, the requirements of this
policy will apply instead.
Everyone has a duty to meet the commitment and requirements statements
below.
Table of
Individual and collective responsibilities are assigned in the following table:
responsibilities
Released
4 April 2022
1

link to page 1 link to page 1 Policy - Privacy
Role
Responsibilities
Fire and Emergency
•  Lead and model best practice behaviours to ensure privacy is core to al  aspects
Executive Leadership
of the culture within Fire and Emergency
Team
Deputy Chief Executive,
•  Consider privacy matters escalated from the Privacy Officer to the Deputy Chief
Office of the Chief
Executive, Office of the Executive
1982
Executive
•  If matters are not resolved, then escalate the matter to the Chief Executive for
consideration
Privacy Officer
•  Work with relevant business units to ensure effective privacy risk management
is ful y embedded within the risk management activities of Fire and Emergency
Act
•  Ensure resource is available to support compliance activities with this policy and
associated guidelines
•  Ensure organisational controls are in place to support the implementation of
this policy
•  Develop and provide training and communications to raise awareness of this
policy and build capability in good privacy practice
•  Oversee privacy investigations and complaints
•  Regularly report on privacy incidents, investigations and complaints
•  Notify any notifiable privacy breaches to the Privacy Commissioner and the
individuals affected
Legal Directorate
•  Provide legal advice in relation to compliance with the Privacy Act 2020 and
Information
associated codes and regulations
•  Provide legal advice in relation to information sharing arrangements
•  Assist with investigations and complaints involving privacy issues
•  Prepare privacy impact assessments (as and when that is appropriate and
necessary)
Information and
•  Ensure privacy has been appropriately considered before making or al owing
Communications
technology changes
Official
Technology Directorate
•  Address privacy concerns within their capability and capacity
Managers and Supervisors  •  Identify privacy risk in own teams and ensure appropriate controls are in place
at al  levels and al
•  Notify privacy incidents to own manager and the Privacy Officer
locations
the
•  Liaise with the Privacy Officer fol owing al  privacy incidents
•  Ensure personnel are aware of their obligations regarding personal information
and recognise the importance of their role in privacy
•  Ensure new personnel complete privacy training as appropriate
•  Model good privacy behaviour – take due care in managing and working with
personal information
under
•  Take steps as advised by the Privacy Officer (or the Legal Team on behalf of the
Privacy Officer) fol owing a privacy incident
All personnel (as
•  Treat information with care and respect
described in Who it
•  Report al  privacy incidents to a manager and the Privacy Officer
applies to above)
•  Comply with this policy
•  Understand and apply this policy and the Information Privacy Principles (IPPs) in
their day-to-day work
•  Refer to privacy guidance and seek advice from the Privacy Officer when
needed
•  Actively participate in privacy training
Released

4 April 2022
2

Policy - Privacy
Policy statements
Our commitment
At Fire and Emergency, we’re committed to respecting the information we hold
about other people and ensuring we treat it lawfully and with care.
Everyone at Fire and Emergency deals with information in some way, including
personal information about people, which can be sensitive, such as the identities  1982
of victims involved in emergency incidents. The communities we serve have a right
to expect that we will respect their privacy and comply with our legal obligations.
Requirements
As personnel of Fire and Emergency, we are responsible for ensuring the  Act
collection, use, disclosure and storage of any personal information complies with
the IPPs in the Privacy Act 2020.
There is further details below about the IPPs and there is also guidance available
on the Office of the Privacy Commissioner’s website at privacy.org.nz > Privacy Act
2020 > Privacy Act 2020 and the Privacy Principles.
Minimising risk
Fire and Emergency wil  consider the IPPs each time a system or process that
col ects, uses, discloses and/or stores personal information is reviewed, adapted or
developed.
The Privacy Officer must be engaged at the outset of any new initiative to
determine whether a Privacy Impact Assessment (PIA) is required.
Information
Privacy incidents
All privacy breaches and near misses (collectively known as privacy incidents)
regarding unauthorised access to, correction of, use of or disclosure of personal
information must be reported to the Privacy Officer.
Privacy incidents will be managed according to Privacy incident process in the
Managing privacy incidents guidelines. Under this process the Privacy Officer or
the Legal Team will take steps to:
•  contain the breach and perform an initial assessment (contain)
Official
•  initiate an investigation, and evaluate the risks (evaluate)
•  remedy and respond (notify)
•  consider the cause and how to prevent it happening again (prevent).
the
The Privacy Officer will engage with and inform the Privacy Commissioner of
notifiable privacy breaches when appropriate and required to by law.
Privacy incidents will be recorded by the Privacy Officer and reported on regularly
to Audit and Risk Committee of the Fire and Emergency New Zealand Board.
Privacy complaints  Privacy complaints will be assessed, investigated and responded to according to
under
the process set out in the Making privacy complaints guidelines.
The Privacy Officer will provide advice, assistance, and oversight in the
management of privacy related complaints. Where the complaint is identified as a
breach, the Privacy incident process set out in the Managing privacy incidents
guidelines will also be followed.
Privacy complaints will be recorded by the Privacy Officer and reported on
regularly to the Audit and Risk Committee of the Fire and Emergency New Zealand
Board.
Released
4 April 2022
3

Policy - Privacy
Good information privacy practice at Fire and Emergency
Introduction
The Privacy Act 2020 sets out the IPPs. The IPPs are the basis for good information
privacy practices. If we follow these principles, it will mean that Fire and
Emergency is acting lawfully in our col ection, use, disclosure and storage of
personal information.
1982
Information
The following table summarises the IPPs.
Privacy Principles
Note: For general information, see the Office of the Privacy Commissioner’s
guidance at privacy.org.nz > Privacy Act 2020 > Privacy Act 2020 and the Privacy
Act
Principles.
IPP number  Principle
IPP 1
We only col ect personal information if it’s necessary for a purpose
IPP 2
We get personal information straight from the person
IPP 3
We explain to the person what we’re going to do with the information
IPP 4
We col ect personal information fairly and legal y
IPP 5
We keep personal information safe and secure
IPP 6
We let the person see their information if they ask to see it
IPP 7
We correct personal information if we’re asked to do so
Information
IPP 8
We make sure personal information is accurate before it gets used
IPP 9
We dispose of personal information when no longer needed and lawful to
do so
IPP 10
We use personal information only for the purpose it was col ected
IPP 11
We disclose personal information only if there is good reason
IPP 12
We disclose personal information overseas only if there are appropriate
Official
safeguards
IPP 13
We only use unique identifiers where this is clearly al owed

Definitions
the
The following definition applies to this policy and all places where these terms are used in Fire and
Emergency:
Personal
Personal information means any information about an identifiable individual. The
information
Privacy Act 2020 applies to all personal information collected and held by Fire and
Emergency.
under
This includes information about people in our community, and information about
Fire and Emergency employees and volunteers or individuals who provide services
on behalf of the organisation.
Released
4 April 2022
4

Policy - Privacy
Related information
Who to contact:
If you have questions about this policy or to make a privacy complaint, email the Privacy Officer at
[email address]
Policies
1982
Code of Behaviour
Standards of conduct
Act
Guidelines
Managing privacy incidents
Making privacy complaints
Legislation
Privacy Act 2020
References
Privacy Act 2020 and the Privacy Principles

Information

Official

the

Document information
Owner
DCE Office of the Chief Executive
under
Steward
Privacy Officer
Last reviewed
4 April 2022
Review period
Yearly
Record of amendments
Date
Brief description of amendment
April 2022
Initial version.

Released
4 April 2022
5

Document Outline