Dear Ministry of Education,

Given recent public reporting on cyber incidents involving sensitive personal information in New Zealand, there is heightened public interest in understanding the safeguards in place for systems collecting children’s data.

Under the Official Information Act 1982, please provide copies of documents that describe how access to student data within the Student Monitoring, Assessment and Reporting Tool (SMART) is governed, controlled, and monitored.

In particular, I request documents that address:
The role-based access control model for SMART, including which categories of data each role is permitted to access.

Differences in data access between user groups, including teachers, principals, Ministry of Education staff, Janison staff, and any subcontractors.

Whether access to SMART data is identifiable at the individual student level or restricted to aggregated or de-identified views for each role.

Audit logging, monitoring, and review arrangements for access to SMART data, including who can view audit logs and how inappropriate access or misuse is detected and managed.

This request includes any relevant policies, access control matrices, security documentation, contractual provisions, or internal guidance relating to data access and oversight.

Yours faithfully,

Phillip Fry