Policy
Privacy
Introduction
When to use
Use this policy when you want to understand the requirements for col ecting,
storing, handling and using personal information at Fire and Emergency New
Zealand when we are not operating in an emergency.
Note: Application of the Information Privacy Principles (IPPs) may differ when Fire
ACT 1982
and Emergency is operating in an emergency situation.
This policy should also be used when managing a privacy incident or making a
privacy complaint, in conjunction with the Managing privacy incidents guidelines or
Making privacy complaints guidelines.
Note: You should read this policy in conjunction with Te Tikanga Whanonga Our
Code of Conduct and Unacceptable behaviours schedule.
Contents
This policy contains the following content:
About this policy
INFORMATION
Definitions
Policy statements
Good information privacy practice at Fire and Emergency
Responsibilities
Related information
About this policy
Purpose
This purpose of this policy is to set expectations for ensuring that Fire and
Emergency only col ects personal information for a lawful purpose, safely and
securely stores personal information, and ensures personal information is not used
or disclosed for unauthorised purposes. It is also to ensure individuals are
protected from any harm that could result from breaches of the Privacy Act 2020.
This policy sets out expectations for those that col ect, hold, use or disclose
personal information so that Fire and Emergency complies with the responsibilities
set out in the Privacy Act 2020. That is, we treat the personal information we
collect and hold lawfully, respectfully and with care, and only use or disclose
personal information where permitted. The purpose of this policy is also to ensure
that privacy incidents and complaints are managed appropriately.
This policy also sets expectations in relation to persons requesting access to their
personal information and taking reasonable steps to update personal information
when it is wrong.
RELEASED UNDER THE OFFICIAL
4 June 2025
1
Policy - Privacy
Who it applies to
We expect the following groups of people to comply with this policy:
• permanent and temporary employees
• casual employees
• volunteers
• contractors (individuals, employees of contractors, subcontractors, or persons
affiliated with third parties)
• anyone working on behalf of Fire and Emergency (for example, service
providers).
In some cases, our providers will have their own privacy policy, however, when
these providers are delivering services on our behalf, the requirements of this
ACT 1982
policy will apply instead.
Everyone has a duty to meet the commitment and requirements statements below.
Definitions
The following definitions apply to this policy and all places where these terms are used in Fire and
Emergency:
Personal
Personal information means any information about an identifiable individual. The
information
Privacy Act 2020 applies to all personal information collected and held by Fire and
Emergency.
INFORMATION
Personal information includes information about people in our community, and
information about Fire and Emergency employees and volunteers or individuals
who provide services on behalf of the organisation.
Examples of personal information include names, addresses and contact details,
and also location of incidents if they occurred on private property.
Sensitive personal Sensitive personal information is information about an individual that has some
information
real significance to that person, is revealing of them, or generally relates to
matters an individual might want to keep private. This includes information that
will potentially allow others to draw inferences about the individual, or might
result in the individual being treated a certain way.
Examples of sensitive personal information include information about a person’s
race, ethnicity, gender or sexual orientation, health, disability, age and religious,
cultural and political beliefs.
Policy statements
Our commitment
At Fire and Emergency, we’re committed to respecting the information we collect
and hold about other people and ensuring we treat it lawfully and with care.
Everyone at Fire and Emergency deals with information in some way, including
personal information about people, which can be sensitive, such as the identities
of victims involved in emergency incidents. The communities we serve have a right
RELEASED UNDER THE OFFICIAL
to expect that we will respect their privacy and comply with our legal obligations.
4 June 2025
2
Policy - Privacy
Requirements
As personnel of Fire and Emergency, we are responsible for ensuring the
collection, use, disclosure and storage of any personal information complies with
the IPPs in the Privacy Act 2020.
Further detail on the IPPs is provided below, and guidance is also available on the
Office of the Privacy Commissioner’s website at privacy.org.nz > Privacy Act 2020 >
Privacy Act 2020 and the Privacy Principles.
Minimising risk
Fire and Emergency will consider the IPPs each time a system or process that
col ects, uses, discloses and/or stores personal information is reviewed, adapted or
developed.
The Privacy Officer must be engaged at the outset of any new initiative to
determine whether a Privacy Impact Assessment (PIA) is required.
ACT 1982
Privacy Impact
A Privacy Threshold Assessment must be completed at the outset of any new
Assessments (PIA) initiative or project to determine whether a Privacy Impact Assessment (PIA) is
required.
There is more information about completing a PIA on the Office of the Privacy
Commissioner’s website at privacy.org.nz > Your responsibilities > Privacy Impact
Assessments.
Privacy incidents
All privacy breaches and near misses (collectively known as privacy incidents)
regarding unauthorised access to, correction of, use of or disclosure of personal
INFORMATION
information must be reported to the Privacy Officer.
Privacy incidents will be managed according to the Privacy incident process in the
Managing privacy incidents guidelines. Under this process, the Privacy Officer or
the Legal Team will take steps to:
• contain the breach and perform an initial assessment (contain)
• initiate an investigation, and evaluate the risks (evaluate)
• remedy and respond (notify)
• consider the cause and how to prevent it happening again (prevent).
The Privacy Officer will engage with and inform the Privacy Commissioner of
notifiable privacy breaches when appropriate and required to by law.
Privacy incidents wil be recorded by the Privacy Officer and reported on regularly
to Audit and Risk Committee of the Fire and Emergency New Zealand Board.
The Information and Communications Technology (ICT) Directorate may also be
involved in this process, in particular, when the incident involves a security breach.
Privacy complaints Privacy complaints wil be assessed, investigated and responded to according to
the process set out in the
Making privacy complaints guidelines.
The Privacy Officer will provide advice, assistance and oversight in the
management of privacy related complaints. Where the complaint is identified as a
breach, the privacy incident process set out in the
Managing privacy incidents
guidelines will also be followed.
RELEASED UNDER THE OFFICIAL
Privacy complaints will be recorded by the Privacy Officer and reported on
regularly to the Audit and Risk Committee of the Fire and Emergency New Zealand
Board.
4 June 2025
3
Policy - Privacy
Integrating privacy Privacy management must be considered at the initiation stage when developing,
into organisational updating or upgrading any of Fire and Emergency’s systems and processes. A
processes
Privacy Impact Assessment will usually be required before developing, updating or
upgrading systems and processes.
Col ecting and
When col ecting information, Fire and Emergency must be clear and open about
storing personal
our purposes for col ecting personal information, limit the intrusiveness of
information
col ection and keep the personal information secure.
(IPPs 1–5)
Fire and Emergency will:
• only collect information that is necessary and relevant to Fire and Emergency's
functions, and only col ect the minimum information necessary
ACT 1982
• wherever possible, collect personal information directly from the person or
people concerned
• be as open as possible about why the information is being collect, the intended
use of the personal information collected, and who will have access to the
information
• be clear about whether providing the information is compulsory or voluntary,
and what wil happen if the information isn’t provided
• col ect personal information in a way that respects individuals’ personal needs
for privacy
• ensure personal information held by Fire and Emergency is safe and secure
INFORMATION
• protect personal information held by Fire and Emergency from loss,
unauthorised access, use, modification or disclosure, or other misuse.
Note: During an emergency, there are different rules around col ecting and
gathering information under IPPs 2–4. For example, during an emergency, Fire and
Emergency can col ect and gather relevant information about a property without
the property owner’s consent. At any other time, we would require consent from
the property owner to col ect information about the property.
Accessing and
Fire and Emergency must facilitate requests from individuals to view and correct
correcting
their personal information.
personal
information
Fire and Emergency will:
(IPPs 6–7)
• give people access to their personal information if it is readily retrievable,
unless a withholding ground under the Privacy Act applies
• tell people that have requested their information that they are entitled to
request that we correct the information, if it is wrong
• make every effort to correct personal information on request
Note: If we are not wil ing or able to do this, an individual is entitled to require
us to attach a statement to the information setting out the corrections they
have asked for.
• ensure requests to access personal information are referred to the Information
Requests Team at [FENZ request email].
RELEASED UNDER THE OFFICIAL
4 June 2025
5
Policy - Privacy
• Ensure organisational controls are in place to support the implementation of this
policy
• Develop and provide training and communications to raise awareness of this
policy and build capability in good privacy practice
• Oversee privacy investigations and complaints
• Regularly report on privacy incidents, investigations and complaints
• Notify any notifiable privacy breaches to the Privacy Commissioner and the
individuals affected
Legal Directorate
• Provide legal advice in relation to compliance with the Privacy Act 2020 and
associated codes and regulations
• Provide legal advice in relation to information-sharing arrangements
• Assist with investigations and complaints involving privacy issues
ACT 1982
• Prepare Privacy Impact Assessments (as and when that is appropriate and
necessary)
Information and
• Ensure privacy has been appropriately considered before making or al owing
Communications
technology changes
Technology Directorate
• Address privacy concerns within their capability and capacity
Data and Analytics
• Ensure Person Private Information (PPI) data stored within the Modern Data
Directorate
Platform and our Geospatial platform has been appropriately identified as private
information, and has metadata which describes it
• Ensure that those accessing PPI from our data platforms are doing so
appropriately
INFORMATION
• Ensure Privacy Impact Assessments are completed and current for all data sets
stored on our data platforms
• Manage the appropriate sharing of PPI with third party organisations, including
other emergency services partners
Records Management
• Oversee the disposal of Fire and Emergency information, including personal
Team
information, to ensure it is in line with Public Records Act 2005 requirements
• Provide advice and support on the secure storage of personal information within
their capability and capacity
Managers and Supervisors • Identify privacy risk in their own teams and ensure appropriate controls are in
at all levels and all
place
locations
• Notify privacy incidents to their own manager and the Privacy Officer
• Liaise with the Privacy Officer following all privacy incidents
• Ensure personnel are aware of their obligations regarding personal information
and recognise the importance of their role in privacy
• Ensure new personnel complete privacy training as appropriate
• Model good privacy behaviour – take due care in managing and working with
personal information
• Take steps as advised by the Privacy Officer (or the Legal Team on behalf of the
Privacy Officer) following a privacy incident
All personnel (as described • Treat information with care and respect
in Who it applies to above) • Report al privacy incidents to a manager and the Privacy Officer
• Comply with this policy
RELEASED UNDER THE OFFICIAL
• Understand and apply this policy and the Information Privacy Principles (IPPs) in
their day-to-day work
• Refer to privacy guidance and seek advice from the Privacy Officer when needed
• Actively participate in privacy training
4 June 2025
7
