Privacy for clubs, charities, marae and community groups

The Privacy Act applies to sports clubs, kapa haka groups, churches, school boards, residents’ associations, charities and marae committees just as it applies to businesses. Volunteer groups have particular risks. Information lives in personal email accounts and phones, committee members change every year, and nobody owns the spreadsheet.

Name a privacy officer

Every organisation must have one. In a small group it can be the secretary or another committee member. Their job is to be the person people go to with requests or concerns, and to keep the group’s habits on track. Put their name and contact on your website or newsletter.

Collect less

Membership forms tend to grow. Go through yours and ask what you use each answer for. Common things to drop include full date of birth when you only need an age group, home address when you only post by email, occupation, and “any other information”.

If you collect health information, such as medical conditions for sport or camps, collect only what’s needed for safety, keep it with the person responsible for first aid, and destroy it after the season or event.

Tell people what you do with it

Put a short notice on your membership form saying what you collect, why, who sees it, and how to ask for a copy or correction. The Privacy Commissioner’s free Privacy Statement Generator can produce a fuller statement for your website. If you collect children’s information from parents, tell the parents so they can explain it to their children.

Keep it in one place, owned by the group

• Use a group account, such as a shared drive or membership system owned by the organisation rather than a volunteer’s personal email.
• When committee members leave, remove their access and make sure they hand over or delete copies.
• Turn on two-step verification for the group’s accounts.
• Use BCC, or a mailing tool, for group emails. Exposing everyone’s email address is one of the most common volunteer-group breaches.

Photos and publishing

Get agreement before publishing photos of identifiable people, and especially children. Offer an opt-out on the membership form. Use first names only for children in newsletters and social media. Don’t publish home addresses or phone numbers in member directories without consent.

Children and young people

The Act requires particular care when collecting information from children and young people. Collect only what you need, explain things in language they understand, and think about what a child’s information on a public results page or team photo could reveal about where they’ll be and when.

When something goes wrong

If information goes to the wrong people, a laptop is lost or an account is hacked, follow the same steps as any organisation. Contain it, assess it, and notify the Privacy Commissioner and affected people if it’s likely to cause serious harm. Our breach assessment record helps you decide.

Handover checklist for the AGM

Each year when the committee changes, the outgoing privacy officer should hand over:

• where the group’s personal information is stored, and who has access
• passwords and account recovery details for group accounts
• any open requests or complaints
• what should be deleted (last year’s camp forms, old applications)