An introduction to DPUP — presentation

In short

• Developed by the social sector for the social sector.
• On the collection or use of data or information from or about service users.
• Recommendations go beyond the law, and are clear when they do so and why.
• Provides guidance how to do this in the most respectful, transparent and trustworthy way.
• Focuses on relationships, values and behaviours more than rules.
• Offers a good practice guide, in a way that makes sense in the context.
• Now part of Government Chief Privacy Officer’s Privacy Maturity Assessment Framework.

The power of data

People’s data and information is used in all sorts of situations, for example:

• when service users are asked to fill out a form about themselves, this information or data is recorded and may be used to make decisions or provide them with support
• when decision makers are thinking about what data and information service users should be asked for, for example to:
  
  • decide if they are eligible for a service
  • learn how helpful a service or programme is
  • help make decisions about how much money a service needs, or if there should be different types of service or programmes for people
  • help understand what situations look like for service users and communities
• when data or information from or about service users is being looked at, made sense of, or used in any way (like the above examples), even if the person using it doesn’t know the individuals the information is about.

It all starts with ‘why’

Why should I learn about DPUP or think about it in my work?

• The Public Service is about people (he tāngata).
• People’s information can be powerful, so trust is vital.

DPUP will help you:

• use data and information in the most respectful, transparent and trustworthy way.
• use it to grow the knowledge about how best to support people’s wellbeing
• build trust with service users in how you care for their information.

The journey

Mid-2016

• Non-governmental organisations (NGOs) were asked to provide individual client level data (ICLD) to the Ministry of Social Development (MSD).
• Office of the Privacy Commissioner (OPC) made an inquiry following complaints about the request.

April 2017

The OPC inquiry found:

• no clear and defined purpose for ICLD
• not enough consideration of privacy risks
• not enough consideration of concerns raised
• proposal not justified or proportionate.

October 2017

• Government asked for discussion on the use of service user data and information in the social sector.
• The Social Wellbeing Agency led the engagement.

November 2019

Endorsed by Cabinet with 5 foundational agencies:

• Ministry of Social Development
• Oranga Tamariki
• Ministry of Education
• Ministry of Health
• Social Wellbeing Agency.

Engagement: Your voice, your data, your say

Between May and September 2018, the Social Wellbeing Agency asked New Zealanders for their thoughts about the Investing for Social Wellbeing Approach and what’s reasonable and what’s not when using people’s information.

Engagement included:

• 27 locations
• 83 hui
• 1,047 people
• 801 online survey responses.

What would you say?

These are some of the questions asked during the engagement:

• When we think about using people’s information, what’s reasonable and what’s not?
• How can organisations make it easy for people to understand what happens with their information?
• What principles should guide our thinking and our behaviour on this topic?

What would you say?

What people said

• “People are not numbers, stories create authentic data.”
• “Counsellors have huge files but won’t share that with me and it’s all about me!”
• “Nothing about us without us.”
• “Honesty of purpose is our tikanga and kawa.”
• “How do we best kaitiaki the pūrākau that have been so trustingly shared?” (How do we care for the stories?)
• “We over collect because we haven’t defined what the purpose is.”
• “It has to be about everyone, not just the government.”
• “Before you democratise data you’ve got to decolonise it.”
• “If the community holds the data, whānau can make better decisions about their lives.”
• “Be crystal clear about the why. Why is this information needed, and how it will be used for service provision.”

From voices to policy

• The Social Wellbeing Agency worked closely with the wider sector to develop DPUP.
• The cross-sector Design Reference Group (DRG) reviewed and provided feedback on the development of the draft Principles and Guidelines. (The DRG was made up of social sector representatives from NGOs and government agencies.)
• A ‘check in’ engagement was held, where people who had attended the first engagement were invited to review and give feedback on the draft DPUP.
• The DRG helped design, review and test the resources in the toolkit.
• Ministerial Working Group (government, non-governmental, service users representatives) took part from start to finish.

DPUP’s structure

Principles

DPUP and the Principles are more about relationships than rules because everything we do is about he tāngata — the people.

• He Tāngata: Focus on improving people’s lives — individuals, children and young people, whānau, iwi and communities.
• Manaakitanga: Respect and uphold the mana and dignity of the people, whānau, communities or groups who share their data and information.
• Mana Whakahaere: Empower people by giving them choice and enabling their access to and use of their data and information.
• Kaitiakitanga: Act as a steward in a way that people understand and trust.
• Mahitahitanga: Work as equals to create and share valuable knowledge.

Guidelines

• Purpose Matters: Be clear about the purpose of collecting or using people’s information. Collect only what is needed. Consider how using people’s information might affect their wellbeing and their trust in those using it.
• Transparency and Choice: Be transparent and help people understand why their information is needed and what happens with it. As much as possible, support their choices about what they want to share and how they want it used.
• Access to Information: Be proactive about supporting people to understand what information is held about them, their rights to access it and ask for corrections to be made. Look for ways to make this easy and safe for service users.
• Sharing Value: Work together, collaborate to make sure the best information is used in the most respectful and helpful way. Share insights across the sector to help grow knowledge and support wellbeing.

The DPUP toolkit

Resources for working with DPUP — a toolkit

The quiz

Question 1: Who was DPUP developed for?

Options

A. Government agencies

B. Any kind of non-governmental organisation (NGO) or charity in New Zealand

C. Government agencies, NGOs and other service providers

D. Any business or organisation that collects information about people

Answer

The correct answer is C.

People have asked whether DPUP could, or should, apply more broadly than the social sector given that its core ideas are respect, transparency and trust.

The answer is ‘yes’, much of what it contains is generally useful as good practice advice.

Find more information about the social sector in DPUP terminology

Question 2: What are the DPUP Principles?

Options

A. He Tāngata, Manaakitanga, Mana Whakahaere, Kaitiakitanga and Mahitahitanga

B. Partnership, Participation and Protection

C. Purpose Matters, Transparency and Choice, Access to Information and Sharing Value

D. Rangatiratanga, Whakapapa, Whanaungatanga, Kotahitanga, Manaakitanga and Kaitiakitanga

Answer

The correct answer is

A.Summary of each principle

He Tāngata: Focus on improving people’s lives — individuals, children and young people, whānau, iwi and communities.

Manaakitanga: Respect and uphold the mana and dignity of the people, whānau, communities or groups who share their data and information.

Mana Whakahaere: Empower people by giving them choice and enabling their access to and use of their data and information.

Kaitiakitanga: Act as a steward in a way that people understand and trust.

Mahitahitanga: Work as equals to create and share valuable knowledge.

Read the DPUP Principles

Question 3: Which statement best summarises the Purpose Matters Guideline?

Options

A. Being clear about why you need data means it’s easier to collect what you need right now, as well as things that you might need at some point in the future.

B. Be clear about purpose from the start to make sure data or information collection or use is based on a clear understanding of why it is needed, and that people’s information is used in a way that improves wellbeing and builds trust.

Answer

The correct answer is B.

The Purpose Matters Guideline encourages broader thinking, focused on relationships between New Zealanders who access services, and those who provide and fund them (usually government).

Being clear about purpose and involving others in its development is a foundation to having the most relevant, useful data or information, and collecting and using it in a respectful, trusted and transparent way.

Question 4: Which statement best summarises the Transparency and Choice Guideline?

Options

A. Aim for a ‘no surprises’ approach — service users should not be surprised about what information is held about them or how it’s used. Look for ways to provide as many choices as possible around what information people need to provide, how it’s recorded, who sees it, how it’s shared or used.

B. As long as there is no way to identify someone when their information or data is used, then they don’t need to know what it’s being used for. If people want to engage with services, then they are not able to have any choices about how or why their data or information is collected or used, or who gets to have it or see it.

Answer

The correct answer is A.

Question 5: Which statement best summarises the Access to Information Guideline?

Options

A. Under the Privacy Act 2020 people have the right to access, and ask for corrections to, their personal information.

The Access to Information Guideline is about Mana Whakahaere and being proactive around these rights. Explain these rights in a way people will understand, make it safe and easy to use them, or look for ways to offer access without service users even having to ask.

B. Under the Privacy Act 2020 people have the right to access and ask for correction of their personal information. Access to information is about having processes in place to respond to people's written requests to access their information.

Answer

The correct answer is A.

Note: There is no legal requirement for people to put a request in writing for their information.

Question 6: Which statement best summarises the Sharing Value Guideline?

Options

A. All data and information should be open and accessible by anyone who wants it. Sharing Value means that at the end of any work with data and information we let people know what we learned.

B. To make the most of the opportunities that come from data and information. Share the results, insights, analysis or appropriate data with those who have a legitimate interest or use for it.

Sharing Value is also about collaborating and having strong partnerships when it comes to making decisions about the collection or use of people’s data or information.

Involve others with an interest in your work, including service users if possible, from the beginning.

Answer

The correct answer is B.

Wrap up

Ask if the group has any remaining questions.

Thank them all for attending and let them know where they can go to for more detail (Data Protection and Use Policy).

Encourage participants to talk to others about what they learnt and how they might apply it in their day-to-day lives — both personally and professionally.