It may come as a surprise that parents, legal guardians, or caregivers do not automatically have a right to access their child’s personal information.
Under the Privacy Act 2020, a person can make a request to access personal information, with parents often assuming this means they can access their child’s personal information if held by an agency.
However, assessing and processing a request from a parent, legal guardian or caregiver is a two-step process:
- Step one: Determine whether the parent, legal guardian or caregiver is a representative.
- Step two: If they are a representative, then determine whether any of the refusal grounds apply.
Determining whether a parent, legal guardian or caregiver is a representative, requires agencies to consider: [1]
- ‘The age and maturity of the child and whether they are capable of understanding and exercising their rights under the Privacy Act’.
- ‘Any court orders relating to parental access or responsibility (e.g. protection orders, custody and guardianship orders)’.
- ‘Whether, based on what is known to the agency, it is (or isn’t) likely to be in the best interests of the child or young person for the parent, legal guardian or caregiver requesting the information to be able to exercise their child’s Privacy Act rights on their behalf.’
In some circumstances, there may be a family breakdown – such as family violence, or a custody or guardianship dispute. In these scenarios, the best interests of the child or young person should be a primary consideration. This involves an agency considering:
- Whether it is satisfied of the identity of the requestor (identification documents may be requested).
- Whether the interests of the child/young person and their parent/ legal guardian/ caregiver are the same or in conflict.
- Whether disclosing the information would go against the child’s interests.
- Whether there are reasonable grounds for believing the child or young person does not or would not wish the information to be disclosed.
- Whether any of the refusal grounds apply.
If the answer to any of the above is ‘yes’, an organisation may lawfully determine that the information is not provided under the Privacy Act 2020 to the parent. In that case, the request may be processed under the Official Information Act 1982 – if the agency is a public sector agency.
Note that a non-custodial parent[2] with guardianship rights[3] can exercise their child’s privacy rights in the same way the custodial parent can. So, an agency that receives an information request from a non-custodial parent should follow the same process for managing their request.
Further, in situations where parents are separated, agencies do not need the consent of the other parent (either custodial or non-custodial) to disclose information about the child or young person.
However, agencies need to consider if the information that may be disclosed could reveal personal information about the other parent – for example, the other parent’s home address or contact details where there is a protection order in place – and whether that information should be removed or redacted.
Lastly, if a Lawyer for Child has been appointed by the Family Court, they may request information held by an agency about the child or young person. In doing so, they should provide evidence of their appointment.
If you are an individual or organisation seeking further guidance in this area, please reach out to our experts.
[1] Office of the Privacy Commissioner | Sharing personal information about children and young people
[2] A parent who does not live with their child most of the time.
[3] They will have guardianship rights if they meet the test in section 17 of the Care of Children Act 2004 (or are otherwise appointed by the Court).
