Privacy Notice
Introduction
The Education Review Office (ERO) is committed to protecting personal information and complying with the Privacy Act 2020.
ERO collects, uses, stores and shares personal information to carry out its functions under the Education and Training Act 2020 and other applicable legislation.
ERO undertakes review and evaluation functions, including reviews and evaluations of schools, kura, early childhood education services and other education providers. ERO also undertakes regulatory functions, including licensing, registration, monitoring, inspection, investigation, compliance and enforcement activities.
You can expect to receive a specific privacy statement when ERO collects personal information directly from you.
This Privacy Notice explains ERO’s general approach to managing personal information.
What personal information ERO collects
The personal information ERO collects will depend on the function being performed. It may include:
names, roles and contact details;
demographic information where relevant to ERO’s functions;
employment, professional, governance and management information;
information relating to learners, children, parents, whānau and caregivers;
information provided during reviews, evaluations, inspections or investigations;
complaints, incident and safeguarding information;
licensing, registration, certification, compliance and enforcement information;
correspondence, records and supporting documents provided to ERO;
information required to assess statutory criteria, including fit and proper person requirements where relevant.
ERO only collects personal information where this is reasonably necessary for a lawful purpose connected with ERO’s functions.
Why ERO collects personal information
ERO collects personal information for purposes connected with its review, evaluation and regulatory functions.
Review and evaluation functions
conduct reviews, evaluations and investigations;
assess education quality, learner outcomes, safety, wellbeing and provider performance where relevant to ERO’s functions;
prepare review reports, evaluation findings and system-level insights;
respond to concerns raised during review activities;
support improvement and fulfil statutory reporting obligations.
Regulatory functions
assess licence, registration, certification or approval applications;
determine whether statutory and regulatory requirements are met;
make regulatory decisions;
monitor ongoing compliance;
undertake inspections, investigations and complaint management;
maintain regulatory records and historical compliance information;
exercise statutory compliance and enforcement powers.
How ERO collects personal information
ERO may collect personal information:
directly from individuals;
through forms, applications, declarations, correspondence and submissions;
during reviews, evaluations, inspections, interviews, visits, investigations and complaint processes;
from schools, kura, early childhood services, hostels and other education providers;
from applicants, licence holders, service providers, boards, governing bodies and staff;
from government agencies, regulators or other organisations where authorised by law.
Collection from other sources
ERO may collect personal information from a person or organisation other than the individual concerned where authorised by law or where the Privacy Act permits this.
Where ERO collects personal information indirectly, ERO will take the steps required by the Privacy Act 2020, including Information Privacy Principle 3A, unless an exception applies.
How ERO uses personal information
ERO uses personal information for purposes connected with its statutory functions, including:
review and evaluation activities;
regulatory decision-making;
licensing, registration, certification, monitoring and enforcement processes;
quality assurance and compliance monitoring;
complaint management and investigations;
analysis, reporting and system-level insights;
communicating with individuals, education providers, applicants and licence holders;
improving ERO services and operations.
Personal information will generally be used only for the purpose for which it was collected or for another purpose authorised by law.
Verification of information
ERO may verify information provided to it where this is necessary to carry out its functions. Verification may include checking information with education providers, applicants, licence holders, other agencies, regulators, or other persons where authorised by law.
Sharing and disclosure of information
ERO may share or disclose personal information where:
the individual has authorised the disclosure;
disclosure is required or authorised by law;
disclosure is necessary for ERO to carry out its functions;
disclosure is permitted under the Privacy Act 2020.
Depending on the circumstances, ERO may share information with education providers, applicants, licence holders, other government agencies, regulators, law enforcement agencies, contractors acting on ERO’s behalf, or other persons where authorised by law.
Storage and security
ERO uses security safeguards that are reasonable in the circumstances to protect personal information against loss, unauthorised access, use, modification, disclosure and other misuse. Personal information is managed in accordance with the Privacy Act 2020 and applicable information management, security and recordkeeping requirements.
How long is the information kept
ERO keeps personal information for as long as it is required for the purpose for which it was collected, for related lawful purposes, or to meet legal and public record keeping obligations.
Retention periods may vary depending on the type of information, the function being performed and applicable disposal authorities.
Your rights
Under the Privacy Act 2020, individuals generally have the right to request access to personal information ERO holds about them and to request correction of that information.
ERO may need to verify your identity before responding to a request. In some cases, the Privacy Act or another law may allow or require ERO to withhold information.
Privacy enquiries and complaints
If you have questions about this Privacy Notice, wish to request access to or correction of your personal information, or wish to raise a privacy concern or complaint, please contact ERO’s Privacy Officer through info@ero.govt.nz Attn Privacy Officer
If you are dissatisfied with ERO’s response, you may also contact the Office of the Privacy Commissioner.
Privacy statements on forms and applications
ERO provides specific privacy statements on forms, applications, review processes and other collection points.
These statements explain why the information is being collected, how it will be used, who may receive it, the consequences of not providing it, and how individuals may access or correct their information.
This Privacy Notice should be read together with any specific privacy statement provided at the point of collection