File photo. Photo: RNZ / Angus Dreaver
Oranga Tamariki is warning children might be put in danger by changes to the Privacy Act.
The government is moving to change the law in line with tighter data privacy regulations in the European Union.
This would likely oblige people to be told if their personal data was accessed by a third party, when at present they do not have to be notified.
The child protection agency, one of 53 submitters on the changes, said children and teenagers came to it expecting confidentiality - not that the people they were talking about would then have to be alerted by OT.
"We ... need to consider the trust, safety, and wellbeing of tamariki and rangatahi when they are the ones providing us with personal information about third parties with an expectation of confidentiality," it said in its submission to the Ministry of Justice.
"Notification could not only frustrate the purpose of collection but put tamariki, rangatahi, their whānau, or others in danger."
It might discourage children from speaking openly with OT, it warned.
"It may also create a chilling effect whereby agencies are more reluctant to share concerns about a child or whānau."
The government has given the European Union undertakings it will change the Privacy Act next year to more closely align it with the EU's tighter General Data Privacy Regulation or GDPR, some of the strictest rules in the world.
The Ministry of Social Development (MSD) backed up Oranga Tamariki.
"MSD regularly provides information to Oranga Tamariki, for instance, about family and whānau members who may be at risk of serious harm," MSD said in its submission.
"It is quite possible that being obligated to disclose information about that sharing would lead, in some cases, to physical harm to individuals."
The Ministry of Justice's discussion document failed to highlight "the potential risks to security from sharing information ... that might, in the wrong hands, lead to an individual being harmed".
The Ministry of Justice has issued a summary of the submissions.
But Privacy Commissioner Michael Webster said the Privacy Act existed to protect privacy rights, including of vulnerable children. And the act already included exceptions that addressed many of the concerns that had been outlined in the Ministry of Justice's summary of engagement document.
"There are existing exceptions in the act that make it very clear the health and safety of individuals, including vulnerable children, are a priority.
"There is no intention to weaken these safeguards. Child safety will always be paramount," Webster said.
The police were worried any new notification obligations would constrain them because they get a lot of personal information second-hand from other agencies.
The spy agencies SIS and GCSB are asking to be exempt.
They had a "unique role in collecting, using and disclosing personal information", they argued in a joint submission.
"To enable our ability to perform these functions, we request that the agencies be exempt if a new notification requirement for collection of personal information from third parties is added to the Privacy Act."
"We also consider that appropriate exemptions should be given to third parties receiving personal information from the agencies for the same reason."
The Ministry of Education was among perhaps half of submitters who backed the change to promote transparency and accountability.
But the ministry - like many others - warned people would get "notification fatigue" if lawmakers were not careful.
The danger was people would be continually getting online alerts notifying them that someone else had got hold of data about them second-hand, various submitters said.
Lawyers have warned businesses could bear the brunt, and MSD said the "compliance burden would potentially be very high".
Many submitters questioned how, technically, notification would even be possible.
OT questioned the practicalities.
"It is highly impracticable to expect that a neighbour, teacher or other concerned member of the public making a report of concern, or providing other information, would also need to notify the individuals concerned."
Like the spy agencies, Oranga Tamariki envisaged having to get some kind of exemption.
Currently, a lot of personal information gets shared online with third parties, for government data-matching or the likes of marketing purposes. In many cases this occurs after a person has provided a general waiver.
The largest single opposition bloc was the real estate industry.
Fourteen submitters argued the likely changes might crimp the collection of unconditional sales data including address and sale price, which is used for market appraisals.
The Insurance Council was among the many who urged caution.
"In considering changes to the Privacy Act, which we understand is Parliament's intention, it is imperative that any future notification obligations do not become unduly onerous for the notifying agency, or so overwhelming for an individual as to lose their effectiveness, with the result that the individual is no better informed of their privacy rights or suffers from notification fatigue," the council told the ministry.