This resource was written by FMC Exec member David Barnes and adapted by FMC Development Officer Dan Clearwater.  If you have questions or further wisdom to offer, please contact FMC. 

Publicity about the arrival of the Privacy Act 2020 caused some clubs to wonder whether they were affected by the changes. While the changes themselves don’t legislate any new duties for clubs, there are plenty of aspects of the existing legislation (now incorporated in the new Act) which clubs should be aware of when they  handle personal information, so it’s timely to revisit them.

What is personal information?

The Act simply defines personal information as “information about an identifiable individual”. In practical terms, clubs often hold an individual’s name, address, phone and email details, age, occupation, spouse contact details etc.

What are the rules around collecting information?

A club can collect information it needs for a justifiable and lawful purpose. Looking at the example above, it’s reasonable for a club to know how to contact a member. On the other hand, a member may not want to be contacted by cellphone, so as long as there are reasonable ways of making contact, you can’t insist on having access to every contact detail. It’s hard to see why a club would need to record someone’s occupation. Age may be an issue if you have different categories of membership (e.g. youth or senior) but if the senior rate cuts in at 60, all you need to know is that the member is over 60. For youths, you may need to know their age so that you know when they cease to be in the youth category. Spouse contact details are sometimes used in emergencies (but aren’t any use if the spouse is on the trip), but it may be better to just ask for an emergency contact, which might not be a spouse.

What are the rules about disclosing information?

The example I use at work is when I hear “he’s not here today; he’s off sick” from a nearby desk. The caller has no need to know why my colleague is absent, and my employer (via another employee) has no right to tell anyone he’s sick.

The main justification for disclosing information is that the individual has consented to the disclosure. And it is lawful to disclose information if doing so aligns with the purpose it was collected for. So, if the Chief Guide asks a member to lead a trip, it’s reasonable that the member’s contact details will appear in the newsletter item promoting the trip.

One club I’m in used to print all members’ names and addresses in its annual journal. While that was legal in those pre-Privacy Act days, it’s not now, without consent from each member. And, why would you need to?

Newsletters and other media

Many clubs write up their trips and other activities in a newsletter, journal, website or social media post. These are all still covered by the legislation. But, as trip reports are a valuable source of information for trip planning, they’d lose some of their usefulness without names. Again, gaining consent is the answer.

Privacy Officer

Every ‘agency’ – and a club fits within that term – has to appoint a Privacy Officer, who is responsible for encouraging and ensuring compliance and dealing with requests under the Act. I strongly suspect that few if any clubs have ever done this. I suggest that it becomes a permanent addition to the secretary’s job description.

How can clubs ensure they comply?

Think about what personal information you’re gathering. When you’re gathering it, tell the person why you’re gathering it and what you might do with it. A good time to do that would be when someone joins the club and then with the annual subscription bill. Tell members what you might do with their information, and when the information is not essential to the running of the club – such as newsletter trip reports – include an opt-out clause.

What might that look like?

Here’s an example of a privacy policy you could adapt for inclusion in your new member application form.

The Backofbeyond Tramping Club takes your privacy seriously and aims to comply with the Privacy Act 2020.

We collect personal information to facilitate your participation on club activities and facilitate the administration of the club. You have the right to access any information held about you at any time, and to correct that information. 

The club’s Privacy Officer is the Secretary. Please contact the Privacy Officer if you have any concerns about our use of personal information.

The club often shares accounts of its activities, with photographs, in its newsletters and other media. This may include the names of participants. Your membership is agreement to this, unless you advise the club that you do not agree. You can request that your name and/or image be omitted from all publications by advising the Privacy Officer, or from individual articles by advising the trip leader. In such cases, your first name may still be used in the article. An “all publications” opt out will expire unless explicitly renewed when you renew your annual subscription.

Privacy Statement Generator developed by the Office of Privacy Commissioner might be helpful with drafting your club’s privacy policy.

First published in the June 2021 issue of FMC’s Backcountry magazine.  To get your copy, visit the FMC site to fine out how.