U3A Tauranga Inc.
Adopted 12 June 2026
1. Purpose
These procedures outline how personal information is managed in practice by U3A Tauranga to comply with the Privacy Act 2020.
2. Roles and Responsibilities
2.1 Privacy Officer
The Executive will appoint a Privacy Officer who is responsible for: overseeing compliance with privacy obligations; handling requests for access or correction; managing privacy breaches; and acting as the contact point for privacy enquiries.
2.2 Executive Members
Authorised Executive members: maintain the membership database; ensure information is accurate and up to date; and control and approve access to personal information.
2.3 Coordinators and Convenors
May access limited member information only where necessary for U3A activities, must not retain or reuse information for other purposes, and must ensure information is kept secure.
3. Storage and Security
3.1 Electronic Records
Membership data is stored electronically with restricted access, limited to authorised Executive members.
3.2 Physical Records
Printed lists or documents are kept in secure locations.
4. Access to Membership Information
- Access to the full membership list is restricted to authorised Executive members
- Limited information may be shared with Coordinators or Conveners where necessary
- Access must be: for a specific purpose and approved by the Executive
- Access is temporary and must not continue beyond the required task.
5. Use of Information
- Personal information may only be used for U3A-related purposes
- Information must not be used for personal, commercial, or unrelated activities.
6. Sharing Information
- Information may be shared internally where necessary for U3A operations
- Where external service providers are used (e.g. banking, database systems):
- only necessary information is shared
- providers are expected to protect the information.
7. Email Communication
- When sending emails to multiple recipients, the Bcc function must be used.
- Member email addresses must not be disclosed without consent.
8. Photos and Videos
- Members should be informed when photos or videos are being taken
- Members may choose not to be included
- Consent must be obtained before publishing on social media
- Any concerns raised by members must be respected and acted on.
9. Retention & Disposal
9.1 Retention
- Members information is retained only as long as necessary
- Information relating to former members is retained for up to two years.
9.2 Disposal
- Paper records must be shredded or securely destroyed
- Electronic records must be permanently deleted
- Devices (e.g. laptops, external drives) must be wiped and hard drives removed and destroyed, before disposal.
10. Access and Correction Requests
- Requests must be directed to the Privacy Officer
- Requests should be acknowledged promptly
- Information must be provided within a reasonable timeframe (normally within 20 working days)
- If a correction is requested: the information should be updated where appropriate; or if not corrected, a note of the requested correction should be retained
11. Privacy Breaches
11.1 Reporting
Any member of U3A who becomes aware of a potential privacy breach must report it immediately to the Privacy Officer.
11.2 Assessment
The Privacy Officer will assess what information was involved and the risk of harm to individuals.
11.3 Response
Where a breach is likely to cause serious harm, affected individuals will be notified and the Privacy Commissioner will be notified. Steps will also be taken to contain the breach and prevent recurrence.
12. Review
This policy will be reviewed periodically, and at least every 3 years, to ensure it remains appropriate and consistent with New Zealand legislation and the needs of U3A Tauranga.
13. Associated Documents
- Form – Removal and Destruction of U3A Electronic and Printed Membership Records and Information
Approval Date: 12-June-2026
President: Bev Edlin
Next Review Date: 2028