MD_OPS 2: How can you design data collection with your Māori customer(s) in mind?

Organisations collect and process data to support the delivery of products and services to customers, stakeholders, and citizens. Data collection occurs in many ways, including filling in a digital form on a website, sensors capturing environmental data like temperature or water flow rates, or a research team capturing data from participants in a university study. Organisations need to consider what data they are collecting, the purpose for collecting the data, and, in the case of personal information, to adhere to the New Zealand Privacy Act 2020. For additional considerations around the collection of personal information, see Using AWS in the Context of New Zealand Privacy Considerations.

• MD_OPS02-BP01: Consider adopting a privacy by design approach by designing and implementing mechanisms and processes that simplify compliance with the New Zealand Privacy Act 2020. When collecting and handling personal information, make sure you comply with all applicable laws, such as the New Zealand Privacy Act 2020. You can design continuous and informed consent mechanisms that provide clear information to users about what personal information is being collected and for what purpose. Consider incorporating mechanisms that make it easier for users to revoke consent and to request access to, or correction of, their personal information. Maintain consent management over how you capture, store, and preserve personal information. 

• MD_OPS02-BP02: Consider how you're communicating why you are collecting this data. Make it clear to users why the data is being collected, how it is used, and how privacy is maintained on an ongoing basis. Customers can interact with your organisation multiple times, so communicating what data is collected, why it is collected, and how it is collected in the context of the interaction may help. Also consider when to communicate this. Some examples include:

  • At the time a user registers or signs up to an organisation (for example, they sign up to a new bank, a new medical centre, or subscribe to a music streaming service).

  • At the time a user applies for a service from your organisation (for example, they apply for a home loan, book a medical exam, request a quote for home improvements, or apply for a government entitlement like a student loan).

  • At the time a user interacts with your organisation (for example, they lodge a complaint with a local council, submit an insurance claim, or request a change to a home loan).

• MD_OPS02-BP03: Consider important lineage and provenance of data that could be captured as additional data. It may be helpful to capture and store lineage and provenance data, which could be included as metadata or a tag. This kind of additional data can provide additional context to the data, such as when it was collected, how it was collected and who was involved in the collection. Maintaining careful records of the data provenance can build trust in the integrity and authenticity of the data and from whom the data was derived. An example of this is a hapū's cultural archive which captures which whānau provided which cultural record. It could also apply to organisations conducting surveys of specific populations for the purpose of creating data sets or performing data analysis.