Privacy Amendment Act 2013

1: Title
This Act is the Privacy Amendment Act 2013.
2: Commencement
1: Section 11 Schedule
2: The rest of this Act comes into force on the day after the date on which it receives the Royal assent. Section 2(1) brought into force 3 October 2013 Privacy Amendment Act 2013 Commencement Order 2013
3: Principal Act amended
This Act Privacy Act 1993 2013-02-27 Privacy Act 1993 SR 2013/341 2013-10-03 Privacy Act 1993 section 11 (which inserts Schedule 2A); brought into force on 3 October 2013 by SR 2013/341/2.
4: Interpretation
1: The definition of personal information section 2(1) (as defined by the Births, Deaths, Marriages, and Relationships Registration Act 1995)
2: Section 2(1) serious threat
a: the likelihood of the threat being realised; and
b: the severity of the consequences if the threat is realised; and
c: the time at which the threat may be realised
5: Information privacy principles
1: Information privacy principle 10(d) in section 6 serious and imminent threat serious threat (as defined in section 2(1))
2: Information privacy principle 11(f) in section 6 serious and imminent threat serious threat (as defined in section 2(1))
6: Functions of Commissioner
Section 13
1AA: Without limiting subsection (1), the functions of the Commissioner in relation to information sharing under Part 9A
a: to make submissions on an information sharing agreement for which approval by Order in Council under section 96J
b: to report to a relevant Minister, under section 96P(1)
c: to publish a copy of a report referred to in paragraph (b) section 96P(3)
d: to receive and investigate complaints about any alleged interference with privacy under an approved information sharing agreement in accordance with Part 8:
e: if appropriate under the circumstances, to exempt an agency, under section 96R section 96Q
f: to conduct a review under section 96W
g: to report to a relevant Minister under section 96X section 96W
h: to require a public sector agency to report, in accordance with section 96S
1AB: In subsection (1AA) adverse action approved information sharing agreement information sharing agreement lead agency relevant Minister section 96C
7: Interference with privacy
Section 66(1)﻿(a)
iia: the action breaches an information privacy principle or a code of practice as modified by an Order in Council made under section 96J
iib: the provisions of an information sharing agreement approved by an Order in Council made under section 96J
8: New Part 9A inserted
The following Part is inserted after Part 9
9A: Information sharing
1: Preliminary matters
96A: Purpose of Part
1: The purpose of this Part is to enable the sharing of personal information to facilitate the provision of public services.
2: To achieve that purpose, this Part—
a: provides a mechanism for the approval of information sharing agreements for the sharing of information between or within agencies; and
b: authorises exemptions from or modifications to—
i: any of the information privacy principles (except principles 6 and 7, which relate respectively to the right to have access to, and correct, personal information):
ii: any code of practice (except any code of practice that modifies principles 6 and 7); and
c: reduces any uncertainty about whether personal information can be lawfully shared for the provision of the public services, and in the circumstances, described in approved information sharing agreements.
96B: Relationship between this Part and other law relating to information sharing
1: To avoid doubt, nothing in this Part—
a: limits the collection, use, or disclosure of personal information that is authorised or required by or under any enactment; and
b: compels agencies to enter into an information sharing agreement if those agencies are already allowed to share personal information—
i: by or under any other enactment:
ii: in circumstances where an exemption from or a modification to any 1 or more of the information privacy principles or any code of practice is not required to make the sharing of the information lawful.
2: Without limiting subsection (1)﻿(a)
a: this Part does not limit section 7, 54 or 57; and
b: this Part and Parts 10 and 11 do not limit one another.
3: An information sharing agreement may—
a: duplicate an information sharing provision by providing for an agency to share the same personal information as specified in the information sharing provision—
i: with the same agencies specified in the information sharing provision; and
ii: for the same purposes specified in the information sharing provision; or
b: extend an information sharing provision that is not a restricted information sharing provision by providing for an agency to share the same personal information as specified in the information sharing provision—
i: with the same agencies specified in the information sharing provision for a purpose not specified in the information sharing provision; or
ii: with an agency not specified in the information sharing provision for a purpose specified in the information sharing provision; or
iii: with an agency not specified in the information sharing provision and for a purpose not specified in the information sharing provision; or
c: duplicate a restricted information sharing provision by providing for an agency to share the same personal information as specified in the restricted information sharing provision—
i: with the same agencies specified in the restricted information sharing provision; and
ii: for the same purposes specified in the restricted information sharing provision; or
d: extend in any manner specified in paragraph (b)
i: the restricted information sharing provision is an information matching provision (as defined in section 97); or
ii: there is express statutory authorisation to do so.
4: In subsection (3) information sharing provision restricted information sharing provision
96C: Interpretation
In this Part, unless the context otherwise requires,— adverse action approved information sharing agreement code of practice department
a: the New Zealand Police:
b: the New Zealand Transport Agency information sharing agreement agreement lead agency
a: the agreement; and
b: the Order in Council approving the agreement local authority Order in Council sections 96V(3) and 96Z section 96J(1) organisation
a: an organisation named in Part 2 of Schedule 1 of the Ombudsmen Act 1975; and
b: an organisation named in Schedule 1 of the Official Information Act 1982 private sector agency public sector agency public service
a: by or under law; or
b: by a policy of the Government relevant Minister sharing
a: collecting the information:
b: storing the information:
c: checking the information:
d: using the information:
e: disclosing the information:
f: exchanging the information:
g: if necessary, assigning a unique identifier to an individual.
2: Information sharing agreements
Authority for information sharing
96D: Information sharing between agencies
An approved information sharing agreement may authorise an agency to share any personal information with 1 or more other agencies in accordance with the terms of the agreement.
96E: Information sharing within agencies
An approved information sharing agreement may authorise a part of an agency to share any personal information with 1 or more parts of the same agency in accordance with the terms of the agreement. Parties
96F: Parties to information sharing agreement
1: Any 2 or more of the following may enter into an information sharing agreement:
a: a public sector agency:
b: a private sector agency:
c: a part of a public sector agency:
d: a part of a private sector agency.
2: Subsection (1) subsections (3) and (4)
3: An overseas agency may not enter into an information sharing agreement.
4: At least 1 of the agencies that enters into an information sharing agreement must be—
a: a public sector agency that is a department; or
b: part of a public sector agency that is a department.
96G: Representative parties
1: An agency that represents the interests of a class of agencies may enter into an information sharing agreement with a department if that agency is—
a: a public sector agency that is not a department; or
b: a private sector agency.
2: If an agreement is proposed to be entered into under subsection (1) Schedule of Parties
3: At any time after an agreement has been entered into the lead agency may, with or without the consent of any agency,—
a: amend the Schedule of Parties to add or remove agencies as parties:
b: substitute a new Schedule of Parties.
4: An agency that becomes a party to the agreement under subsection (2) or (3)
5: Unless the context otherwise requires, every reference in this Part subsection (2) or (3) Lead agency
96H: Determining which party is lead agency
1: If only 1 public sector agency that is a department enters into an information sharing agreement, it must be designated as the lead agency for the agreement.
2: If more than 1 public sector agency that is a department enters into an information sharing agreement, the parties to the agreement may agree between themselves which of those public sector agencies is to be designated as the lead agency. Form and content
96I: Form and content of information sharing agreement
1: An information sharing agreement must be in writing.
2: An information sharing agreement must—
a: specify with due particularity the purpose of the information sharing agreement:
b: set out the information referred to in section 96K
c: contain an overview of the operational details about the sharing of information under the agreement:
d: specify the safeguards that will apply to protect the privacy of individuals and ensure that any interference with their privacy is minimised:
e: if a party to the agreement is a private sector agency, state which public sector agency will be responsible for dealing with complaints about an alleged interference with privacy if the private sector agency is unable to be held to account for those complaints:
f: state that every party to the agreement must give any reasonable assistance that is necessary in the circumstances to allow the Commissioner or an individual who wishes to make a complaint about an interference with privacy to determine the agency against which the complaint should be made:
g: if entered into under section 96G
i: identify the party that is a public sector agency or private sector agency representing the interests of a class of agencies; and
ii: describe that class of agencies; and
iii: include a schedule that sufficiently identifies the public sector agencies or private sector agencies within that class that are parties to the agreement.
3: An information sharing agreement may specify any other terms or conditions that the parties may agree, including—
a: the fees and charges that are payable under the agreement; and
b: any other business processes relating to the sharing of information under the agreement. Approval of information sharing agreements
96J: Governor-General may approve information sharing agreement by Order in Council
1: The Governor-General may, by Order in Council made on the recommendation of the relevant Minister, approve an information sharing agreement.
2: An Order in Council may grant an exemption from or modify the application of—
a: any 1 or more of the information privacy principles (except principles 6 and 7):
b: any code of practice (except any code of practice that modifies principles 6 and 7).
3: An Order in Council that, under subsection (2)
4: An Order in Council that, under subsection (2)
96K: Requirements for Order in Council
An Order in Council must—
a: state, if applicable,—
i: the nature of the exemption granted under section 96J(2)
ii: how any of the information privacy principles or any code of practice will be modified under section 96J(2)
b: state the public service or public services the provision of which the information sharing agreement is intended to facilitate:
c: specify with due particularity the personal information or the type of personal information to be shared under the agreement:
d: set out the parties, or classes of parties, to the agreement and designate 1 of the parties as the lead agency:
e: for every party to the agreement,—
i: describe the personal information or type of personal information that the party may share with each of the other parties; and
ii: state how the party may use the personal information; and
iii: state the adverse actions that the party can reasonably be expected to take as a result of sharing personal information under the agreement; and
iv: specify the procedure that the party must follow before taking adverse action against an individual as a result of sharing personal information under the agreement if the requirement in section 96Q(1) section 96R(a)﻿(ii)
f: state how a copy of the agreement can be accessed.
96L: Further provisions about Order in Council
1: An Order in Council must provide that it comes into force on a date specified in the Order in Council (which must not be a date that is before the date on which it is made).
2: An Order in Council remains in force until it—
a: expires on a date appointed in the Order in Council (if any); or
b: is revoked.
3: An Order in Council must insert into Schedule 2A
a: a description of each of the following:
i: the information sharing agreement that is approved by the Order in Council:
ii: the public service or the public services the provision of which the agreement is intended to facilitate:
iii: the personal information or type of personal information that may be shared between or within the agencies that are party to the agreement; and
b: the name of the agreement; and
c: the name of the lead agency for the agreement; and
d: the Internet site address where a copy of the agreement can be accessed.
96M: Application of Acts and Regulations Publication Act 1989 and Regulations (Disallowance) Act 1989
An Order in Council is a regulation for the purposes of—
a: the Acts and Regulations Publication Act 1989; and
b: the Regulations (Disallowance) Act 1989. Procedure for recommending Order in Council
96N: Matters to which relevant Minister must have regard before recommending Order in Council
1: Before recommending the making of an Order in Council, the relevant Minister must—
a: be satisfied of the matters set out in subsection (2)
b: have regard to any submissions made under section 96O(1)﻿(a)
2: The matters referred to in subsection (1)﻿(a)
a: that the information sharing agreement will facilitate the provision of any public service or public services:
b: that the type and quantity of personal information to be shared under the agreement are no more than is necessary to facilitate the provision of that public service or those public services:
c: that the agreement does not unreasonably impinge on the privacy of individuals and contains adequate safeguards to protect their privacy:
d: that the benefits of sharing personal information under the agreement are likely to outweigh the financial and other costs of sharing it:
e: that any potential conflicts or inconsistencies between the sharing of personal information under the agreement and any other enactment have been identified and appropriately addressed.
96O: Consultation on proposed information sharing agreement
1: The agencies proposing to enter into an information sharing agreement must, before the proposed agreement is concluded,—
a: consult with, and invite submissions on the proposed agreement from,—
i: the Commissioner; and
ii: any person or organisation that the agencies consider represents the interests of the classes of individuals whose personal information will be shared under the proposed agreement; and
iii: any other person or organisation that the agencies consider should be consulted; and
b: have regard to any submissions made under paragraph (a)
2: The Commissioner—
a: must consider the privacy implications of the proposed agreement; and
b: may make any submissions under subsection (1)﻿(a)﻿(i)
3: The agencies must give the relevant Minister a copy of the submissions made under subsection (1)﻿(a) Commissioner's report on approved information sharing agreement
96P: Commissioner may prepare and publish report on approved information sharing agreement
1: If an information sharing agreement is approved by Order in Council, the Commissioner may prepare a report to the relevant Minister on any matter relating to privacy that arises or is likely to arise in respect of the agreement.
2: Without limiting subsection (1)
a: any comment that he or she wishes to make about the consultation that the agencies carried out under section 96O(1)﻿(a)
b: any submissions that he or she made to the agencies under section 96O(1)﻿(a)﻿(i)
3: The Commissioner—
a: may publish a report under subsection (1)
b: must consult the relevant Minister before doing so.
3: Matters relating to operation of approved information sharing agreements
Notice of adverse action
96Q: Requirement to give notice of adverse action
1: A party to an approved information sharing agreement must give written notice to an individual before it takes any adverse action against the individual on the basis (whether wholly or in part) of personal information about the individual that was shared under the agreement.
2: The notice must—
a: give details of the adverse action that the party proposes to take and the personal information about the individual on which the action is based; and
b: state that the individual has 10 working days from the receipt of the notice in which to dispute the correctness of that personal information.
3: To avoid doubt, an individual who is given the notice may take any steps that are available under any enactment to dispute any proposed adverse action against him or her, but he or she may show cause under this section as to why the proposed adverse action should not be taken only on the basis that it is based on incorrect personal information.
96R: When requirement to give notice of adverse action applies
The requirement to give notice under section 96Q
a: an approved information sharing agreement provides that a party to the agreement may—
i: give a shorter period of notice than the 10-working-day period referred to in section 96Q(2)﻿(b)
ii: dispense with the giving of the notice; or
b: if an approved information sharing agreement does not provide in the manner specified in paragraph (a)
i: give a shorter period of notice than the 10-working-day period referred to in section 96Q(2)﻿(b)
ii: dispense with the giving of the notice. Responsibilities of lead agency
96S: Responsibilities of lead agency
1: A lead agency for an information sharing agreement must, if the agreement is approved by Order in Council under section 96J(1)
a: make a copy of the agreement—
i: available for inspection, free of charge, at the lead agency's head office on any working day; and
ii: accessible, free of charge, on an Internet site maintained by or on behalf of the lead agency; and
b: prepare a report on the operation of the agreement at the intervals required by the Commissioner under section 96U
c: carry out any other responsibilities imposed by this Part.
2: A lead agency does not need to comply with subsection (1)﻿(a)﻿(ii)
3: To avoid doubt, nothing in this section applies to a party to an information sharing agreement that is not the lead agency except as provided in subsection (2)
96T: Report of lead agency
1: A report prepared by a lead agency under section 96S(1)﻿(b)
a: the costs of reporting:
b: the degree of public interest in information about the matters prescribed in those regulations:
c: the significance of the privacy implications of the approved information sharing agreement.
2: A report must be included—
a: in the lead agency's annual report under the Public Finance Act 1989, if it is required annually; or
b: in the lead agency's annual report under the Public Finance Act 1989 that immediately follows the end of each interval specified under section 96U(1)﻿(b)
96U: Commissioner may specify frequency of reporting by lead agency
1: The Commissioner may require a lead agency to prepare a report under section 96S(1)﻿(b)
a: annually; or
b: at less frequent intervals that the Commissioner may specify.
2: In determining the appropriate frequency in subsection (1) section 96S(1)﻿(b)
a: the costs of reporting:
b: the degree of public interest in information about the matters prescribed in regulations made under this Act:
c: the significance of the privacy implications of the approved information sharing agreement. Amendment of approved information sharing agreements
96V: Amendment of approved information sharing agreement
1: This section applies if the parties to an approved information sharing agreement amend the agreement (whether in accordance with the Commissioner's recommendation in a report under section 96X(1)
2: As soon as practicable after the amendment is made, the lead agency must—
a: give written notice of the amendment to—
i: the Commissioner; and
ii: the relevant Minister; and
b: make a copy of the amendment—
i: available for inspection, free of charge, at the lead agency's head office on any working day; and
ii: accessible, free of charge, on the Internet site where a copy of the agreement is accessible.
3: The information sharing agreement approved by Order in Council continues to have effect as if the amendment notified under subsection (2)
4: Sections 96J to 96P
5: Nothing in subsection (2)﻿(a), (3), or (4)
a: the fees and charges payable under the agreement; or
b: the name or description of a party to the agreement; or
c: any terms or conditions of the agreement that the lead agency considers, after consulting the Commissioner, do not, or are unlikely to, have any effect on the privacy implications of the agreement. Review of approved information sharing agreement
96W: Review of operation of approved information sharing agreement
1: The Commissioner may, on his or her own initiative, conduct a review of the operation of an approved information sharing agreement—
a: at the end of a period of 12 months after the Order in Council approving the agreement is made; and
b: at any time that the Commissioner considers appropriate for any subsequent reviews.
2: In conducting a review, the Commissioner must—
a: consult the following about the review:
i: the parties to the agreement:
ii: any person or organisation that the Commissioner considers represents the interests of the classes of individuals whose personal information is being shared under the agreement; and
b: consider any submissions made on the review.
3: The parties to the agreement must take all reasonable steps to co-operate with the review.
96X: Report on findings of review
1: After completing a review under section 96W
a: operating in an unusual or unexpected way (that is, in a way that was not foreseen by the Commissioner or the parties to the agreement at the time the agreement was entered into):
b: failing to facilitate the provision of the public service or public services to which it relates:
c: unreasonably impinging on the privacy of individuals:
d: operating in such a way that the costs of sharing personal information under the agreement outweigh the benefits of sharing it.
2: The Commissioner may recommend in the report that—
a: the parties to the agreement should amend it in 1 or more material respects; or
b: the Order in Council by which the agreement was approved should be revoked.
96Y: Relevant Minister must present to House of Representatives copy of report under section 96X(1) and report setting out Government's response
The relevant Minister must—
a: present a copy of a report under section 96X(1)
b: as soon as possible after complying with paragraph (a) section 96X(1)
4: Miscellaneous
96Z: Power to amend Schedule 2A
1: Without limiting the matters that an Order in Council made under section 96J Schedule 2A section 96L(3)
a: make any amendments to Schedule 2A
i: to recognise the abolition or dissolution of any agency that is party to an approved information sharing agreement or any change in the name of such an agency; or
ii: to reflect any change in the Internet site address where a copy of an approved information sharing agreement can be accessed; or
iii: to reflect any amendments to an approved information sharing agreement that are approved under section 96V
iv: to correct any error or omission in any description in that schedule:
b: remove any description or matter in Schedule 2A
c: otherwise amend or replace Schedule 2A
2: To avoid doubt, any of the matters set out in this section may be included in an Order in Council made under section 96J
9: Regulations
Section 128
aa: prescribing the matters that the Commissioner may specify to a lead agency as matters that are to be included in a report by the lead agency under section 96S(1)﻿(b)
10: New sections 129A and 129B inserted
The following sections are inserted after section 129
129A: Amendment relating to Legislation Act 2012
Section 129B
129B: New section 96M substituted
Section 96M
96M: Application of Legislation Act 2012
An Order in Council—
a: is a legislative instrument for the purposes of the Legislation Act 2012; and
b: is a disallowable instrument for the purposes of the Legislation Act 2012; and
c: must be presented to the House of Representatives under section 41 of that Act.
11: New Schedule 2A inserted
The Schedule 2A Schedule Schedule 2