Access to information can take several forms:
Almost everyone who holds personal information is an 'agency' under the Privacy Act.
An agency can be a public sector body like:
Or it can be a private sector body like:
Even an individual person is an agency (but see section 56 for further details about when an individual person might not be liable for privacy breaches).
However, the Act specifically excludes some people and organisations from being agencies. This means they are not governed by the privacy principles.
Section 2 of the Act (under 'agency') sets out the complete list of exclusions. For example, these are not agencies under the Act:
Other privacy rules may cover what these people and organisations can do. See here for information on other privacy rules, and for some useful links.
To collect information, the agency must, in some way, ask to get it.
This includes setting up equipment to record anything that happens in an area.
It is not a "collection" if the agency is just given information that it did not ask for.
An agency that holds personal information shall, if requested by the individual concerned, take such steps (if any) to correct that information. The information held should be accurate, up to date, complete, and not misleading. (See principle 7).
Information is disclosed when it passes to a person who did not know it before.
A disclosure does not have to be deliberate.
(Also known as data matching programmes)
Information matching / data matching programmes
Systems for bulk comparison of personal information.
Information matching programmes can be conducted manually or electronically. They are designed to produce or verify information that can then be used to take adverse action against an individual.
For there to be an interference with privacy, two things are needed:
1. A breach
2. harm (or likely harm) resulting from that breach.
Harm can be things like:
A real risk that something may happen, supported by evidence.
Importantly, the risk does not have to be 'more likely than not' to eventuate. It just needs to be a distinct or significant possibility.
See for instance Commissioner of Police v Ombudsmen  1 NZLR 385; M v Ministry of Health CRT  12; Nicholl v Chief Executive of Work and Income (6 June 2003) High Court, Rotorua, AP 255/01, Hansen J.
Information about a living human being.
The information needs to identify that person, or be capable of identifying that person.
So, for example, personal information is not
Information contained in