22/01/2016 9:00am

A quick tour of the privacy principles

Download a PDF of the quick tour of the privacy principles.

Principle 1

Personal information must only be collected when:

• The collection is for a lawful purpose, connected with what the agency does, and
• It is necessary to collect the information for that purpose

Principle 2

Personal information must usually be collected from the person the information is about. But sometimes it is all right to collect information from other people instead - for instance, when:

• Getting it from the person concerned would undermine the purpose of the collection
• It’s necessary so a public sector body can uphold or enforce the law
• The person concerned authorises collection from someone else

Principle 3

When an agency collects personal information from the person the information is about, it has to take reasonable steps to make sure that person knows things like:

• Why it is being collected
• Who will get the information
• Whether the person has to give the information or whether this is voluntary
• What will happen if the information isn’t provided

Sometimes there are good reasons for not letting a person know about the collection, for example, if it would undermine the purpose of the collection, or it’s just not possible to tell the person.

Principle 4

Personal information must not be collected by unlawful means or by means that are unfair or unreasonably intrusive in the circumstances.

Principle 5

It’s impossible to stop all mistakes. But agencies must ensure that there are reasonable safeguards in place to prevent loss, misuse or disclosure of personal information.

Principle 6

People usually have a right to ask for access to personal information that identifies them.

However, sometimes, agencies can refuse to give access to information, for instance because giving the information would:

• endanger a person’s safety
• prevent detection and investigation of criminal offences
• involve an unwarranted breach of someone else’s privacy.

Principle 7

People have a right to ask the agency to correct information about themselves, if they think it is wrong.

If the agency does not want to correct the information, it does not usually have to. But people can ask the agency to add their views about what the correct information is. 

Principle 8

Before it uses or discloses personal information an agency must take reasonable steps to check that information is accurate, complete, relevant, up to date and not misleading. 

Principle 9

An agency that holds personal information must not keep that information for longer than is necessary for the purposes for which the information may be lawfully used. 

Principle 10

Agencies must use personal information for the same purpose for which they collected that information.

Other uses are occasionally permitted (for example because this is necessary to enforce the law, or the use is directly related to the purpose for which the agency got the information).

Principle 11

Agencies can only disclose personal information in limited circumstances. One example is where another law requires them to disclose the information. Also, an agency can disclose information if it reasonably believes, for example, that

• disclosure is one of the purposes for which the agency got the information
• disclosure is necessary to uphold or enforce the law
• disclosure is necessary for court proceedings
• the person concerned authorised the disclosure
• the information is going to be used in a form that does not identify the person concerned.

Principle 12

Some agencies give people a “unique identifier” instead of using their name. Examples are a driver’s licence number, a student ID number, or an IRD number. An agency cannot use the unique identifier given to a person by another agency. People are not required to disclose their unique identifier unless this is one of the purposes for which the unique identifier was set up (or directly related to those purposes).