9 Oct 2018, 09:00

Privacy Commissioner John Edwards is recommending the repeal of 22 government information matching provisions, after a report showed many of them were never used.

Mr Edwards says information matching provisions are enacted by Parliament to allow the sharing of information in ways that would otherwise breach the Privacy Act’s information privacy principles.

“I am concerned these exceptional powers have been sought by officials, agreed to by Ministers, enacted by Parliament, and then never used. It shows up a weakness in the system and demonstrates the importance of having robust policy development procedures in advance of enacting such provisions.”

Mr Edwards says the unused information matching provisions did not deliver their intended benefits to society and continuing Parliamentary authorisation of these privacy intrusive measures was unjustified.

An Office of the Privacy Commissioner report details information matching provisions made under the Privacy Act 1993 which override the Act’s information privacy principles.

Once an information matching provision is enacted, section 106 of the Privacy Act requires the Privacy Commissioner to review the operation of the provision to consider whether the authority conferred should be continued and whether any amendments to the provision are necessary or desirable.

Mr Edwards says as part of the review, he consulted department chief executives on whether agencies were using these provisions or had any plans to use them. In the report, he recommended unused provisions be repealed.

“I have found that agencies have no active plans to use the majority of the unused information matching provisions I have reviewed. Many of these provisions were never used after Parliament enacted them. Agencies used some provisions for a limited period before abandoning them.”

“These examples underscore the importance of a rigorous and disciplined policy process. Given the considerable resources involved in enacting provisions, Parliament should expect officials to conduct full due diligence to support future claims that privacy overrides are necessary to achieve public policy objectives.”

Some of the legislation which have information matching provisions are the Accident Insurance Act 1998, the Births, Deaths, Marriages and Relationships Registration Act 1995, the Customs and Excise Act 1996, the Immigration Act 2009, the Social Security Act 1964, the Housing Restructuring and Tenancy Matters Act 1992, and the Tax Administration Act 1994.

What is information matching?

Government agencies conduct information matching when they compare one set of data about individuals with another set. They usually do this to find records in both data sets that are about the same person. Government agencies use information matching to help them provide benefits to society. For example, agencies often use information matching to make sure people get their correct entitlements, or to detect fraud.

The Privacy Commissioner examines each case and reports to the responsible Minister on whether the potential public interest in matching justifies the legislative intrusion into privacy.

How do the Privacy Act’s privacy principles relate to information matching?

Information matching provisions override individuals’ rights and protections under the information privacy principles by authorising:

• agencies to collect information from an individual from another agency’s dataset (in contrast to principle 2 which requires an agency to collect personal information from the individual concerned);
• agencies to use and disclose information from datasets that were collected for their own purposes for other, new purposes (in contrast to principles 10 and 11 which generally require an agency to use and disclose information within the purposes for which it was collected); and
• agencies to sometimes use and disclose individuals’ information for purposes that were not known to the individual when their information was originally collected (in contrast with principle 3 which requires an agency to take reasonable steps to inform an individual about how their information would be used and disclosed).

A copy of the report with detailed findings and recommendations is available here.

ENDS

For further information:

Charles Mabbett - 021 509 735