Privacy Act & codes

(1) Where an agency collects personal information, the agency shall collect the information directly from the individual concerned.

(2) It is not necessary for an agency to comply with subclause (1) if the agency believes, on reasonable grounds,-

(a) that the information is publicly available information; or

(b) that the individual concerned authorises collection of the information from someone else; or

(d) that non-compliance is necessary -

(i) to avoid prejudice to the maintenance of the law by any public sector agency, including the prevention, detection, investigation, prosecution, and punishment of offences; or

(ii) for the enforcement of a law imposing a pecuniary penalty; or

(iii) for the protection of the public revenue; or

(iv) for the conduct of proceedings before any court or tribunal (being proceedings that have been commenced or are reasonably in contemplation); or

(e) that compliance would prejudice the purposes of the collection; or

(f) that compliance is not reasonably practicable in the circumstances of the particular case; or

(g) that the information -

(i) will not be used in a form in which the individual concerned is identified; or

(ii) will be used for statistical or research purposes and will not be published in a form that could reasonably be expected to identify the individual concerned; or

(h) that the collection of the information is in accordance with an authority granted under section 54.

The best source of information about a person is usually the person him or herself. Also, collecting information from the person concerned means that people know what is going on and have some control over their information. Principle 2 recognises this - it says that, where possible, information must be collected directly from the person concerned.

However, there can be situations where it's not appropriate or possible for an agency to collect information directly from the person concerned. Principle 2 contains a range of exceptions to deal with these situations.

Principle 2(2)(a)
This exception allows an agency to collect information from a source other than the individual when the information is 'publicly available information'.
But to take advantage of the exception, the agency must have actually collected the information from the publicly available source.

'Publicly available information', defined in the Privacy Act, can be information in a magazine, book, newspaper, public register, or other publication that is (or will be) available to members of the public. This can include internet sites that are available to the public, such as social media sites.

As an example, an agency can get the information from the white pages of the phone book. That's a publicly available publication. But if the agency collected the information from somewhere else (eg. a marketing list) then the fact that the information might also be in the phone book doesn't matter - the exception doesn't apply.

Even if you collect information from a publicly available source, though, it is a good idea to check it with the individual to make sure it's correct.

See Case Note 100091 [2009] NZPrivCmr 2
Case Note 100413 [2007] NZPrivCmr 20

Principle 2(2)(b)
This exception allows an agency to collect information from someone else if the individual concerned has authorised that collection.

Getting authorisation is common business practice (for example reference checks, or credit checks). And it makes sense. If you need to collect information about someone from a third party, it's usually best to let them know you're going to do that and make sure they agree. That saves surprises - and possible arguments - later.

Authorisation should usually be explicit. It's possible, on occasion, to have implied authorisation but it will need to be very clear.

There is no requirement to have an authorisation in writing, but this is usually a good idea since it saves confusion if there's a query later. If there's no written authorisation then the agency should make a record of the conversation it's had with the person showing that they have authorised the collection, and what they agreed the agency could collect.

When recruiting new staff, can I call a job applicant's current employer if they haven't been listed as a referee?
Reference checking is based entirely on the job applicant's consent. If the applicant has not agreed to you approaching a particular person, don't approach that person.

There are other ways of managing the situation if you really do need to get a reference from a particular person who is not given as a referee. For example, you can ask the applicant whether you can approach their current employer. If the applicant refuses, you will need to decide how (or whether) to continue with the application. [For more details, see the relevant section of Privacy at Work].

See Case Note 2976 [1996] NZPrivCmr 1
Case Note 19740 [2002] NZPrivCmr 5

See the Human Rights Review Tribunal's case
Lehmann v Canwest Radioworks Ltd [2006] NZHRRT 35

Principle 2(2)(c)
There may be some situations where it is necessary to collect information about an individual from someone else but where the collection would not disadvantage the individual.

It is important to be aware that what might be considered a disadvantage will often depend on the individual. So if it's possible, it's still best to have a conversation with them.

Are schools able to find out students' medical conditions from their parents/caregivers?
Yes. This information would not disadvantage the children. It is in their interests for the school to know of any medical issues so it can accommodate the child's needs and keep them safe. Collecting the information from parents would ensure the school receives correct and full information. In addition, children may not be able to give the full information needed.

The school needs to make sure that the information is properly stored, though, and only shared with those who need to know (see the principles on storage, use and disclosure).

See Case Note 4339 [2001] NZPrivCmr 2

Principle 2(2)(d)(i)
Sometimes collecting that information from a person directly might get in the way of a public sector agency being able to maintain the law. If so, this exception will allow the agency to collect the information from third parties.

Generally, only agencies with law enforcement functions will be entitled to rely on this exception.

For example, the Police can collect information from a range of sources if this is necessary to investigate a crime. They may not wish to talk to a suspect too early in the investigation, if that suspect could destroy evidence, change their behaviour, or make up a story that would undermine the investigation.

Can any agency rely on this exception?
No. This exception may only be relied upon by public sector agencies that have a law enforcement function, such as Police, ACC, MSD or IRD - agencies that have powers to enforce certain legislation or to prevent and investigate offences.

Does this exception apply only to Crimes Act offences?
No. As noted above, any agency with a law enforcement function can rely on this exception. Many statutes contain offences that attract criminal liability.

ACC, for example, is required by the Accident Compensation Act 2001 to investigate fraudulent claims for compensation. In Case Note 6314 [1997] NZPrivCmr 10, the Privacy Commissioner formed the opinion that the ACC was entitled to rely on principle 2(2)(d)(i) to collect information about an individual it suspected of fraudulent behaviour. It was accepted that telling claimants that an investigation was underway could give them time to cover up their fraudulent behaviour.

Must an investigation be in progress for an agency to rely on this exception?
Yes, usually. It would be difficult for an agency to establish that it was necessary to go to someone else to collect personal information if it were not currently investigating that individual.

Principle 2(2)(d)(ii) - for the enforcement of a law imposing a pecuniary penalty
This exception is rarely raised but would allow an agency to collect information from another source if this was necessary to enforce a particular piece of legislation that required the payment of a fine or penalty, such as the Land Transport Act 1998.

Principle 2(2)(d)(iii) - for the protection of the public revenue
This exception allows an agency to collect information from another source if this is necessary to protect the public revenue. This is rarely raised. To rely on it an agency would need to establish first, that public revenue was being protected and, secondly, that the collection of information from another source was necessary for this purpose.

The term 'public revenue' is not defined in the Privacy Act. In a complaint relating to the disclosure of personal information, the Privacy Commissioner considered the meaning of 'public revenue'. The Commissioner noted that the Oxford English Dictionary defines revenue as 'annual income, especially that of the state or government institution'. 'Income' is in turn defined as 'periodical, especially annual, receipts from one's work, lands and investments', so an essential characteristic of 'revenue' is regular payments to a person or agency (see Case Note 2663 [1998] NZPrivCmr 6).

Generally, there are special schemes for recovering public money - for example, specially controlled information matches between government departments to make sure people are not being overpaid, and that they pay their fines and taxes.

Principle (2)(d)(iv) - for the conduct of court proceedings
This exception is usually raised when gathering evidence for court or tribunal proceedings. Often a party to proceedings, or their lawyer, will need to gather information to allow them to either establish a case or respond to an allegation. This is often information that the person will either not be aware of or refuses to give to the opposing party. This exception allows the party seeking the information to go to another source to obtain it. The reason for the exception is that courts need to get the best possible information to administer justice.

However, the collection does need to have a reasonably clear link to actual or proposed court proceedings. The exception cannot be used as an excuse for a fishing expedition

Do legal proceedings have to be underway in a court for this exception to apply?
No, provided that an agency can establish that it had a real intention to commence proceedings at the time that it collected personal information. The exception applies to proceedings that have commenced or are reasonably contemplated.

'Reasonably contemplated' means the proceedings are being seriously considered and, often, that steps have been taken by the party initiating those proceedings to gather evidence, talk with lawyers and start the process.

Is this exception limited to the gathering of evidence for proceedings?
No, not necessarily. Provided that the information collected is necessary for the conduct of legal proceedings, then this exception may apply. 'Conduct' relates to the actual management or performance of the proceedings. This would include:
evidence needed to establish an element of a claim;
evidence needed to counter a claim made by an opposing party; or
other information without which it would be difficult to progress the proceedings, such as the address for service.

Again, though, the information must be necessary for the conduct of the legal proceedings.

In Case Note 18893 [1998] NZPrivCmr 18, a man complained about his business partner using a private investigator to collect credit information about him. At the time of the credit check, civil proceedings were in contemplation. The credit check was carried out to confirm the accuracy of information in an affidavit prepared for those proceedings. The Privacy Commissioner was satisfied that it was reasonable for the private investigator to collect this information from another source - namely the credit reporter.

Is this the same as discovery?
No. The discovery process is separate from the Privacy Act and can include information that is not 'personal information' about an individual. Discovery is the process by which parties to litigation are able to obtain information about the existence and contents of relevant information relating to that litigation. It is for the court to decide whether information is relevant to particular litigation.

Usually, once a court makes orders for discovery, the Privacy Act will not apply to the collection or disclosure of the information by the parties to the proceedings. If a party has an issue with particular information being produced, then they should raise this with the judge who made the order.