Clear purpose required for sharing personal information

Being clear about purpose when collecting personal information can be relevant to whether an agency can share that information with others. This is because, under the Privacy Act 2020’s information privacy principle 11 (IPP11) — Limits on disclosure of personal information, an agency must not disclose the personal information unless it believes, on reasonable grounds, that one of the listed exceptions in the IPP applies.

The first exception is that the disclosure is one of the purposes the information was originally obtained for or is directly related to those purposes. To determine if this exception applies, an agency must know the original purposes for obtaining the information.

If one of the purposes of collecting personal information is to share it with another agency for a particular reason, then the collecting agency needs to be clear about that upfront. If it will be shared with an agency overseas, the collecting agency needs to assess if sharing would be consistent with IPP12 — Disclosure of personal information outside New Zealand.

If collecting the information directly from service users, under IPP3 — Collection of information from subject, an agency needs to explain what agencies the information will be shared with and why. This is the case unless an exception under IPP3 applies — for example, if it would undermine the purpose of the collection, or it’s just not possible to tell the person.

If using information collected by another agency, the collecting agency needs to say who they will be sharing the information with and why. This may influence whether the collecting agency or organisation:

• is willing to disclose the information
• may seek to impose controls on further distribution of the information, for example, under a memorandum of understanding or contract.

Find more information on the information privacy principles:

• IPP3: Collection of information from subject — Office of the Privacy Commissioner
• IPP11: Disclosure of personal information — Office of the Privacy Commissioner
• IPP12: Cross-border disclosure — Office of the Privacy Commissioner

If disclosure appears to be authorised by a specific statutory provision

IPP11 can be overridden by specific statutory provisions that either authorise or require the disclosure of personal information to other agencies. This is common in the social sector.

However, purpose remains relevant in this context as well. Usually such precise statutory provisions specify what purposes particular personal information can be shared for. This means the agency needs to be clear about the intended purpose of disclosure before relying on a specific statutory disclosure provision. This ensures the intended purpose of disclosure is covered by the provision.

If an agency does not define the intended purpose properly, its disclosure may amount to an interference with privacy if the disclosure:

• was not covered by the provision
• would not have been permitted under IPP11 either.