Purpose Matters’ intent

This Guideline helps agencies who are considering collecting and using people’s personal information clarify why they are collecting that information.

The first part of this Guideline explains important aspects of legislation (particularly the Privacy Act 2020) that are relevant to:

• purpose and collection of personal information
• purpose and use of personal information
• purpose and sharing of personal information.

This Guideline then describes an approach to defining and assessing proposed purposes. The approach focuses on:

• being clear about how the personal information contributes to the outcomes to be achieved
• being clear about the method that will be used to achieve the outcomes
• considering the context in which the information is being collected and used.

It also provides a range of checks and balances that can help determine if:

• a proposed collection or use is lawful and appropriate
• there’s a need to get input from others, and when to seek it.

Purpose Matters’ key concepts

Agencies must be clear about why they collect personal information as it informs many of the key decisions made with people’s information.

• Agencies can only collect personal information for lawful purposes connected with their functions or activities.
• Agencies can only collect personal information to the extent reasonably necessary for those lawful purposes, or as otherwise permitted by specific statutory provisions.
• Agencies should, when considering what’s reasonably necessary, look at the intended outcomes together with their processing methods and the context of use.
• In some cases, the context may suggest that, even where a purpose of collection is lawful and it’s reasonably necessary to collect personal information for that purpose, proceeding with the collection may be ethically questionable or otherwise undesirable.
• Agencies can only use personal information for the purposes it was collected for, unless it can legally be used or disclosed for other purposes.

Addressing concerns

Before and during the Data Protection and Use Policy’s (DPUP’s) engagement stage, non-governmental organisations (NGOs), people who use agencies' services, and the Office of the Privacy Commissioner expressed concerns that directly relate to the purpose of collecting people’s information.

Those concerns included:

• if agencies are not clear enough about why they collect personal information and how they inform people of that purpose, then:
  • agencies might collect more information than they need, which is unlawful and inappropriate
  • agencies that collect personal information from other agencies (who collect it directly from people) are not able to tell those other agencies what they need to know, and this can put those other agencies in a difficult position as they may not know if they should provide the information or what to tell the people they collect it from
• agencies give enough thought to how appropriate it is to collect, use or share certain kinds of personal information, even when the law allows it.

Ensuring information collection is legal and ethical

This is one of DPUP’s most important Guidelines. This is because it’s important that agencies:

• approach questions of purpose with enough precision.
• understand that purpose informs many important decisions with people’s information

This helps them to approach information collection in a manner that is legally and ethically sound. Not doing this may result in:

• legal problems with otherwise sound policy or service initiatives
• failure to deliver intended wellbeing outcomes for people
• a loss of trust and confidence from the people that agencies serve.

Important reasons for this Guideline

• Service providers, including government agencies, NGOs and other providers, view the respectful, trusted and transparent use of people’s personal information as a joint responsibility for collective benefit. A lack of understanding or clarity about the purposes of collection, use or sharing can undermine that responsibility.
• NGOs often say that better clarity on the purpose of collecting and using information is the topic of greatest importance to them.
• People who use services understand that agencies may want to use their information to improve outcomes for people in similar situations. However, they still want clarity on the purpose for collecting and using their information. For example, agencies telling people they need their information for research purposes is not helpful.
• Understanding purpose and getting it right can help an agency earn people’s trust and confidence. This is vital to ensure what it’s doing is both lawful and ethically justifiable.