Chapter 8

Privacy and dealing with information about people

This is a single section from Chapter 8. Read the full chapter here.

Part 1

Is the legislation consistent with the requirements of the Privacy Act 2020 and that Act’s 13 information privacy principles?

Legislation should be consistent with the requirements of the Privacy Act 2020, in particular the information privacy principles.

The 13 information privacy principles are the cornerstone of the Privacy Act (and can be found in section 22). They address how agencies may collect, store, use, and disclose personal information. They also allow a person to request access to and correction of their personal information. Many of the information privacy principles have in-built exceptions, and Part 6 of the Privacy Act has further exemptions.

The policy objective will sometimes justify an inconsistency with the privacy principles. Section 24 of the Privacy Act provides that nothing in information privacy principle 6 (access to personal information), 11 (limits on disclosure), or 12 (disclosure of personal information outside of New Zealand) limits or affects:

• a provision contained in New Zealand legislation that authorises or requires personal information to be made available; or
• a provision contained in any other New Zealand Act that imposes a prohibition or restrictions in relation to the availability of personal information or regulates the manner in which personal information may be obtained or made available.

For information privacy principles 6, 11 and 12 there is then no need for legislation overriding the Act to contain an express override provision. However, any override of the Act requires careful consideration and the reasons should be clearly identified in relevant decision making documents.

If that occurs, the policy should be developed so as to minimise the inconsistency. If there is any ambiguity regarding an inconsistency with the Privacy Act, the courts may prefer an interpretation of the legislation that involves the least impact on the privacy interests of individuals.

The design of any legislative provision that overrides the privacy principles, in particular principles 10, 11 and 12 (relating to the use and disclosure of personal information), should reflect as necessary the principles of specificity, proportionality, and transparency. Consultation with the Office of the Privacy Commissioner and the Ministry of Justice will help to identify the necessary design features.

The Cabinet Manual requires Ministers to draw attention to any aspects of a bill that have implications for, or may be affected by, the principles in the Privacy Act 2020, when submitting bids for bills for the legislative programme. Similarly, it requires Ministers to confirm compliance with those principles when subsequently submitting the bill to the Cabinet Legislation Committee for approval for introduction.^[1]

[1] Cabinet Office Cabinet Manual 2017 at 7.65 – 7.66.