The Ministry of Justice is considering broadening the notification requirements under the Privacy Act 2020 (Privacy Act) to apply to the collection of personal information by agencies indirectly through a third party, rather than directly from the individuals concerned. The Ministry has released an Engagement Document seeking feedback on the form, and scope of, any such changes.
Changes to the notification requirements will affect any agency that collects personal information indirectly through other agencies.
What are the current notification requirements?
The current notification requirements under the Privacy Act are governed by Information Privacy Principles (IPP) 2 and 3:[1]
- IPP 2 provides that if an agency collects personal information, the information must be collected from the individual concerned. This is considered to be a direct collection of personal information. There are certain exceptions to this rule, including where the information is publicly available or when compliance is not reasonably practicable in the circumstances.
- IPP 3 provides that if an agency is collecting personal information from an individual, the agency must take steps that are reasonable to ensure the individual concerned is notified of certain aspects of the collection, such as the fact that the information is being collected and for what purpose. There are also certain exceptions to this rule, including where notification is not reasonably practicable in the circumstances or may prejudice the purpose of collection.
Agencies most commonly comply with their obligations under IPP 2 and 3 under their standard privacy policies.
Why is an expansion of the notification regime being considered?
The Ministry is of the view that the way in which IPP 2 and 3 work together may mean that where personal information is collected indirectly, the notification requirements under IPP 3 do not apply.
The Ministry is concerned that this creates a gap in the notification regime and potentially puts New Zealand out of step with overseas jurisdictions.
Next steps
Feedback is due by 5pm Friday 30 September 2022. The Ministry is particularly interested in hearing from agencies that collect personal information indirectly, as well as from individuals whose personal information may be indirectly collected.
If you have any questions regarding the issues raised in the Engagement Document, would like to understand how an expansion to the notification regime may affect you, or if you require support in responding to the Ministry's request for feedback, please get in touch.