Blog

Does the Privacy Act 2020 narrow the scope of the ‘storage or processing’ holding provision?

Quick summary: This post addresses the issue of whether section 11 of the Privacy Act 2020 narrows the scope of its predecessor, section 3(4) of the Privacy Act 1993. If it does, there could be adverse practical implications for agencies involved with outsourced storage or processing of personal information. The short answer? No, despite its wording, I don’t think it does. We can keep calm and carry on.

Introduction

If you work frequently on issues under the Privacy Act, one of the topics you’ll have addressed over the years is the position where an agency (let’s call it the “Primary Agency”) uses another agency or organisation (let’s call it the “Processing Agency”) to store or process personal information for the Primary Agency. In this scenario, under section 3(4) of the Privacy Act 1993, the personal information is deemed to be held by the Primary Agency, and not the Processing Agency, as long as the Processing Agency doesn’t use or disclose the information for its own purposes.

Is the Civil Defence National Emergencies (Information Sharing) Code 2013 clear enough?

Introduction

The Civil Defence National Emergencies (Information Sharing) Code 2013 (Civil Defence Code, a code of practice under the Privacy Act) is a powerful tool for agencies that need to collect, use or disclose personal information as part of responding to the COVID-19 epidemic (or any state of national emergency). In substance, when it applies, it modifies some of the standard information privacy principles relating to collection, use and disclosure of personal information. In other words, some of the Privacy Act’s usual controls on the collection, use and disclose of personal information yield to the exigencies of the emergency at hand.

What would a subject-matter ranking of information collection, use and sharing provisions look like?

Let’s look at subject-matter this time

In my last post, Which Government departments have the most information collection, use and sharing provisions?, I described which Government departments and non-Crown agencies feature the most in specific statutory provisions concerning (or that could cover) the collection, use or sharing of personal information.

Which Government departments have the most information collection, use and sharing provisions?

If you’ve read “Why we need to understand more than the Privacy Act“, you’ll know my view that we cannot fully understand how New Zealand law addresses the collection, use and sharing of personal information by understanding the Privacy Act alone. To obtain a full understanding, we often need to understand other laws and how they interact with the Privacy Act.

That’s all well and good, but just how many specific statutory provisions are there in our statute books that address or, given their breadth, could cover the collection, use and sharing of personal information?

Why it’s important for the new coronavirus to be classified here as a notifiable infectious disease

The importance of having the right information at the right time

It goes without saying that the ability for health officials to:

obtain information on people suspected of having the new coronavirus;
to require tests to be undertaken if that’s considered necessary; and
if necessary, to quarantine people,

is vital to their ability to understand the prevalence and spread of the disease and to contain it.

How to rein in IPP10 and IPP11 exceptions when sharing personal information

Introduction

As most people know, the Privacy Act’s information privacy principles 10 and 11, relating to the use and disclosure of personal information that an agency holds, are subject to a range of exceptions: