Collecting personal information

Introduction

How this works

This assessment asks questions that arise if you wish to collect personal information. The questions you will be asked depend on whether you’re proposing to collect the information directly from the individuals concerned or from a third party such as another agency. You’ll be shown feedback on your proposed collection as you answer the questions below. Once you’ve submitted the assessment form, you’ll be provided with a summary report as a downloadable PDF.

If you need to pause before completing the assessment form (for example, you might need to obtain more information and come back to your assessment tomorrow), you can use the ‘save and continue later’ link that you’ll see at the bottom of each page of the assessment. If you do this, be sure to save the link you’re given, otherwise you could lose your progress. The link is a bit like a password, so don’t share it with anyone.

Guidance and feedback

In both the form you fill out and your PDF summary report, you’ll see guidance content and the feedback mentioned above.

Guidance content will be in yellow boxes. It explains aspects of the law that are relevant to questions you’re about to be asked.

Show me an example

Explanation of IPP1: Under the Privacy Act’s IPP1, an agency can only collect personal information if the information is collected for a lawful purpose connected with a function or activity of the agency, and the collection of the information is necessary for that purpose. You need to consider this question because you’ve said there is no specific legislative authority that authorises the collection of the personal information.

IPP1 uses the language of ‘necessary for the purpose’ rather than ‘reasonably necessary’. However, it is generally accepted that an “agency does not need to show that it absolutely must collect the information in order to achieve its purpose”. Rather, it needs to show “that it is reasonably necessary to collect it”. See the Office of the Privacy Commissioner’s website.

The feedback you’ll see, when completing the form and in the PDF summary report, is colour-coded, using traffic light colouring:

If in a red box, the message is: “Stop. There’s a problem. You shouldn’t proceed with the collection unless it can be resolved.”
If in an orange box, the message is: “Look. There’s a potential issue here that you should consider further.”
If in a green box, the message is: “Go. It looks like there’s no problem with this particular topic or issue.”

Show me an example

A single completed form or PDF summary report might contain all green feedback or a mixture of green, orange and/or red feedback. All green means it looks like, overall, the proposed collection ticks all legal boxes. If there’s a mix of colours, it will be important to review any orange and red feedback before proceeding with the proposed collection of personal information.

Assessment

What kind of agency are you and what kind of information do you propose to collect? Click the button that applies.

Agency collecting personal information
Health agency collecting health information
Telco agency collecting telco information
Agency collecting personal information during emergency

Not sure? Click here to find out

Check the information below to find out whether you’re a “health agency collecting health information” or a “telecommunications agency collecting telecommunications information”. If you’re neither of these, click the “Agency collecting personal information” button above, unless there’s a state of national emergency, in which case select the “Agency collecting personal information during emergency” button.

Health agency collecting health information

To be a health agency collecting health information, you need to be a “health agency” and you need to be collecting “health information”. If so, click the “Health agency collecting health information” button above.

Health agency is defined in the Health Information Privacy Code (HIPC) as follows:

  • an agency which provides health or disability services
  • with a larger agency, a division or administrative unit (including an individual) which provides health or disability services to employees of the agency or some other limited class of persons
  • a person who is approved as a counsellor for the purposes of the Accident Compensation Act 2001
  • a school, faculty or department of a tertiary educational institution which provide the training or a component of the training necessary for the registration of a health practitioner
  • an agency having statutory responsibility for the registration of any health practitioners
  • a health professional body (which is defined separately as an authority empowered to exercise registration and disciplinary powers under the Health Practitioners Competence Assurance Act 2003)
  • persons appointed or designated under the Health and Disability Commissioner Act 1994
  • an agency which provides health, disability, accident or medical insurance, or which provides claims management services in relation to such insurance, but only in respect of providing that insurance or those services
  • an accredited employer under the Accident Compensation Act 2001
  • an agency which provides services in respect of health information, including an agency which provides those services under an agreement with another agency
  • a district inspector, deputy district inspector or official visitor appointed pursuant to section 94 of the Mental Health (Compulsory Assessment and Treatment) Act 1992
  • a district inspector or deputy district inspector appointed pursuant to section 144 of the Intellectual Disability (Compulsory Care and Rehabilitation) Act 2003
  • an agency which manufactures, sells, or supplies medicines, medical devices or related products
  • an agency which provides health and disability services consumer advocacy services
  • the department responsible for the administration of the Coroners Act 2006, but only in respect of information contained in documents referred to in section 29(1) of that Act
  • Ministry of Health
  • Health Research Council
  • Institute of Environment Science and Research Limited
  • The Interchurch Council on Hospital Chaplaincy
  • New Zealand Health Partnerships Limited
  • Accident Compensation Corporation
  • The Regulator under the Accident Insurance Act 1998 and the Accident Compensation Act 2001

Health information is defined in the HIPC as the following information or classes of information about an identifiable individual:

  • information about the health of that individual, including his or her medical history
  • information about any disabilities that individual has, or has had
  • information about any health services or disability services that are being provided, or have been provided, to that individual
  • information provided by that individual in connection with the donation, by that individual, of any body part or any bodily substance of that individual or derived from the testing or examination of any body part, or any bodily substance of that individual
  • information about that individual which is collected before or in the course of, and incidental to, the provision of any health service or disability service to that individual

Telco agency collecting telco information

To be a telecommunications agency collecting telecommunications information, you need to be a “telecommunications agency” and you need to be collecting “telecommunications information”. If so, click the “Telecommunications agency collecting telecommunications information” button above.

Telecommunications agency is defined in the Telecommunications Information Privacy Code (TIPC) as follows:

  • a network operator
  • a telecommunications service obligation provider or TSO provider
  • a directory publisher
  • a directory enquiry agency
  • an Internet service provider
  • a call centre which provides call centre services on contract to another agency
  • a mobile telephone retailer
  • for the purposes of Schedule 4 of the TIPC, the “relevant government agency” and an “emergency service provider” (Schedule 4 enables the disclosure of emergency caller location information (ECLI) by network operators to emergency service providers, and the collection and use of ECLI by emergency service providers, for establishing the location of an individual who has made an emergency call, to facilitate a response to that call. The “relevant government agency” is the government agency responsible for the location area service system (LAS system), and “emergency service provider” means the New Zealand Police, New Zealand Fire Service, St John, Wellington Free Ambulance Service, and any other agency authorised by the relevant government agency to receive ECLI from the LAS system.)

Telecommunications information is defined in the TIPC as:

  • subscriber information
  • traffic information
  • the content of a telecommunication

Many of the terms defined above (e.g., network operator, telecommunications service, directory publisher, Internet service provider, subscriber information, traffic information, and telecommunication) are further defined in the TIPC. See the TIPC for the detail if required.


What if I'm a credit reporter collecting credit information?
If you’re a credit reporter collecting personal information for credit reporting, you’re subject to the Credit Reporting Privacy Code. At this stage, given the small number of credit reporters in New Zealand, our assessment tools do not accommodate that Code. You should consult the Code directly instead or, if necessary, obtain advice on its application.