Before collecting personal information

Agencies must be clear about the purpose they are collecting the personal information for.

• Under the Privacy Act 2020’s information privacy principle 1 (IPP1) — Purpose of collection of personal information, agencies should not collect personal information unless it is for a lawful purpose connected with their functions or activities and, importantly, the collection is reasonably necessary for that purpose.
• If agencies are collecting personal information under a specific statutory power that authorises or requires the collection, they need to be clear on the purpose of collection to ensure the statutory power covers the information they propose to collect and the reason for collecting it.

IPP1: Purpose for collection of personal information — Office of the Privacy Commissioner

Collecting information from people or other agencies

Clarity of purpose is vital regardless of whether agencies are collecting information directly from people or from other agencies and organisations. The reasons for that go beyond ensuring that a collection is lawful under either IPP1 or a specific statutory collection power.

• If agencies are collecting information from people, clarity of purpose is vital to helping people understand why their information is being collected, as is usually required by the Privacy Act 2020’s IPP3 — Collection of information from subject. As the Office of the Privacy Commissioner has observed that, “it is fundamental to people’s right to privacy that, when providing information about themselves, individuals know why the information is being collected and what it is going to be used for”. This topic is discussed further in the Transparency and Choice Guideline.
• Sometimes providing people with details about the collection of their information, who will receive it, the reasons for doing so and other matters listed in IPP3 could undermine an agency’s reason for collection and could therefore justify not telling them. However, the relevant exception in IPP3 that would justify not telling them applies where doing so would “prejudice the purposes of the collection”. If the purposes of collection have not been clearly articulated, it will be difficult to rely on this exception. Without clarity of purpose, it may also be difficult to rely on other exceptions in IPP3.
• Information needs to be collected from the relevant individuals unless an agency is authorised or required by a specific statutory provision to collect personal information from another agency or an exception in the Privacy Act 2020’s IPP2 — Source of personal information applies. One of those exceptions is that collection directly from the individuals concerned would “prejudice the purposes of the collection”. Again, if the purposes of collection have not been clearly articulated, it will be difficult to rely on this exception. And again, without clarity of purpose, it may also be difficult to rely on other exceptions in IPP2.

IPP2: Source of personal information — Office of the Privacy Commissioner

IPP3: Collection of information from subject — Office of the Privacy Commissioner

When other agencies need to understand the purpose of collection

This is an example of a government agency collecting personal information from a non-governmental organisation (NGO) that collects it directly from people. However, the guidance can be applied to any agency collecting information from another.

If a government agency collects personal information from an NGO, it’s important the government agency:

• has a clearly articulated and lawful purpose of collecting the information from the NGO
• fully informs the NGO of the government agency’s purpose of collection in a manner that is easy for the NGO to understand and explain to its service users
• tells the NGO about the government agency’s purpose, so the NGO can include that in its statement of purposes to the people it serves.

Detailed description of diagram

The diagram shows that a government agency collecting information from another agency (an NGO) about their service users, needs to tell the NGO what they are going to do with the information.

The diagram shows an image of the beehive representing a government agency and the words underneath: “Agency requesting information collected through / from another agency.”

A dotted arrow comes out of a speech bubble from the beehive saying “The purpose is…” and goes to a circle that represents the NGO / agency collecting information from the service user.

A dotted arrow, representing the purpose for collection, goes from the NGO circle to 2 service users / people icons who are asking “The purpose is…” and “Why?”

A solid arrow representing their personal information goes from them to the NGO. A solid arrow representing that same personal information goes from the NGO to the beehive / government agency.

View larger image (PNG 170KB)

The government agency should also tell the NGO if providing the agency with the information for the specified purposes is voluntary or mandatory. If mandatory, then the government agency needs to say what particular statutory provision this is under.

The Privacy Act 2020 does not specify all of these requirements, in terms of what the government agency needs to tell the NGO, but they are often vital. If the NGO does not fully understand these collection requirements, it could struggle to assess:

• if it is lawful to provide the information to the government agency
• if it must or only may provide the information to the government agency
• where providing the information is voluntary, if it should provide the information to the government agency.

In addition, it might not be able to meet its own transparency obligations to service users under IPP3.

The NGO will value the government agency providing this information proactively. If the NGO wishes to ask further questions, it’s important the government agency respects the NGO's right to make the request and provides the information in a responsive and respectful manner to ensure the NGO knows it is welcome to ask such questions whenever it needs to.

If identifying information is not required, do not ask for it

IPP1 says do not collect personal information unless it’s reasonably necessary for a lawful purpose connected with an agency’s functions or activities. If a collecting agency can achieve its purpose without collecting identifying information (personal identifiers such as name and residential address), then it should not collect it.

The Privacy Act 2020 makes this clear with its new IPP1(2): “If the lawful purpose for which personal information about an individual is collected does not require the collection of an individual’s identifying information, the agency may not require the individual’s identifying information.”

Part 3 of the Privacy Act 2020: Information privacy principles — Parliamentary Counsel Office