Chapter 12: Proactive release and publication

Legislative impact of proactive publication

New Part to OIA and LGOIMA

We recommend that the agency duty to take reasonably practicable steps to proactively make official information publicly available be introduced in a new Part of each Act that would include supplementary provisions that expand on and support the primary obligation. We have not developed a legislative vehicle that is comprehensive in respect of all matters of detail, but we raise some of the considerations below and make recommendations as to our preferred approach.

R92The new statutory duty to proactively release information should be placed in a new Part to each Act that also sets out provisions governing proactive release.

How will the official information process apply to proactive release?

The expansion of the official information legislation to expressly provide for proactive publication will require a number of structural issues to be addressed. The conceptual differences between reactive and proactive release will have implications for agency processes. Essentially, agencies will need to be clear about the process to be applied as the factors to be considered will differ depending of the disclosure context.

Requests for official information

The official information legislation is currently configured to deal with one-off requests for information and release to a specified individual or organisation.648 Agencies may also receive requests for information to be released to the public as a whole. The limits of the legislation mean that a request for broader publication of official information is not an “OIA request.”

The broadening of the legislation to encompass proactive publication, as well as other steps towards open data, is likely to mean that there will be a broader range of requests for information from citizens. There may be requests to agencies for the publication of information with appropriate licensing under the NZGOAL framework so that it can be re-used by the requester. There are also “demands for data.” The www.data.govt.nz portal allows members of the public to register their request or demand for the release of particular datasets for re-use. The registration of demand for a dataset however is a request to the agency to publish the particular information to the public or to make a particular dataset publicly available, rather than a request for the information to be provided specifically to the requester under section 12.

A requester may opt to demand data at the www.data.govt.nz portal and simultaneously make a section 12 official information request to seek release of the same public data. Each request however, would be processed somewhat differently. For example, the time limits that apply to processing section 12 requests would not apply where an agency is asked to publicly release a dataset. An agency would have significantly more autonomy and discretion in deciding what information should be published in response to a request for public release. A section 12 request would require an agency to release a dataset, unless there is a good reason for not making it available to the requester (such as a withholding ground or an administrative reason to refuse such as substantial collation and research).649 Release of the data to meet a section 12 request may be subject to conditions, whereas the publication of open data is directed to be in a form that is freely re-useable by members of the public who access it.

We recommend that the current scope of an official information request in section 12 be retained, and continue to establish the threshold for citizen entitlements to official information, namely an entitlement to the release of specified information to the individual requester, subject to an assessment of the withholding grounds, public interest test, and other provisions of the legislation.

However, we think that the legislation should also recognise other kinds of information requests from the public for the wider release and publication of official information. Such requests should be taken into account by agencies as part of their proactive release strategies as indicating public demand for the information requested.

It is worth noting that “official information” is defined in section 2 of each Act as meaning information “held” by a relevant public entity. This means that the scope of the official information legislation is limited to providing access to information in existence at the time of the request and does not extend to information that will be created or updated at some time in the future. Requests for on-going access to real-time information for example would be outside the scope of the official information legislation and could not be considered as a section 12 request; although there may be grounds for reviewing a refusal to provide access under the Ombudsmen Act.

For example in 2007, the Ombudsmen considered a request for public access to the Ministry of Education’s SchoolSMART website, but found that this amounted to a standing request for both existing and future information that may at some time become available on the website which extends beyond the scope of the OIA.650 The investigation of the decision to deny access nevertheless proceeded under the Ombudsmen Act 1975, with the decision being found not to be unreasonable.

It may not always be clear whether a request is a section 12 request or a publication request, for example, where information is made available to citizens online subject to payment of a charge. In some cases, the information may be specifically tailored to the particular requester (such as property information). We understand that local authorities in particular, make or plan to make certain types of official information available in this way.

Our view is that where the information released is tailored to the particular requester, it should be regarded as a section 12 request. Where however, the same information is released, regardless of who requests it, on condition of payment, that information should be treated as published information and therefore outside the scope of section 12. Information being publicly available is already a ground for refusing section 12 requests.651 In chapter 7 we recommend adopting a statutory definition of the concept of “publicly available information,” that confirms that information may be publicly available, even if subject to payment of a fee. This would be a helpful aid to interpreting the scope of this refusal ground.

R93An official information request should continue to be a request for the provision of information to an individual requester (for the purposes of section 12 of the OIA and section 10 of the LGOIMA) and no legislative change is required.

R94The new Part to each Act that regulates proactive release should recognise public requests that official information be published and require agencies to take such requests into account in developing their proactive release strategies.

Withholding grounds and public interest test

An assessment of the withholding grounds and the balancing of the public interest are key steps in processing a section 12 request for official information. An important question is the extent to which these steps should also apply to the discretionary proactive publication of official information.

We consider that the revised legislation and guidance should require agencies to take account of the OIA and LGOIMA withholding grounds in making decisions about proactive publication. This is consistent with current Cabinet guidance,652 the New Zealand Data and Information Management Principles,653 and NZGOAL.654

This is also reflected to some extent in other legislative provisions.655 For example, the Public Transport Management Act 2008 provides that in relation to information that regional councils can require from operators of commercial public transport services and submissions from those operators on district plans, where the regional council believes that the commercial withholding grounds may apply, or the operator has described the information as “commercially sensitive”, there are restrictions on disclosure of the information by the Council.656 Similar restrictions also apply where such information is held by the New Zealand Transport Agency.657

We therefore recommend that agencies should take account of the various interests protected by the withholding grounds in reaching decisions about the proactive publication of official information. One way to express this in the legislation might be to place a duty on agencies to ensure that proactive publication does not prejudice the interests protected by the withholding grounds, and in relation to the non-conclusive withholding grounds, there are no countervailing public interest factors. We recommend below a different approach to the privacy withholding ground however, as we believe that the protection of privacy in this context should sit within the Privacy Act framework.

The balancing required by the public interest test may be different in relation to proactive publication. Because publication involves making the information available to everyone, the damage or prejudice to the interest protected by the relevant withholding ground may be greater, so that the public interest grounds favouring proactive release may need to be stronger than they would be to justify release to a particular requester. On the other hand, there may be a stronger public interest in making information publicly available to everyone, than making it available just to one requester. We recommend that the Ombudsmen’s guidance on the public interest test include commentary about application of the test in relation to proactive release.

R95The new Part to each Act that regulates proactive release should require agencies to take account of the interests protected by the respective withholding grounds in each Act in reaching decisions about the proactive release of official information.

R96The Ombudsmen’s Guidelines should address how the public interest test is applied before information is proactively released.

Privacy

The expansion of the official information legislation to include proactive publication raises an issue as to how that legislation should intersect with the Privacy Act 1993. Currently, where official information is made available in response to a request, the question of giving adequate protection to privacy depends on the privacy withholding ground and whether there are countervailing public interest factors that justify release.658 Otherwise agencies must observe the restrictions on disclosure contained in the Privacy Act.659

While generally, an agency undertaking proactive release should observe the withholding grounds and protect material accordingly, in the specific case of the privacy withholding ground, we conclude that the applicable disclosure standards to be applied should be those contained in the Privacy Act.660 Otherwise, public agencies would effectively move outside the scope of the Privacy Act in relation to such publication.

In a report on privacy and transparency for the UK government, an independent reviewer noted:661

There are many important factors in the maintenance of trust, but privacy is central to the concerns of this review. If citizens come to believe that an effect of the release of public data will be a significant decrease in privacy, then the result will inevitably be a withdrawal of support and a reduction in the democratic legitimacy of the programme.

The potential impact on privacy was also noted by Senator Faulkner in an address to the Information Policy Conference in Australia:662

As attractive as the simplistic notion of absolute government transparency may be in the abstract, in practice much of the information amassed by any government belongs in fact to individuals, and the unfettered release of all government documents would be a breach of privacy of those millions of Australians.

We recommend that the current boundaries between the official information legislation and the Privacy Act should be maintained. This would mean that where agencies make official information available as a matter of proactive publication, the requirements of the Privacy Act should be observed. This demarcation should be taken into account in any redraft of the official information legislation to incorporate legislative provisions about proactive release.

R97The protection of privacy in the context of proactive publication programmes should continue to be covered by the Privacy Act 1993.

Charging

Under the official information legislation, charging practices for responding to requests vary. As a matter of practice, a presumption against charging has developed under the OIA, although agencies report that the ability to charge is a useful mechanism in the case of large or unwieldy requests. There is much greater willingness by local authorities to charge for requests under the LGOIMA to meet the costs involved.

The provision of official information in response to a request may be subject to a charge that is set by statute or regulation, such as the cost of a birth or death certificate663 or the cost of a land information memorandum.664 Other official information that is proactively released by agencies may be subject to a charge where there is a cost to provide or print the information, such as government publications. There is also the potential for charges to apply to the use of information, even if it is provided for free.665

A relevant factor in relation to the proactive publication of datasets is the New Zealand Data and Information Management Principle that data will be reasonably priced:666

Use and re-use of government held data and information is expected to be free. Charging for access is discouraged.

Pricing to cover the costs of dissemination is only appropriate where it can be clearly demonstrated that this pricing will not act as a barrier to the use or re-use of the data. If a charge is applied for access to data, it should be transparent, consistent, reasonable and the same cost to all requestors.

In summary, charging policies are currently piecemeal, spread across a number of policy documents and are not always consistent. In chapter 10 we recommend that work be undertaken to develop a charging regime for the release of official information. This work should examine the appropriate charging mechanisms for both reactive and proactive release.

Complaints

The broadening of the legislation to encompass the proactive publication of information would extend agency obligations, in pursuance of the objectives of the legislation. We do not see this as an expansion of formal citizen rights to information, given the largely discretionary nature of the proactive publication duty. Therefore there would be no specific complaint rights in relation to proactive release, if citizens wished to complain about an agency’s failure to publish particular information.

Nevertheless, there should, we think, be a degree of oversight as discussed further below. There would also be jurisdiction for the Ombudsmen to review the reasonableness of agency decisions in relation to proactive release under the Ombudsmen Act.667 The three year statutory review we recommend would be another opportunity to review agency release efforts including responsiveness to demand.

Third party information

We have considered the position of third parties where information provided by them or about them is published under an agency’s proactive release strategy. Should third parties have the right to object to or complain about the publication of such information? In chapter 10 we recommend that agencies should be required to notify third parties about the release of their information to requesters, where certain withholding grounds (privacy, commercial and confidentiality grounds, and the tikanga Māori ground in the LGOIMA) are considered to be outweighed by public interest factors favouring release668 and in chapter 11 we recommend that third parties should be able to bring complaints about the release of their information to requesters.669

In our view there should be protection for third party information, regardless of whether the information is released to an individual requester or published to the world in accordance with a proactive release strategy. The publication of this information may cause similar or greater harm than release to an individual requester. There is also a risk that limiting third party rights only to cases where the information is released to individual requesters, may create an incentive for agencies to publish the information to avoid triggering their obligations to third parties.

As recommended above, the Privacy Act should apply in relation to privacy complaints resulting from proactive publication. The Privacy Act provides for complaints to be referred to the Privacy Commissioner where breach of a privacy principle amounts to an interference with the privacy of an individual.670

In relation to the other withholding grounds that protect third party interests, we have identified two options:

(a)Restricting an agency from publishing any third party information where the commercial and confidentiality withholding grounds (and, in the case of LGOIMA, the tikanga Māori withholding ground) are engaged, unless the third party consents; or

(b)Placing a duty on agencies to consult with third parties before publishing their information where the relevant withholding grounds are engaged.

In chapter 10, we recommend a tightly limited form of consultation in relation to the release of third party information to meet a request, in order to avoid unduly delaying responses to requests. We recommend there that agencies give third parties five working days’ notice of an impending release to a requester, so that there is a short opportunity to object to the release. A proactive release strategy will be developed over a longer period and the imperative of avoiding undue delay is not as strong in this context. Therefore, any third party consultation prior to proactive release should be of a fuller kind.

We do not have a particularly strong view about which option should be adopted, but are inclined, to avoid unnecessary complexity in the new framework, to prefer the first option. This would limit agencies from publishing third party information where the relevant third party withholding grounds are engaged, unless the consent of the third party is obtained. A complaint provision would be necessary to allow third parties to bring a complaint where an agency fails to gain the necessary third party consent.

R98The new Part to each Act that regulates proactive release should make the proactive release of third party information that would otherwise be protected by the commercial and confidentiality withholding grounds and, in the case of the LGOIMA, the tikanga Māori ground, conditional on the prior consent of the relevant third party.

R99The proactive release of such third party information without consent should be a new ground of complaint to the Ombudsmen in section 28 of the OIA and section 27 of the LGOIMA.

Issues of liability

Section 48 of the OIA671 protects agencies from liability incurred in releasing official information in response to requests. The question is whether such far-reaching protection should apply where agencies proactively publish information. That would be a significant step beyond the present law. It would effectively accord protection against defamation claims, and defences to actions for such matters of breach of privacy and breach of confidence, to a government agency which has decided to publish the information. The law of defamation has to date not been prepared to go this far. While certain privileges are codified in the schedule of the Defamation Act 1992, they stop short of conferring as wide a protection as this.

We think there are significant differences between releasing information in response to a request and proactively publishing it. First, the OIA and LGOIMA require release of the information if it is requested, provided there is no good reason for withholding it. In such a case some protection from legal consequences is justified. On the other hand proactive publication presupposes an active and voluntary decision to publish, and we think that such decision should involve a consideration of the legal consequences of doing so.

Secondly, where information is released on request it is released only to the requester. This may be somewhat less true with electronic release but it is still true that with proactive release the publication is to a significant number of people and the damage to any person whose interests are affected is potentially much greater.

Thirdly, if information is released on request the aggrieved person has no legal recourse against the agency but does at least retain the right to sue any recipient who publishes it to the world. If there were protection for any agency who published information proactively to all the world, the individual would have no legal recourse at all in relation to such general publication.

The response to this issue amongst submitters to the issues paper was divided.672 A slight majority agreed that section 48 should not apply to proactive release. However some key state agencies took the view that potential subjection to liability would act as a disincentive to proactive release, and urged strongly that the section 48 protection should apply. They emphasised the good faith qualification in the section. One option suggested to us was that protection from liability should depend on a high level sign-off for the disclosure from within an agency.

We continue to hold our view that while section 48 should remain in relation to information released in response to a request, it should not apply to proactive disclosure. While section 48 protection can continue to be justified in relation to one-off releases of information on a case by case basis, it is not appropriate to exempt more systematic proactive release strategies from liability. The emphasis should be on greater proactive release by agencies of official information and public data that is appropriate for release, without an unjustifiable overriding of legitimate third party interests.

It seems to us to be important that individual rights, particularly in relation to defamation and privacy, should continue to be protected, and that matters such as contempt of court and name suppression should not be overridden simply because an agency has decided to publish without taking sufficient care to check content first. The Government should not be above the law in this. Having said that, we think the risks involved are fairly low. The kinds of documents which are likely to be released are seldom going to contain such material.

The approach taken in NZGOAL is to encourage agencies to undertake a review and release process so that they can be confident that there are no copyright or other intellectual property right restrictions in the material and no contractual or other restriction that would prevent release and/or re-use.673 Agencies are also encouraged to use one of six Creative Commons licences when releasing data, which include the following disclaimer:

Except as required by law or as otherwise agreed in writing between the parties, the Work or any Adaptation is licensed by the Licensor on an “as is” and “as available” basis without any warranty of any kind, either express or implied.

Subject to any liability which may not be excluded or limited by law the Licensor shall not be liable on any legal basis (including without limitation negligence) and hereby expressly excludes liability for loss or damage howsoever and whenever caused to you.

Our view is that, given the proposed level of agency discretion as to proactive publication, tools such as due diligence and contractual disclaimers (as promoted by NZGOAL and Creative Commons) are the appropriate measures in this context, in preference to a full exclusion of liability such as that afforded by section 48.

We recommend that liability issues and best practice due diligence processes for managing them be addressed in guidance provided by the official information oversight office we discuss in chapter 13.

R100Section 48 of the OIA and section 41 of the LGOIMA should continue to apply to the release of official information in response to specific requests, but should not be extended to the broader proactive publication of official information.

R101Liability issues in relation to proactive release and best practice due diligence processes for managing them should be addressed in guidance.

Oversight

As the proactive release duty we recommend is a relatively light-handed one, we think it is important that there be a degree of oversight of agency efforts to progressively increase their proactive release of official information and support for these efforts. We believe oversight encompasses a monitoring function, a policy function, a review function and a promotion of best practice function.674 All these facets of oversight are critical in the developing field of proactive disclosure by public agencies, and we favour centralising the formulation of information policy under the auspices of a new oversight office, as discussed in chapter 13.

Oversight of proactive release has been assigned in various ways in other jurisdictions:

(a)In Australia and the United Kingdom, the respective Information Commissioners oversee the operation of information publication schemes.

(b)In the United Kingdom, a Public Sector Transparency Board has been established in the Cabinet Office to oversee the implementation of the government’s commitment to release key datasets and to oversee sector transparency boards for Health, Crime and Justice, Transport, and Education and Welfare.675 A Data Strategy Board is being created to work with the Public Data Group (the four trading funds of the Met Office, Ordnance Survey, Land Registry and Companies House) with the aim of improving access to public information and the consistency of access. An Open Data User Group is also to be established to advise the Data Strategy Board on public sector data that should be prioritised for release.676 And a Local Public Data Panel has been established to identify local public data and its potential uses that are likely to have the greatest impact on empowering citizens or improving local service delivery.

(c)In the United States, various responsibilities are shared among the Office of Management and Budget (OMB) (instructing agencies on developing Open Government Plans), the federal Chief Technology Officer and Chief Information Officer (establishing an Open Government Dashboard for the development of Open Government Plans by agencies) and the Justice Department’s Office of Information Policy (establishing the FOIA.Gov website for monitoring FOIA compliance and providing FOIA resources and support).677

(d)In Canada the government has appointed an Advisory Panel on Open Government to consult on and help prioritise the development and implementation of its Open Government Action Plan.

In the following chapter we discuss oversight functions in relation to the official information legislation more generally. We recommend that this should include oversight of agencies’ proactive release activity. In consultation with central agencies this was regarded as a sensible approach that should result in administrative efficiencies.678

In addition, the oversight office would have an important role to play in the area of providing guidance about proactive release. In relation to the release of datasets in particular, guidance would also be provided by the Data and Information Re-use Chief Executives Steering Group leading New Zealand’s Open Government Information and Data Work Programme.679

The Cabinet paper supporting the Declaration on Open and Transparent Government sets out the level of ministerial oversight for agency compliance with the stated government policy directing the release of high value public data:680

(a)Departments are directed to report back annually to their Ministers with their plans for the release of high value public data;

(b)The Steering Group is to report annually the aggregate plans to the Ministerial Committee on information and communications technologies (ICT).

To ensure co-ordination of the oversight functions in relation to proactive release generally and the release of high value public datasets in particular, we recommend that the oversight office contribute to the work of the Steering Group, in an advisory capacity.

R102Oversight functions in relation to the official information legislation should include oversight of proactive release activities in the public sector including monitoring, policy, review and promotion of best practice.

R103The oversight office should contribute to the work of the Data and Information Re-use Chief Executives Steering Group, in an advisory capacity.

Privacy

Attention also needs to be paid to the oversight of privacy issues in relation to proactive release. Although the Declaration on Open and Transparent Government is framed in terms that it excludes personal data, consideration of privacy issues in releasing datasets should not be overlooked. There may be some grey areas as to whether a dataset indirectly conveys personal information or provides the potential for identifiability of data subjects.681 There will also be privacy issues to consider where datasets are anonymised to facilitate release.682

As noted in a review for the United Kingdom government:683

Privacy is extremely important to transparency. The political legitimacy of a transparency programme will depend crucially on its ability to retain public confidence. Privacy protection should therefore be embedded in any transparency programme, rather than bolted on as an afterthought.

We think this is a particularly important consideration in the New Zealand context; as a small country with a highly connected population, the privacy impacts from the release of information can be significant.

We recommend that the Privacy Commissioner have an oversight role in relation to the privacy aspects of proactive release. This would include:

(a)consultation between the official information oversight office and the Privacy Commissioner,

(b)the Privacy Commissioner contributing to the work of the Data and Information Chief Executives Steering Group as an expert adviser; and

(c)the Privacy Commissioner having the power to recommend that a Privacy Impact Assessment be completed prior to proactive release.684

R104The Privacy Commissioner should have an oversight role in relation to the privacy aspects of proactive release, including:

(a)consulting with the oversight office;

(b)contributing to the work of the Data and Information Re-use Chief Executives Steering Group as an expert adviser; and

(c)having the power to recommend a Privacy Impact Assessment prior to proactive release.

OIA, s 12; LGOIMA, s 10.

The term “substantial collation and research” is discussed in chapter 9, where we recommend that “substantial” should be defined to mean that the work would substantially and unreasonably divert resources from the agency’s other operations.

Office of the Ombudsmen “Refusal to provide open and ongoing public access to the SchoolSMART website” (W56378, 2007).

OIA, s 18(d); LGOIMA, s 17(d). See further [7.40]–[7.52].

See Cabinet Manual, above n 560, at [8.4(b)]: “The person administering the release of the material should consider deleting any information that would have been withheld if the information had been requested under the Official Information Act 1982”; Cabinet Office Notice, above n 560, at [7.2]: “Before approving publication, the Minister should consider whether the document contains any information that would have been withheld if the information had been requested under the Official Information Act 1982.”

The openness principle provides that “Data and information held by government should be open for public access unless grounds for refusal or limitations exist under the Official Information Act or other government policy. In such cases they should be protected.”

See State Services Commission, above n 596, at [29].

See for example s 36YC of the Securities Markets Act 1988 (to be re-enacted by cl 338 of the Financial Markets Conduct Bill 2011), that allows the Financial Markets Authority to omit from the written report of a review of a registered exchange that it is required to publish, any information for which it considers there would be good reason for withholding under the OIA if a request for that information was made under the OIA.

Public Transport Management Act 2008, s 14(3), s 20(3).

Section 22(3).

OIA, s 9(2)(a).

Privacy Act 1993, s 6, information privacy principle 11.

See Office of the Australian Information Commissioner, above n 595, at 6, reminding agencies of their obligations under the Australian Privacy Act 1988 when publishing public sector information.

Dr Kieron O’Hara “Transparent Government, Not Transparent Citizens: a Report on Transparency and Privacy for the Cabinet Office” (2011, UK) at 27. A review of the UK government’s transparency agenda has recommended that the government set out governance structures and processes required to manage risks to the protection of personal data: National Audit Office Cross-government review “Implementing Transparency” (2012) at 11.

Senator John Faulkner (address to Information Policy Conference, Canberra 14 November 2011).

Births, Deaths, Marriages and Relationships Registration Act 1995, s 72.

LGOIMA, s 44A(4).

State Services Commission, above n 596, at 14–15.

Cabinet Minute of Decision, above n 556.

See, for example, Office of the Ombudsmen, above n 650.

Ch 10 at R58.

Ch 11 at R79.

Privacy Act 1993, s 66.

LGOIMA, s 41.

Issues Paper at Q91.

State Services Commission, above n 596, at [90].

See further chapter 13.

Prime Minister (United Kingdom) Letter to Government Departments on Opening Up Data (31 May 2010).

Sam Jardine, Evershed LLP “Government Promises £7 million in Drive to Improve Openness of Public Sector Data” (5 April 2012) <www.lexology.com>.

The White House, above n 554. In addition other agencies involved include the Office of Government Information Services (OGIS) (providing help with complex requests to both requesters and agencies), the National Archives and Records Administration (NARA) (reviewing categories of controlled information), and the Office of Personnel Management (OPM) (enhancing professionalism of individuals working in the freedom of information field).

Letter from Colin MacDonald, Chair, Data and Information Re-use Chief Executives Steering Group, to the Law Commission (16 March 2012).

Cabinet paper, above n 587, at [33].

At [31].

O’Hara, above n 661, at 25–26.

State Services Commission, above n 596 at 23, 34–36; O’Hara, at Part 4; Glyn Moody “Making Open Data Real: A Response” (19 September 2011) <http://blogs.computerworldu.com>; Office of the Australian Information Commissioner, above n 595, at 5-6, citing the submission of the Information Commissioner, Queensland noting that the potential for data-matching and aggregation makes it increasingly difficult to be confident that information has been effectively de-identified. See also Information Commissioner “Summary of ICO Privacy and Data Anonymisation Seminar” London (30 March 2011), noting the problems of “jigsaw identification” whereby data from a number of sources can be combined to enable identification of individuals; Graham Smith “Britain Juggles Right to Know with Privacy Concerns” Calgary Herald (27 September 2011); Halonen, above n 542, at 103–104; Yiu, above n 615 at 25–26.

O’Hara, at 1.

See also Law Commission Review of the Privacy Act 1993 (NZLC R123, 2011) at R104, recommending that the Government should adopt a policy and issue a Cabinet Office circular setting out the circumstances in which public sector agencies are expected to produce a privacy impact assessment.