Chapter 6: Protecting privacy

Information sharing: requests between public sector agencies

In the issues paper we raised a question about the extent to which government agencies should be permitted or restricted from using the OIA to obtain or share personal information about citizens.218

A small number of submitters did not think that any legislative change is needed. Some agencies didn’t think that such requests can be made under the OIA. The Department of Internal Affairs expressed the view that section 12 of the OIA does not extend to the Crown, although the Department notes that there are Crown agencies that attempt to use and are often successful in using the OIA to gain access to information (both personal information about citizens and more general information). The Ombudsmen’s view is that the definition of “person” is broad enough for section 12 to include requests from public sector agencies. Crown Law drew our attention to section 19 of the Protected Disclosures Act 2000. Subsection (2) anticipates that official information requests may be made by the Police:

(2) A request for information under the Official Information Act or under the Local Government Official Information and Meetings Act 1987 (other than one made by a constable for the purpose of investigating an offence) may be refused, as contrary to this Act, if it might identify a person who has made a protected disclosure.

Given the divergence of views, we think that it would be desirable for the ambiguity about whether public sector agencies can make any OIA and LGOIMA requests to be resolved. This could be addressed in the redrafting of the legislation, as discussed in chapter 16, to confirm that agencies can themselves make official information requests.

The remaining question is whether any requests from public sector agencies should extend to personal information. 16 submitters expressed a high degree or at least some degree of concern about the issue raised. Concerns included that the use of the OIA in this way does nothing to promote the OIA’s aims of transparency and good government; it is inconsistent with the privacy principles that information made available for one purpose can be made available to another agency for unrelated purposes; and the need to maintain trust in government. Some expressed the view that the Privacy Act, rather than the official information legislation should cover this issue.

The Ombudsmen expressed concern about the scope of any proposed limitation, pointing out that some agencies will have legitimate reasons for requesting official information that includes personal information, and suggesting that only requests by central public service departments219 with the principal purpose of obtaining personal information about identifiable individuals should be restricted.

We agree that it is the potential for information sharing about citizens that raises the particular concern. Since the release of the issues paper, the Privacy (Information Sharing) Amendment Bill 2011 (the “Information Sharing Bill”) has been introduced into Parliament.220 The Bill proposes the creation of a new Part 9A of the Privacy Act that allows for the sharing of personal information between public sector agencies in accordance with approved information sharing agreements.

Upon enactment, the Information Sharing Bill would provide another avenue by which public sector agencies may obtain personal information from other agencies. The Privacy Act already provides a number of options for information sharing between agencies, i.e.:

(a)Discretionary release of personal information under privacy principle 11;

(b)Release in accordance with an authority issued by the Privacy Commissioner;221

(c)Release in accordance with an information matching agreement;222

(d)Release in accordance with Schedule 5 to the Privacy Act (in relation to those agencies who are subject to Schedule 5).

In our view it is appropriate for the disclosure of personal information about citizens between public sector agencies to be governed by one of the measures in the Privacy Act, with the necessary checks and balances, rather than under the official information legislation. Otherwise there is a risk of Privacy Act processes, including the new process for information sharing that is contemplated by the Bill, being undermined.

However, surveying the range of personal information that could potentially be requested, we think a limitation that sought to restrict public sector agencies from obtaining any personal information under the official information legislation would be overly broad.

Personal information that might be sought in an OIA request could include personal information about:

(a)Officials (in their official capacity), either officials of the agency to whom the request is directed or officials of other public sector agencies;

(b)Officials in their personal capacity (i.e. employment information);

(c)Ministers of the Crown in their official capacity;

(d)Personnel of corporate and unincorporated entities acting in a professional capacity; and

(e)Citizens in their personal capacity.

The difficulty with a purpose limitation as suggested by the Ombudsmen is that as we do not recommend that a requester be required to state the purpose of their request,223 it would problematic to structure a limitation on this basis.

We also considered the suggestion of the Ombudsmen that only central government departments should be subject to any limitation on using the official information legislation to obtain personal information. However, as the scope of the Information Sharing Bill potentially covers a wide range of public sector agencies, we consider that for consistency, any limitation should apply to the same range of public sector agencies.

We think a more workable limitation would be to draw a distinction based on the nature of the personal information, i.e. whether it relates to a person in their personal or their official or professional capacity. We believe that this distinction is at the crux of the concern. Personal information about a person in their personal capacity should not be shared by public sector agencies through the vehicle of official information requests: the appropriate mechanisms for this activity are those provided by the Privacy Act (including the Information Sharing Bill). However personal information about people in their official or professional capacity should remain within the scope of official information requests from public sector agencies, on freedom of information grounds. This is where the interests of transparency and accountability remain in play.

We recommend that the official information legislation be amended by the inclusion of provisions clarifying that requests from public sector agencies (including local government) for personal information about individuals in their personal capacity are outside the scope of the official information legislation.224

One option would be to include a new sub-clause along the following lines:225

Nothing in this Act authorises or permits the making available of any personal information to a Department, Minister of the Crown, organisation or local authority.

“Personal information” could be defined for this purpose as:

“official information held about an identifiable individual in their personal capacity”.

There will be some grey areas as to whether personal information relates to a person’s personal capacity or to their official or professional capacity, for example employment information relating to terms of employment and salary. Guidance will be important in helping to clarify where the boundaries lie.

The creation of a limit on use of the official information legislation by public sector agencies in this way would not limit other avenues of obtaining personal information in appropriate circumstances. As noted above there are a range of mechanisms in the Privacy Act for releasing or sharing personal information subject to applicable safeguards, as well as the new regime proposed in the Information Sharing Bill.

R23A new provision in the OIA and LGOIMA should make it explicit that OIA and LGOIMA requests may be made by public agencies, subject to the limitation that personal information about individuals in their personal capacity is outside the scope of these requests.

Issues Paper at Q25. The Law Commission also raised this issue, above n 200, at [11.62] – [11.66]; above n 208, at [8.18].

I.e. those agencies listed in the first schedule to the Ombudsmen Act 1975.

The Privacy (Information Sharing) Amendment Bill draws on the Law Commission’s information sharing proposals arising out of the review of the Privacy Act: Law Commission Information Sharing (Ministerial Briefing, 29 March 2011); contained also in Law Commission, above n 208, Appendix 1.

Privacy Act 1993, s 54.

Part 10.

Chapter 9.

Personal capacity is a concept that is used in the official information legislation for other purposes, see OIA, ss 20(1)(c), 22(1), 23(1); LGOIMA ss 21(1), 22(1). See also Ombudsmen Act 1975, s 13(1).

This could be included as s 52(2A) of the OIA and s 44(1A) of the LGOIMA.