Chapter 6: Protecting privacy

 

The problem

The problem we have identified from responses to the survey and submissions to the issues paper is one of confusion amongst agencies about how the privacy withholding ground operates. The Ombudsmen suggested the complexity of this withholding ground was overstated in the issues paper; however other submissions we received confirmed our initial view that agencies find the privacy withholding ground confusing. Crown Law, agreeing that the interface between the OIA and Privacy Act is problematic, expressed the view that both the OIA and the Privacy Act 1993 are engaged when an OIA request involves personal information about someone other than the requester, and that information privacy principle 11 should be considered as part of the decision-making process. That does not seem to be the usual approach however. The Ombudsmen’s guidelines on the withholding ground make no mention of privacy principle 11.196

Other agencies reported that they use a Privacy Act approach when faced with withholding and release decisions under the official information legislation, and it seems that on occasion, some agencies omit to apply the public interest balancing test before reaching a final decision. We suspect that this may be partly because the generalised expression of privacy in the current withholding ground means that agencies reach for tools from the Privacy Act to try to make sense of it.

Officials are expected to be familiar with and expert in two distinct disclosure frameworks: the Privacy Act and the official information legislation. Where agencies are responding to a request for official information, any privacy considerations are assessed against the privacy withholding ground, rather than the Privacy Act. However, where agencies publish information proactively, in the absence of a request for it, they must comply with the privacy principles contained in the Privacy Act.197

While both statutes deal with the withholding and release of information, the Privacy Act has a different emphasis to the official information legislation and deals with the nature of the privacy interest, disclosure and withholding, and the role of the public interest in a way that is quite different to the official information legislation. Agencies sometimes seem to struggle to reconcile the different requirements, namely the requirement of the Privacy Act not to disclose personal information except in certain circumstances,198 and the requirement of the official information legislation to disclose official information that is requested unless there is a good reason to withhold it. As we noted in the issues paper, we are concerned that the extent of the conceptual differences between the two approaches creates potential for confusion in the decision-making process.

The Ombudsmen and the Privacy Commissioner have not indicated a high degree of concern with the situation, and each is satisfied that the interface works well once users become familiar with it. As expert users themselves, these bodies are skilled at explaining the interface and providing training to agencies on it, from their respective perspectives. Nevertheless, we think it would be desirable and useful to take a holistic view of the information legislation and to see whether the complexity can be reduced.

In the issues paper we explored options for improving the OIA withholding ground to make it easier for users to interpret on a more consistent basis. We examined the approach taken in other jurisdictions such as Australia and the United Kingdom. Our aim has been to identify options that would make the withholding ground more conceptually consistent with the Privacy Act, so that it might be more user-friendly for the agencies that apply it, without detracting from the key objective of the official information legislation, namely the principle of availability in the public interest.

We are mindful of the move towards greater proactive disclosure.199 This may increase the extent to which agencies are required to switch between the different disclosure frameworks in assessing privacy interests: the Privacy Act for proactive release and the official information legislation for reactive release. We think that this development strengthens the need for greater coherence in the legislative framework.

Another factor we are mindful of is the related topic of notification to affected third parties. In chapter 10 we recommend that agencies should be required to give prior notice of release where there are certain important third party interests at stake such as privacy. This also strengthens the need for a clearer privacy withholding ground so that agencies can readily recognise what amounts to a third party interest that would trigger this requirement.

Office of the Ombudsmen Practice Guidelines – Official Information (Wellington, 2002) Part B 4.1.

Proactive release and the boundary between the official information legislation and the Privacy Act are discussed in chapter 12.

Privacy Act 1993, s 6, information privacy principle 11.

See chapter 12.