Agency responsibilities

Personal information held by government agencies is often collected when an individual applies for a government service. The unique relationship this creates between individuals and government gives agencies significant responsibility to keep personal information safe.

When government agencies share personal information with the third party, the agencies must make sure they can satisfy the requirements in the information sharing standard.

Broader public sector responsibilities

The GCDO has more guidance on public sector responsibilities for personal information that go broader than sharing with third parties.

Public sector responsibility

Questions to help agencies meet the 9 responsibilities

Agencies must make sure they can carry out all 9 responsibilities. Agencies can test this by asking themselves the questions listed under each responsibility.

The questions provided here are not an exhaustive list. Agencies are encouraged to ask themselves more questions and adapt the questions here so they are appropriate for their specific situation.

To help an agency answer these questions, an agency may need to:

• talk with the third parties to make sure the third parties understand the requirements
• establish requirements in agreements that are specific to the risks that have been assessed
• educate third parties with training to upskill where required.

1. Clear purpose and legal authority

Sharing personal information with the third party must have a specific purpose and be done under a legal authority.

• The purpose for sharing will be linked to the delivery of public services that the third party is doing with the agency.
• The legal authority can be under the Privacy Act 2020 or under specific legislation that an agency administers.

Having a specific purpose for collection and a legal authority to share are legal requirements under the Privacy Act 2020.

Get more guidance on purpose and legal authority:

• Principle 1: Purpose for collection of personal information — Office of the Privacy Commissioner
• Data protection and use policy: Purpose matters guideline
• Legal authority to share information

2. Clear accountability

One of the aims for the standard is that agencies have accountability for the personal information they have responsibility for. This accountability includes when personal information is under the control of the third party.

Clear accountability means the agency makes sure the third party acts in line with their agreed responsibilities, and those responsibilities are clear to both parties. The third party demonstrates they understand the expectations by putting the necessary protections in place. This is on top of the third party’s own responsibility for using personal information under the Privacy Act 2020.

Accountability does not mean the agency observes and approves every single case of personal information used by the third party. That expectation is not realistic and can cause a high burden for both the agency and the third party.

The most effective way for an agency to set clear expectations for accountability is to have a written agreement with the third party, when it is required.

The Office of the Privacy Commissioner has guidance on privacy responsibilities for agency accountability.

Your privacy responsibilities — Office of the Privacy Commissioner

3. and 4. Risk identification, assessment and mitigating risks

An agency working with the third party must identify and understand the risks when sharing personal information with the third party. The agency needs to do a proportional risk assessment.

Once these risks are identified, the agency must have assurance that the risks can be managed and controlled, before personal information is shared. This process is called risk mitigation.

Guidance on assessing risk

The Office of the Privacy Commissioner has information and resources to help you do a privacy impact assessment (PIA). (Links to the PIA resources are at the bottom of the page.)

Privacy Impact Assessments (PIA)

See the guidance on this website:

• Due diligence
• Risk assessment guidance
• Assess project privacy risk.

The Department of Corrections has developed a risk-framework template for third parties that agencies can use to create their own risk framework.

Privacy risk and assurance framework — Privacy Foundation NZ (PDF 94.5KB)

5. Assurance that personal information is protected

When the third party holds personal information that has been shared by an agency, the third party needs to protect that information in a way that is practically similar to how the agency would protect it.

This means third parties need to have controls for the security and privacy of the personal information they hold. The agency is responsible for identifying the controls the third party has and to have assurance that those security and privacy processes are adequate.

The Office of the Privacy Commissioner and the Protective Security Requirements (PSR) have guidance on protecting personal information.

• Principle 5: Storage and security of information — Office of the Privacy Commissioner
• Poupou Matatapu: Security and internal access controls — Office of the Privacy Commissioner
• Information security (INFOSEC) — Protective Security Requirements

Public Records Act 2005

Protecting personal information includes the agencies’ requirements for information storage and disposal under the Public Records Act 2005. The third party may not be aware of the agency’s requirements under this Act.

Archives New Zealand is responsible for the Public Records Act 2005 and issued the Information and records management standard in 2016.

Key obligations and the standard — Archives New Zealand

Subcontractors and agreement for approval

The third party may need to provide a subcontractor with the personal information that the agency shared with the third party. As a result, the personal information could be used and held by a subcontractor that the agency did not know about, when it agreed to share the personal information with the third party.

This situation can be avoided if the agency’s agreement with the third party includes provisions about sharing personal information with subcontractors. The provisions might include, for example:

• the agency must approve the third party’s subcontractors before the subcontractor can access the personal information
• steps to take if the agency-approved subcontractor is changing, after the subcontractor has had access to the personal information.

6. Conflicts of interest and management processes

Third parties and the individuals that work or volunteer for them often have a wide range of interests. It’s normal for a third party to have conflicts of interest with their local community.

Identifying and managing conflicts of interest properly helps to build and maintain public trust. Conflict of interest management is an active process which includes keeping good records and monitoring changing circumstances.

The third party is responsible for identifying and managing its conflicts of interest, including with the agency-approved subcontractors it uses.

Before information is shared or collected:

• agencies and third parties must discuss any interests relevant to the information sharing that could give rise to possible conflicts
• both the agency and the third party must agree and record in writing how any conflicts will be managed
• the agency must have confidence that the third party’s policies and process are in place and conflicts are well-managed by the third party.

The Public Service Commission has reissued the Conflicts of interest model standard and guidance for that standard.

• Model standards: Conflicts of interest — Te Kawa Mataaho Public Service Commission
• Guide to conflicts of interest conversations — Te Kawa Mataaho Public Service Commission (PDF 173KB)

7. Take action with security or privacy breaches

Agencies are accountable for the personal information that’s shared with third parties. They must be able to intervene and support the third party in the event of a suspected or actual security or privacy breach. Agencies must also investigate the breach if required.

Agencies need to make sure the third party knows:

• who to contact in the agency if there has been a breach
• how to report a privacy breach to the Office of the Privacy Commissioner and potentially to the National Cyber Security Centre.

Resources on reporting breaches:

• Breach Management — Office of the Privacy Commissioner
• Incident response — National Cyber Security Centre
• Report an incident — National Cyber Security Centre.

The GCDO has resources on how to maintain a privacy incident register, response plan, and learning from privacy breaches.

Privacy incidents and breaches

8. Record and report on information sharing

Agencies must keep a central record of information sharing agreements and be able to provide details about them when requested by an appropriate government authority.

These authorities are the:

• Public Service Commission
• Government Chief Data Steward
• Government Chief Digital Officer.

Records of information sharing agreements may be requested if there is an investigation by the Privacy Commissioner. The Privacy Commissioner has the legal ability to investigate both the agency and the third party if it has received a complaint or on their own initiative.

The information an agency should record and be able to report on includes:

• the risk assessment approach the agency has used, and the number of proportional agency risk assessments done
• details of information sharing agreements such as the number of information sharing agreements entered and reviewed, and how many of those agreements are legally binding or have legally binding agreements attached
• the details of individual information sharing agreements such as the signed original copy between the agency and the third party.

9. Being aware of and understanding responsibilities

Third parties may not have the privacy or security resources and experience that is needed to adequately protect the personal information that is shared with them.

The agency has a responsibility to engage with the third party to make sure the third party understands and can protect the personal information that has been shared.

Your privacy responsibilities — Office of the Privacy Commissioner

The Office of the Privacy Commissioner has free e-learning modules about:

Information privacy principles, Privacy Act 2020 and specific privacy topics.

Contact us

For further information, to ask questions or give feedback, please email the Government Chief Digital Officer (GCDO) team.

Email: gcdo@dia.govt.nz