Primary legislation may authorise or enable agencies to collect, use, and disclose personal information for specified purposes.
How primary legislation affects sharing
Primary legislation that authorises the collection, use and sharing of information will override the Privacy Act with regard to collection, use and sharing, although only to the extent that the primary legislation cannot be read consistently with the Information Privacy Principles (IPPs).
However, the remaining IPPs covering security, storage and accuracy will still apply to your information sharing activity.
The following sections set out some of the most common primary legislation used across the government sector to facilitate information sharing.
The first group of statutory provisions do not require agencies to share information, but they provide discretion to do so in appropriate circumstances, for sound public interest reasons.
Note: Seek advice from your privacy, information sharing or legal teams on whether your agency has primary legislation that enables the sharing of information with other agencies, organisations, or individuals and how that legislation is applied in practice.
Oranga Tamariki Act 1989
The Oranga Tamariki Act authorises the sharing of information between agencies within the child welfare and protection sector and with ‘independent persons’ — those working within the child welfare and protection sector.[Footnote 1]Footnote Footnot
Section 15
If you become aware that a child or young person has been, or is likely to be, harmed, ill-treated, abused, neglected, or deprived, or have concerns about the wellbeing of a child or young person, section 15 permits you to share information in good faith about your concerns with Oranga Tamariki.
You do not need to be working for a child welfare and protection agency or have the consent of the child or their parents or whānau to make a report of concern.
If you work in the child welfare sector you can use section 66C of the Oranga Tamariki Act to request and disclose information to support safety and wellbeing for children or young people (tamariki or rangatahi) to:
prevent or reduce the risk of harm, ill-treatment, abuse, neglect, or deprivation for tamariki
make or contribute to an assessment of risk or needs of tamariki
make, contribute, or monitor any support plan for tamariki that is managed by Oranga Tamariki
prepare, implement, or review any prevention plan or strategy made by Oranga Tamariki
arrange, provide, or review services facilitated by Oranga Tamariki for tamariki or their whanau
carry out any function in relation to a family group conference for tamariki in care or anything else related to the care and protection of tamariki.
You do not need the consent of the individual to share the information if the sharing is for one of the specified purposes under section 66C. Section 66K does require consultation with tamariki and rangatahi whenever practicable or appropriate to do so.
When sharing information using section 66C as the legal authority, you must believe on reasonable grounds that the sharing of information will assist the receiving agency for any or all of the purposes provided above. This applies whether you are sharing information proactively or whether you are responding to a request for information from a child welfare and protection agency or an Independent Person.
If you have received a request for information under section 66C but require more information before you can believe you have reasonable grounds to share, contact the requestor and ask for more information. If you’re still unsure about whether you should share information using section 66C you should seek support from your privacy, information sharing or legal team.
It’s important to remember that while section 66C authorises the sharing and use of information, the Privacy Act IPPs relating to security, accuracy, storage, and unique identifiers still apply.
The Family Violence Act authorises the sharing of information between agencies within the family harm sector.
If you work in the family harm sector you can use section 20C of the Family Violence Act to request and disclose information to:
make or contribute to a family violence risk or need assessment
make or contribute to making or carrying out of a decision or plan that is relation to or that arises from or responds to family violence
help ensure that a victim is protected from family violence.
You do not need the consent of the individual to share the information if the sharing is for one of the specified purposes under section 20. However, provided that it’s safe to seek consent, it’s often best practice to do so.
When applying section 20, you must believe on reasonable grounds that sharing information will or may help the receiving agency achieve one or more of the purposes above.
If you require more information before you can form a reasonable belief that the information sharing will fit with section 20, contact the requestor and ask for more information. If you’re still unsure about whether you should share information using section 20 you should seek support from your privacy, information sharing or legal team.
While section 20 authorises the sharing and use of information, the IPPs relating to security, accuracy, storage, and unique identifiers still apply.
Sharing to support enforcement and regulatory functions
Primary legislation can also facilitate the sharing of information to enable agencies to undertake enforcement or regulatory functions.
In some cases, these legislative provisions will require an agency to create an agreement that documents the details of the sharing. For example, sections 303, 303A and 303B of the Immigration Act 2009.
The Immigration Act 2009 is a good example of primary legislation that contains provisions facilitating the sharing of information for enforcement and regulatory purposes. Sections 301 to 306 set out when Immigration New Zealand can disclose immigration information, who it can be shared with and for what purpose.
Example 1 — Passenger information collected by airlines
Airlines provide Advance Passenger Processing (APP) information about every passenger and crew member on their flights coming to or leaving New Zealand, including passengers who are only in transit. The information the airlines collect is shared with Immigration New Zealand (INZ). The sharing is authorised under section 303A of the Immigration Act 2009 and allows INZ to compare personal information it holds with APP information and load alerts into the system.
On this particular day at a check-in desk in Singapore a traveller has triggered an alert during the APP check as they have been found to have attempted to travel on false documents in the past. This has informed a ‘do not board’ message and the airline agent calls an Immigration Border Officer. The officer checks the documents, but it is not immediately clear they are false and she lets the traveller board. On arrival with increased scrutiny at the border it appears the traveller’s documents are false and they are declined entry into New Zealand. The traveller is held until they can be put on a plane back to their country of origin.
At the time of the traveller’s turn-around, biometrics are taken (fingerprints and face images) so that fingerprint checks can be done with other Five Eyes Partners. This prevents travellers excluded from one country from gaining entry to another country through false pretences.
Legislation requiring the sharing of information
An agency’s primary legislation may require you to share personal information for specific purposes.
Some examples of these types of legislative provisions include:
Section 17B of the Tax Administration Act
Section 66 of the Oranga Tamariki Act 1989
Section 23 of the Data and Statistics Act 2022
Section 619 of the Education and Training Act 2020
Schedule 6 clause 2 of the Social Security Act 2018
Section 20(1)(a) of the Children’s Commissioner Act 2003
Schedule 5 of the Pae Ora (Healthy Futures) Act 2022
Section 20 of the Inquiries Act 2013
A notice requiring the provision of information:
should be made in the prescribed form
clearly identify the legal authority under which the notice has been issued
clearly state the information you are required to provide and for what purposes.
When you receive a notice, you must provide the information requested to the issuing agency within the specified timeframe.
Record the notice and your response to the notice in the appropriate register.
Example 2 — Statistics New Zealand requesting personal information
Statistics New Zealand (Stats NZ) are producing official statistics about child poverty. They have approached your agency because they need personal information you hold to produce these statistics.
Do you need to provide this information?
Yes, the Government Statistician can make mandatory requests for data if the data is necessary or desirable for official statistics. Your agency must comply with this request. Stats NZ has high standards for keeping information private, secure, and confidential. This includes enforceable requirements to keep data confidential, ensuring that Stats NZ will not publish statistics in a form that could reasonably be expected to identify the individual concerned.
Stats NZ will undertake a Privacy Impact Assessment (PIA) before they collect the data from your agency. The PIA will identify and assess privacy risks and ensure there are good practical measures in place to protect the personal information.
Example 3 — Abuse in Care Royal Commission information request
You have received a request for information about an individual from the Abuse in Care Royal Commission. The information requested includes personal information about the individual.
Can you share this information with the requestor?
Yes, you can. The Abuse in Care Royal Commission has powers under section 20 of the Inquiries Act 2013 to collect information appropriate for the purposes of the inquiry. This means they can require any person to produce documents and provide information necessary for the Abuse in Care to identify, examine and report on matters in scope of the inquiry.
Given the sensitive nature of the information, make sure that you share the information using a secure method to protect the personal information.
Example 4 — Mortality Review Committee requesting information
You have received a request for information about a number of individuals from the chairperson of a Mortality Review Committee. The request is for personal information, including health information about the individuals listed in the request.
Can you share this information with the chairperson?
Yes, you can. Mortality Review Committees are set up under the Pae Ora (Healthy Futures) Act 2022, and Schedule 5 of that Act grant the Mortality Review Committee (or the appointed agent) the power to source any information relevant to their purpose.
Given the sensitive nature of the information, make sure that you share the information using a secure method to protect the personal information.
Note: Always seek advice from your privacy, information sharing or legal team if you have received a notice requiring you to provide information.
