Vulnerable people to benefit from improved information sharing

A bill that improves the sharing of personal information between agencies was introduced to Parliament today by Justice Minister Simon Power.

The Privacy (Information Sharing) Bill responds to the Law Commission’s review of the Privacy Act in regards to information sharing.

Mr Power said the bill aims to improve the rules around the collection, storage, and use of person information while ensuring there are safeguards in place to protect an individual’s right to privacy.

The bill:

• Allows agencies to share personal information at an earlier stage when it is deemed there is a ‘serious’ threat to public health or safety, or to the life or health of an individual. Currently, the threat must also be ‘imminent’ for the information to be shared.
• Inserts a new mechanism into the Privacy Act to allow for the approval of information sharing agreements between agencies. This mechanism will apply only to information sharing for public purposes and may include non-government organisations when they are providing public services on behalf of a public sector agency.
• Sets out the process for drawing up an information-sharing agreement. This requires consultation with the Privacy Commissioner and for the agreement to be approved by Order in Council. The bill will specify the criteria for approval, the matters that need to be covered in the agreements, and general rules for the operation of such agreements including appropriate safeguards, as well as suitable transparency, accountability, and review processes.

Mr Power said the information-sharing aspect of privacy reform was fast-tracked ahead of other privacy work because of its potential to help vulnerable people, including children.

“As the Law Commission put it, information sharing has major benefits in allowing agencies to see all sides of an individual’s case rather than just through their own narrow lens.

“Although agencies are already able to share a great deal of personal information under the Privacy Act, the Act itself is unclear and misunderstood around when and how personal information can be shared."

The bill is also expected to save information-handling costs across government. The Government will respond to the remainder of the Law Commission’s Privacy Act report within the 120 working days allowed.

The issue of mandatory reporting for child abuse is not included in this bill and is being considered as part of the Government’s Green Paper on Vulnerable Children.

The Cabinet paper can be found here.

Questions and Answers:

Will the bill lead to a more intrusive government presence in people’s lives?
The Government is satisfied that the bill has appropriate safeguards in place to protect a person’s right to privacy. In particular, the information-sharing agreements are still required to comply with some information privacy principles and will have to specify safeguards that will protect the privacy of individuals and ensure that any interference with their privacy is minimised.
The Privacy Commissioner will have an oversight role to ensure that limitations on personal privacy are minimised and will be able to alert the public if she considers privacy is not being adequately safeguarded.

What is the Privacy Commissioner’s role in drawing up information-sharing agreements?
When drawing up information-sharing agreements, agencies must consult the Privacy Commissioner. The commissioner may report to the relevant Minister before agreements are approved, and the Minister must take the report into account before agreements are finalised.
The commissioner will have the power to publish a report about an agreement after it is approved, and will be able to report on the operation of an agreement if he or she feels something is going wrong. The report can be presented to the House of Representatives, and the Government will have an obligation to respond.

Does the bill allow private sector agencies to share information with each other?
Private sector agencies can become parties to information-sharing agreements and share information in the course of delivering public services. A government department must always be a party to an information-sharing agreement and is ultimately responsible for the conduct of a private services provider delivering public services.

What will happen if a public service provider breaches an information-sharing agreement?
A complaint can be made to the Privacy Commissioner which may result in an investigation under the Privacy Act’s existing complaints process. A complaint could also be made to the Ombudsman.

How will the Government ensure that non-government organisations can be trusted to protect individual privacy?
Government agencies will enter into information sharing agreements only with non-government organisations that they believe are trustworthy. In addition, if a private sector agency is unable to be held to account for a complaint about alleged interference with privacy, then a government agency will be responsible for dealing with the complaint. 

How will the Privacy Act be amended to allow agencies to share information at an earlier stage?
Exemptions to information privacy principles contained in the Privacy Act (that information should be collected from only the individual concerned and that information collected for one purpose should not be used for another) will be widened to allow for personal information to be shared in circumstances where there is a ‘serious’ threat to public health or safety, of the life or health of an individual. Currently, the threat has to be ‘serious and imminent’ to allow the information to be shared.

Can an information-sharing agreement override all privacy protections?
Agreements can override only the information privacy principles (except for principles 6 and 7 which provide an individual’s right to access information about themselves and request corrections of that information). Agreements cannot override other legislation. 

Can members of classes of parties join information-sharing agreements?
Information sharing agreements may include clauses that specify that members of a class of agencies can, after it is approved, join the agreement. No further approval will be required, but the lead agency will need to update the agreement on its website. The new agency would have the same rights and obligations as any other party to the agreement. For example, an information-sharing agreement could specify that ‘schools registered under the Education Act’ be added to the agreement to share truancy information with CYF. The lead agency could then add the names of specific high schools to the schedule.