Similar to the Australian Privacy Principles, New Zealand has its own set of Information Privacy Principles (IPPs). The IPPs are a part of Part 3 of the Privacy Act, 2020. The IPPs are important because they are principles that govern the code of practice that agencies i.e.organisations in New Zealand must follow to safeguard the privacy of the data collected by the agencies. If any IPP is not complied with, it can lead to a privacy breach.
6 of the 13 Information Privacy Principles are as follows:
IPP 1: Purpose of collection of personal information
The purpose behind collecting personal information must be exclusively lawful. The information collected must be to fulfill the function or activity of the agency. If the identifying information is not needed, then the agency must not collect this information.
IPP 2: Source of personal information
The information collected must be from the individual concerned. However, IPP 2 lists the exceptions to this which are broadly as follows:
-An agency can collect information from a source other than the individual concerned if it would prejudice the interests of the individual if collected directly from him/her
-If the individual authorizes collection of information from another source
-If the information is publicly available
-Collection of information from a source other than the individual would not prejudice the law and order, threaten the life and health of the individual concerned, jeopardize judicial proceedings
-The information collected shall be used for research and statistical purposes
IPP 3: Collection of information from subject
When an agency collects personal information from the individual concerned, it must take the following reasonable steps:
-The individual must be made aware that information is being collected
-The purpose for which the information is being collected
-Who shall receive the information
-The name and address of the agency who shall be collecting the information and who shall hold the information
-The law by way of which the information is being collected
-Whether the collection of information is voluntary or mandatory
-The consequences if the requested information is not provided
-The individual must also be made aware of the rights of access and correction of information as available to him/her.
The above has the same exceptions as IPP 2 mentioned above.
IPP 4: Manner of collection of personal information
The means by which personal information is collected must be by way of lawful means and must not unnecessarily intrude in the private affairs of the individual concerned. Special care must be taken when personal information is being collected from children and young persons.
IPP 5: Storage and security of personal information
An agency that holds personal information must take all reasonable safeguards to protect the information from all kinds of loss, access, use, modification or any kind of misuse. All measures must be taken to prevent any kind of unauthorized disclosure.
IPP 6: Access to personal information
Every individual has the right to know if the agency holds personal information about him/her and a right to access the personal information held by the agency.