In continuation to our series on Information Privacy Principles, we bring to you IPPs 7-13:
Information Privacy Principle 7: Correction of personal information
An individual can request the organization that holds his/her personal information can request for it to be corrected. It is also the duty of the organization to ensure that the information that it holds is accurate, complete and not misleading. A statement of correction is to be provided to the organization by the individual detailing the correction that is to be made.
Information Privacy Principle 8: Accuracy, etc, of personal information to be checked before use or disclosure
No information held by an organization must be used or disclosed without first taking steps to ensure that the information held is complete, accurate, up to date, relevant and not misleading.
| Information privacy principle 9: Agency not to keep personal information for longer than necessary Information must not be held for a period longer than what is necessary Information Privacy Principle 10: Limits on use of personal information Information collected for the fulfillment of a particular purpose cannot be used for any other purpose. However, there are exceptions to this IPP which are as follows: -The purpose for which the information is collected is directly related to the purpose for which the information shall be used -The information shall be used in such a manner that the individual shall not be identified -The information shall be used for statistical or research purposes -The individual has authorized the use of the personal information -The information to be used is publicly available -The use of the information is necessary to maintain law and order, conduct of judicial proceedings, lessen threat to public health and safety -An intelligence or security agency can also use the information to carry out its functions. Information Privacy Principle 11: Limits on disclosure of personal information IPP 11 mirrors IPP 10. An additional exception is that personal information can be used for purposes other than the original purpose to facilitate the sale or other disposition of a business as a going concern. IPP 11 is subject to IPP 12. Information Privacy Principle 12: Disclosure of personal information outside New Zealand IPP 12 is applicable on the following grounds: -The purpose for which the information is collected is directly related to the purpose for which the information shall be used -The individual has authorized the use of the personal information -The use of the information is necessary to maintain law and order, conduct of judicial proceedings, lessen threat to public health and safety -The information shall be used in such a manner that the individual shall not be identified -The information shall be used for statistical or research purposes -To facilitate the sale or other disposition of a business as a going concern If the above grounds are fulfilled, an organization can disclose personal information to a foreign entity only if: -The individual authorizes the disclosure to the foreign entity after the organization that holds the personal information informs the individual that safeguards in comparison to the Privacy Act do not need to be put in place. -The foreign entity is carrying on business in New Zealand and hence is subject to the Privacy Act -The foreign entity shall be subject to privacy laws that provide comparable safeguards to the Privacy Act. The foreign entity is a participant in a binding scheme (Section 213 of the Privacy Act)The foreign entity is subject to the privacy laws of a prescribed country (Section 214 of the Privacy Act) -The organization believes that the foreign entity must put in place safeguards that are comparable to the Privacy Act. Information Privacy Principle 13: Unique identifier An organization may assign an identifier to an individual to ensure that the information is not easily identifiable. The assignment of an identifier is necessary only if the organization can carry out its functions efficiently. No two organizations can assign the same unique identifier to an individual unless both the organizations are associated persons within the meaning of the Income Tax Act or the organizations are to use the identifier only for statistical and research purposes. It must be noted that a unique identifier is to be assigned only to an individual whose identity is clearly established and the individual is to reveal the unique identifier only for the purpose for which the unique identifier was assigned. |