1. Asian Personal Data Privacy Forum, Hong Kong, 27 March 20011 Cross-border Data Matching Blair Stewart Assistant Commissioner Office of the Privacy Commissioner New Zealand

2. Asian Personal Data Privacy Forum, Hong Kong, 27 March 20012 Data Sharing arrangements  Certified copies of documents eg birth, qualification, professional record  Request and response eg FOI laws, Mutual assistance laws  Disclosure of complete databases eg published register of teachers, NZ passport database to Australia  Comparisons of data Eg computer matching or data matching

3. Asian Personal Data Privacy Forum, Hong Kong, 27 March 20013 Data Matching meaning #1 Procedure whereby a list of personal data about a number of people held for one purpose is compared with a list of personal data held for another purpose for the purpose of producing or verifying data that may be used for taking adverse action against any person

4. Asian Personal Data Privacy Forum, Hong Kong, 27 March 20014 Data Matching meaning #2 Put another way The computerised comparison of 2 or more sets of records with the objective of seeking out records which relate to the same individual in order to detect cases of interest

5. Asian Personal Data Privacy Forum, Hong Kong, 27 March 20015 Data matching laws examples  Personal Data (Privacy) Ordinance 1995 (HK), Part VI  Privacy Act 1993 (NZ), Part X  Data-matching Program (Assistance and Tax) Act 1990 (Aust)  Computer Matching and Privacy Protection Act (USA)

6. Asian Personal Data Privacy Forum, Hong Kong, 27 March 20016 Typical data matching controls #1 Evaluation Operation Authorisation

7. Asian Personal Data Privacy Forum, Hong Kong, 27 March 20017 Typical Data Matching Controls #2  Authorisation – assess public interest, technical/policy issues, public confidence  Operation – openness, fair processing, protect individual interestes  Evaluation – did it achieve its objectives, is it cost effective, what problems encountered

8. Asian Personal Data Privacy Forum, Hong Kong, 27 March 20018 Operational controls Examples  notice, consent, accuracy, minimisation, security and accountability  Data checking, ability to contest findings  No completely automated decision-making  Destruction of unused data  Robust technical standards  No presumption of guilt

9. Asian Personal Data Privacy Forum, Hong Kong, 27 March 20019 Cross-border Matching NZ proposals  Netherlands-NZ Social Security Agreement  Worldwide Dutch policy  Means tested benefits – cost where o/seas pensions not declared, choice of residence, verification etc  Mutual recovery of debts  Tax and social security depts both involved  Australia-NZ Social Security Agreement  CER, Free movement but limited SS entitlements  Determining periods of residency  Verify entitlements, amounts, debt recovery

10. Asian Personal Data Privacy Forum, Hong Kong, 27 March 200110 Some issues with Cross-border matching  Authorisation processes – suit both jurisdictions?  Which jurisdiction’s law to apply?  What of jurisdictions without data protection laws?  Compatability of data, definitions etc (always an issue anyway)

11. Asian Personal Data Privacy Forum, Hong Kong, 27 March 200111 New NZ framework law  Social Welfare (Transitional Provisions) Amendment Act 2000  New sections on mutual assistance provisions in reciprocity agreements, terms and conditions for recovery of debts and for exchange of data  Safeguards consistent with NZ information matching controls  Privacy Commissioner to report of any proposed agreement include “the adequacy of the privacy protection given in the other country to information about individuals supplied by NZ”

12. Asian Personal Data Privacy Forum, Hong Kong, 27 March 200112 On-going Issues  Combines the issues and complexity of both data matching and TBDF  Bound to be of growing interest to officials and politicians given globalisation and the enhanced ability of computers to sort mass data