An NZFFBS Training Module

 Objective 1  State the purpose and principles of the Privacy Act and the Code of Ethics.  Objective 2  Apply the principles of the Privacy Act and the Code of Ethics

 The Privacy Act has twelve information privacy principles.  Principle 1, Principle 2, Principle 3 and Principle 4 govern the collection of personal information. This includes the reasons why personal information may be collected, where it may be collected from, and how it is collected. Principle 1Principle 2Principle 3Principle 4

 Principle 5 governs the way personal information is stored. It is designed to protect personal information from unauthorised use or disclosure. Principle 5  Principle 6 gives individuals the right to access information about themselves. Principle 6  Principle 7 gives individuals the right to correct information about themselves. Principle 7

 Principle 8 and Principle 9, Principle 10 and Principle 11 place restrictions on how people and organisations can use or disclose personal information. These include ensuring information is accurate and up-to-date, and that it isn’t improperly disclosed. Principle 8Principle 9Principle 10Principle 11

 Principle 12 governs how “unique identifiers” – such as IRD numbers, bank client numbers, driver’s licence and passport numbers – can be used. Principle 12  (taken from

 Personal information shall not be collected by any agency unless:  collected for a lawful purpose  collection is necessary for that purpose

 Collect the information directly from the individual concerned.  Exceptions

 Ensure the individual is aware of:  the fact that information is being collected  purpose of collection  intended recipients  the name and address of agency  Laws  consequences  rights to access and correct information

 Personal information shall not be collected  unlawfully  or in ways that are:  unfair  unreasonably intrusive

 An agencies must ensure that:   information is protected against;  loss  unauthorised access, use, modification or disclosure  other misuse  if the information is given to another agency, that agency shall do likewise to protect it. 

 An individual is entitled to:  know what information an agency holds on them  access that information  be advised of their right to request a correction to that information

 An individual is entitled to:   request correction of personal information  request that a statement be attached to the information of the correction requested but not made.   An agency shall:   correct such mistakes  take steps to ensure that the information held is accurate, up to date, complete and not misleading.  inform other holders of the steps taken above.  inform the individual of the steps taken.

 An agency shall take reasonable steps to ensure that the information it uses is:   accurate,   up to date,   complete, relevant and   not misleading. 

 An agency shall not keep information for longer than the purposes for which the information may lawfully be used.

 An agency shall not use information it holds for any other purpose than was originally planned, unless:  the information was sourced from publicly available material  the individual concerned authorised its use  the information is directly concerned with the original purpose  the information is not used in a form that can identify the individual   the information is used for statistical or research purposes and is not published in a form that can identify the individuals.

 An agency shall not disclose information to another party unless:  disclosure is one of the original purposes (or directly related to one of the purposes) for which the information was gathered, or  the individual authorised its disclosure  the information was sourced from publicly available material   the information is not used in a form that can identify the individual  the information is used for statistical or research purposes and is not published in a form that can identify the individuals.

 An agency shall assign a unique identifier:  only if necessary to carry out its functions efficiently  different from other agencies  only to individuals clearly identified  Agencies shall not require individuals to disclose their own other unique identifiers