Processing requests
18.4MACMA contains provisions that provide for the processing of some types of assistance. For example, where a request has been made for assistance in locating a person pursuant to section 30, once the Attorney-General has authorised the request, the:
… Attorney-General shall forward the request to the appropriate agency in New Zealand, and that agency shall use its best endeavours to locate or, as the case may be, identify and locate the person to whom the request relates, and shall advise the Attorney-General of the outcome of those endeavours.
18.5Another example is where a request has been made for assistance in arranging service of process under section 51. Once the Attorney-General has authorised the request, the:
… Attorney-General shall direct the appropriate authority to arrange service, and in such a case the authority shall—
(a) use its best endeavours to have the process served—
(i) in accordance with procedures proposed in the request; or
(ii) if those procedures would be unlawful or inappropriate in New Zealand, or if no procedures are so proposed, in accordance with the law of New Zealand.; and
(b) if the document—
(i) is served, transmit to the Attorney-General for transmission to the foreign country making the request a certificate as to service; or
(ii) is not served, transmit to the Attorney-General for transmission to the foreign country a statement of the reasons which prevented the service.
18.6In the examples above, the domestic agency is compelled to carry out the request. However, MACMA does not stipulate a procedure for the forwarding of requests for information to domestic agencies. The Central Authority does not have an empowering provision that enables it to compel the domestic agency to provide it with the requested information. Accordingly, these requests must be made under some authority outside of MACMA.
18.7Crown Law has told us that it might use the Official Information Act to obtain the requested information under MACMA from the relevant New Zealand agency.
18.8The Official Information Act provides that a department, Minister of the Crown or organisation may be requested to provide official information. The information sought must be specified with due particularity. The requester can, with reasons, ask that his or her request be treated as urgent. A decision on whether to grant the request must be made and conveyed to the requester as soon as reasonably practicable and within 20 working days of the request being received. This time limit can be extended for a “reasonable period of time having regard to the circumstances” where there is a large quantity of information or the need to consult other parties. If a decision is not made within the time limit, or if there is “undue delay” in actually supplying the information, the request is deemed to have been refused, and the requester can ask the Ombudsman to investigate the refusal. Requested information should be made available unless there is good reason for withholding it. The grounds for refusal generally relate to administrative difficulty in complying with the request or to the harm that disclosure may cause.
18.9The statutory purpose of the Official Information Act is:
(a) to increase progressively the availability of official information to the people of New Zealand in order—
(i) to enable their more effective participation in the making and administration of laws and policies; and
(ii) to promote the accountability of Ministers of the Crown and officials,—
and thereby to enhance respect for the law and to promote the good government of New Zealand:
(b) to provide for proper access by each person to official information relating to that person:
(c) to protect official information to the extent consistent with the public interest and the preservation of personal privacy.
18.10We do not believe the Official Information Act was intended to be used by the Central Authority for the purpose of accessing information to satisfy a request from a foreign country in respect of a criminal matter. Further, it is unclear whether the Attorney-General, in the capacity as the Central Authority under MACMA, could make such a request. We noted this in our recent report on the Privacy Act:
The very purpose of the [Official Information Act] is to enable “the people of New Zealand” to get information about government and not the reverse. Moreover, the list of persons who can make requests under section 12 of the [Official Information Act] probably does not include the Crown (although that is not absolutely clear).
18.11This was also considered in the Law Commission’s recent review of the Official Information Act. In that report, we noted that the ambiguity about whether public sector agencies can make Official Information Act requests needed to be resolved. In both these reports, we also discussed whether any requests from public sector agencies under the Official Information Act should extend to personal information. We took the view that it is more appropriate for the disclosure of personal information between public sector agencies to be governed by the Privacy Act, and we recommended that the ability of public sector agencies to make information requests to each other under the Official Information Act should not extend to requests for information about people in their personal capacity.
Privacy Act 1993Top
18.12In New Zealand, personal information held by agencies cannot simply be shared with other agencies. This is because New Zealand has a privacy framework governed by the Privacy Act 1993. This framework is based on the general premise that an agency that holds personal information obtained in connection with one purpose should not use that information for any other purpose. The fundamental nature of the protection of personal information has resulted in agencies taking a risk-averse approach to the sharing of information, even where there are legitimate exceptions in the Privacy Act allowing for such sharing to take place.
18.13The Privacy Act allows for personal information to be shared between public agencies in the following limited circumstances:
- Release in accordance with an authority issued by the Privacy Commissioner.
- Release in accordance with Schedule 5 of the Privacy Act (in relation to those agencies who are subject to Schedule 5).
- Release in accordance with an information-sharing agreement.
- Discretionary release of personal information under Privacy Principle 11.
18.14In the MACMA context, a domestic agency could potentially release the information to the Central Authority under one of the exceptions in Privacy Principle 11. Principle 11 places limits on the disclosure of information, subject to a number of exceptions, including an exception where the restriction on disclosure of information would prejudice the maintenance of law, specifically:
An agency that holds personal information shall not disclose the information to a person or body or agency unless the agency believes, on reasonable grounds,—
…
(e) that non-compliance is necessary—
(i) to avoid prejudice to the maintenance of the law by any public sector agency, including the prevention, detection, investigation, prosecution, and punishment of offences;
18.15Foreign assistance approved under MACMA is clearly in accordance with the maintenance of foreign law. The circumstances under which the assistance can be provided and the details that must be provided in respect of a request give solid evidence of this.
18.16However, as observed by the Privacy Commissioner, the maintenance of the law exception was probably not intended to permit disclosure for maintenance of foreign law because:
… it is linked to the notion of avoiding prejudice to the maintenance of the law by any “public sector agency” (which means a New Zealand public sector agency). This is likely to mean that the prejudice to the law covered may only be in relation to a New Zealand law.
18.17The sharing of information for the purposes of foreign law enforcement fits uneasily with the Privacy Act. The recently introduced Organised Crime and Anti-corruption Legislation Bill amends the Policing Act 2008 to provide the Police with a power to share personal information with its international counterparts. The Bill was introduced because of the concern that the present state of the law does not allow New Zealand to share that sort of information. The Regulatory Impact Statement noted that the lack of express legislative authority creates a risk that information sharing will breach the Privacy Act 1993. The Bill deals with this by including an express provision that provides that the disclosure of personal information is subject:
… to any other enactment, other than the Privacy Act 1993, that limits or restricts the disclosure of information or requires information of a particular kind to be disclosed or obtained in a prescribed manner.
18.18In practice, we understand that Crown Law relies on the agency that holds the relevant information to advise whether there are any privacy concerns in terms of its provision to the requesting country. Crown Law considers that, as that agency holds the relevant information, it is for that agency to decide whether information should be released, subject to the requirements of the Privacy Act and any requirements in the agency’s own legislation. The problem is that some agencies assume that, if Crown Law has approved a request under MACMA, the agency is required simply to provide the requested information.
18.19We do not believe the Official Information Act was intended to be used by the Central Authority for the purpose of accessing information to satisfy a request from a foreign country in respect of a criminal matter.
18.20Without an Official Information Act request, however, the Central Authority does not have a statutory framework that compels the agency to action the request and respond within a given timeframe. Our preliminary view is that a specific provision in MACMA could easily resolve this issue.
Question
Q76 Do you think MACMA needs a specific provision that gives the Central Authority a statutory mechanism for requesting information from domestic agencies?
18.21We also think that the role of the Privacy Act needs to be clear. In clarifying how MACMA should fit with the Privacy Act, the policy question is who, if anyone, ought to guard the privacy of personal information under MACMA requests. We believe there are three possible positions:
- The information-holder agencies: Any privacy risks associated with sharing personal information with a foreign country should be considered on a case-by-case basis.
- The Central Authority: Any privacy risks associated with sharing personal information with a foreign country should be considered on a case-by-case basis.
- Public benefit outweighs privacy interests: Privacy risks need not be considered on the basis that, as MACMA requests will have been approved by the Central Authority, it is clear that the public benefit afforded by sharing the information will more than likely outweigh any privacy risks.
We discuss each of these positions below and also provide options that could be implemented for each.
18.22The advantage of this approach is that it mirrors domestic law. The clear disadvantage is that the Central Authority has already thoroughly considered the request and deemed it appropriate to provide the assistance. Thus, consideration by another agency is arguably unnecessary.
18.23One option would be to amend the current maintenance of the law exception (Privacy Principle 11) in the Privacy Act to expressly include maintenance of foreign law. This would allow the holder agencies to consider whether to release the information on a discretionary basis. However, as noted by the Law Commission in its review of the Privacy Act, any amendment to the phrase “maintenance of the law” would prove difficult, because it is used in various statutes as a standard form provision and risks impacting on settled understandings of the Principle.
18.24More acceptable options may be to either issue a code of practice under the Privacy Act that could elaborate on the maintenance of the law exception in the MACMA context or to create a new exception in Privacy Principle 11 for the disclosure of information in accordance with a MACMA request.
Central Authority
18.25The advantage of taking privacy considerations away from the holder agency and giving these to the Central Authority is that the Central Authority already has to consider a number of factors in deciding whether to accede to a MACMA request. It seems both inappropriate and inefficient to separate out consideration of the privacy of personal information.
18.26One option would be to create a new discretionary ground for refusal in section 27(2) of MACMA to allow the Attorney-General to refuse the request if he or she is not satisfied that privacy rights will be sufficiently protected, for example, where the Attorney-General is not comfortable that the material will only be used for the requested purpose.
18.27We note that a provision in the Privacy Act would still be required to give the holder agency authority to release the information.
Public benefit outweighs privacy interests
18.28It is arguable that any assistance in a criminal matter is of high public benefit and is most likely to outweigh privacy rights. Consequently, it may be unnecessary to consider privacy issues in MACMA requests. This would make a clear statement that responding to foreign requests is always more important than the protection of personal information.
18.29The problem with this approach is that there would be less privacy oversight over information that is shared internationally than there is domestically (which is subject to the discretionary release by the information holder). This position would be inconsistent with one of the guiding principles of the review that the ability to assist foreign countries should not extend beyond what is available domestically.
18.30MACMA could be amended to include a provision, similar to section 43D of the Australian Mutual Assistance in Criminal Matters Act 1987 (Cth), which provides that the collection, use, or disclosure of personal information about an individual in response to a mutual legal assistance request under the Australian Act is authorised by law for the purposes of the Australian Privacy Act 1988. Section 43D provides:
(1) The collection, use or disclosure of personal information about an individual is taken to be authorised by law for the purposes of the Privacy Act 1988 if the collection, use or disclosure is reasonably necessary for the purposes of:
(a) the provision, or proposed provision, of international assistance in criminal matters by the Attorney General, or an officer of his or her Department, to a foreign country; or
(b) the obtaining, or proposed obtaining, of international assistance in criminal matters by the Attorney General, or an officer of his or her Department, from a foreign country.
18.31An even more direct option would be to insert a provision similar to that in the new Organised Crime and Anti-corruption Legislation Bill on the new Police foreign information-sharing regime, which provides that the disclosure of personal information is subject to any other enactment other than the Privacy Act 1993.
Question
Q77 How can the relationship between the Privacy Act and MACMA be clarified in the law?
