This guidance note is intended to assist anyone who may be contemplating applying under section 54 of the Privacy Act for an exemption. It has no formal legal status and in all cases persons are referred to the wording of section 54 of the Act itself (the text of which is appended to this note).
1.1 Section 54 of the Privacy Act empowers the Privacy Commissioner to authorise an agency to collect, use or disclose personal information even though that collection, use or disclosure would otherwise be in breach of information privacy principles 2, 10 or 11. Before granting an exemption the Commissioner must be satisfied that in the special circumstances of the case:
the public interest in that collection or use or disclosure outweighs to a substantial degree any interference with the privacy of the individual that could result from that collection, use or disclosure; or
that collection, use or disclosure involves a clear benefit to the individual concerned that outweighs any interference with the privacy of the individual that could result from that collection or use or disclosure.
The Commissioner is not permitted to grant an authority if the individual concerned has refused to authorise the collection or use or disclosure.
The Commissioner may impose conditions on any authority.
1.2 A number of enquiries have been received by the Commissioner in relation to exemptions which could not be granted because they concern circumstances not contemplated by section 54 or because the necessary supporting information has not been supplied. Accordingly, this guidance note seeks to remind potential applicants as to the purpose of section 54 and to indicate the sort of information that should be supplied in support of an application.
2.0 Limit on scope of authorisations which may be granted under section 54
2.1 Section 54 clearly sets out a number of limitations on the authorisations which may be granted. In the paragraphs that follow some of these limitations are discussed. Presently only a few applications have been formally dealt with. From time to time it is anticipated that this guidance note will be revised to take account of the decisions reached by the Commissioner in particular cases.
2.2 The Commissioner is only empowered to authorise an agency to “collect, use or disclose” personal information. The power does not, for instance, extend to the authorisation of the assignment of a unique identifier or the retention of information.
2.3 The Commissioner may authorise an agency to collect, use or disclose personal information even though that collection, use or disclosure would otherwise be in breach of “principle 2 or principle 10 or principle 11”. It would appear that an authorisation granted under section 54 will not authorise an agency to collect information which would otherwise be in breach of principle 1, 3 or 11 or to use, retain or disclose personal information in breach of principles 5, 8, 9 or 12. The exemption process has no relevance to access or correction requests under principles 6 or 7. Nor can an exemption validate actions which would be in breach of the public register privacy principles or any other part of the Privacy Act.
2.4 There are two separate grounds for granting an application under section 54(1). The first of these stresses the public interest outweighing to a substantial degree any interference of the privacy of the individual. The second emphasises a clear benefit to the individual concerned that outweighs any interference with the privacy of the individual. Applicants will need to provide information as to the matters contained in paragraphs (a) or (b).
2.5 Section 54(1) requires the Commissioner to be satisfied that paragraph (a) or paragraph (b) applies “in the special circumstances of the case”. The Commissioner will consider the special circumstances on a case by case basis. However, the section requires there to be something “special” about the particular case. It is suggested that the section is not intended to cover an ordinary and routine collection, use or disclosure. Such routine matters are more appropriately dealt with in a code of practice, if at all.
2.6 Subsection (3) makes it quite clear that the Commissioner is not empowered to grant an authority where the individual concerned has refused to authorise the collection or, as the case requires, the use or disclosure of information for a particular purpose.
3.0 Applicants should provide supporting information
3.1 An applicant should supply sufficient supporting information with an application to satisfy the Commissioner as to the special circumstances of the case and to the application of either paragraph (a) or paragraph (b) of subsection (1). If the applicant does not supply sufficient information the Commissioner will request further details. If no information is supplied, or the information does not satisfy the Commissioner, the application will not be granted.
3.2 It will assist the Commissioner if applicants can be as precise as possible. However, any applicants having difficulty framing an application, particularly those without legal assistance, may ask the Commissioner’s staff for assistance.
3.3 The applicant should first of all make it clear whether an authorisation is sought for:
of personal information.
3.4 The applicant should then explain the “special circumstances”. Section 54 seems primarily designed for “one-off” situations. If the circumstances giving rise to an application are likely to arise again and again, or are a routine part of an agency’s activities, it is likely that an exemption will be inappropriate. Consideration should instead to given to seeking a code of practice (see Privacy Act, sections 46-53).
3.5 The applicant should identify whether an authorisation is being sought under paragraph (a) or under paragraph (b) of subsection (1).
3.6 If the application is under section 54(1)(a) the applicant should explain what he or she believes the “public interest” is in the collection, use or disclosure. If the application is under section 54(1)(b) the applicant should explain what is believed to be a “clear benefit to the individual concerned”. The applicant’s views as to why that public interest or personal benefit outweighs, to a substantial degree any interference with the privacy of the individual that could result from the collection, use or disclosure will assist the Commissioner in that decision. However the Commissioner can still process the application even if no views are expressed as to the weight to be given.
3.7 The Commissioner is not permitted to grant an authority where the individual concerned has refused to authorise the collection, useor disclosure. The application should indicate whether any such indication has been given. Depending upon the circumstances it may also be appropriate for the applicant to indicate what steps have been taken to ascertain the views of the individual or individuals concerned if this is possible. Where it is not possible to ascertain views in advance it may be possible to indicate how any authorisation might apply to a person later objecting to the collection, use or disclosure (eg. if such an individual can elect to have their information handled in a different way).
3.8 The Commissioner may impose conditions on applications that she grants. It makes sense for an applicant to give some thought to the kind of conditions that would seem reasonable and which are acceptable. It is not essential to specify those but it will certainly assist the Commissioner.
3.9 In summary, an application for a section 54 exemption should:
explain whether the authorisation is sought for collection, use or disclosure, of personal information;
outline the “special circumstances” of the case;
state whether the application is being sought under subsection (a) of section 54(1) (“the public interest”) or under paragraph (b) (“clear benefit to the individual concerned”);
explain why the applicant believes that either the public interest or the benefit to the individual concerned outweights any resulting interference with the privacy of individuals;
suggest suitable conditions, if appropriate;
explain whether any individual concerned has objected to the collection, use or disclosure and whether any steps have been taken to ascertain the views of any individuals who will be affected by the exemption.
4.1 Examples of the sort of conditions that might be considered by the Commissioner include:
a limit on the duration of the authorisation;
notice to affected individuals by letters or public notices;
a requirement to take steps to ensure that the special circumstances leading to the need for the exemption are put right or are avoided into the future;
the adoption of arrangements which enhance privacy in a way that differs to that required by principles 2, 10 or 11;
where the authorisation will affect information relating to more than one person, a mechanism to enable individuals to “opt out” of the collection, use or disclosure;
a report to the Commissioner at some appropriate point concerning the exercise of the authorisation, in some cases including an audit of compliance with conditions.
5.0 Further information
5.1 Details of the exercise of the section 54 authorisation power are given each year in the Privacy Commissioner’s annual report. Extracts from the annual reports are given below illustrating some of the authorisations granted.
5.2 If you wish to discuss a proposal for a section 54 application, please speak in the first instance to one of the Commissioner’s enquiries officers.
This guidance note has been released in draft form as the Privacy Commissioner welcomes comment on it and may revise the note as a result of any suggestions. Comments may be sent to the Privacy Commissioner, PO Box 10094, Wellington.
Guidance note – 12 May 1997
Appendix A – Section 54
54. Commissioner may authorise collection, use or disclosure of personal information –
(1) The Commissioner may authorise an agency to collect, use, or disclose personal information, even though that collection, use, or disclosure would otherwise be in breach of principle 2 or principle 10 or principle 11, if the Commissioner is satisfied that, in the special circumstances of the case, –
(a) The public interest in that collection or, as the case requires, that use or that disclosure outweighs, to a substantial degree, any interference with the privacy of the individual that could result from that collection or, as the case requires, that use or that disclosure; or
(b) That collection or, as the case requires, that use or that disclosure involves a clear benefit to the individual concerned that outweighs any interference with the privacy of the individual that could result from that collection or, as the case requires, that use or that disclosure.
(2) The Commissioner may impose in respect of any authority granted under subsection (1) of this section such conditions as the Commissioner thinks fit.
(3) The Commissioner shall not grant an authority under subsection (1) of this section in respect of the collection, use, or disclosure of any personal information for any purpose if the individual concerned has refused to authorise the collection or, as the case requires, the use or disclosure of the information for that purpose.
Extracts from Privacy Commissioner’s annual reports concerning section 54 authorisations
1993/94 annual report
In one case I provided the authorisation requested. My authorisation under section 54 arose from the reorganisation of electricity supply arrangements, and allowed a local body to provide to an energy trust a list of those eligible to be ratepayers so that they could be allocated voting powers within the limited time in which this had to be done. I did not receive any complaints about the application of my authorisation.
1994/95 annual report
In only one case did I give authorisation as requested, and this covered the disclosure by newspaper advertisements of a list of the names of a substantial number of shareholders who were entitled to payment from the liquidation of a company. The liquidation had taken a particularly long time and, despite considerable research by the liquidator’s staff, there remained many shareholders who could not be traced by other economic means.
1995/96 annual report
I granted only one authorisation under section 54 during the 1995/96 year. This was the disclosure between the Residual Health Management Unit and the Public Trustee of the names of several thousand former patients of psychiatric hospitals. There had been an arrangement prior to 1987 whereby the money of patients receiving hospital care for psychiatric illnesses had been invested by the hospitals with interest accumulating into a separate fund rather than being allocated to the individual patients at the time. With the reorganisation of the health sector in 1993, it was decided that this substantial fund should be allocated and paid out to the patients concerned or to their beneficiaries. The Residual Management Unit was given the task of administering the payment of the fund. By then, of course, most of the patients were no longer in hospital and the Unit advertised extensively to ask for claims to be lodged by any people who believed they were entitled to some of the money. The Unit had established that there were in the order of 13,000 former patients who would apparently be entitled to share in this money. By the time the Unit approached me it had paid out claims to some 4,000 people, but were still trying to locate about 8,000 more. The Unit believed that many former patients may have placed their affairs in the hands of the Public Trustee, who would be able to claim on behalf of the patient or their beneficiaries.
I was satisfied that there was in this case a clear benefit to the individuals concerned that outweighed the interference with their privacy. I therefore authorised the unit and the Public Trustee to disclose to each other the names and certain other details so that the Trustee could compare that list with its own records and either initiate claims as appropriate or advise the Unit of how the individuals it sought might be contacted. I granted the authorisation upon conditions that the information disclosed was not used for any other purpose and was not retained for any longer than was necessary for the purpose of matching and the lodging of claims.