The collection, maintenance, use and disclosure of personal information relating to individuals is regulated by the Personal Information Protection Act 2004 (PIP Act). The Act places specific obligations upon personal information custodians for this purpose.
The following sets out the principles that are applied by the public authority in managing personal information.
Application of the Act
Under the PIP Act, the public authority is the custodian of personal information related to its functions and activities.
What is 'Personal Information'?
'Personal information' is any information or opinion, recorded in any format, about an individual whose identity is apparent or is reasonably ascertainable from the information or opinion. This includes information about an individual who has been deceased for less than 25 years.
A person's recorded image on CCTV (or photograph, video and so on) is not, for example, personal information unless, from that image, the person's identity is apparent or reasonably ascertainable.
'Basic personal information' (i.e. name, residential or postal address, date of birth and gender of an individual) can be used and disclosed to other Government bodies without consent in certain limited circumstances.
This Act does not extend to public information.
If, for example, a person's email is contained in a publicly available record or publication it is public information – to which the PIP Act does not apply.
The public authority only collects personal information that is necessary for it to perform its functions, and will only use or disclose this information for the purposes for which it was provided.
The type of personal information collected includes names, addresses and telephone numbers, together with any specific information about a person that may be required to enable us to provide a service or administer legislation.
The public authority takes reasonable steps to ensure that the personal information it holds is accurate, complete and up to date. Where practicable, the public authority will check on the accuracy of personal information before it is used.
'Sensitive information' may include, but is not limited to, things like health information, criminal record, racial origin and sexual preferences. Generally, the public authority collects sensitive information where it is necessary or required or permitted by law.
If you are making a general inquiry, it may not be necessary to identify yourself. However, if you want to obtain a service, identification may be necessary.
The public authority does not assign unique identifiers to people unless it is necessary for us to carry out our functions efficiently or is required by law. In certain circumstances, we may collect the unique identifiers assigned to you by another organisation, but we will not disclose these without lawful authority.