Resource Finder
Search
- Type
- Publisher
Jobs Forum - Sebastian Morgan-Lynch
The Privacy Act in Relation to Job Applications
Sebastian Morgan-Lynch, Office of the Privacy Commissioner
The Privacy Act is intended to give individuals greater control over their personal information, and to require agencies to be transparent about why they want information and who will use it.
It promotes and protects individual privacy;
It is concerned with the privacy of information about people not companies, or organisations, called 'Data Protection' in UK, more accurate;
It establishes 12 principles, based on OECD guidelines, regulates the collection, use, disclosure and storage of personal information and rights to access and correction;
Individuals can complain when they believe themselves to have suffered from an interference with their privacy;
The current Privacy Commissioner is Marie Shroff. There are two offices, in Auckland and Wellington, with around 30 staff.
Information Processing Cycle
1-4 Collection of Information
5.9 Storage, Access, Correction, Accuracy and Retention of Information
10-11 Disclosure and Use of Information
Purpose and Openness
You won't find these words in the Act, but they are still important. The Act tries to instil a way of thinking about peoples personal information, and these two words sum up that approach.
Although most complaints come from other parts of the Act, the Principles relating to collection are very important, as they set up the way in which information can be used and/or disclosed.
Principle 1
Principle 1 addresses:
What information an agency is allowed to collect.
The objective of Principle 1 is to guard against collection of excessive information.
Principle 1 provides that agencies must not collect information unless:
It is collected for a lawful purpose connected with the function or activity of the agency; and
Collection is necessary for that purpose.
In order to comply with Principle 1, agencies must set their own purposes with regard to the information they collect. In doing so, the agency must ask itself the following questions:
Do I have a lawful purpose for collecting the information? In order to determine this, a subset of issues must be addressed:
-
What information do I need to collect?
Why do I need this information?
Does the law regulate or prescribe the collection process?
Is the purpose connected with a function or activity of the agency?
Is the collection of this information necessary to achieve that purpose?
Notes on Principle 1
Principle 1 links into other Principles, so that, if an agency has made a good attempt at explaining its purpose, as required under Principle 3, people are more likely to understand why the collection of the information is necessary and how the information will be used and disclosed.
Note that any collection of personal information is prohibited unless three conditions are met;
The three conditions start wide, get narrower;
"Lawful purpose" - wide. A purpose that is not illegal;
"Connected with function or activity of agency" - narrower, but still broad. The purpose could be connected in any way. This part of the Principle asks an agency to look at what information it needs to do its job.
"Necessary for that purpose" - This is arguably quite a tight restriction. In practice, however, it is not too constricting as long as the functions and activities of the agency are understood.
Principle 2
Principle 2 requires agencies to collect information directly from the individual concerned. This is why you normally have to give your consent for an agency to contact a referee.
Notes on Principle 2
Pay attention to any ‘authorisations' contained in a job application form you are filling out - who are you authorising the prospective employer to contact? Is there anyone you would not wish them to speak to?
There are a number of exceptions to this Principle, but they're normally not relevant in an employment application situation.
Principle 3
This requires agencies to let you know what they are collecting the information for, which is something they have decided back in Principle 1, and a number of other facts in relation to the collection, namely:
The fact that information is being collected, which will normally be obvious in an employment application;
The intended recipients;
Contact details for the agency holding the information;
Whether supplying that information is mandatory or voluntary;
What the consequences may be if information not supplied;
That you have rights of access and correction to the information held.
Notes on Principle 3
There will normally be a "Privacy Statement" on an application form, or there might be an indication in the questions as to what the information is intended to be used for.
In general terms, you cannot prevent an agency asking for certain information unless to collect it would be a breach of Principle 1.
Complaints
Complaints about potential breaches of the Act are made to the Privacy Commissioner. She will investigate them and try to settle them in a way that is acceptable to both parties. If she can't, she will either close the investigation or form an opinion as to whether an interference with someone's privacy has occurred.
For there to be an interference she must be satisfied both that a breach of one or more of the Principles has occurred, and that the breach has caused some kind of harm or other adverse consequence.
Top