If an agency collects personal information about an individual other than from the individual concerned, the agency must take any steps that are, in the circumstances, reasonable to ensure that the individual concerned is aware of—

the fact that the information has been collected; and

the purpose for which the information has been collected; and

the intended recipients of the information; and

the name and address of—

the agency that has collected the information; and

the agency that is holding the information; and

if the collection of the information is authorised or required by or under the law, the particular law by or under which the collection of the information is authorised or required; and

the rights of access to, and correction of, information provided by the IPPs.

The steps referred to in subclause (1) must be taken as soon as is reasonably practicable after the information has been collected (unless taken sooner).

An agency is not required to take the steps referred to in subclause (1) in relation to the collection of personal information if the individual concerned has previously been made aware by any means of all of the matters specified in subclause (1) in relation to the agency’s collection of the information.

It is not necessary for an agency to comply with subclause (1) if the agency believes, on reasonable grounds,—

that non-compliance would not prejudice the interests of the individual concerned; or

that the information is publicly available information; or

that non-compliance is necessary—

to avoid prejudice to the maintenance of the law by any public sector agency, including prejudice to the prevention, detection, investigation, prosecution, and punishment of offences; or

for the enforcement of a law that imposes a pecuniary penalty; or

for the protection of public revenue; or

for the conduct of proceedings before any court or tribunal (being proceedings that have been commenced or are reasonably in contemplation); or

that compliance would prejudice the purposes of the collection; or

that compliance is not reasonably practicable in the circumstances of the particular case; or

that compliance would cause a serious threat to—

public health or safety; or

the health or safety of another individual; or

that the information—

will not be used in a form in which the individual concerned is identified; or

will be used for statistical or research purposes and will not be published in a form that could reasonably be expected to identify the individual concerned.

It is not necessary for an agency to comply with subclause (1) if—

It is not necessary for an agency to comply with subclause (1) if compliance would be likely to prejudice—

the security or defence of New Zealand, the Cook Islands, Niue, Tokelau, or the Ross Dependency; or

the international relations of the Government of New Zealand, the Cook Islands, or Niue; or

the relations between any of the Governments of—

the entrusting of information to the Government of New Zealand on a basis of confidence by—