Privacy Law and Policy Reporter
The ''international information superhighway' is an expression that is currently receiving a lot of attention. The highway is seen as a technological advancement as inescapable as simultaneous speech translations, virtual reality or 500 channels on cable TV. In California, information booths already exist, making it possible to tap into a huge range of information sources. Vice President, Al Gore is taking the initiative to assist with the expansion of the superhighway in the US. New Zealanders are becoming accustomed to tuning into Internet, the world's most comprehensive reference library and an early entry on to the superhighway. Information from all over the world can be swapped, accessed and obtained.
In NZ, the information contained on public registers will be electronically available. This will be advantageous in terms of time and money saved to those who regularly have to access that information. It also throws open the registers to becoming part of the ever expanding worldwide information base.
Public registers, long before the Privacy Act 1993 (NZ) was passed, were a means of regulating the government databases which hold massive quantities of personal information concerning almost every individual in NZ. The developments in technology which have now made this information even more accessible and commercially useful have also meant that the individual has potentially less control over their personal information. This raises valid concerns about how the privacy of the individual is going to be protected. How are the rights of the individual to what has been described as ''informational self- determination' going to be balanced with the ever increasing free flow of information not just within NZ but potentially worldwide?
The legal response to the protection of privacy comes in the (PRPPs) form of the public register privacy principles of the Privacy Act. This article will consider issues arising from them.
Before considering these issues, it may be helpful to look at what exactly defines a public register, the background to the present status of public registers, the changing legislative context surrounding public registers and how public registers are regulated by the public register privacy principles..
A public register is any register, roll, list or other document maintained according to a public register provision. A public register provision is a section of an enactment listed in the Second Schedule to the Privacy Act, which imposes an obligation on any person, or registrar to maintain a public register. Eighteen statutes establishing 53 registers are listed in the Second Schedule. They include the Valuation of Lands Act, Births and Deaths Registration Act, the Land Transfer Act, the Companies Act and the Transport (Vehicle and Driver Registration and Licensing) Act 1986.
Documents held by local authorities containing authority carry out any work for or in connection with the construction, alteration, demolition, or removal of a building, where the authority was granted under s648 (1) of the Local Government Act 1974 are also deemed to be public registers.
Further registers can be included by an amendment to the Second Schedule made by Order in Council on the advice of the Minister of Justice.
The term ''public registers' should not be confused with the term ''publicly- available' information. While a public register is deemed to be a ''publicly available publication', the terms are not synonymous. Telephone directories or commercial lists such as those published in the Mercantile Gazette are not public registers.
The relevance of these definitions on private sector agencies comes in the exceptions to the information privacy principles (IPPs). As a user of public register information a law firm that collects personal information about a property owner (name, address, occupation, amount of rates owed) from the District Land Registrar, and rates record of a local authority, will not be in breach of IPP 2 for not collecting the information directly from that person. It is not necessary for an agency to comply with that principle where the information is publicly available.
A dog breeder may use information for any purpose where the source of the information is a publicly-available publication, such as the public register maintained under s35 Dog Control and Hydatids Act 1982.
A sharebroker may disclose information about an individual's directorship or share holdings where they have obtained that information from a publicly- available publication such as the register maintained under the Companies Act.
Note the difference in wording between the ''publicly available' exception under the collection principles, and the use and disclosure principles. Collection of information other than from the individual concerned is permitted when the information is publicly- available information, which implies that as long as it is contained somewhere in a magazine, book or public register, you may collect it from any source.
An agency, proposing the use or disclosure of information, must have reasonable grounds to believe that the source of the information is a publicly- available publication, that is, the agency obtained the information from a public register.
A list broker, for example, may have no idea whether the names and addresses he or she has on his or her ''dog fanciers' database have come from the public register, from competition coupons, or from the membership list of the Pit Bull Terriers Friendly Society.
Most of the statutes which have public register provisions were enacted at an earlier time in NZ's history. The requirement to maintain information publicly was imposed during the life of the Official Secrets Act. Legislation was passed spelling out what information should be available for public search and was not due to any concerns for information privacy issues but because of the obligations placed on public servants to keep information secret.
There are sound policy reasons for having certain information publicly available. How do you know whether a mortgage or other security you are seeking to obtain will have priority unless you are able to check a register for prior security.
The electoral roll is published to enable scrutiny of voter eligibility to vote in a particular electorate and is a necessary part of our democratic system.
There are also combined social and commercial reasons why certain public registers are open to scrutiny. For example, to ensure certainty in the sale and purchase of motor vehicles, by providing registers to allow you to verify that the person selling the vehicle is registered as its owner, and that the vehicle is not subject to other interests.
The Acts providing for public registers also acknowledge that there are situations where people should not be compelled to have this personal information disclosed. The Electoral Act, for example, makes provision for registrars to enter electors on an unpublished role where they have well-founded concerns about their safety. This provides a measure of protection, for example, for undercover police officers, and people fleeing violent relationships.
Any person is entitled to request a certificate containing the particulars of all persons recorded in the register of motor vehicles and the registrar must give the certificate (provided the prescribed fee has been paid) unless the registrar certifies that supplying the information would prejudice a range of interests including the maintenance of the law, the security or defence of NZ or the privacy or personal safety of any person.
The various Acts establishing public registers also acknowledge that although a registrar must collect information, not all of it needs to be made publicly available. The Registrar of Electors, for example, must collect not only information disclosing name, address and occupation of electors, as appears in the public rolls, but also information about the person's age, which is not maintained on the register.
Applicants for information held on the Driver's Licence Register are entitled to receive information about the classes of vehicle for which the licence is held, and the expiry date but will not receive other items held such as date of birth, eye colour, address or organ donor status.
The Privacy Act provides that the agency responsible for administering the register shall comply with the IPPS and the PRPPs as far as is reasonably practicable. The tensions between the IPPs and the PRPPs are clear. For example, IPP 11 operates to limit the disclosure of personal information whereas public registers exist as a statutory regime to keep information publicly available.
An apparently contradictory provision of the Act also states that nothing in any of the IPPs shall apply in respect of a public register. An interpretation of these potentially conflicting sections is that the agency must try and comply with both the IPPs and PRPPs with the PRPPs taking precedence. Also, if there is an inconsistency between the Act establishing the public register (or any other enactment) and the PRPPs, that enactment shall prevail.
Agencies administering public registers need to assess the administration of the registers with reference to the IPPs, the PRPPs, the Act establishing the register, and any other Act, and settle on appropriate procedures which balance their competing objectives.
Just as with the IPPs the common theme that runs through the PRPPs is ''what is the purpose of the collection of the information?'.
PRPP 1 Personal information shall be made available from a public register only by search references that are consistent with the manner in which the register is indexed or organised.
This principle has in mind the purpose for which the information was collected. It means that the Electoral Act should not be able to be searched by reference to occupation. For example, I cannot find out who all the plumbers are in the Island Bay electorate and what their addresses are. The agency that maintains the register should not enable me to do so.
PRPP 2 Personal information obtained from a public register shall not be resorted, or combined with personal information obtained from any other public register, for the purpose of making available for valuable consideration personal information assembled in a form in which that personal information could not be obtained directly from the register.
This principle appears to prevent agencies from crunching information through their computers from the Electoral Roll, the Motor Vehicle Register, and the Dog Control and Hydatids Register to produce a list for hire or sale of Toyota owners in Sydenham that own poodles.
Three of the four PRPPs apply to the agency responsible for administering the register. Principle 2 however applies to every person.
PRPP 3 Personal information in a public register shall not be made available by means of electronic transmission, unless the purpose of the transmission is to make the information available to a member of the public who wishes to search the register.
This principle is problematic. It says that the agency may make the information available by electronic transmission to members of the public to search the register but not for other purposes.
It is difficult to say what activities are prohibited. Certainly on-line access to registers that would enable manipulation of the source data would be prohibited, but what else? The phrase ''member of the public' does not appear to limit access. A member of a law firm, a real estate agent and a direct marketer are all members of the public.
PRPP 4 Personal information shall be made available from a public register for no charge or for no more than a reasonable charge.
This principle acknowledges that despite necessary restrictions for the protection of privacy, there are still sound policy reasons to retain the public access. The right of members of the public to search the register should not be fettered by the levying of unreasonable charges.
These principles amount to a legislative response to developments in technology enabling matching of information from a variety of publicly available sources, to build up profiles on individuals. Assumptions may be made on the basis of these profiles as to the subject's lifestyle and spending habits. The agency then has a great deal of power over the individual if information is obtained and profiled concerning, for example, the individual's income, property ownership, indebtedness and share holdings.
Such information is highly valuable for marketing purposes and allows the direct targeting of preferred groups of consumers. This may seem like a legitimate method of using available information and technology but it also raises valid concerns from the individual as to how much should be known about them and how that affects their privacy.
The individual has been compelled by statute to provide information for a particular purpose (for example, to lawfully operate a motor vehicle) but has no control over who receives this information or what purpose it is used for. The PRPPs, rather than allowing the individual to be totally protected from information technologies ''reflect the need to ensure that the individual is not to be regarded simply as a rich and unconscious source of personal data'.
The agency administering the public register shall comply with the four PRPPs so far as is reasonably practicable.
The Privacy Commissioner, on receiving a complaint or on initiative may investigate the actions of any agency that is responsible for administering any public register and the actions of any person if not in compliance with Principle 2.
The Commissioner may also inquire into any public register provision if it appears that any provision is inconsistent with the PRPPs or IPPs. The results of any inquiry are directed to the minister responsible for administering the enactment and may include recommendations for legislative changes.
Agencies administering registers may (and all should have begun to) review what information on the register needs to made publicly available, to whom and in what manner.
The public register provisions of the Privacy Act do not call for radical alterations to what is already current practice. Modification of the use of public registers and the ability to adapt to the changing technology and societal expectations may be achieved by the implementation of codes of practice.
Parliament has delegated to the Privacy Commissioner the job of clarifying grey areas and apparent inconsistencies between various Acts and current practices by enabling him to conduct inquiries, and to issue codes of practice in relation to the public registers.
Codes of practice may:
(a) modify the application of any one or more of the PRPPs, IPPs or both by:
(i) prescribing standards that are more stringent or less stringent than the standards that are prescribed by the principle;
(ii)exempting any action from any such principle, either unconditionally or subject to such conditions as are prescribed in the code.
(b) prescribe how any one or more of the PRPPs, or IPPs, or both are to be applied or complied with.
(c) impose requirements that are not prescribed by any PRPP.
Before issuing a code the Commissioner must undertake public consultation, and receive submissions on a proposed code so that he is able to gauge business, government and community expectations of public registers. 
An example of how a code of practice might work to prescribe how agencies can comply with the principles is in relation to PRPP 1. Personal information shall be made available from a public register only by search references that are consistent with the manner in which the register is indexed or organised.
In this regard, it can be seen as an anomaly that if I own shares in a property-owning company, it is relatively easy to conceal my share holdings. It is not so easy to conceal where the land I own directly is. However, if I want to know who owns an easement over the property at 112 Kelburn Parade, I should be able to do so. There should be no objection to the maintenance of the street address index, the lot deposit plan index, but why should someone be able to find out all interests I have in land by looking up my name? Perhaps there are legitimate reasons for doing so. Investigative journalists would be deprived a source of information they consider necessary for their inquiries. Is simple curiosity a sufficient reason to allow unfettered access to information about me?
A code of practice might require those searching the register to state the purpose for which the information is required.
In NSW, you may search the motor vehicle register only for specified purposes. In Ontario, those maintaining public registers are to record who has made a search, and must advise the subject that the search has been made.
No public register in NZ has been established to provide a source of addresses for those wishing to engage in direct marketing. It might well be that agencies will wish to restrict the use of their registers for this purpose by means of codes of practice. For example, agencies may be able to restrict access by limiting the number of searches that can be made at any one time.
Those wishing to use public registers for that purpose (including agencies responsible for administering the register) will be able to make representations to the Commissioner to enable this practice to continue. People providing information would almost certainly have to be advised that this would be one of the purposes for which the information is collected, and may even have to positively consent to the use of the information for that purpose.
The English Data Protection Tribunal has held that actual consent is required for the use of any personal information for ''non-obvious' purposes. The Tribunal held that one such ''non-obvious' use of information obtained for direct-marketing purposes, was the sale of the information through list brokers. In this case, the direct marketer obtained the information to sell the individual product, but also to pass on their names and addresses to the merchants. If positive consent is onerous or impracticable, a code may prescribe that the agency at least gives an individual the opportunity to ''opt out' of the use of the information for that non-obvious purpose, or for disclosure for that secondary purpose.
Codes may also provide guidelines for omissions from public registers on particular grounds. For example, a code may contain the policy to be applied when assessing whether an elector has reasonable grounds to believe their safety would be endangered, or for determining how the Registrar of Motor Vehicles may arrive at a decision that disclosure of details of motor-vehicle ownership would be likely to prejudice the privacy of any person.
Drafters of codes must however bear in mind that the standards they prescribe for administration of the codes cannot be inconsistent with any provision of any other enactment. If there is an inconsistency, the code shall to the extent of the inconsistency, be of no effect.
Public register information was made available for social, economic and political reasons. Now the whole legislative climate has changed to a more balanced approach. The introduction of the Official Information Act and, more recently the Privacy Act, has meant that although greater importance has been placed on the need for the free flow of certain information, the rights of the individual have also been strengthened to allow for more control over the use of their personal information. Advances in information technology and the commercial gains available have made this approach even more necessary.
The present situation means that for the administrator of the registrar the task of complying with the Privacy Act will require careful consideration of the interests involved, the legislative requirements and the possible adoption of a code of practice. For those who wish to use the information such as direct marketers the information will still be available although the individual concerned will have a greater say in what it is used for and by whom
John Edwards is a Barrister and Privacy Consultant based in Wellington.
Versions of this paper were presented at the AIC Privacy Summit, March 1994, and at the Privacy Issues Forum, May 1994.
 Council of Europe Recommendations of Communications to Third Parties of Personal Data held by Public Bodies 1991 at p15.
 s2 Privacy Act 1993.
 Information privacy principle 2(2)(a).
 Information privacy principle 10(a).
 Information privacy principle 11(b).
 s62A, Electoral Act.
 s19(5) Transport/Vehicle and Driver Registration and Licensing Act 1968 (as amended by 1992 No10).
 s7 (6) Privacy Act 1993.
 s60 (3).
 note 1 at see above, 19.
 s61 Privacy Act 1993.
 s47-53,63,64 Privacy Act.
 The Privacy Committee of NSW Annual Report 1989, p26.
 s63 (4) Privacy Act.