Whiteman, Grendon --- "Local government and the NZ Public Register Privacy Principles" [1994] PrivLawPRpr 81; (1994) 1(6) Privacy Law & Policy Reporter 106

---

Local government and the NZ Public Register Privacy Principles

Brendon Whiteman, Legal Counsel for the New Zealand Local Government Association, examines the PRPRs' effect on local government.

Local authorities are responsible for four of the 18 sets of Public Register Provisions listed in the Privacy Act 1993 (NZ). As functions are redistributed between central and local government, local authorities may inherit more. A local authority role in Births, Deaths and Marriage Registration has been suggested.

Privacy issues in local government involve the Privacy Act 1993, the Local Government Official Information and Meetings Act 1987 (NZ), as well as the complex draft of legislation and the administrative law principles governing particular activities. That mix of legislation makes it hard to identify the relevant rules.

Issues can be further complicated by the very large range of functions carried out by local authorities. There is a real tension between ''purpose based' elements of the Privacy Act regime and efficient management which requires information to be used over the range of a council's activities.

This article focuses on issues thrown up by local authorities' experiences of the Privacy Act.

Public Register Privacy Principles (PRPRs)

[The general operation of the PRPRs is discussed in (1994) 1 PLPR 85: Ed].

Public Registers seem to have received special statutory treatment because they raise a set of peculiar issues.

1. Information is often compelled, for example, the Electoral Roll.
2. In other cases information is held simply because individuals carry on some normal activity (owning a dog or a car).
3. Information is held about a very large number of individuals.

Public Registers are very valuable sources of information which can be manipulated to provide very powerful tools for private gain. This has very real implications for personal privacy.

There is a real case for limiting such uses. However, the PRPPs, as they exist, focus on particular mechanisms, not the substantive issues that underlie such a trade-off. In particular:

(a) the proscription on the use of particular mechanisms requires them to be defined. That task involves making assumptions about technology which will, over time, be proven wrong;

(b) the statutory context in which the PRPPs (and IPPs) appear means, for local authorities, that their impact on questions of disclosure is fairly random; and

(c) the regime does not allow a sufficiently clear focus on the purpose for which a public register is kept.

Proscription of particular mechanisms

PRPP 1 provides that: Personal information shall be made available from a public register only by search references that are consistent with the manner in which the register is indexed or organised.

Modern database packages, however, allow information to be stored and searched on almost any combination of references in the data.

Many local authorities hold their rates records in such systems. They search them by address, value and names. All of those pieces of information are required to be in the public register.

There is real bafflement at the meaning of PRPP 1 in such cases. It seems ineffective where such powerful packages are used but provides substantive restrictions in other cases.

PRPP 3 provides that: Personal information in a public register shall not be made available by means of electronic transmission, unless the purpose of the transmission is to make the information available to a member of the public who wishes to search the register.

This approach raises a number of issues, for instance:

1. Does ''electronic transmission' include physically delivering information held in electronic storage media?
2. How much information can a searcher validly take by electronic transmission before the operation becomes something more than ''searching'. In any case how can an agency tell what is being downloaded?
3. Who is a member of the public a lawyer, a private investigator, a policeman, a direct marketer's employee?
4. Hard copy appropriately formatted can be scanned and subjected to optical character reading. It allows bulk acquisition of data. This process lies outside PRPP 3. The technology will only get better and cheaper.

These are the kind of practical issues which are being faced now by local authorities practitioners. PRPP 1 and 3 offer little practical help in solving them and often add confusion.

Rules applicable to disclosure

A diagram can illustrate the sources of rules which local authorities must apply to disclosure of information.

The diagram shows that most of the concrete answers to disclosure questions will be provided by legislation which governs the relevant activity, not by the Privacy Act which exists more as an abstract overlay. Most real answers are provided by the legislation governing the activity and the generally applicable freedom of information legislation, the Local Government Official Information and Meetings Act 1987 (NZ).

Incidentally, it highlights the fact that the PRPPs, as mechanistic provisions, sit oddly with the rest of the structure. Generally PRPPs will apply to disclosure because there will be no mechanistic provisions in the primary legislation to displace them.

Note that the Privacy Act will have more impact on issues about the collection, handling and storage of information because those areas are less thoroughly dealt with by existing law. The provisions on disclosure are listed at the end of this article.

The primacy of the functional legislation can lead to strange results. For instance, Valuation New Zealand sees itself as obliged to remove names from valuation roll information before making it available. However, the provisions in s113-115 Rating Powers Act mean that local authorities are obliged to include names in the rates records which are available for public inspection.

Much of the legislation dealing with local authority functions was drafted at a time when the law took a very different attitude to issues of access to the information held by public bodies and to the protection of personal privacy.

Much of the legislation has grown up since the nineteenth century in a very ad hoc way with various elements being added as local authorities took up new functions.

That pattern produces quite random results on issues of information disclosure and privacy. The way that the Privacy Act regime overlays the existing law, in many cases, means that it does not fundamentally change the underlying pattern.

Purpose issues

Public Registers exist for particular purposes. It is often possible to isolate purposes fairly effectively by looking at the scheme of the legislative regime that generates them. For instance, rates records seem to exist so that:

(a) buyers, lenders and others can see the amount owing on particular properties; and

(b) the place of a particular property and the framework of a council's rating system can be determined, for example, whether it is subject to commercial or residential differentials.

Ideally such purposes should provide very useful guides to restrictions on the use of public registers. However the factors already discussed (the mechanistic approach in the PRPPs and the fairly random effect of the mix of legislation) mean purpose issues often have too little influence or disclosure decisions.

In some cases purposes can change from the time legislation was enacted. The Dog Control and Hydatids Act 1982 (NZ) started its life as a provision about dog control alone. It was later adapted for use in control aimed at diseases where dogs were vectors. The disease control element of the Act is now being phased out and dealt with under other legislation, for example, the Biosecurity Act. That kind of change can raise difficult interpretative issues.

Charging PRPP 4

PRPP 4 provides that:

Personal information shall be made available from a public register for no charge or for no more than a reasonable charge.

Freedom of information legislation may require public bodies to provide information without cost or at a price less than the real cost of producing it.

Such provisions reflect the fact that access to information is a vital tool for debate in democratic societies and that access is critical to individuals exercising control over how public agencies deal with information about them.

However, much of the information in public registers is not used for those purposes but is rather an input into a range of small and large commercial transactions. Efficiency requires that the body providing the information can charge the marginal cost of producing it.

There is a degree of recognition of these ideas in the guidelines currently used by the Crown for charging under the Official Information Act which are adopted by many local authorities.

However, local authority charging options are often restricted by the legislation dealing with the function; for instance, s35 of the Dog Control and Hydatids Act 1982 requires free access to dog registers.

Local authorities are also subject to administrative law principles in relation to decisions to charge and the factors they use in constructing charging regimes. They have little ability to make charges which are, themselves, unreasonable.

All these existing constraints on local authority charging means that the envelope of possible charging decisions is already fixed at a size which is the same or smaller than that provided for by PRPP 4.

Codes of practice

Codes of practice may provide some solutions. The provisions which allow codes of practice in relation to public registers (s63) describe a larger envelope than those about codes in relation to IPPs (s46 onwards).

Public register codes can extend, modify or provide exemptions from PRPPs. They can create completely new rules. Codes of practice may need to evolve anyway. Local authorities are tending to aggregate data to bring efficiencies to their operations. The most stark example is in geographic and land information databases. These aggregations may themselves require codes to be produced.