Authors: Cleaver, O. & Nicklin, G.
Published in National Security Journal, 12 June 2020
The OPC works to protect New Zealanders’ personal information, providing guidance on how agencies collect, use, disclose, store and give access to information. The Privacy Act 1993 and its principles require personal information to be collected, stored and disclosed in ways that protect the privacy of that information. OPC oversight is relevant to the question of SOCMINT because its collection is not disclosed. Understanding the OPC involvement in agencies’ information gathering activities from private citizens is therefore important.
The OPC were consulted about the findings from the survey and agency practices. They advised that they review agencies’ policy and procedures for the collection, use and disclosure of information, usually at the request of the agency. It is each agency’s responsibility to determine, when, how and what information is required to be collected, in line with the Privacy Act 1993 and its principles.
Three principles of the Privacy Act are relevant to this research – principles one, two and four. Principle one requires the collection of information from social media to be for a lawful purpose related to a function of the agency. Collection must also be necessary. If an agency can determine that the use of social media is lawful, necessary and aligns with the requirements of its regulatory function, then there is no theoretical reason why it should not be able to collect information from social media platforms. The contested issues often come down to determining which actions are unlawful within the context of agencies’ regulatory functions.
Principle two, ‘Source of personal information’ highlights the importance of clarifying whether social media collection is done in the private or public space. This principle states agencies can only collect information directly from the individual, unless it is publicly available and the individual concerned authorises collection. Collections are also permitted for maintenance of the law. The OPC definition of publicly available information is “information in a magazine, book, newspaper, public register, or other publication that is (or will be) available to members of the public. This can include internet sites that are available to the public, such as social media sites”.37 While “public information” includes social media, it is silent on the manner of collection – in the current case, via false social media personas.
Principle four addresses the manner of collection. It states that information cannot be collected unlawfully, unfairly or in a way that intrudes on the personal affairs of the individual concerned. The test for intrusion is the breach of reasonable expectation of privacy. The survey results provide an indication of the extent of “Reasonable expectation” for SOCMINT collection.
In summary, the Privacy Act and principles work as an enabler for government agencies to carry out their regulatory functions in a way that meets the best interests of New Zealanders. Despite this, there is possibly confusion about whether the use of false social media personas