7 September 2021
45 Pipitea Street, Thorndon, Wellington 6011
PO Box 805, Wellington 6140
Phone +64 4 495 7200
Mr M Chipping
Fax +64 4 382 3589
[FYI request #16373 email]
Emai
l [email address]
Websit
e www.dia.govt.nz
Tēnā koe Matthew
Your Official Information Act request OIA2122-0130
Thank you for your Official Information Act (the Act) request, which was received by the
Department of Internal Affairs (the Department) on Tuesday 10 August 2021.
Your request asked for the following information:
“
Has your agency contracted work to Research New Zealand in the last five years? If so,
did you provide private information or data on individuals to Research New Zealand. If
so, what agreements did you make with Research New Zealand regarding privacy and
data retention? Have you been notified of any data breaches, security issues, or privacy
issues with Research New Zealand?”
Engagement with Research New Zealand
In 2017 the Department engaged Research New Zealand to conduct our Customer
Experience Survey Programme, a continual assessment of customer engagement with the
Department. The Programme measures the quality of service provided by the Passport,
Citizenship, Charities, Community Operations, Births, Deaths, and Marriages, and RealMe
services. These services are managed by the Service Delivery and Operations (SDO) Branch of
the Department, which some clauses in the Agreement refer to (which are appended to this
letter).
In addition to questions about customer satisfaction with these services, the Department is
also interested in understanding the potential drivers and barriers for digital uptake of these
services.
Personal information shared with Research New Zealand
The Department shares personal information about users of our services with Research New
Zealand to enable them to contact the users. This information is provided on a monthly
basis.
The following information fields may be shared with Research New Zealand in order to
conduct the survey:
• Surname
• Given Name
• Date of Birth
• Address
• Email address
• Phone number
Agreement clauses relating to information management
The relevant clauses of the Agreement between the Department and Research New Zealand
are appended to this letter.
Reporting of privacy incidents
The Department has not been advised of any issues with the management of information
shared with Research New Zealand.
If you have any feedback or questions about the Department’s response, please let us know
at [email address]
You have the right to seek an investigation and review by the Ombudsman of this decision.
Information about how to make a complaint is available
at www.ombudsman.parliament.nz or Freephone 0800 802 602.
Ngā mihi
Karlene Symonds
General Manager Information and Safety
Organisational Capability and Services
Page 4 of 4
Appendix A
Agreement between the Department and Research New Zealand
The Agreement clauses relating to the management of personal information are replicated
below. In this Agreement the terms “Service Provider” and “Vendor” refers to Research New
Zealand.
12.1 Confidentiality obligations: The Service Provider must:
(a) use any Confidential Information solely for the purpose of, and solely to the
extent necessary for, the performance of the Service Provider’s obligations
under this Agreement;
(b) only disclose the DIA’s Confidential Information to those of the Service
Provider’s employees, agents and contractors to whom, and to the extent
that, such disclosure is reasonably necessary for the purpose of performing
the Service Provider’s obligations under this Agreement; and
(c) maintain effective and adequate security measures to safeguard the DIA’s
Confidential Information from access or use by unauthorised persons and keep
the Confidential Information under its control.
12.2 Exceptions to obligations: The provisions of clause 12.1 will not apply to
Confidential Information, to the extent that the Confidential Information:
(a) was, before the Service Provider received such Confidential Information from
the DIA, in the Service Provider’s possession without any obligations of
confidence;
(b) is independently acquired or developed by the Service Provider without
breaching any of the Service Provider’s obligations under this Agreement and
without use of any other Confidential Information of the DIA;
(c) is subsequently disclosed to the Service Provider, without any obligations of
confidence, by a third party who has not derived it, directly or indirectly, from
the DIA;
(d) is or becomes generally available to the public through no act or default of the
Service Provider or any of the Service Provider’s employees, agents or
subcontractors; or
(e) is required to be disclosed by law, or to the courts of any competent
jurisdiction, or to any government regulatory or financial authority, provided
that:
(i) as soon as reasonably practicable, and prior to the disclosure, the Service
Provider will inform the DIA of the requirement for disclosure and consult
with the DIA; and
(ii) at the DIA’s request, the Service Provider will seek to persuade the court
or authority to have the information treated in a confidential manner.
12.3 Disclosure: The Service Provider must ensure that any person to whom the Service
Provider makes any disclosure in accordance with clause 12.1(b):
(a) is made aware of, and subject to, the Service Provider’s obligations under
clause 12.1; and
(b) has entered into a written undertaking of confidentiality in favour of the
Service Provider or, if requested by DIA, in favour of DIA, that is at least as
restrictive as the undertakings set out in clause 12.1 and that applies to the
Confidential Information, and the Service Provider remains responsible to DIA
for any unauthorised use or disclosure of DIA’s Confidential Information by
such persons as if the use or disclosure was made by the Service Provider
under this clause 12.
12.4 Announcements: The Service Provider must not make any announcement
regarding this Agreement to any person, without DIA’s prior written consent.
12.5 Protecting Personal Information: The Service Provider agrees:
(a) to use or disclose Personal Information obtained only for the purposes of
delivering the Service and Deliverables and complying with this Agreement,
including the reporting requirements;
(b) not to do anything that would breach an information privacy principle
contained in the Privacy Act 1993, which if done or engaged in by an agency
under the Privacy Act 1993, would be a breach of that information privacy
principle;
(c) to otherwise comply with the Privacy Act 1993 and any code established under
the Privacy Act 1993;
(d) to immediately notify DIA if the Service Provider becomes aware of any breach
or possible breach of the Privacy Act 1993 whether by it or any of its
subcontractors; and
(e) to ensure that the Service Provider’s Personnel who are required to deal with
Personal Information for the purposes of this Agreement are made aware of
and comply with the obligations set out in this clause.
Schedule 2
1.1 Contact databases
SDO will supply a contact database monthly for each business unit. Contact databases will
only be delivered in a secure manner and are required to be kept secure by the vendor at all
times.
Contact datasets need to be de-duplicated where possible, following SDO guidelines.
Individual customers are to be contacted no more often than once a year.
A no contact list must be created and maintained.
Page 4 of 4
