Information matching and sharing

What is the difference between information matching and sharing?

In simple terms, information sharing is where one agency provides information to another agency. Information Matching (or data matching, as it is often called) involves the comparison of a set of records from one agency with records from another agency. In that case, the aim is usually to find records in both sets of data about the same person.

Does all information matching or sharing require a legal basis?

Yes. One agency cannot disclose information to another, be it a private or public one, without a legal basis to do so.

This basis can come from a number of places, for example, a government department’s primary legislation.

There are two ways Customs can lawfully disclose personal information. The first comes from the legislative authority provided through out primary legislation - the Customs and Excise Act 2018. That legislation sets out the circumstances in which we can lawfully share information. In some cases, it specifies what types of information we are allowed to share, and which agencies we can share it with.

The second comes from the Privacy Act 2020. We can disclose personal information where we believe, on reasonable grounds, that an exception to Information Privacy Principle 11 of the Privacy Act applies.

Sharing with other agencies, through primary legislation

Government departments can share information with other agencies, public or private, if there is legislation that allows the sharing.

In 2018 a new Customs and Excise Act came into effect. That Act provides us with specific mechanisms to share information as well as imposing additional responsibilities. This includes the requirement to publish information sharing agreements that we are a party to.

Following implementation of the Act, we've been reviewing all information sharing agreements to make sure they are current and fit for purpose. As each agreement is reviewed and signed-off, a link to it will be added to this page.

Approved Information Sharing Agreements

AISAs provide another legal basis for agencies to share personal information where other legal mechanisms are not appropriate in the circumstances. AISAs allow sharing between agencies for the purpose of delivering services that provide a benefit to the public. AISAs have a large degree of oversight and need to be approved by an Order in Council. The form of an ASIA, and the process that agencies must follow to create one, is set out in Part 7 of the Privacy Act.

AISAs are agreements between two or more agencies; it is a requirement under the Privacy Act that a lead agency is appointed for each AISA.  The lead agency is also required to publish a copy of the agreement online, and has to report periodically to the Privacy Commissioner about activities carried out under the AISA.

Currently, we're party to three completed AISAs, but are not the lead agency for any of them:

• the Gang Intelligence Centre AISA with the New Zealand Police
• the Ministry of Social Development (MSD) who are the lead agency for this AISA
• an AISA with Inland Revenue, for targeting serious crime.

We're currently involved in the creation of another AISA. When this is approved, links and information about it will be published on this website.

Information Matching Agreements

The Privacy Act provides a definition for information matching programmes but simply put, it is a mechanism where two agencies can match records to find sets of data about the same person.

Information matching programmes are approved by an Act of Parliament. Part 7 and Schedule 6 of the Privacy Act govern information matching agreements, including how they are set-up, the rules around the process, and the Privacy Commissioner’s role in monitoring the use of data matching by government departments.

We review information matching agreements on a periodic basis to check whether they are still necessary and, if required, the agreements are updated.

We are currently a party to the following information matching agreements: