Draft Approved Information Sharing Agreement

DISCUSSION DRAFT ONLY

Approved Information Sharing Agreement

Between

Ministry of Social Development

And

Inland Revenue Department

Pursuant to Part 9A of the Privacy Act 1993 and
section 81A of the Tax Administration Act 1994

May 2017

Approved Information Sharing Agreement

The Parties

Inland Revenue (IR) (acting through the Commissioner of Inland Revenue)

Ministry of Social Development (MSD) (acting through the Chief Executive)

The Agreement
This Agreement is put in place under Part 9A of the Privacy Act 1993 and section 81A of the Tax Administration Act 1994 (TAA) to enable the Parties to share Information for the purpose of:

(a) assessing eligibility for, and entitlement to, Benefits and Subsidies;
(b) assessing and enforcing any obligations related to Benefits and Subsidies, including recovering any associated debt;
(c) assessing and enforcing Tax Obligations, including recovering any associated debt; and
(d) updating customer contact details.

Acceptance
In signing this Agreement, each Party acknowledges that it has read and agrees to be bound by it.

For and on behalf of Inland Revenue:

___________________________
Naomi Ferguson
Commissioner
Inland Revenue
Date_______________________

For and on behalf of the Ministry of Social Development:

___________________________
Brendan Boyle
Chief Executive
Ministry of Social Development
Date_______________________

BACKGROUND

A. The Government has set out its commitment to ensuring that government agencies share information as efficiently and effectively as possible.

B. The Parties share information under Current Agreements made under various sections of the TAA, the Income Tax Act 2007, the Student Loan Scheme Act 2011 and the Child Support Act 1991, each of which enable them to share specified information for specified purposes.

C. The Parties wish to consolidate these Current Agreements into one approved Information Sharing Agreement under section 81A of the TAA and Part 9A of the Privacy Act 1993 which enables a slighter broader range of Information to be shared for a slightly broader purpose.

D. More specifically, the Parties wish to be authorised to:

share some additional information related to the provision of social housing, income-related rent and student allowances; and
use this new information, and the information that they currently share, across their respective organisations for the purpose of:

a. assessing eligibility for, and entitlement to, Benefits and Subsidies;

b. assessing and enforcing any obligations related to Benefits and Subsidies, including recovering any associated debt;

c. assessing and enforcing Tax Obligations, including recovering any associated debt; and

d. updating customer contact details.

E. The Parties agree to enter into MOUs pursuant to this Agreement that replace the Current Agreements with effect from the date this Agreement comes into force.

F. IR intends to amend or repeal the legislative provisions that currently authorise the sharing of information between the Parties (as referred to at paragraph B) with effect from the date that this Agreement comes into force.

TERMS

1. Defined Terms

In this Agreement, including the Background, unless the context otherwise requires:

Adverse Action has the meaning specified at section 96C of the Privacy Act 1993.

Agreement, Approved Information Sharing Agreement or AISA means this Information Sharing Agreement between the Parties that is approved by the Order in Council, and includes the Schedules and any amendment made by the Parties.

Authorised Staff in relation to a Party, means staff of that Party who are authorised to send or receive Information under this Agreement.

Benefit has the meaning specified at section 3 of the Social Security Act 1964.

Current Agreements means the agreements between the Parties on the following topics that were in force at the date of this Agreement and that, from the date of this Agreement, have been replaced with MOUs entered into under this Agreement:

(a) working for families double payment and community service cards;
(b) commencement/cessation of benefits/students;
(c) working for families tax credits administration;
(d) child support and domestic maintenance;
(e) pro-active information sharing to reduce benefit debt; and
(f) student loan programme.

Information means the information that may be shared by the Parties under this Agreement, including Personal Information, as described at Schedule 1 and in the MOUs.

Information Sharing Agreement has the meaning specified at section 96C of the Privacy Act 1993.

Lead Agency means IR.

MOUs means the memoranda of understanding on the following topics that the Parties have entered into pursuant to this Agreement, that replace the Current Agreements, and that set out the operational arrangements by which the Parties may share Information:

(a) working for families double payment and community service cards;
(b) commencement/cessation of benefits;
(c) working for families tax credits administration;
(d) child support and domestic maintenance;
(e) pro-active information sharing to reduce benefit debt; and
(f) student loan programme; and
(g) social housing.

Order in Council means the Order in Council that approves this Agreement and that is made under section 96J(1), Part 9A of the Privacy Act 1993 and section 81A of the TAA, dated May 2017.

Party means IR or MSD and Parties means both IR and MSD.

Personal Information has the meaning in section 2(1) of the Privacy Act 1993.

Privacy Commissioner means the Commissioner established under section 12 of the Privacy Act 1993.

Revenue Acts means the Acts referred to at section 81(1C) of the TAA.

Subsidies means:

(a) working for families tax credits payable under Income Tax Act 2007 and the TAA;
(b) community services cards available under the Social Security Act 1964;
(c) student loans payable under the “student loan scheme” as defined in the Student Loan Scheme Act 2011;
(d) student allowances payable under the Education Act 1989;
(e) child support payable under the Child Support Act 1991;
(f) income-related rent payable under the Housing Restructuring and Tenancy Matters Act 1992; and
(g) social housing available under the Housing Restructuring and Tenancy Matters Act 1992.

TAA means the Tax Administration Act 1994.

Tax Obligations means tax obligations arising under the Revenue Acts.

2. Purpose

The purpose of this Agreement is to authorise the sharing of Information and enable the Information to be used for the purpose of:

3. Information to be shared

The Parties may share the Information and may use the Information for the purposes specified at clause 2.

4. Exemptions and/or modifications to information privacy principles

For the purposes of this Agreement, information privacy principles 2 and 11 which are set out in section 6 of the Privacy Act 1993 are modified (by the Order in Council that approves this Agreement) as follows:

(a) Principle 2: Source of Personal Information

It is not a breach of information privacy principle 2 for the Parties to collect Personal Information from each other for the purposes of this Agreement.

(b) Principle 11: Limits on disclosure of Personal Information

It is not a breach of information privacy principle 11 for the Parties to disclose Personal Information to each other for the purposes of this Agreement.

5. The public services that this Agreement is intended to facilitate

The public services that this Agreement is intended to facilitate are the accurate and efficient assessment of:

(a) entitlements to Benefits and Subsidies; and
(b) Tax Obligations.

6. Adverse Actions

(a) Section 96Q of the Privacy Act 1993 requires parties to an Information Sharing Agreement to provide written notice to individuals before any Adverse Action is taken against them on the basis of information shared under that agreement, including details of the Adverse Action that the party proposes to take and the Personal Information about the individual on which the action is based. The notice must give those individuals 10 working days to dispute the correctness of the information. Section 96R of that Act allows an approved Information Sharing Agreement to provide that a party to that agreement may give a shorter period of notice or dispense with the notice requirement.

(b) The Parties agree to dispense with the notice requirement under section 96Q where the sharing of Information under this Agreement gives either Party reasonable grounds to suspect that:

(i) a crime has been committed, is being committed, or will be committed; and
(ii) the Information is relevant to decision-making on preventative, investigative and enforcement interventions related to that crime; and
(iii) advance notification by a Party to a suspect of an Adverse Action might defeat the purpose of the intervention.

(c) The Adverse Actions that the Parties may take under this Agreement are specified at Schedule 2 and in more detail in some of the MOUs, where required for the purposes of the particular MOU.

7. Where you can view this document

This document is available:

(a) on the public website of each Party;
(b) at www.legislation.govt.nz; or
(c) in person at Inland Revenue, 55 Featherston Street, Wellington.

8. Overview of operational details

(a) The Information will be transferred securely between the Parties in accordance with MOUs that have been consulted on with the Privacy Commissioner.

(b) The Parties agree that this Agreement and the MOUs will replace the Current Agreements with effect from the date of this Agreement.

(c) The MOUs will contain operational details about how the Parties may share Information under this Agreement, including:

(i) security arrangements, as described at clause 9 below;
(ii) procedures to verify an individual’s identity; and
(iii) provisions that specify how frequently Information is to be provided and in what format.

(d) Operational details will be included in the MOUs, rather than in this Agreement, as they may need to be regularly updated over time, and they relate to matters that it is appropriate for the Parties to manage internally within their respective organisations. The Privacy Commissioner will be consulted on any amendments to the MOUs that have privacy implications.

(e) Information will only be accessible by Authorised Staff, for the purposes set out in this Agreement.

9. Safeguards that will be applied to protect the privacy of individuals and ensure that any interference with their privacy is minimised

(a) Security Provisions

Each Party will have mechanisms and procedures for:

(i) the secure storage and transfer of Information in accordance with government security standards (including by encrypted USB Iron Key, SEEMail, Secure File Transfer Protocol, or B2B framework, as applicable to the particular MOU);
(ii) the appointment of Authorised Staff;
(iii) the training of Authorised Staff, so that they share Information appropriately and in accordance with this Agreement;
(iv) ensuring that the Information is of adequate quality;
(v) ensuring that the Information is only used for the purposes specified in this Agreement.

(b) Disclosure

Neither Party will disclose the Information to any other agency or third party, except as required by law or the courts.

(c) Access and correction requests for Personal Information under Information Privacy Principles 6 & 7

Each Party will be responsible for responding to requests for Personal Information as appropriate in the circumstances.

(d) Privacy breaches

Each Party will be responsible for the investigation of privacy breaches as appropriate in the circumstances. Where Personal Information is found to have been inappropriately accessed or disclosed, the relevant Party’s internal investigation processes will be applied. Where an internal investigation confirms the loss of, or unauthorised access to, Personal Information amounting to a material privacy breach, the Privacy Commissioner will be notified as soon as possible.

(e) Audit

The Parties will undertake an annual audit of the operation of this Agreement to check that the safeguards in the Agreement are operating as intended, that they remain sufficient to protect the privacy of individuals, and to ascertain whether any issues have arisen in practice that need to be resolved.

10. Assistance statement

The Parties will provide any reasonable assistance that is necessary in the circumstances to allow the Privacy Commissioner or an individual who wishes to make a complaint about an interference with privacy to determine the Party against which the complaint should be made.

11. Security in the event of a breach

(a) If a Party has reasonable cause to believe that any breach of any security provisions in this Agreement or the MOUs has occurred or may occur, that Party may investigate that actual or suspected breach as it deems necessary.
(b) The other Party shall ensure that reasonable assistance is provided to the investigating Party in connection with the investigation.
(c) The investigating Party will ensure that the other Party is kept informed of any developments.
(d) Compliance by IR officers with this clause 11 is subject to their obligations under the TAA.
(e) A Party may suspend its sharing of Information under clause 3 of this Agreement to allow time for a security breach to be remedied.

12. Dispute resolution

(a) Should any dispute arise in relation to this Agreement, the Parties will meet in good faith to attempt to resolve it as quickly as possible.
(b) If the Parties are unable to resolve the dispute within 60 days, the matter shall be referred to the relevant Chief Executives, or their delegates, for resolution.
(c) The Parties will continue to comply with their obligations under this Agreement despite the existence of any dispute.

13. Review

(a) A joint review of this Agreement may be undertaken whenever the Parties consider that such a review is necessary.
(b) The Lead Agency will conduct a review annually or at intervals specified by the Privacy Commissioner and will produce a report that will be included in the Lead Agency's annual report.
(c) The Parties will co-operate with each other in any review and will take all reasonable actions to make the required resources available.

14. Amendments

(a) Any amendments to this Agreement or an MOU must be in writing and signed by the Chief Executives of the Parties, or their delegates.
(b) Amendments to this Agreement or an MOU will be made in accordance with section 96V of the Privacy Act 1993.
(c) If the Parties are unable to agree on any amendments, the matter will be dealt with under clause 12.

15. Term and termination

(a) This Agreement comes into force on the date specified in the Order in Council and shall continue in force until the Parties agree to terminate it or the Order in Council is revoked.
(b) A Party may suspend, limit, or terminate its participation in this Agreement if it appears to that Party that the terms of the Agreement or the Order in Council are not being met or the sharing of Information under this Agreement is otherwise unlawful.
(c) The obligations in the MOUs which concern confidentiality and secrecy shall remain in force notwithstanding the termination of this Agreement.
(d) If extraordinary circumstances arise (including but not limited to earthquake, eruption, fire, flood, storm or war) which prevent a Party from performing its obligations under the Agreement, the performance of that Party's obligations shall be suspended, to the extent necessary, for as long as those extraordinary circumstances prevail.

16. Departmental representatives

(a) Each Party will appoint a contact person to co-ordinate the operation of this Agreement with the other Party and will ensure that the contact person is familiar with the requirements of the Privacy Act 1993 and this Agreement.

(b) The initial contact persons are as follows:

(i) MSD: Director, Information Sharing.
(ii) IR: Manager, Information Sharing Hub.

(c) All notices and other communication between the Parties under the Agreement shall be sent to the contact persons specified above.

(d) The contact persons set out above may be updated from time to time by notice to the other Party and the Privacy Commissioner.

17. Precedence

This Agreement takes precedence over the MOUs, to the extent of any inconsistency.

SCHEDULE 1: INFORMATION

The Parties may share Information that falls into the following categories (the Information is specified in more detail in the MOUs):

Category	Definition
Contact Information	Information that may be used to contact an identifiable individual or their nominated representative(s), including names, email and postal addresses, and phone numbers.
Identifying Information	Information that may be used to identify an individual, including name(s), alias(es), date and location of birth and death.
Domestic Relationship Information	Information about individuals with whom an identifiable individual has or had a Domestic Relationships (as defined below), including their: (a) current and previous names, aliases, and contact details, and dates of birth; (b) Employment Information, Social Assistance Information, and Tax Information (as defined below). Domestic Relationship means a current or previous relationship between an identifiable individual and another person who is or was a spouse or partner of the individual, is or was a child of the individual or their spouse or partner, is or was a family member of the individual or ordinarily shares or shared a household with the individual.
Employment Information	Information about an identifiable individual’s employment, including: (a) current or previous engagement in a contract of service or a contract for service; (b) employer’s name and/or trading name; (c) employer’s contact details; (d) employer’s IRD number; (e) name that employer knows individual by; (f) date the individual commenced and/or date the individual ceased employment with the employer; (g) details of the income that the individual earned and period(s) of payment; and (h) the individual’s tax code(s).
Financial Information	Basic financial information about an identifiable individual, including bank account numbers, debt and Income Information (as defined below).
Income Information	This includes, but is not limited to: (a) salary and wages income; (b) interest, dividends, and Maori Authority income; (c) business income; (d) other taxable and non-taxable income.
Parents’ Income Information (in relation to student allowance applicants or recipients)	This includes, but is not limited to: (a) salary and wages income; (b) interest, dividends, and Maori Authority income; (c) business income; (d) other taxable and non-taxable income.
Social Assistance Information	Information about the Benefits and Subsidies received by an identifiable individual, including amount paid, recovery of over-payments, current and previous account status, entitlement, payment methods, balance, and dependants who have received/are receiving assistance payments.
Housing Information	Information about an identifiable individual’s housing history including rental payments and the terms of any rental agreements.
Tax Information	Information about an identifiable individual’s tax affairs, including: (a) tax class; (b) tax year; (c) tax paid; (d) tax refunds; (e) tax adjustments.

SCHEDULE 2: ADVERSE ACTIONS

1. The type of Adverse Action a Party may take is dependent on:

(a) the immediacy of the action required; and

(b) the nature and value of the Information that it receives from the other Party when considered alongside the facts of the case and the information that it already holds.

2. The types of Adverse Action that MSD may take include, but are not limited to:

(a) investigation;

(b) refusal to grant, or cessation of, or reassessment of entitlement to, a Benefit or Subsidy; and

(f) prosecution.

3. The types of Adverse Action that IR may take include, but are not limited to:

(a) investigation;

(b) refusal to grant, or cessation of, or reassessment of entitlement to, a Benefit or Subsidy;

(d) prosecution.

4. The Parties may use their statutory powers to support these actions.

5. The Parties will comply with all of their respective policies and guidelines as well as the Solicitor General’s Prosecution Guidelines (Guidelines), before taking any Adverse Action. The Guidelines assist in determining:

(a) whether criminal proceedings should be commenced;

(b) what charges should be filed; and

The Guidelines also provide advice for the conduct of criminal prosecutions, and establish standards of conduct and practice expected from those whose duties include conducting prosecutions.

6. If Personal Information shared under this Agreement forms part of the prosecution’s evidence in a criminal case, the Personal Information may be disclosed to an individual in accordance with the Criminal Disclosure Act 2008. Any dispute about the provision of such information will be managed by the courts as part of the subject matter of the prosecution.