Information matching and sharing

So that organisations can provide the best services to you and, in the case of public sector agencies, to the Government, agencies may need to share information with each other.

What is the difference between information matching and sharing?

In simple terms, information sharing is where one agency provides information to another agency. Information Matching (or data matching, as it is often called) involves the comparison of a set of records from one agency with records from another agency. In that case, the aim is usually to find records in both sets of data about the same person.

Does all information matching or sharing require a legal basis?

In a word, yes. One agency cannot disclose information to another, be it a private or public one, without a legal basis to do so.

This basis can come from a number of places, for example, a government department’s primary legislation. For Customs, our legal basis comes from the Customs and Excise Act 2018. That legislation sets out the circumstances in which we can lawfully share information. In some cases, it even says what types of information we are allowed to share, and which agencies we can share it with.

Sometimes we may also share information even where it doesn’t explicitly say so in our Act. For example, if we want to share information and we identify that an exception to Information Privacy Principle 11, of the Privacy Act applies, then we may be able to share information by relying on the Privacy Act.

We may also be able to share information where there’s an information sharing tool such as a memorandum of understanding, Approved Information Sharing Agreement (AISA) or Information Matching Agreement.

Sharing with other agencies, through primary legislation

Government departments can share information with other agencies, public or private, if there is legislation that allows the sharing.

In 2018 a new Customs and Excise Act came into effect. That Act provides us with new mechanisms to share information as well as imposing additional responsibilities. This includes the requirement to publish information sharing agreements that we are a party to.
Following implementation of the Act, we've been reviewing all information sharing agreements to make sure they are current and fit for purpose. As each agreement is reviewed and signed-off, a link to it will be added to this page.

Approved Information Sharing Agreements

AISAs provide another legal basis for agencies to share personal information where other legal mechanisms are not appropriate in the circumstances. AISAs allow sharing between agencies for the purpose of delivering services that provide a benefit to the public. AISAs have a large degree of oversight and need to be approved by an Order in Council. The form of an ASIA, and the process that agencies must follow to create one, is set out in Part 9A of the Privacy Act.

AISAs are agreements between two or more agencies; it is a requirement under the Privacy Act that a lead agency is appointed for each AISA.  The lead agency is also required to publish a copy of the agreement online, and has to report periodically to the Privacy Commissioner about activities carried out under the AISA.

Currently, we're party to three completed AISAs, but are not the lead agency for any of them:

• the Gang Intelligence Centre AISA with the New Zealand Police
• the Ministry of Social Development (MSD) who are the lead agency for this AISA
• an AISA with Inland Revenue, for targeting serious crime.

We're currently involved in the creation of another AISA. When this is approved, links and information about it will be published on this website.

Information Matching Agreements

The Privacy Act provides a definition for information matching programmes but simply put, it is a mechanism where two agencies can match records to find sets of data about the same person.

Information matching programmes are approved by an Act of Parliament. Part 10 and Schedule 4 of the Privacy Act govern information matching agreements, including how they are set-up, the rules around the process, and the Privacy Commissioner’s role in monitoring the use of data matching by government departments.

We review information matching agreements on a periodic basis to check whether they are still necessary and, if required, the agreements are updated.

We are currently a party to seven information matching agreements: