GM Custom All Fields – GravityMerge

GM Custom
All Fields

This plugin allows you to display a form's fields and their inputs in confirmation screens while respecting the form's conditional logic, and you can download the output as a document that can be read by Microsoft Word.

Features
Questions
Demo

Features

Display a form's fields and their inputs in confirmation screens while respecting conditional logic: With the plugin's modified all fields merge tag, you can display the questions in your form, and the answers someone gives to them, while also respecting conditional logic. This means that if someone filling the form doesn't see fields due to conditional logic, those fields won't show when the customised all fields merge tag is used in your confirmation.
Choose not to see fields for which there is no input: If questions in your form are optional (rather than required) and someone doesn't answer them, you can choose to exclude those fields from displaying in your confirmation.
Show HTML fields: If you're using Gravity Forms to display advice or instructional output that depends on how a person answers questions in a form, the ability to show HTML fields (which will show conditionally depending on a person's answers) is a must. This plugin has an option for that.
Download confirmation as Word-readable document: The merge tag also has an option that allows you to download the output in your confirmation screen as a Word-readable document. This allows you to use Gravity Forms to produce downloadable documents that reflect that customised output in your confirmation screens using its modified all fields merge tag.

An example of the plugin in action

Here's a demo of a form that's used to create a report containing preliminary advice for proposed collections of personal information under the laws of a particular legal system. Don't worry about understanding the detail of the questions. Just fire in some text, submit the form, and see what this plugin can do 🙂
Collect report - administrative details
Give a name to your report*
For example: Report on collection of personal information from students for loan application purposes
Enter the name of your agency*
If you don't want to enter the real name of your agency, you can always enter a fictional name
Enter your name*
If you don't want to enter your real name, you can always enter a fictional name
Collect assessment: {Give a name to your report:825}
Report details

Report for: {Enter the name of your agency:835}

Relating to: {Give a name to your report:825}

Form submitted by: {Enter your name:836}

Date submitted: 27/07/2024

Introduction

Thank you for using the Collect assessment tool that has been designed to help you assess the privacy implications of a proposed collection of personal information. This report is automated and based on what you have told us. It collects all the questions you answered, together with your answers to them, and adds the preliminary feedback and any warnings you will have seen when filling out the online form.

Depending on what you're proposing and the content of the report, you may:
- feel that the report is sufficient by itself, or
- wish to use it as an input into decision-making by your agency, or
- wish to use it as a component of a privacy impact assessment, or
- wish to provide it to a lawyer or privacy professional when seeking definitive advice.
Personal information
Describe the personal information that you intend to collect, including specific data elements (if known)*
"Personal information” is any information that could be used to identify the person the information is about. The Privacy Act defines it as "information about an identifiable individual".
Further explanation of 'personal information'
There are many types of personal information, including:

names, addresses, phone numbers and email addresses

unique identifiers, like IRD numbers

photos, videos or audio recordings

financial or medical records

ethnicity, and iwi and hapu affiliation

religious details

records of a person’s transactions

handwritten notes, opinions and allegations

records of interactions with a client or customer.

Information can be personal information if it can be linked to an individual when combined with other available information.
Purpose
The importance of 'purpose': When collecting personal information, it is particularly important to be clear about the purpose(s) of collection and to articulate and record those purposes clearly. The reason for this importance differs depending on whether you'll be collecting information under a specific legislative authority or not. A "specific legislative authority" is any legislative provision, beyond the Privacy Act's information privacy principles, that authorises or requires the collection of personal information, including provisions in particular Acts like the Social Security Act 2018, provisions in regulations under Acts, and Approved Information Sharing Agreements that are put in place under the Privacy Act.

If there's no specific legislative authority governing your proposed collection, use and disclosure, then all of the Privacy Act's information privacy principles (IPPs) will apply. If you are unclear on your purpose(s) of collection, it may be difficult to apply and satisfy IPP1. IPP1 requires that your collection be necessary for a lawful purpose connected with your agency's functions or activities. If you're unclear on your purpose(s) of collection, it can be difficult to determine whether the collection is necessary for such a purpose. This has flow-on effects for other IPPs. It can affect one's ability to rely on an exception in IPP2 to collection other than from individuals (where compliance would prejudice the purposes of the collection). It also affects the use and disclosure of the personal information you're collecting, as 'purpose' is central to IPP10 (on the use of personal information) and IPP11 (on the disclosure of personal information). Note also that, if you're collecting personal information directly from individuals, you need to inform them of various matters listed in IPP3 unless an exception applies. Those matters include the purpose(s) for which you're collecting the information and the intended recipients of the information.

If your collection of personal information is covered by a specific legislative authority, purpose is still important. You'll still need to be clear on your purposes of collection to know whether the specific legislative authority applies to permit your proposed collection. In addition, it is likely that some of the Privacy Act's IPPs will still apply. You may not need to worry about IPPs 1 and 2, but other IPPs will still likely apply, including IPP3 (mentioned above). A specific legislative authority may override some IPPs but it's rare to override all of them.
Describe the specific purpose(s) of collecting this personal information?*
Be sure to specify all purposes that you do or will genuinely contemplate at the time of collection.
Who will you collect this personal information from, directly from the individuals concerned or another source?*
Note that, under the Privacy Act's IPP2, where an agency collects personal information, the agency needs to collect the information directly from the individuals concerned unless an exception in IPP2(2) applies. If you select "From another source", you'll be asked some IPP2-related questions further below.
- Directly from the individuals concerned
- From another source
Collection of personal information directly from individuals
Will you be obtaining the personal information under a specific legislative authority that expressly authorises or requires collection from the individuals concerned?*
This question is referring to specific legislative authority beyond the Privacy Act's information privacy principles. If you need to check the content of potentially relevant specific legislative authorities, you can do that by using our Info-Provisions tool (opens in a new tab/window), and then come back here to continue. In case you forget to come back, you might want to save your progress by using the 'Save and continue' link at the bottom of the page before checking out the Info-Provisions tool.
- Yes
- No
- Do not know
What is the section number and name of the specific legislative authority?*
For example: Section 17 of the Tax Administration Act 1994.
Explain why it applies to the proposed collection of new personal information from individuals, including why it captures the specific purpose(s) of collecting the new personal information that you’ve described above*
How confident are you that the specific legislative authority applies to your proposed collection of personal information?*
- Highly confident
- Less than highly confident
Given your high degree of confidence, it seems likely that you can proceed to collect the personal information identified above in reliance on the specific legislative authority. You could always have a lawyer check this but that may not be necessary.
Given that you're not sure whether you can rely on the specific legislative authority to collect the personal information you've identified above, it may be desirable to have a lawyer check this issue before you collect the information.
You’ve said you don’t know if your agency will be obtaining the personal information under a specific legislative authority that expressly authorises or requires collection from the individuals concerned. You'll need to find this out, because:
- if a specific legislative authority that authorises or requires the collection does exist, it may prevail over the Privacy Act in certain respects and may need to be considered;
- if a specific legislative authority does not exist, you will need to assess whether the collection will be consistent with IPP1 (Purpose of collection).
Once you know the answer to this question, you should undertake this assessment again, as you'll then be asked further relevant questions that depend on whether you're relying on a specific legislative authority or not.
Explanation of IPP1: Under the Privacy Act's IPP1, an agency can only collect personal information if the information is collected for a lawful purpose connected with a function or activity of the agency, and the collection of the information is necessary for that purpose. You need to consider this question because you've said there is no specific legislative authority that authorises the collection of the personal information.

IPP1 uses the language of 'necessary for the purpose' rather than 'reasonably necessary'. However, it is generally accepted that an "agency does not need to show that it absolutely must collect the information in order to achieve its purpose". Rather, it needs to show "that it is reasonably necessary to collect it". See the Office of the Privacy Commissioner's website.

Note that when IPP1 applies, if a collecting agency can achieve its purpose without collecting identifying information (personal identifiers such as name and residential address), then it shouldn’t collect identifying information. IPP1(2) states: “If the lawful purpose for which personal information about an individual is collected does not require the collection of an individual’s identifying information, the agency may not require the individual’s identifying information.”
Will your collection of this personal information from individuals be ‘reasonably necessary for a lawful purpose connected with your agency's functions or activities’?*
In answering this question, you need to think about:

- what the purpose is
- whether that purpose is lawful
- whether the purpose is connected to a function or activity of your agency, and
- whether it's reasonably necessary to collect the information for that purpose

It's also important to think about all the personal information attributes or elements that you propose to collect and to ask yourself whether you truly need all of them. If you need some but not others, the ones you don't need should not be collected.
- Yes
- No
- Do not know
Explain why you believe that to be the case*
Explain why you do not know or are unsure*
If, as you've stated, it's reasonably necessary to collect the personal information for a lawful purpose connected with a function or activity of your agency, then there will not be any issue under IPP1.
If it is not necessary for your agency to collect the personal information for a lawful purpose connected with its functions or activities then your agency will likely breach the Privacy Act's IPP1 if it proceeds to collect it. That, in turn, may amount to an interference with privacy.
You've indicated you don't know whether your agency's collection of this personal information would be necessary for a lawful purpose connected with its functions or activities. It is important to make an assessment of whether the collection will be necessary for such a purpose because, if not, your agency would likely breach the Privacy Act's IPP1 (Purpose of collection of personal information). That, in turn, may amount to an interference with privacy.
Introduction to Privacy Act's IPP3 - collection of information from individuals: If an agency collects personal information directly from individuals, then the Privacy Act's IPP3 (Collection of information from subject) applies (unless overridden by other legislation). Under IPP3, unless an exception applies, the collecting agency must take steps that are, in the circumstances, reasonable to inform the individuals of:
- the fact that the information is being collected
- the purpose of collection
- the intended recipients
- the names and addresses of who is collecting the information and who will hold it
- if a specific law governs provision of the information, what the law is and whether provision of information is voluntary or mandatory
- the consequences if all or any part of the requested information is not provided, and
- the individual’s rights of access to and to request correction of personal information.
The collecting agency doesn't need to take these steps if it has already done so in relation to the same personal information, or information of the same kind, on a recent previous occasion, or if the agency believes on reasonable grounds that:
- non-compliance would not prejudice the interests of the individual concerned
- non-compliance is necessary to avoid prejudice to the maintenance of the law by any public sector agency, or to enforce a law that imposes a pecuniary penalty, or to protect public revenue, or for the conduct of court or tribunal proceedings
- complying with this principle would prejudice the purposes of collection
- complying with this principle is not reasonably practical in the particular case
- the information will not be used in a form in which the individual concerned is identified, or will be used for statistical or research purposes and will not be published in a form that could reasonably be expected to identify the individual concerned.
Do you propose to inform the individuals of the matters listed in IPP3?*
- Yes
- No, as an exception in IPP3 applies
- No, as IPP3 is expressly overridden by a specific legislative authority
- No, we would rather not
- No, as my agency has already done so in relation to the same personal information, or information of the same kind, in the recent past
- Do not know
Please explain when and how your agency did so*
Explain how you propose to inform individuals of the matters listed in IPP3*
Select the IPP3 exception(s) that apply*
- Non-compliance would not prejudice the interests of the individuals concerned
- Non-compliance is necessary to avoid prejudice to the maintenance of the law by any public sector agency, or to enforce a law that imposes a pecuniary penalty, or to protect public revenue, or for the conduct of court or tribunal proceedings
- Complying with IPP3 would prejudice the purposes of collection
- Complying with IPP3 is not reasonably practical in the particular case
- The information is not going to be used in a form in which the individual concerned would be identified or will be used for statistical or research purposes and will not be published in a form that could reasonably be expected to identify the individual concerned
Explain why the selected exception(s) apply*
Explain why you believe this to be the case*
There does not appear to be any issue under IPP3, as you've said you will inform the individuals from whom you'll be collecting the information of the matters listed in IPP3.
On the basis of the answers you've given, there does not seem to be any issue relating to IPP3. However, this tool cannot assess the textual explanations you've given. If you're in any doubt as to your ability to rely on an IPP3 exception, you may wish to either check with a lawyer or privacy professional, or (if possible) comply with IPP3 anyway.
On the basis of the answers you've given, there does not seem to be any issue relating to IPP3. However, this tool cannot assess the textual explanations you've given. If you're in any doubt as to whether the specific legislative authority overrides IPP3, you may wish to either check with a lawyer or privacy professional, or (if possible) comply with IPP3 anyway (as long as doing so isn't contrary to the specific legislative authority).
On the basis of the answers you've given, there does not seem to be any issue relating to IPP3. However, this tool cannot assess the textual explanations you've given. If you're in any doubt as to whether your agency has informed individuals of the matters in IPP3 in the recent past, in relation to kind of personal information in question, you may wish to either check with a lawyer or privacy professional, or (if possible) comply with IPP3 anyway.
If you don't have a valid reason for not informing people of the matters mentioned in IPP3, your agency will be in breach of IPP3 and that, in turn, could amount to an interference with privacy under the Privacy Act. You may wish to reconsider your answer to the question above.
You will need to determine whether your proposal entails informing people of the matters in IPP3 or not. If you are proposing not to inform individuals of those matters, you will need to consider whether that is acceptable under an IPP3 exception.
Introduction to IPP4 - manner of collection of personal information: Under the Privacy Act's IPP4, an agency that collects personal information needs to collect it by a means:
- that is lawful; and
- that, in the circumstances (particularly in circumstances where personal information is being collected from children or young persons), is fair and does not intrude to an unreasonable extent upon the personal affairs of those individuals.
IPP4 addresses the 'how', or the method, of collection. A collection will be unlawful and breach IPP4 if the means by which it is done is contrary to an Act, regulations or the common law. Examples could include trespassing on someone's property to take photos, recording someone else's phone call, or hacking in to someone's device to obtain information.

A method of collection could be unfair if, for example, people are bullied, threatened or coerced. It might be unreasonably intrusive if, for example, people are followed surreptitiously in their private life or covertly monitored. These are just examples. There could be other unfair or unreasonably intrusive means of collection. Each situation needs to be considered in the light of its circumstances. See further the Office of the Privacy Commissioner's website.
How will your agency collect the new personal information from individuals? Explain relevant context and processes*
Are individuals likely to be concerned or upset by your agency's collection of their personal information in this manner?
- Yes
- No
- Do not know
Explain why individuals would be concerned or upset*
Are there any other ways your agency could collect the information that would be less concerning to the individuals concerned?*
- Yes
- No
- Do not know
Explain the other ways in which your agency could collect the information and why it would not use them instead*
If you don’t know whether there are other ways the information could be collected from individuals that would be less concerning to them, then this is something you may need to consider. Bear in mind that, as a matter of good practice, agencies should be minimising concern to people in relation to the collection of their personal information whenever reasonably possible to do so.
If you don’t know whether individuals are likely to be concerned or upset by your agency's collection of their personal information in this manner then this is something you may wish to consider further.
Given your answers above, are you confident that the means by which you will collect the personal information is lawful, fair, and does not intrude unreasonably upon individuals' personal affairs?*
- Yes
- No
You've said you're confident that you'll be collecting people's personal information by lawful and fair means. If so, there won't be any issue under IPP4. You could have a lawyer or privacy professional check this for you but it sounds like that may not be required.
You've said you're not confident that you'll be collecting people's personal information by lawful and fair means. Given that this raises a risk of your breaching the Privacy Act's IPP4, it may be desirable to check this issue with a lawyer or privacy professional before collecting the information by the proposed means.
Collection of personal information from another source
Will you be obtaining the personal information under an existing specific legislative authority that expressly authorises or requires collection from a source other than the individuals concerned?*
This question is referring to specific legislative authority beyond the Privacy Act's information privacy principles. If you need to check the content of potentially relevant specific legislative authorities, you can do that by using our Info-Provisions tool (opens in a new tab/window), and then come back here to continue. In case you forget to come back, you might want to save your progress by using the 'Save and continue' link at the bottom of the page before checking out the Info-Provisions tool.
- Yes
- No
- Do not know
You’ve said you don’t know whether your agency will be obtaining the new personal information under a specific legislative authority that expressly authorises or requires collection from another source. This will need to be determined because, if a specific legislative authority that authorises or requires the collection does exist, it may prevail over the Privacy Act in certain respects and will need to be considered. If a specific legislative authority does not exist, you will need to consider additional questions that arise under the Privacy Act’s IPP1, IPP2 and IPP11.
What is the specific legislative authority?*
For example: section 17 of the Tax Administration Act 1994. If the specific legislative authority is an approved information sharing agreement (AISA) under the Privacy Act, state the full name of the AISA. If the authority is an old information matching agreement, state the full name of the agreement and the statutory provision it relies upon.
Is the specific legislative authority that you identified above an approved information sharing agreement or an information matching agreement?*
- Yes
- No
- Do not know
Explain why the specific legislative authority applies to the proposed collection of new personal information from another source, including why it captures the specific purpose(s) of collecting the personal information that you’ve described above*
How confident are you that the specific legislative authority applies to your proposed collection of personal information from another source?*
- Highly confident
- Less than highly confident
Given your high degree of confidence, it seems likely that you can proceed to collect the personal information identified above in reliance on the specific legislative authority. You could always have a lawyer check this but that may not be necessary.
Given that you're not sure whether you can rely on the specific legislative authority to collect the personal information you've identified above, it may be desirable to have a lawyer check this issue before you collect the information.
Does the specific legislative authority require the third party source to provide the personal information or only allow it to provide the information?*
This question is relevant to whether your agency should explain to the third party source that its provision of the information to your agency is mandatory or voluntary.
- Require
- Allow
- Do not know
Remember that, when collecting personal information from other agencies, they need to understand your purpose of collection. It is important not only that your agency has a clearly articulated and lawful purpose for collecting the information from the other agency, but also that you fully inform the other agency of your agency's purpose of collection in a manner that is easy for the other agency to understand and (where relevant) explain to its service users.

You've indicated that the specific legislative authority under which you'll be collecting information from another agency requires that agency to provide the personal information. You should inform the other agency of this as well.

The Privacy Act does not specify these requirements in an agency-agency context but they are often vital. If the other agency doesn’t fully understand these matters, it could struggle to assess whether it is lawful to provide the information to your agency, and whether it must or only may provide the information.
Remember that, when collecting personal information from other agencies, they need to understand your purpose of collection. It is important not only that your agency has a clearly articulated and lawful purpose for collecting the information from the other agency, but also that you fully inform the other agency of your agency's purpose of collection in a manner that is easy for the other agency to understand and (where relevant) explain to its service users.

You've indicated that the specific legislative authority under which you'll be collecting information from another agency allows but doesn't require that agency to provide the personal information. You should inform the other agency of this as well.

The Privacy Act does not specify these requirements in an agency-agency context but they are often vital. If the other agency doesn’t fully understand these matters, it could struggle to assess whether it is lawful to provide the information to your agency, and whether it must or only may provide the information.
Remember that, when collecting personal information from other agencies, they need to understand your purpose of collection. It is important not only that your agency has a clearly articulated and lawful purpose for collecting the information from the other agency, but also that you fully inform the other agency of your agency's purpose of collection in a manner that is easy for the other agency to understand and (where relevant) explain to its service users.

You've indicated that you don't know whether the specific legislative authority under which you'll be collecting information from another agency requires or only allows that other agency to provide the information; in other words, whether the other agency's provision of information to you is mandatory or voluntary. It is advisable to find this out and inform the other agency of the position.

The Privacy Act does not specify these requirements in an agency-agency context but they are often vital. If the other agency doesn’t fully understand these matters, it could struggle to assess whether it is lawful to provide the information to your agency, and whether it must or only may provide the information.
Introduction to IPP4 - manner of collection of personal information: Under the Privacy Act's IPP4, an agency that collects personal information needs to collect it by a means:
- that is lawful; and
- that, in the circumstances (particularly in circumstances where personal information is being collected from children or young persons), is fair and does not intrude to an unreasonable extent upon the personal affairs of those individuals.
IPP4 addresses the 'how', or the method, of collection. A collection will be unlawful and breach IPP4 if the means by which it is done is contrary to an Act, regulations or the common law. Examples could include trespassing on someone's property to take photos, recording someone else's phone call, or hacking in to someone's device to obtain information.

A method of collection could be unfair if, for example, people are bullied, threatened or coerced. It might be unreasonably intrusive if, for example, people are followed surreptitiously in their private life or covertly monitored. These are just examples. There could be other unfair or unreasonably intrusive means of collection. Each situation needs to be considered in the light of its circumstances. See further the Office of the Privacy Commissioner's website.

It is possible for a specific legislative authority to permit a means of collection that would otherwise be contrary to IPP4, but that is rare.
How will your agency collect the personal information from the third party source? Explain relevant context and processes.*
Are individuals likely to be concerned or upset by your agency's collection of their personal information in this manner or would they be upset if they knew?*
- Yes
- No
- Do not know
Explain why individuals would be concerned or upset*
Are there any other ways your agency could collect the information that would be less concerning to the individuals concerned?*
- Yes
- No
- Do not know
Explain the other ways in which your agency could collect the information and why it would not use them instead*
If you don’t know whether there are other ways the information could be collected from the third party source that would be less concerning to them, then this is something you may need to consider. Bear in mind that, as a matter of good practice, agencies should be minimising concern to people in relation to the collection of their personal information whenever reasonably possible to do so.
If you don’t know whether individuals are likely to be concerned or upset by your agency's collection of their personal information in this manner then this is something you may wish to consider further.
Given your answers above, are you confident that the means by which you will collect the personal information is lawful, fair, and does not intrude unreasonably upon individuals' personal affairs?*
- Yes
- No
You've said you're confident that you'll be collecting people's personal information by lawful and fair means. If so, there won't be any issue under IPP4. You could have a lawyer or privacy professional check this for you but it sounds like that may not be required.
You've said you're not confident that you'll be collecting people's personal information by lawful and fair means. Given that this raises a risk of your breaching the Privacy Act's IPP4, it may be desirable to check this issue with a lawyer or privacy professional before collecting the information by the proposed means.
Explanation of IPP1: Under the Privacy Act's IPP1, an agency can only collect personal information if the information is collected for a lawful purpose connected with a function or activity of the agency, and the collection of the information is necessary for that purpose. You need to consider this question because you've said there is no specific legislative authority that authorises the collection of the new personal information.
IPP1 uses the language of 'necessary for the purpose' rather than 'reasonably necessary'. However, it is generally accepted that an "agency does not need to show that it absolutely must collect the information in order to achieve its purpose". Rather, it needs to show "that it is reasonably necessary to collect it". See the Office of the Privacy Commissioner's website.

Note that when IPP1 applies, if a collecting agency can achieve its purpose without collecting identifying information (personal identifiers such as name and residential address), then it shouldn’t collect identifying information. IPP1(2) states: “If the lawful purpose for which personal information about an individual is collected does not require the collection of an individual’s identifying information, the agency may not require the individual’s identifying information.”
Will your agency's collection of this personal information from a third party be ‘reasonably necessary for a lawful purpose connected with your agency's functions or activities’?*
In answering this question, you need to think about:
- what the purpose is
- whether that purpose is lawful
- whether the purpose is connected to a function or activity of your agency, and
- whether it's reasonably necessary to collect the information for that purpose
- Yes
- No
- Do not know
Explain why you believe that to be the case*
If, as you've stated, it's reasonably necessary to collect the personal information for a lawful purpose connected with a function or activity of your agency, then there will not be any issue under IPP1.
If it is not necessary for your agency to collect the personal information for a lawful purpose connected with its functions or activities then your agency will likely breach the Privacy Act's IPP1 if it proceeds to collect it. That, in turn, may amount to an interference with privacy.
You've indicated you don't know whether your agency's collection of this personal information would be necessary for a lawful purpose connected with its functions or activities. It is important to make an assessment of whether the collection will be necessary for such a purpose because, if not, your agency would likely breach the Privacy Act's IPP1 (Purpose of collection of personal information). That, in turn, may amount to an interference with privacy.
Application of IPP2: You've said your agency will not obtain the information under a specific legislative authority that expressly authorises or requires collection from the third party. That raises the question of whether your agency's collection of the information from a source other than directly from the individuals concerned will be permissible under the Privacy Act's IPP2 (Source of personal information).

Under IPP2, agencies are required to collect personal information from the individuals concerned unless an exception applies. As to those exceptions, an agency may collect information from another source when the agency believes on reasonable grounds that:
- the interests of the individual concerned are not prejudiced
- complying with this principle would prejudice the purposes of collection
- the individual concerned authorises collection of the information from someone else
- the information is publicly available
- it is necessary to avoid prejudice to the maintenance of the law by any public sector agency, or to enforce a law that imposes a pecuniary penalty, or to protect public revenue, or for the conduct of court or tribunal proceedings, or to prevent or lessen a serious threat to the life or health of any individual
- complying with this principle would not be reasonably practicable in the circumstances of the particular case
- the information will not be used in a form that identifies the individual
- the information will be used for statistical or research purposes and will not be published in a form that could reasonably be expected to identify the individual concerned
Do any of these IPP2 exceptions apply to enable your agency to obtain the personal information from the third party?*
- Yes
- No
- Do not know
Select the IPP2 exception(s) that apply*
- the interests of the individual concerned are not prejudiced
- complying with this principle would prejudice the purposes of collection
- the individual concerned authorises collection of the information from someone else
- the information is publicly available
- it is necessary to avoid prejudice to the maintenance of the law by any public sector agency, or to enforce a law that imposes a pecuniary penalty, or to protect public revenue, or for the conduct of court or tribunal proceedings, or to prevent or lessen a serious threat to the life or health of any individual
- complying with this principle would not be reasonably practicable in the circumstances of the particular case
- the information will not be used in a form that identifies the individual
- the information will be used for statistical or research purposes and will not be published in a form that could reasonably be expected to identify the individual concerned
Explain why the exception(s) that you’ve selected apply*
On the basis of the answers you've given, there does not seem to be any issue relating to IPP2. However, this tool cannot assess the textual explanations you've given. If you're in any doubt as to whether your agency can rely on an exception in IPP2, you may wish to check with a lawyer or privacy professional.
Caution is required. If the collection of the personal information from a third party isn’t permissible under IPP2, your agency may breach IPP2 if it were to proceed and that may amount to an interference with privacy.

To proceed with the collection of personal information from a third party, your agency may need to consider putting an Approved Information Sharing Agreement in place or seeking a legislative change.
It is important to determine whether your agency's proposed collection of this personal information from the third party will be permissible under IPP2 because, if not, your agency would likely breach IPP2 and that might amount to an interference with privacy.
Introduction to IPP4 - manner of collection of personal information: Under the Privacy Act's IPP4, an agency that collects personal information needs to collect it by a means:
- that is lawful; and
- that, in the circumstances (particularly in circumstances where personal information is being collected from children or young persons), is fair and does not intrude to an unreasonable extent upon the personal affairs of those individuals.
IPP4 addresses the 'how', or the method, of collection. A collection will be unlawful and breach IPP4 if the means by which it is done is contrary to an Act, regulations or the common law. Examples could include trespassing on someone's property to take photos, recording someone else's phone call, or hacking in to someone's device to obtain information.

A method of collection could be unfair if, for example, people are bullied, threatened or coerced. It might be unreasonably intrusive if, for example, people are followed surreptitiously in their private life or covertly monitored. These are just examples. There could be other unfair or unreasonably intrusive means of collection. Each situation needs to be considered in the light of its circumstances. See further the Office of the Privacy Commissioner's website.
How will your agency collect the personal information from the third party source? Explain relevant context and processes.*
Are individuals likely to be concerned or upset by your agency's collection of their personal information in this manner or would they be upset if they knew?*
- Yes
- No
- Do not know
Explain why individuals would be concerned or upset*
Are there any other ways your agency could collect the information that would be less concerning to the individuals concerned?*
- Yes
- No
- Do not know
Explain the other ways in which your agency could collect the information and why it would not use them instead*
If you don’t know whether there are other ways the information could be collected from the third party source that would be less concerning to them, then this is something you may need to consider. Bear in mind that, as a matter of good practice, agencies should be minimising concern to people in relation to the collection of their personal information whenever reasonably possible to do so.
If you don’t know whether individuals are likely to be concerned or upset by your agency's collection of their personal information in this manner then this is something you may wish to consider further.
Given your answers above, are you confident that the means by which you will collect the personal information is lawful, fair, and does not intrude unreasonably upon individuals' personal affairs?*
- Yes
- No
You've said you're confident that you'll be collecting people's personal information by lawful and fair means. You could have a lawyer or privacy professional check this for you but it sounds like that may not be required.
You've said you're not confident that you'll be collecting people's personal information by lawful and fair means. Given that this raises a risk of your breaching the Privacy Act's IPP4, it may be desirable to check this issue with a lawyer or privacy professional before collecting the information by the proposed means.
Application of IPP11: Because you've said your agency will not be obtaining the new personal information under a specific legislative authority that expressly authorises or requires collection from the third party, another question that arises is whether the third party will be permitted under the Privacy Act's IPP11 (Disclosure of personal information) to disclose the personal information to your agency. This is a separate question to whether your agency is itself permitted by the Privacy Act's IPP2 to 'collect' it from the third party. There can be circumstances where the Privacy Act will permit an agency to collect information from a third party but where the third party may not be or feel permitted to disclose the information to the requesting agency. An example of this where:
- under IPP1 (Purpose of collection of personal information), it is necessary for an agency to collect personal information for a lawful purpose connected with its functions; and
- under IPP2 (Source of personal information) the collecting agency believes on reasonable grounds that not collecting the information directly from the individuals concerned would not prejudice the interests of those individuals; but
- under IPP11 (Disclosure of personal information), no exception permitting the third party to disclose the information to the collecting agency applies.
Under IPP11, an agency must not disclose personal information it holds unless the agency believes on reasonable grounds that one of the listed exceptions applies. Those exceptions are that:
- the disclosure is in connection with, or directly related to, one of the purposes for which it was obtained
- disclosure is to the individual concerned
- disclosure is authorised by the individual concerned
- the agency got the information from a publicly available publication and, in the circumstances, it would not be unfair or unreasonable to disclose the information
- disclosure of the information is necessary to avoid prejudice to the maintenance of the law by a public sector agency, or to enforce a law that imposes a pecuniary penalty, or to protect public revenue, or for the conduct of court or tribunal proceedings
- disclosure is necessary to prevent or lessen a serious threat to public health or safety, or the life or health of any individual
- disclosure is necessary to enable an intelligence and security agency to perform any of its functions
- the information is to be used in a form in which the individual concerned is not identified, or is to be used for statistical or research purposes and will not be published in a form that could reasonably be expected to identify the individual concerned
- disclosure is necessary to facilitate the sale or other disposition of a business as a going concern
Do any of these IPP11 exceptions apply?*
- Yes
- No
- Do not know
Select the IPP11 exception(s) that apply*
- the disclosure is in connection with, or directly related to, one of the purposes for which it was obtained
- disclosure is to the individual concerned
- disclosure is authorised by the individual concerned
- the agency got the information from a publicly available publication and, in the circumstances, it would not be unfair or unreasonable to disclose the information
- disclosure of the information is necessary to avoid prejudice to the maintenance of the law by a public sector agency, or to enforce a law that imposes a pecuniary penalty, or to protect public revenue, or for the conduct of court or tribunal proceedings
- disclosure is necessary to prevent or lessen a serious threat to public health or safety, or the life or health of any individual
- disclosure is necessary to enable an intelligence and security agency to perform any of its functions
- the information is to be used in a form in which the individual concerned is not identified, or is to be used for statistical or research purposes and will not be published in a form that could reasonably be expected to identify the individual concerned
- disclosure is necessary to facilitate the sale or other disposition of a business as a going concern
Explain why you believe that the exception(s) you’ve selected applied to the third party’s disclosure of the personal information to your agency*
IPP11 requires the disclosing party (not your agency) to believe on reasonable grounds that the relevant exception(s) applied. Do you have any evidence that the third party has or will have this belief?
- Yes
- No
- Do not know
Describe the evidence you have that the disclosing party believes or will believe on reasonable grounds that the relevant exception(s) in IPP11 apply*
You've indicated that there's evidence that the third party 'believes on reasonable grounds' that an IPP11 exception applies to allow it to disclose the personal information to your agency and you've described that evidence. If an IPP11 exception does apply, there won't be any issue under IPP11 with the third party disclosing the information to your agency.
If practicable, you should contact the third party to ask it whether it has or will have the required belief on reasonable grounds when disclosing the personal information to your agency. Without knowing this, you cannot determine whether the third party’s disclosure to your agency will be in accordance with IPP11. If that disclosure is not in accordance with IPP11, your proposed use of the information runs the risk of worsening a potential interference with privacy by the disclosing third party.
You should check whether your agency has any evidence of the third party’s reasonable belief on reasonable grounds that an IPP11 exception will apply. If you can’t find any, you should contact the third party to ask it whether it has or will have the required belief on reasonable grounds when disclosing the personal information to your agency. Without knowing this, you cannot determine whether the third party’s disclosure to your agency will be in accordance with IPP11. If that disclosure is not in accordance with IPP11, your proposed use of the information runs the risk of worsening a potential interference with privacy by the disclosing third party.
You’ve indicated that the third party’s disclosure of the personal information to your agency will not be permissible under IPP11 and this is in circumstances where, given your previous answers, there is no other legal authority to justify the third party’s disclosure to your agency. On the information provided so far, this means the third party might breach IPP11 and potentially commit an interference with privacy if it discloses the information to your agency. An approved information sharing agreement or legislative change may be required for what you're proposing.
If you cannot find out whether the third party’s disclosure of the personal information to your agency will be permissible under IPP11, then a risk remains as to whether the third party’s disclosure will breach IPP11 and amount to an interference with privacy. If that disclosure is not in accordance with IPP11, your proposed use of the information runs the risk of worsening a potential interference with privacy by the disclosing third party.
Is or will your agency's collection of the personal information from a third party source be subject to an MOU or agreement with that third party or to a code of practice?*
- Yes, MOU or agreement
- Yes, code of practice
- No
- Do not know
Does the MOU or agreement already exist?*
- Yes
- No
What is the MOU or agreement called?
Provide a link to the MOU or agreement if you can
You've indicated that your collection of personal information from the third party will be subject to an MOU or agreement. It will be important to ensure you comply with the MOU or agreement's requirements.
You will need to work through a range of issues relating to the planning and drafting of the proposed MOU or agreement. If you're looking for an MOU, you can build one with the MOU builder if you wish.
What is the code of practice called?*
Provide a link to the code of practice if you can
You've indicated that your collection of personal information from the third party will be subject to a code of practice. It will be important to ensure you comply with the code of practice's requirements.
If your agency is collecting information from another source in relation to one or a small number of people for a specific, ad hoc reason (e.g., to protect someone from harm), it is unlikely that you'd put an MOU in place to set expectations around the sharing. However, the more systemic or widespread the collection becomes, the more desirable it may be to put an MOU in place to ensure that the collecting and sharing parties' rights and obligations are clearly set out. If you're in this latter situation, you may wish to consider putting an MOU in place. You can use the MOU builder for this purpose if you wish.
You've indicated that you don't know whether the collection of information will be subject to an MOU, agreement or code of practice. The remaining comments assume there won't be a code of practice but you may wish to confirm this.
If your agency is collecting information from another source in relation to one or a small number of people for a specific, ad hoc reason (e.g., to protect someone from harm), it is unlikely that you'd put an MOU in place to set expectations around the sharing. However, the more systemic or widespread the collection becomes, the more desirable it may be to put an MOU in place to ensure that the collecting and sharing parties' rights and obligations are clearly set out. If you're in this latter situation, you may wish to consider putting an MOU in place. You can use the MOU builder for this purpose if you wish.

Save and continue later

Features

Answers

If I use the document download option, is the file a .doc or a .docx file?

The document is a .doc file. The plugin takes the HTML output, enables a download of it as a .doc file that Word can read, which you can then save as a docx file when you open it in Word.

An example of the plugin in action

Collect report - administrative details

Collect assessment: {Give a name to your report:825}

Report details

Introduction

Personal information

Purpose

Collection of personal information directly from individuals

Collection of personal information from another source

About

Quick links

Legal