connection with one purpose may use the information for any other purpose (a secondary purpose) if the agency believes on reasonable grounds that the use of the information for the secondary purpose is necessary to enable the agency to perform any of its functions.161 Act 1993. The Act gives the Privacy Commissioner power to prohibit a transfer of personal information from New Zealand to another State by issuing a transfer prohibition notice.167 Such a notice may be issued if the Commissioner is not satisfied that: However, any use of information by those agencies would have to be consistent with the policy principles set down in Ministerial Policy Statements by the Ministers responsible for the GCSB and the NZSIS and accordingly meet legality, necessity and proportionality requirements, minimise impact on third parties and facilitate effective oversight by the oversight entities.162 • Information has been received in New Zealand from another State and it is likely to be transferred to a third State which does not provide comparable safeguards to the Privacy Act; and 4.4 International Intelligence Sharing and Data Transfers The OECD Guidelines provide member countries with a framework for managing the flow of data across their borders. The Guidelines require member countries to: • Take steps to ensure that trans-border flows of personal data are uninterrupted and secure.163 • Restrict the sharing of personal data with other member countries that do not substantially observe the OECD Guidelines or that do not have in place equivalent privacy protections in domestic legislation.164 • Ensure that procedures for trans-border flows of personal data, including those that protect of privacy and individual liberties, are simple and compatible with those of other member countries.165 • Establish procedures to facilitate information exchange and mutual assistance in procedural and investigative matters.166 The OECD Guidelines are reflected in the Privacy 161 Privacy Act 1993, Principle 10(2). 162 Section 206 of the Intelligence and Security Act 2017. See, for example, the MPS on Collecting Information Lawfully paragraphs 18-31, https://www.nzic.govt.nz/assets/MPSs/Ministerial-Policy-Statement-Collecting-information-lawfully.pdf 163 OECD Guidelines, Article 16. 164 Ibid. art. 17. 165 Ibid. art. 20. 166 Ibid. art. 21. • Transfer would be likely to lead to a contravention of the basic principles of national application set out in part two of the OECD Guidelines.168 When considering whether to issue a Notice, the Privacy Commissioner must have regard to whether the proposed transfer of personal information affects, or would be likely to affect any individual, the desirability of facilitating the free flow of information between New Zealand and other States, and any existing or developing international guidelines relevant to trans-border data flows.169 As noted above, the new Privacy Bill strengthens the requirements relating to the disclosure of information to an overseas person. Among the new requirements under privacy principle 11 are that the disclosing agency must not disclose the personal information unless the agency believes on reasonable grounds that the overseas person is required to protect the information in a way that, overall, provides comparable safeguards to those in the Act.170 In December 2012, the European Council issued a formal decision recognising that New Zealand law provides an adequate level of data protection for the purposes of EU law.171 This decision means that personal data can flow from the EU member states to New Zealand for processing 167 Privacy Act 1993, s 114B. 168 Ibid. 169 Ibid s 114B(2). 170 Privacy Bill, Clause 19, http://www.legislation.govt.nz/bill/government/2018/0034/latest/whole.html#LMS23342 171 See Commission Implementing Decision of 19 December 2012 http://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1415703506367&uri=CELEX:32013D0065 32