provide that personal information shall not be: • Collected unless for a lawful purpose connected with a function or activity of the collecting agency129 (reflecting the legality principle). • Collected unless collection of the information is necessary for that lawful purposes130 (reflecting the necessity principle). • Used or disclosed without consent unless certain prescribed grounds are met e.g. to avoid prejudice to maintenance of the law, to prevent of lessen serious harm131 (reflecting the proportionality principle). The limiting principles are more explicitly referenced in Ministerial Policy Statements issued under the Intelligence and Security Act 2017132 by the Ministers Responsible for the GCSB and the NZSIS.133 These will be discussed further below. 129 Privacy Act 1993, Information Privacy Principle 1. 130 Ibid. 131 Ibid, Information Privacy Principles 10 and 11. 132 Intelligence and Security Act 2017, ss 206-208. 133 Ministerial Policy Statements issued to date are publicly available at www.nzic.govt.nz 27