Starting transparency reporting is not a 5 minute job. It will require some thinking. It is also not for everyone but we think that organisations that meet one or more of the following criteria should be undertaking transparency reporting.
- A medium-sized or large ISP.
- An online service provider (e.g. Trade Me, Xero, Vend).
- Any organisations in the financial sector.
- Any organisation with a large customer base.
- Any organisation that maintains a large amount of personal information (including metadata).
The first step in considering releasing information is to understand why you are being asked for it. That will help you decide whether the reason falls under the exceptions outlined in the Privacy Act.
To make this decision, you should think about whether you believe the disclosure is required, based on the evidence in front of you. It needs to be stronger than a suspicion. Releasing more sensitive information means greater consequences for the individual, so the more reasoned your decision needs to be.
Then you need to make a call about how necessary it is that the agency asking you for the information gets it. Are there other ways they could get the information? Is the information you have relevant to their investigations and scoped appropriately? How urgent is it that they get the information right now, and what harm would be caused if you didn't release it?
When you are dealing with the "serious threat" exceptions, you'll want to think about whether the threat is imminent, likely or severe. The combination of these factors helps you decide how serious it is. Once you have an idea, then you can make a call about whether releasing the information will lessen or prevent that threat.
If you need help with a specific issue, the Office of the Privacy Commissioner can provide advice.
To help organisations with recording and generating transparency reports we have produced a spreadsheet. The spreadsheet has four tabs:
- instructions
- Data entry sheet: where you can record and enter in information
- Full Report using data: this takes the text in our template and populates the data you've entered into it. This tab is A4 width and can be copy & pasted into a .docx or .odt easily.
this FAQ is for your customers. You can either add the content to your existing FAQ or you can add it on to the end of your report's web version.
Can I access your raw data?
Yes. You can download the data we use to make this report here insert a link (csv file) Some of your customers or members of the public may want to access the raw numbers in order to synthesis them with other organisations’ data. Therefore, as a part of this, we recommend you make your data available
What is metadata?
Metadata is data about data. It includes things like timestamps of when a transaction happened or when a communication was sent, parties to a transaction, geo-location or tracking information and so on. Metadata is a really powerful analytical tool for government agencies and people can now be easily identified through metadata. Thats' why we treat metadata the same as we do personal information.
When will my information be released to government agencies?
We release information when we are required to by law, or where, under the Privacy Act we think that we need to release private information in order to protect individuals or the public. This is explained further in our transparency policy link.
What does voluntary disclosure mean?
In some cases we might be asked for your information by another agency without being required to release it by law. This means that the onus is on us to weigh up the reasons for and contents of the request against the Privacy Act. It is a voluntary disclosure because the final decision is ours to make.
Do you need permission to release a customer’s information?
No. We will seek customer permission in many situations (police checks, vetting, professional registrations etc) but when a government agency serves us with a court order, or uses a statutory power to obtain personal information they are doing so for a purpose.
See our terms and conditions of service for more information.
How often will this report be released?
We aim to publish this data annually.
- InternetNZ Website: [https://InternetNZ.nz]
- Office of the Privacy Commissioner
- Berkman Centre and Open Technology Institute's Transparency report toolkit is a great resource that analyses different components of transparency reporting and identifies best practice within US Technology companies. Transparency report toolkit
- TradeMe's Transparency report is a great example of best practice. You don't need to be as good as they are right away, but TradeMe are setting the example for doing transparency reporting well.