23.3 Data re-use by third party hosts
The New Zealand Web Standards 2.0 were released in March 2009 and replace the previous version, the New Zealand Government Web Standards 1.0 (below). See Meeting the standards for more information.
The Standard
23.3 When contracting with a service provider, the contract must specify that the provider must not independently collect or reuse data gained in the course of providing the service, unless prior approval has been given by the agency.
This does not relieve the contractor of their obligations under the Privacy Act 1993.
Guide to this standard
An external service provider can have access to personal information about a service user; can gain information in the form of server or application logs, tracking, client data, HTTP header information that includes data from cookies, and click-stream data.
Rationale for this standard
The contracting out of services, for example the hosting of a web site, can include a range of issues that are similar to those faced by a government agency when hosting services in-house.
