In this episode, privacy experts Richard Wells and Suzy McMillan discuss the implications of a recent Human Rights Review Tribunal decision highlighting the privacy risks of informal industry information sharing and consider practical steps businesses can take to support responsible information sharing practices.
[01:51] Richard and Suzy consider the decision in Sheehan v Wilson [2026] NZHRRT 10 and why it has attracted attention beyond the tenancy sector, highlighting how informal information sharing networks used across many industries may be subject to the Privacy Act 2020 and its compliance obligations.
[05:53] Suzy explains why legitimate commercial concerns, such as preventing fraud, managing health and safety risks or protecting staff and property, do not automatically justify sharing personal information. She explains that once information relates to an identifiable individual, the obligations of the Privacy Act apply regardless of the motivation behind the disclosure.
[07:25] Richard and Suzy talk through the key Information Privacy Principles (IPPs) most relevant to industry information sharing, including IPPs 3, 3A, 10 and 11, explaining how their various requirements can create compliance challenges where information is shared beyond its original or disclosed purpose.
[13:00] They consider some steps organisations can take to support responsible information sharing, including updating privacy notices and clearly documenting the purpose and nature of information sharing arrangements, ensuring individuals can access and correct their personal information and implementing appropriate governance, staff training and privacy-by-design controls.
[16:06] Richard highlights the risks associated with ad-hoc information sharing practices, particularly where inaccurate information is shared, creating further potential for privacy, reputational and legal risks.
[17:58] Suzy concludes by emphasising that information sharing between businesses is not necessarily inherently unlawful, but requires a rigorous, structured and transparent approach. She explains that clear communication about how personal information may be used and shared is central to supporting compliance with the Privacy Act 2020.
Information in this episode is accurate as at the date of recording, 10 November 2026.
Please contact Richard Wells, Suzy McMillan or our Privacy team if you need legal advice and guidance on any of the topics discussed in the episode.
And don’t forget to rate, review or follow MinterEllisonRuddWatts wherever you get your podcasts. You can also email us directly at [email protected] and sign up to receive technology updates via your inbox here.
Additional resources
