Everything You Learn About a Candidate From Someone Else

It usually starts with a phone call. A hiring manager rings the second name on the referee list late on a Thursday, notebook open, and asks the question everyone asks: would you employ her again? There is a pause on the line before the answer. The pause goes into the notebook, and the notebook goes into the decision. Maybe. And that “maybe” is the issue.

Since 1 May 2026, that note carries an obligation. So does the recruiter’s shortlist comment, the screening provider’s report, the search someone ran on the candidate’s name, and the ranking an AI tool produced from a stack of CVs. Each of them is personal information the employer has collected, in the words of the Privacy Act 2020, “other than from the individual concerned”. Information privacy principle 3A now asks the employer to make sure the candidate knows. This places a positive responsibility on that employer.

The question we hear most is whether information gathered without that notice can still be used. It can. The better question is what using it costs — the true costs — and the answer for that comes in two parts: a weaker process, and a second front.

What IPP 3A asks

When an agency collects personal information about someone from another source, it must take reasonable steps to make sure that person is aware of six things: that the information has been collected; why; who will receive it; the name and address of the agency that collected it and of the agency holding it; any law that authorises the collection, and their rights to access and correct it. These steps are due as soon as reasonably practicable after the collection, unless they were taken sooner. The principle applies only to information collected on or after 1 May 2026 (s 25A).

The Office of the Privacy Commissioner’s final guidance is plain about detail. A purpose has to be specific enough that the person understands what their information is being used for: “It is not enough to say, ‘for business purposes.’” Recipients the employer routinely shares with should be named. The guidance allows a category only where naming them is impractical, and expects even that to be specific.

Two points from the guidance stand out. The obligation sits with the agency that collects the information indirectly, which in recruitment is usually the employer. And the exceptions release the employer from notifying, not from the rules on collecting. Before any of this, IPP 2 still has to be satisfied: personal information should come from the person themselves unless an exception applies, such as the person authorising collection from someone else.

Five side doors into the hiring file

Referees

A referee’s view of a candidate is the candidate’s personal information. The OPC’s own example makes the point with a car: when an insurer asks a garage whether its customer caused the damage, the garage’s opinion is information about the customer. Swap the garage for a former manager and nothing changes.

The OPC’s recruitment guidance says that employers may contact only the referees a candidate nominates, and need express consent to approach anyone else. Nominating a referee, though, is not the same as being told the six things IPP 3A requires. The cleanest answer is the application form. A short notice there: who you will contact, why, who will see what they say, and how the candidate can ask for it. This lets the employer rely on the exception for people who have already been made aware. The guidance expects that reliance to rest on evidence rather than assumption, and a signed application form is evidence.

Recruiters

Where a recruitment agency holds candidate information for the employer and does not use it for its own purposes, s 11 of the Act treats the information as held by the employer. The IPP 3A obligation comes with it. Where the agency also keeps candidates in its own database, it is a collector in its own right, and there are two sets of obligations running side by side.

The guidance accepts that one agency in a chain can notify on behalf of another, but only where there is evidence that it has, and it suggests building that into the contract. The responsibility does not move with the paperwork. It stays with the agency that collected indirectly. The OPC’s recruitment guidance puts the same point bluntly: an employer is responsible for its agency’s handling of candidate information.

Screening providers

Criminal record, qualification, and credit checks have always needed the candidate’s prior consent, and the OPC says credit checks should be reserved for roles that carry significant financial risk. The consent form is the natural home for the IPP 3A matters: the provider’s name, what is being checked, why, and who will see the result.

Consent to a check and notice of a collection are different things. The guidance uses a credit-checking example to make it: even where the client authorised the check, they still needed to be told who collected their information and why.

Social media and search

This is where the publicly available exception does real work. The guidance says it may apply to information taken from a website or a public social media page, and will not apply where viewing the page needs extra permission, such as being a friend or follower of a private account. The recruitment guidance adds three things that are simply off-limits: asking for login details, asking a candidate to befriend you, and asking someone already connected to look on your behalf.

The exception lifts the duty to notify. It does not lift the duty in IPP 8 to take reasonable steps to check that information is accurate before using it. A search result about the wrong person with the same name is still the wrong person.

AI tools

This is the hard case, and the honest position is that the law has not been tested on it. The OPC’s IPP 3A guidance does not say whether information an AI tool generates about a candidate counts as a collection. Its general guidance on AI, from September 2023, says the privacy principles apply at every stage of using an AI tool, including receiving its response, but it does not classify an inference as collected information.

The Act defines “collect” as taking any step to seek or obtain personal information, and excludes information received unsolicited. On that wording, our reading separates two situations. A screening product that reaches beyond what the candidate gave you — searching the web, pulling social profiles, or drawing on a vendor’s own data — and returns a profile or a score has obtained information from somewhere other than the candidate. We would treat that as an indirect collection, with the vendor named in the notice. A tool that draws an inference only from the CV the candidate supplied looks more like the employer creating information than collecting it, and IPP 3A is probably not the principle doing the work. Accuracy (IPP 8) and the candidate’s right of access (IPP 6) apply either way.

Until the OPC says otherwise, the cautious course is to name every tool that touches candidate information in the recruitment notice. It costs a sentence, and it answers a question before anyone asks it.

Can you still use it?

Yes. Nothing in IPP 3A says that information collected without notice is void, and with one narrow exception for public sector access requests, the privacy principles do not create rights enforceable in a court (s 31). In the Employment Relations Authority, s 160(2) of the Employment Relations Act 2000 allows the Authority to take into account “such evidence and information as in equity and good conscience it thinks fit, whether strictly legal evidence or not”. Information gathered in breach of a notification duty is not, for that reason alone, inadmissible.

That is where the comfort ends.

The first cost: a weaker process

Recruitment sits partly outside the Employment Relations Act, but less of it than employers tend to assume. A candidate who has been offered work and accepted it is a “person intending to work”, and so an employee under s 6. An internal applicant is already an employee. And recruitment information has a long tail: the reference that seemed harmless in March can surface in a disciplinary meeting in October.

Whenever an employer acts on third-party information against someone the Act protects — withdrawing an accepted offer, declining an internal move, relying on it in a disciplinary process — the familiar questions apply. Section 103A(3) asks whether the employer raised its concerns, gave a reasonable opportunity to respond, and genuinely considered the explanation. Section 4(1A)(c) requires access to relevant information, and a chance to comment, before a decision likely to affect the continuation of someone’s employment. The Employment Relations Act allows some confidential information about other people to be withheld, but only on the grounds it states (s 4(1B)).

Information the person was never told you had is information they never had the chance to answer. The missing notice is not itself the unfairness. It is how the unfairness happens, and it is evidence of how the process was run. Since February 2026, a procedural defect makes a dismissal unjustified only where it caused actual unfairness (s 103A(5)). A missed privacy notice, on its own, will rarely meet that test. An adverse account from a third party that the employee never saw and never answered comes much closer to it.

One exception will matter more once the candidate is an employee. Notice can be withheld where telling the person would prejudice the purpose of the collection — the OPC’s example is an internal fraud investigation, where a warning might let someone destroy evidence or lean on a witness. The guidance adds two conditions: the collection must still be justified under IPP 2, and an agency relying on the exception should take great care and seek professional advice first. That exception delays the privacy notice. It does not remove the employee’s right, under the Employment Relations Act, to see and answer what is used against them.

The second cost: a separate complaint

A privacy complaint runs on its own track. A candidate can complain to the Privacy Commissioner whether or not they have any employment claim at all. The breach alone is not the whole of it: an interference with privacy needs the breach plus some harm, such as loss, an adverse effect on the person’s interests, or significant humiliation (s 69). A rejected candidate who learns that an undisclosed reference sank their application will usually be able to say something about harm.

The information also tends to surface whether or not the employer volunteers it. Under IPP 6, a person can ask any agency for the personal information it holds about them. The Commissioner’s first case note of 2026 is not a recruitment case, but its finding is the one that matters here. In Case Note 329928 [2026] NZ Priv CMR 1, an employer was found to hold personal and privileged emails sent from a staff member’s work account, simply because they sat on its system and it could retrieve them. The reference notes in the manager’s folder, the recruiter’s file you were sent, and the AI tool’s output saved to your HR system are held by you in the same way. Withholding grounds exist, including for evaluative material supplied in confidence, which is why the OPC suggests checking with referees whether their comments are given on that basis. The notice you did not give tends to arrive anyway — later, and framed by someone else.

What a sound process looks like

None of this needs a new system. It needs a short notice, given early, and a habit of putting things to people before acting on them. In practice, that means:

• one recruitment privacy notice in the application pack, naming each source you will use — referees, any recruiter, any screening provider, public searches, and any AI tool — with the purpose of each, who will see the results, and how to ask for them;
• contracts with recruiters and screening providers that say who notifies candidates, and how that will be evidenced;
• a brief record whenever you rely on an exception instead of notifying, and why; and
• before acting on adverse information from someone else, putting its substance to the person concerned.

Where to start

The AI line is usually where the notice stalls, because few employers can say with confidence which tools touch candidate information. If you cannot list them, you cannot describe them. Our free Workplace AI Register is built for exactly that first step — a fillable spreadsheet that shows what is in use and where the gaps sit.

Once the list exists, the AI Governance Foundation is where the policy layer gets written: the AI use policy that recruitment notices, supplier terms, and human checkpoints hang from. Baseline is $750; the Policy Framework tier is $1,500, flat, regardless of headcount.

The reference call will still happen, and it should. Referees, recruiters, and careful checks are part of hiring well. What changed on 1 May is that the candidate is entitled to know the call was made. Told, the pause on the line becomes something they can answer. Kept quiet, it becomes something you will one day have to explain.

Lex Praxis advises New Zealand employers on employment law and AI governance. This article is general commentary and does not constitute legal advice. For advice specific to your circumstances, contact us directly.