Version as at 6 December 2023 Privacy Act 2020 (ii) Part 3 s 22 will be used for statistical or research purposes and will not be published in a form that could reasonably be expec‐ ted to identify the individual concerned. Information privacy principle 4 Manner of collection of personal information An agency may collect personal information only— (a) by a lawful means; and (b) by a means that, in the circumstances of the case (particularly in circum‐ stances where personal information is being collected from children or young persons),— (i) is fair; and (ii) does not intrude to an unreasonable extent upon the personal affairs of the individual concerned. Information privacy principle 5 Storage and security of personal information An agency that holds personal information must ensure— (a) that the information is protected, by such security safeguards as are reasonable in the circumstances to take, against— (i) loss; and (ii) access, use, modification, or disclosure that is not authorised by the agency; and (iii) other misuse; and (b) that, if it is necessary for the information to be given to a person in con‐ nection with the provision of a service to the agency, everything reason‐ ably within the power of the agency is done to prevent unauthorised use or unauthorised disclosure of the information. (1) (2) (3) Information privacy principle 6 Access to personal information An individual is entitled to receive from an agency upon request— (a) confirmation of whether the agency holds any personal informa‐ tion about them; and (b) access to their personal information. If an individual concerned is given access to personal information, the individual must be advised that, under IPP 7, the individual may request the correction of that information. This IPP is subject to the provisions of Part 4. 27