How to declassify information

This section provides guidance to organisations on how to declassify government information. The guidance is for any agency needing information on how to meet the requirements for declassifying government information contained in the New Zealand Government Information Security Classification System (Classification System).

Government information is all information, regardless of form or format, from documents through to data.

The Classification System is mandatory for use within a prescribed list of mandated government departments, the NZ Police, and the NZ Defence Force [CAB (00) M42/4G/4]. This is aligned with the Cabinet decision in 2014 agreeing which agencies are mandated to follow the Protective Security Requirements (PSR) [CAB (14) 39/38].

Other government agencies are encouraged to voluntarily adopt the Classification System as a best practice framework for classifying, handling, and protecting government information.

In this guide:

• Section 1 provides general guidance to all agencies on declassification.
• Section 2 provides specific guidance for those agencies considering or delivering a programme to proactively declassify classified historical records.

Section 1 — General Guidance

What is declassification?

Declassification includes reassessing how information is protected and – if appropriate – the release of that information.

For agencies that protectively mark information, declassification results in a change to the classification of a document. For example, an agency may receive a request for information that is classified as RESTRICTED. After assessment and applying any redaction to declassify the document to allow its release, the RESTRICTED marking should be struck through and the new classification either stamped or watermarked in the document.

Some agencies do not routinely apply protective markings to information. They still however make equivalent assessments about whether information that was protected can be released, e.g., following an Official Information Act (OIA) request.

Declassification is based on an assessment of harm

When assessing whether to release information, agencies should consider whether there is any potential harm in release, as this may provide grounds to withhold information.

The OIA defines ‘good reasons’ for withholding information. If such ‘good reasons’ for withholding information exist, agencies are required to balance this against any public interest in disclosure as this may outweigh the need to withhold — see Public interest (ombudsman.parliament.nz)(external link).

When declassifying, you can use the guidance on how to assess harm of its release:

• Assess the harm

The declassification assessment does not always result in information becoming unclassified: this is called reclassification

The declassification process does not necessarily mean information is made public or that it ends up being unclassified. Declassification reconsiders the original reasons for classifying a document and may result in:

• A formerly classified record [or part of it] becoming unclassified
• The original classification being maintained
• A formerly classified record [or part of it] being reduced in classification [reclassification].

The last example typically only applies to agencies who hold more highly classified information. For example, agencies working in the national security sector may create SECRET documents which are unable to be shared with most agencies. Reclassification in this context could allow for some material to be removed in order to create a document that could be classified at a lower level, e.g., RESTRICTED which would allow it to be shared more widely.

Agencies should use the Business Impact Levels to assess the harm of disclosing classified information and select the appropriate classification level. Guidance on classification is available at How to classify information.

The information sharing landscape 

As the picture below shows, information sharing can occur in many ways, all of which may require records to be declassified.

Sharing information under the Official Information Act, Privacy Act, and Public Records Act

Official Information Act (OIA) and Privacy Act requests are common for most agencies. The OIA states that, ‘information shall be made available unless there is good reason for withholding it’. If there is a good reason (as defined in the legislation) to withhold information, then it can be withheld. Otherwise, it should be released.

The purpose of the Public Records Act (PRA) includes ‘the preservation of, and public access to, records of long-term value’. Records that have been transferred to Archives New Zealand or are controlled by an access authority may be ‘open access’ (in which case they are available to the public) or restricted access.

When determining whether information and records should be ‘open’ or ‘restricted’, organisations should always begin with an assumption of openness unless there are good reasons to restrict. The PRA covers a range of reasons why access can be restricted including national security and international relations and preventing the disclosure of highly sensitive personal information. Without such reasons, records should be ‘open access’.

Proactive information sharing 

Under the PRA, restricted access information will usually become available at a determined point in time. Proactive release of information takes place when agencies choose to release information before that date. This usually happens through the following mechanisms.

Proactive release of government information

This includes the release of government information without any request from the public. Government has set expectations that all agencies take a more proactive approach to releasing government information (see: Acting in the spirit of service: official information. Proactive release of official information. State Services Commission (2018)). For example, this has included guidance on publishing completed OIA requests and strengthening the proactive release of cabinet papers (see: Cabinet Paper: strengthening proactive release requirements (September 2018); The next steps in the public release of official information).

Proactive declassification of classified archives (the scope of Section 2 of this guidance)

Under the NZ Classification System Policy, agencies are required to have a policy setting out their approach to the proactive declassification of their classified archives.

This includes a deliberate process to review and prioritise the release of archived material that is of high public interest and suitable for release. For example, this might include information about New Zealand’s involvement in the First World War.

Relatively few agencies hold information that is suitable for proactive declassification.

Operational reclassification of classified information to enable better information sharing 

As described above, reclassification can lower the classification to make it easier to share with other agencies.

Sharing information in these ways requires consideration of how the information is moved, i.e., from a higher classified IT system to a lower classified IT system; and who it will be seen by, i.e., between security clearance holder levels and non-security clearance holders. Facilitating information sharing in this context requires policies and procedures to ensure that information is only shared with individuals who have a need to access the information and are authorised to receive it.

For more information, see the information sharing guidance at How to share information.

Declassification principles

Many organisations have good reasons to keep some information protected but these reasons will not remain valid forever

Nations and agencies have good reasons to keep some information protected. This could include personal information about the public, commercially sensitive information received during a tender or [within a national security context] security information obtained from intelligence partners.

However, information usually becomes less sensitive with the passing of time. In most cases, agencies cannot justify keeping the information classified indefinitely.

For example, information about the location of New Zealand Defence Force members who are deployed in a conflict zone is likely to be highly classified, given that this information could inform an attack against them. However, the same grounds for the classification may not apply after the conflict has ended.

Citizens have a right to government information

The proactive release of information promotes good government, openness and transparency and fosters public trust and confidence in agencies. Public access to government information can be restricted excessively if it is not regularly reassessed.

Policy requirements to declassify under the Classification System

The Classification System was updated in July 2022 and lays out the following policy for information declassification. This document provides guidance on how agencies may meet each of the expectations.

Impact on agencies

What do I need to do?

For most agencies, the main mechanisms through which information is declassified are official information requests and the proactive release of government information such as OIA responses and Cabinet Papers.

Do I need a declassification programme?

Declassification programmes are relevant only to organisations that hold classified historical archives that contain information of public interest.

Most classified historical information will not be suitable for release. For example, it would never be in the public interest to release an individual’s medical records, which may be held for a long time without any expectation of release. Equally, some classified holdings may be of no obvious utility or interest to the public and are therefore unsuitable for public release.

If an agency holds classified historical information whose release would be of public value, it should have policy and procedure describing its approach to declassifying those archives.

Section 2 provides some guidance to those agencies for whom this may be relevant.

Section 2 — Guidance for agencies seeking to implement a declassification programme

Meeting Policy Requirements

This section provides some practical advice for agencies who may wish to establish a declassification programme for its classified archives. It includes some practical tips from New Zealand agencies (and international partners) about how to run a successful declassification programme. A templated declassification policy has also been produced which agencies can adapt to suit their own needs.

Policy statement

Mandated agencies are required to have an organisational policy and procedures for declassification of classified archival information. This need not exist as a standalone policy and declassification requirements may be easier to include within existing information management policies.

Relevant policies should include:

• A high-level commitment to declassification
• Reference to any legislation that needs to be considered
• Any principles or values underpinning the policy
• High level declassification criteria, i.e., about what sort of information the agency believes should be prioritised for declassification
• Requirements for implementation, e.g., on review periods for different types of information
• Performance indicators, e.g., on what activity the agency expects to undertake each year
• Responsibilities for declassification are clearly defined.
• Provision for the policy to be reviewed.

Understanding information holdings and assessing the potential value of proactive declassification

Agencies need to understand what classified information they hold, assess its value, and then decide what information should be considered for declassification.

As noted, much of an agency’s classified holdings will not be suitable for release:

• Either, it is of no obvious utility or interest to the public
• Or, because it is personal information that should not be released (such as court records)

The volume of classified information that could be publicly released will likely far exceed the capacity to assess and declassify it. Agencies prioritise where to focus based on a range of factors, including the level of public interest and the feasibility of declassifying different subjects.

Declassification policy

The New Zealand Security Classification System Policy states, ‘Agency heads must establish an organisational declassification policy and procedures in line with the Classification System’.

This does not mean that agencies must have a separate policy for declassification, only that policy exists that addresses declassification.

Agencies can choose whether to have a stand-alone policy for declassification or to incorporate this content into existing policies, e.g., their Information Management policy.

Some agencies have asked for guidance on how to develop a declassification policy. The Declassification Policy Template [DOCX, 35 KB] is provided primarily as a starting point for agencies considering establishing their own declassification policy and need guidance.

The template is not prescriptive, and agencies should apply their own judgement about whether the content is useful to them or whether declassification requirements are already addressed in other policies.

What topics should be addressed?

Agencies can take several approaches to identify themes suitable for declassification, including:

• Analysing Official Information Act requests to identify themes of most interest
• Engaging with the public, such as through the historical and academic community to determine areas of most interest
• Selecting topics of greatest value or scarcity, e.g., Pacific Island records

Declassification governance

Governance arrangements should be proportionate to the size of the declassification programme.

Effective declassification involves responsibilities at several layers, from deciding what topics should be addressed to approving the release of information. Who fills those roles must be contextualised for each agency.

Establishing a declassification programme

This section provides some practical tips on how agencies might go about delivering a declassification programme. The tips are based on New Zealand experience and that of overseas partners.

Declassification needs people with experience and expertise

Declassification decisions are often complex, nuanced and require significant knowledge of an organisation’s history. While at one level the task is administrative, declassification decisions rely on expert judgement and substantial organisational experience.

Declassification needs a team

Given the level of professional judgement involved, it is unrealistic to expect individuals to draw identical conclusions to each other. Ideally, people should work within a team so that discussions can be discussed collectively and made more consistently.

Advice on where to start

To begin with, historical declassification should be targeted against areas of wider utility or interest to the public. Historical declassification is time-consuming and would be largely a waste of effort if applied to topics of limited interest.

After having identified topics of public interest, agencies will probably still have a much larger volume of information than they have the resources to declassify.

Agencies should therefore include pragmatic considerations about what to declassify. For example, agencies will also find it easier to begin with declassifying older, non-electronic records as relevant artefacts are usually already archived and easier to find.

Corporate services need confidence in the declassification process

Various functions in an agency may have an interest in declassification, including legal, risk management, compliance, audit, and others.

It is recommended that relevant corporate functions are involved in the development of declassification policy and procedures. Their input on individual records should be by exception and policy should give guidance to where this might be required. For example, the advice of the legal team may be required if items in a record relate to a matter that was subject to a legal process, but one would not expect the legal team (or other corporate services) to review every document.

How often should agencies declassify?

While the choice of when to proactively declassify records is up to the agency, it is preferable to release regularly, i.e., a few times during each year. The reason for this is that some agencies report that if records are only rarely declassified, then people tend to forget (and have to relearn) how decisions were made previously.

Where declassification occurs more frequently, organisational memory of the process is usually retained, and subsequent rounds of declassification can become more efficient. This is greatly assisted if the reasons for any key decisions are recorded when files are being declassified.

Who should run a declassification programme?

Declassification programmes could be run from several parts of an organisation. However, the process most naturally fits within the responsibilities of a knowledge or information management team.

Do I need to involve other agencies?

Agency experience to date has been that topics for declassification tend to be either specific to agencies or of different importance to different agencies. For these reasons, joint-agency declassification programmes (while compelling in theory) are unlikely to be feasible.

However, agencies should engage with other agencies if a proposed topic for declassification is likely to have a high impact on them, e.g., result in a large number of OIA requests for another agency, or if they have other reasons for the information to remain classified.

How do I report on the value of the declassification programme?

Mandated agencies will provide some information about their declassification programmes through the PSR self-assessment and reporting process. However, this information is not publicly available. It is recommended that the easiest way to report publicly against declassification activities is to include a short description in the agency’s Annual Report.