Privacy Act Requests
Privacy Act 1993
The Privacy Act was introduced to provide a comprehensive structure for the
management of personal information and for the handling of requests for
personal information including requests to correct information which may be
incorrect. It applies to both public sector and private sector organisations.
The Privacy Act states that POLICE has a duty to ensure that all reasonable
assistance is provided to any person who wishes to make a request for
personal information (i.e. about themselves). It is important that POLICE
staff are aware of, and comply with, the Privacy Act.
Personal information
“Personal information” is information that Police holds about an identifiable
individual. It includes information that is held by Police electronically (for
example on NIA), on paper files, and may even extend to information that is
known to Police staff but not recorded.
No matter where or how information is stored, if the information is about an
identifiable individual, Police must comply with the rules in the Privacy Act
1993 in respect of that information.
Even if information does not name a person the person may still be
identifiable, for example by describing a set of circumstances unique to that
person.
Privacy requests
Any request made to Police by or on behalf of a person for information about
that person, is a Privacy Act request.
Police has a Privacy Request Form which members of the public can use to
request information about themselves. However, requests may also be made
a letter or email, or orally.
The Act does not specify how a request must be made. Police may ask a
requester to make their request in writing, but cannot require them to do so.
If an oral request is made to you, ensure that you record the date that the
request was made, and the information that was requested.
The requester does not have to mention that the request is made under the
Privacy Act 1993, or may even refer to legislation that does not apply or does
not exist. It is your obligation to determine that the Privacy Act 1993 applies.
• Example: Mr Brown requests a copy of all information Police hold
about him on the Police Wanganui Computer.
The Wanganui Computer no longer exists but Police does hold
information about Mr Brown on NIA database. Police are required to
consider all information held on NIA about Mr Brown.
All privacy requests must be logged. If the request is made at District,
provide details of the request to your District Co-ordinator. If the request is
made at PNHQ, send the request to the Privacy Office.
Who can make a privacy request?
The following persons are entitled to make a Privacy Act request:
• A New Zealand citizen (whether in NZ or not)
• A New Zealand permanent resident (whether in NZ or not)
• Any other person who is actually in New Zealand.
The Privacy Act 1993 does not apply to any other requesters. For example, it
will not apply to an Australian citizen who is living in Australia but was once in
New Zealand. If Police receive a request for information from an individual
who is not in New Zealand, ask for further information to confirm whether the
Privacy Act 1993 applies, before responding to the requester and either
providing the information, or advising why the request is refused. Although
the Privacy Act 1993 may not apply to the request, you may take the same
considerations into account when deciding whether to disclose the
information.
If you have any questions regarding a request from an ineligible person,
please contact the Privacy Office.
If the request is made on behalf of the individual the information is about, for
example by a lawyer, an immigration consultant, or a Member of Parliament,
before providing a response you must first be satisfied that the individual has
authorised Police to provide their personal information to the requester. In
most cases, a signed authorisation will be provided with the request. If you
are concerned that the individual concerned has not authorised the disclosure
of the information, you should contact the individual directly to confirm this.
Proof of identity
Section 45 of the Privacy Act 1993 requires that before providing information
to a requester, Police must take reasonable steps to satisfy itself of the
requester’s identity. The Privacy Request Form for requesting information
from Police requires requesters to also provide proof of their identity by
providing a copy of some form of identification. If you receive a written
request that does not enclose a copy of identification, you may ask the
requester to provide proof of their identification prior to processing their
request or disclosing the information to him or her. The requester may
provide a copy by post or fax. Alternatively, he or she may wish to collect
their information from a Police Station and show you a copy of their photo
identification at that time.
Section 45 of the Privacy Act 1993 also requires Police to adopt procedures to
ensure that any response to a request for personal information is received
only by the individual who made it. If the requester is unable to collect the
information from the Station and show proof of identity when collecting it, it is
best to courier the information to the requester’s home address rather than
sending the response by mail.
Duty to provide assistance
Under section 38 Police has a duty to assist anyone who:
• wishes to make a request under the Privacy Act, and
• has not made a request in accordance with the Act, or
• has not made a request to the appropriate agency.
The right of access applies only to information which is “readily retrievable”.
Information is readily retrievable if Police can identify the information sought
and know where it is stored or held.
If the person has not specified which part of Police would be likely to hold the
information, it may make it difficult for you to know whether, for example,
the requester is a former employee seeking his or her personal file, or a
member of the public who has had an interaction with Police and requires the
file which relates to that interaction. Rather than refusing the request, Police
must assist the requester to better define the request.
A requester’s reason for asking for the information, and the use to which you
think it might be put, are irrelevant to the consideration to the request.
If it is difficult to understand what the person is requesting, or you are having
difficulty locating information they are seeking, explain the situation to the
requester, and ask them to provide further information to assist you to
identify the information they are seeking.
Transferring a request to another department or
agency
The decision whether to transfer a request (or part of it) to another agency
must be based on one of the reasons below and within ten working days of
receiving the request.
Section 39 of the Privacy Act provides that requests may be transferred
where the information is either:
• Not held by Police, but is believed to be held by another agency; or
• Believed by the person dealing with the request to be more closely
connected with the functions of another agency.
Police should
always transfer the request when we do not hold the
information requested but believe it may be held by another agency.
However, the fact that Police physically holds the information requested
doesn't make the information Police's to disclose. If the information was
provided to Police by another agency, for example to assist with a Police
investigation, then you should transfer the request back to that agency.
Similarly, if the request is for information that is accessed by Police but
owned by another agency (such as conviction records which are owned by the
Ministry of Justice, or driver licence information which is owned by New
Zealand Transport Agency) the request must to be transferred to the other
agency.
You must advise the original agency that the request has been transferred to
them and provide a copy of the requesters request.
As well as advising the other agency that you are transferring the request to
them, section 39 of the Privacy Act 1993 requires that when you transfer a
request, you must also notify the requester that their request has been
transferred.
• Example 1: Police receives a request from an individual for a copy of a
family violence file. On the file is information provided to Police by the
Family Court relating to an application by one of the parties for a Protection
Order. Police provides a copy of the Family Court information from the file to
the Family Court, along with a copy of the request, and transfers that aspect
of the request to the Family Court to respond to. Police considers the
remainder of the information on the file for disclosure to the requester.
• Example 2: Police receives a request from an individual for all
information provided to Police by Child, Youth and Family about them during
the course of an investigation. Police collates all the information that falls
within the scope of the request, then provides a copy of that information to
Child, Youth and Family, and transfers the request to Child, Youth and Family
to respond to.
• Example 3: Police receives a request from an individual for a copy of
their criminal conviction history. Police has access to the information, but
the information belongs to the Ministry of Justice. Police therefore transfers
the request to the Ministry of Justice to process.
Time frames for responding
The Privacy Act contains requirements about how soon any request has to be
answered.
The statutory obligation is to provide the requested information, if that's
possible, or to communicate your decision on the request “as soon as
reasonably practicable” but within 20 working days. That means getting on
with processing the request.
If you are going to need more time and have to extend the timeframe, the
Act provides 20 working days to notify the requester of the extension of time,
the new timeframe, and his or her right to complain about the extension..
If you receive a request that is transferred from another agency or a Minister
you have a maximum of 20 working days (from when Police receives the
request on transfer) to communicate your decision on the request.
Urgent requests If the requester indicates the request is urgent, you are entitled to ask for
supporting reasons. Those reasons need to be assessed on a case by case
basis in determining and whether the request for urgency is reasonable in the
circumstances. What is reasonable must take account of both the
practicalities for us and the needs of the requester.
If we can’t meet the urgent timetable expected by the requester, we should
explain why. Alternatively consider separating the request into parts if some
parts can be provided earlier. [i.e. explain that the request can be separated
to try and at least provide something within the urgent timetable.]
How to count time
Time limits are expressed in “working days” – any day that is not a Saturday,
a Sunday, a public holiday, or a day between 25 December and 15 January
inclusive. Also note that regional Anniversary Day holidays are not excluded
from “working day”, so they must still be counted.
To count working days available, day 1 is the first working day after the day
on which the request is received.
So, if a request is received on a Monday, the last and 20th working day
available to send out the response is the 4th Monday after that (unless a
public holiday or the Christmas holiday period adds some time to the
deadline).
If a request has been made orally, then later confirmed in writing, you must
count the working days from the date of the oral request, not from the receipt
of the written confirmation.
Notifying an extension
If you are unable to communicate a decision on the request within 20 working
days, Police is able to notify an extension of time, under section 41 of the
Privacy Act. Extensions are permitted where:
• The request is for a large quantity of information or necessitates a
search through a large quantity of information, and meeting the
original time limit would unreasonably interfere with the operations of
Police
• Consultations necessary to make a decision on the request are such
that a proper response to the request cannot reasonably be made
within twenty working days
It is important that the further period of time that Police requests is realistic
and reasonable.
Should Police need to notify an extension, formal notification needs to be
made within the 20 working days limit, and include the following:
• Period of extension
• Reasons for extension
• Advice that the requestor has the right to make a complaint about the
extension to the Office of the Privacy Commissioner.
• Example: An individual with a large number of convictions and a history
of family violence incidents asks Police for a copy of all of the information
Police holds about him. The files are held across three different Districts, and
some of the prosecution files are very large. Police writes to the individual
and notifies an extension of a further 30 working days. The letter explains
that some of the files are located in different Districts, and that as large
quantities of information are involved an extension is required. Advice is
included regarding the right to complain to the Office of the Privacy
Commissioner.
Collating the information
You must always start by assembling all the information that is sought by the
requester (unless you are intending to refuse on the grounds that the
information is “not readily retrievable”).
It is acceptable for an individual to request a copy of "all information about
me".
Often NIA will be a good starting place to determine what information Police
hold and what files exist.
Sometimes the information requested will be all in one place, and easily
located. Sometimes it will be necessary to look further for the requested
information.
• Example 1: Police receives a request from an individual regarding an
investigation into allegations made against them. The information is held all
in one file, which Police then considers for disclosure to the requester.
• Example 2: Police receives a request from an individual for all
information about him or her. A search on NIA suggests that there are files
held in three different districts, as well as complaint files held at PNHQ. The
NIA information and hard copy files must all be considered for disclosure to
the requester.
If having searched thoroughly and made all reasonable enquiries (including
confirmation from the requester of the subject matter of his or her interaction
with Police) the information still cannot be found, the request can be refused
under section 29(2)(b) on the basis that the information does not exist or
cannot be found.
Decision on the Request
The important thing to remember at this stage is that you are assessing
information, not documents. Documents contain information, but each part of
a document may have to be treated differently, and so must be assessed on a
case by case basis.
So, for example, a single document might contain information needing to be
protected for privacy reasons, for maintenance of the law reasons to protect
an informant, or legal advice that must not be released to maintain legal
professional privilege. However, the information in other parts of the
document may not attract those same protections or any other relevant
protections so should be released.
Police should approach all Privacy Act Requests from the presumption that the
individual is entitled to know what information we hold about them unless
there is a good reason to withhold it. In other words, you should not embark
on the assessment from the point of view of looking to withhold.
Decisions about withholding information can only be made with reference to
the reasons listed in sections 27 and 29 of the Act.
Each part or element of the information must be assessed in its own right.
If information is going to be disclosed to an individual, Police must determine
how the information will be disclosed. The Privacy Act states that the
information must be provided in the form it was requested unless to do so
would impair efficient administration, or would prejudice the interests
protected by section 27 or 29.
Withholding grounds
Sections 27 and 29 of the Act set out the reasons for refusing a privacy
request. A request cannot be refused for any other reason.
Individuals must be told if Police are withholding any of the information they
have requested.
The two sections Police commonly rely on to withhold information are section
27(1)(c) and section 29(1)(a) of the Privacy Act.
Section 27(1)(c)
This section permits Police to refuse a request and withhold information if the
disclosure of the information would be likely to prejudice the maintenance of
the law, including the prevention, investigation, and detection of offences,
and the right to a fair trial.
• Example 1: Police is investigating an individual for alleged sexual
offending. While the investigation is continuing, the alleged offender
requests a copy of the information about him on the investigation file. Police
refuses the request as the disclosure of the information would be likely to
prejudice the maintenance of the law and in particular the detection and
investigation of the alleged offences.
• Example 2: Police has charged an individual with assault. Before the
matter is heard by the court, the victim requests information about their
assault. Police refuses the request as the disclosure of the information would
be likely to prejudice the maintenance of the law, and in particular the right
to a fair trial.
• Example 3: Police receive information from an informant, and an alleged
offender is subsequently charged. The alleged offender then requests from
Police the name of the informant and the information the informant provided.
Police refuses the request as the disclosure of the information would be likely
to prejudice the maintenance of the law,
• Example 4: Police receives a request from an individual for all
information held on NIA about them. There are a number of alerts about the
individual, and if the individual was aware of the alerts, he would be likely to
alter their offending or the way in which he interacts with Police. Police
therefore has good reasons to withhold the alerts as the disclosure of the
alerts would be likely to prejudice the maintenance of the law, and in
particular Police's ability to prevent, detect and investigate offences.
• Example 5: An individual requests a copy of a statement or complaint
their neighbour has made about them. If Police disclosed the statement,
the neighbour would be unlikely to provide information or make complaints
to Police in future. Police therefore refuses the request as the disclosure of
the information would be likely to prejudice the maintenance of the law, and
in particular Police's ability to prevent, detect and investigate offences.
• Example 6: An individual who was investigated, but not charged with,
offending requests a copy of the investigation file. Some of the information
on the file details Police investigative techniques, and if the individual
became aware of those techniques he or she may alter his or her offending
techniques in future in order to avoid the offending being detected by Police.
Police therefore withholds the information regarding investigative techniques
as the disclosure of the information would be likely to likely to prejudice the
maintenance of the law, and in particular Police's ability to prevent, detect
and investigate offences.
Section 29(1)(a)
Section 29(1)(a) provides good reasons for withholding information about a
third party from a requester. Section 29(1)(a) states that Police may refuse
to disclose any information if the disclosure of the information would involve
the unwarranted disclosure of the affairs of another individual or of a
deceased individual.
Often Police will hold information that is 'mixed' information, in that it is about
more than one person. If the disclosure of the third party's information would
be unwarranted, Police may withhold that information. You should consider
The nature and sensitivity of the information
The nature of the relationship between the requester and the other person
The likely reaction of the other person to the disclosure
The other person's views about giving access
• Example 1: Police receives a request from an individual for all
information held on NIA about them. The information includes a noting
about information provided by a third party, and includes the third party's
name and contact information. The information about the third party is
withheld from the requester as disclosure of the information would involve
the unwarranted disclosure of the affairs of the other individual.
• Example 2: An individual requests from Police any complaints made
about him or her by a next-door neighbour. Police may refuse the request if
the disclosure of the information would involve the unwarranted disclosure of
the next-door neighbour's affairs.
• Example 3: An individual is involved in a traffic crash which is witnessed
by a third party who calls 111. The individual requests a copy of the 111 call
about him or her. Police provide the requester with a copy of the part of the
call that relates to him or her but withholds the information about the
witness as the disclosure would involve the unwarranted disclosure of the
witness's affairs.
There are also a number of other reasons Police may withhold information for
under the Privacy Act 1993.
Section 29(1)(i) - Contempt of Court
Care must be taken not to release information that is the subject of a
suppression order. The suppression order also applies to the victim of
offending and prevents Police from releasing any information that is the
subject of the suppression order even to the individuals concerned.
The requester should be told to make an application to the relevant Court
asking for the suppression order to be varied to permit the disclosure of
information.
• Example: Police receives a request for information that was evidence in a
proceeding, where the evidence was suppressed. Police refuses the
request on that basis.
Section 29(2)(b) - Information Does not Exist or Cannot be Found
• Example: Police receives a request for a copy of a 111 call about an
incident, but no call was made to Police regarding the incident. Police
refuses the request as the information does not exist.
• Example: Police receives a request for a file that cannot be located. After
reasonable attempts to locate the file, Police refuse the request on the
basis that it cannot be found, and advise the requester what steps were
taken to find it.
27(1)(d) - The release would be likely to endanger the safety of an
individual
• Example: An offender seeks details of a witness who has given
information to Police about the offender's involvement in drug dealing.
Police are aware that the offender has threatened the witness with
violence in the past, and believes that the threat will be carried out if the
information is disclosed. Police has good reasons to refuse the request.
Note: The threshold for this withholding ground is very high. If you are
intending to withhold information pursuant to this section, please contact the
Police Privacy Office. It is necessary to have some information that supports
the threat to the physical safety of the individual.
Section 29(1)(c) - Police is satisfied, after consulting with the
applicant’s medical practitioner, that the disclosure would be likely to
prejudice the requester's physical or mental health
• Example: Police receives a request from an individual who appears to
have severe mental health issues for a copy of all information Police holds
about him or her. Police contacts the individual's GP who advises that the
disclosure of the information would adversely affect the individual's mental
health. Police therefore refuses the request.
Section 29(1)(e): The disclosure of information to a prisoner would
be likely to prejudice the safe custody or the rehabilitation of that
individual
• Example: a high profile prisoner, currently serving a life sentence,
requests all information Police hold about him or her. The Prison
psychologist advises Police that providing the material to the prisoner
would be detrimental to his or her rehabilitation. Police therefore refuses
the request.
Section 29(1)(f) - Legal Professional Privilege
• Example: An individual requests a copy of legal opinion that was
prepared by Legal Services regarding whether their actions amounted to an
offence. The request is refused to protect legal professional privilege.
Contrary to another Enactment
If another piece of legislation requires Police to disclose information, or
prohibits Police from disclosing information, that legislation trumps the
Privacy Act 1993.
• Example: Police receives a request from an offender for a copy a of a
victim impact statement. The Victims' Rights Act 2002 states that no person
may give an offender a victim impact statement to keep, and that no
offender may have access to a victim impact statement relating to the
offender under the Privacy Act 1993. Therefore, the request must be refused
pursuant to the Victims' Rights Act 2002.
Providing a response
Use the template letters as the starting point for your response to a privacy
request.
The letter conveying the decision must
inform the requester of the right to
seek review by the Privacy Commissioner if we are refusing to release
personal information to an individual, extending the time to respond, or giving
access to the information in a form other than that requested.
Peer Review
Before sending a response to a requester, you must ensure that your
response and the information you propose to release has been peer reviewed.
Housekeeping
• Always record the date the request was received by Police as the twenty working
days starts from the day after the request was received by Police not you
personally.
• Make up a file for the request.
• Keep a working copy of the information considered for release.
• Keep a copy of what was provided to the requester including a copy of your
letter, and any other letters sent to the requester.
Office of the Privacy Commissioner
Complaints about the handling of requests under the Privacy Act are handled
by the Office of the Privacy Commissioner.
The contact address is:
Office of the Privacy Commissioner
P O Box 10 094
The Terrace
Wellington 6143
The Privacy team at PNHQ Legal Services manages Police's liaison with the
Office of the Privacy Commissioner.
Document Outline
