Dear New Zealand Transport Agency,

The data you publish here (https://www.nzta.govt.nz/assets/vehicle/...) shows that as at 30th Nov 2023 there are 1,848 organisations with "open" access to Personally Identifiable Information (PII) held in the Motor Vehicle Register (MVR). By "open" I mean without requiring a record review by NZTA staff which I beleive is referred to as a MVR31. This is in addition to organisations or people who use services like CarJam.co.nz that resell information from the MVR.

1. Record keeping
I am aware that in some cases the organisation may be required by the gazette approval to keep their own record of when they access the MVR, or in particular PII from the MVR. However that does not absolve your agencies responibilities under the Privacy Act.
For this question I am only interested in the information that your agency may, or may not, hold and not the organisations who access the MVR.

1a. Do you keep a record each time any one of those organisations request PII from the MVR?
For clarity I will give a scenario. John Doe has a car registered in the MVR, as an approved organisation Acme Corp searches the MVR for that car and retrieve's John's personal info.
Do you record that Acme has accessed John Doe's personal info?

1b. If not, why not keeping in mind your responibilities and accountabilities under the Privacy Act 2020, the Public Records Act 2005 (PRA)?
1c. If so, how long do you keep that record for?
1d. If so, what attributes are there in that record? e.g. date, time, method of access to the MVR, requesting organisation name etc... Note I am only asking what type of data is recorded, not for a copy of the data itself.
1e. If so, can the person who owns that PII make a privact request under the Privacy Act 2020 for a "report" (or similar) that would show them each time their PII was accessed by one of the 1,848 organisations?
e.g. Using the scenario provided, can John request a "report" from you showing each time a organisation accessed his information from the MVR?

2. Private parking enforcement
There are quite a number of parking enforcement organisations, which are not local government, with access pursuant to s 241 of the Land Transport Act 1998. From the better known ones like Care Park NZ Limited and Wilson Parking New Zealand Limited to the lessor such as Colwall Property Investment Limited T/A Atrium Carpark.

2a. When considering a request by one of these parking enforcement organisations to be granted access to PII in the MVR what is the basis that NZTA is looking for to decide to use s 241 of the Land Transport Act 1998 to expose PII in an effort to uphold a claim of Contract law from a private parking enforcement organisation?
To be clear I am asking for what factors your agency takes into consideration when granting access in these specific cases, and what measures it applies when granting the approval.
2b. Has the agency taken legal advice on the use of s 241 of the Land Transport Act 1998 to assist private parking enforcement organisations trying to enforce a contract.

3. Care Park NZ Limited
Gazette ID # 2022-au3717 refers to the link https://www.nzta.govt.nz/assets/vehicle/... for the conditions but that document is no longer available online.

3a. Can you please provide a copy of those conditions that were published on your website and is referenced by the Gazette.

Yours faithfully,

Mike

Dear Official Correspondence,

First off thank you for your clear reply, it has answered all of the questions I raised. Could I please ask one clarification question based on your reply to save requesting it in a separate OIA.

In your response you mention that "users log in via a RealMe account".
Could you advise if the user must use a RealMe Verified account (https://www.realme.govt.nz/how-apply/) or if any RealMe account is accepted?

Yours sincerely,

Mike