Dear Government Communications Security Bureau,

I would like to request copies of every available iteration of the GCSB Policy on Personal Information that is statutorily mandated by s 25A of the GCSB Act 2003.

In addition, I have two further queries which relate specifically to the procedures and safeguards around the GCSB's information sharing with foreign agencies.

Firstly, to the greatest degree of specificity you can provide, in what ways are fundamental concepts such as necessity, proportionality and reasonableness taken into account before any information is shared?

Secondly, what is the nature of the privacy safeguards that apply to such information once it is shared overseas? Are there limits on further sharing of that information?

Yours faithfully,

J. Whyte

Dear GCSB,

Thank you for the informative, if partial, response to my earlier request.

In your response (dated 14 December 2015) to my OIA request you advised that the GSCB policy on personal information would be publicly available on the GCSB website "before the end of February 2016".

It was on this basis that my second query was declined under section 18(d).

It has now been almost 3 months since the end of February and there is still no published policy on personal information available on the GCSB website.

I am again requesting the prompt publication of the personal information policy as well as requesting an explanation for the delay in its publication contrary to your own advice.

Yours sincerely,

J. Whyte

Dear GCSB,

The following information is requested under the Official Information Act 1982.

(1.) Is it the official position of the GCSB that the Bureau has adequately fulfilled its statutory duty under s 25A(1) of the GCSB Act 2003 to "as soon as is reasonably practicable after the commencement of this section" formulate a policy relating to personal information:

(a) Given that s 25A(1) commenced over 3 years ago (September 26 2013) and no such policy has yet been published, and;

(b) having precise regard to the objective standard of 'reasonable practicability' established under s 25A(1).

(2.) What is your justification for the ongoing postponement of the publication of the statutorily mandated policy?

(3.) What specific interim measures, if any, are in place to ensure that the principles enacted under s 25B of the GCSB Act are nonetheless adhered to within the GCSB in the absence of the aforementioned policy.

Yours faithfully,

J. Whyte