Dear New Zealand Police,

Under the OIA, I request the following information

1. Confirmation of whether Police has ever, for any purpose, directly or indirectly purchased, licensed, or otherwise acquired data about people from private data brokers including where that data was described, presented, or claimed to be anonymous, pseudonymous, de-identified, or similar.

For this request, “private data broker” means a commercial entity whose business is to collect, aggregate, analyse, and sell or license data about individuals obtained from multiple sources (e.g., public records, online activity, consumer transactions, mobile apps, sensors, or other datasets), whether or not the data is described as anonymised, pseudonymised, de-identified, or otherwise stripped of direct identifiers.

This may include commercial data aggregators providing bulk datasets on populations or large groups, such as mobility/location data, consumer purchase histories, marketing profiles, identity verification databases, or risk-scoring datasets.

It does not include any lawful, case-specific requests for information from telecommunications companies, banks, or other service providers relating to an already identified person(s) (e.g., warrants, production orders, or equivalent legal processes).

Nor does it include data sharing between government agencies under existing statutory powers or MOUs, publicly available datasets accessed without a commercial agreement, or data collected directly by Police from individuals through its own services or functions.

2. For any such instances, please provide:
• The name of the data broker or supplying entity
• The date or time period of acquisition
• A brief description of the type or category of data obtained
• The claimed level of anonymisation or pseudonymisation
• The purpose for which the data was acquired
• Whether the data was retained, deleted, or shared with any other party (and, if shared, with whom)

3. If Police has a policy, guideline, standard, or internal process relating to the acquisition or use of anonymous or pseudonymous data from private data brokers, please provide a copy.

4. If Police has undertaken any assessment or analysis regarding the privacy, security, or ethical implications of acquiring anonymous or pseudonymous data from private data brokers, please provide a copy of that assessment or analysis.

Yours faithfully,
Dale