OIA 20383 Response.pdf

44 Bowen Street
Private Bag 6995

Wellington 6141
New Zealand

T 64 4 894 5400

F 64 4 894 6100

www.nzta.govt.nz

19 December 2025

Charlie Drummond
[FYI request #32949 email]
REF: OIA-20383

Dear Charlie

Request made under the Official Information Act 1982

Thank you for your email of 21 November 2025 requesting information about the process for
disclosing information from the Motor Vehicle Register (MVR) to private entities for the purpose of
enforcing parking rules on private land under the Official Information Act 1982 (the Act).

I have responded to each part of your request in turn below.

1. Authorised Access Criteria: Please provide the current criteria, policy, or checklist that
Waka Kotahi uses to determine if a private company is granted "authorised access" to the
Motor Vehicle Register for this purpose.

Applications are assessed against criteria outlined in the legislation, specifical y Section 241 of the
Land Transport Act 1998 and sections 52–58 of the Land Transport (Motor Vehicle Registration and
Licensing) Regulations 2011. As set out in the legislation, we consult with the Privacy Commissioner,
the Chief Ombudsman, and the Commissioner of Police on applications for authorised access. You
can find this information from at the following link:
www.legislation.govt.nz/regulation/public/2011/0079/latest/DLM2938403.html

The fol owing documents are in scope of this part of your request and have been released to you.
•  Attachment 1 - S241 - Application Assessment Sheet Template
•  Attachment 2 - Application processing SOPs
•  Attachment 3 - Summary of The Standard Terms Answers Guidance Document

We are withholding Attachment 4 – Section 241 Access in ful  under section 9(2)(h) of the Act to
maintain legal professional privilege.

Certain information has been withheld within Attachment 2 under the fol owing sections of the Act
9(2)(k) to prevent the disclosure or use of official information for improper gain or improper advantage.

Please note, Attachment 3 is a summary of the ‘Standard Terms Answers Guidance Document’, which
has been withheld under section 9(2)(k) of the Act, to prevent the disclosure or use of official
information for improper gain or improper advantage.

We have however supplied a summary of the document as permitted under section 16(1)(e) of the Act
where the information requested by any person is comprised in a document, that information may be
made available by giving an excerpt or summary of the contents.

This summary has been provided because the information contained in the original document outlines
what is considered during the application process. As such, we believe sharing this document in full
could potentially give private entities an unfair advantage by effectively providing a step-by-step guide
to meeting legislated requirements, which might undermine the public interest.

I trust the information released to you in Attachment 3 provides guidance of what NZ Transport
Agency Waka Kotahi (NZTA) is looking for in a section 241 authorisation application, however each
application is reviewed on a case-by-case basis.

2. List of Authorised Entities: Please provide a current list of al  private companies that are
authorised to access the Motor Vehicle Register for the purpose of private parking
enforcement.

A ful  list of authorised entities is available on our website at the following link:
www.nzta.govt.nz/vehicles/how-the-motor-vehicle-register-affects-you/authorised-access-to-the-
register

Please find a list of authorised entities for the purpose of private parking enforcement released to you
in Attachment 5.

3. Auditing and Compliance: Please provide any documents detailing the process by which
Waka Kotahi audits these authorised companies to ensure they are using the data only for its
intended purpose and are complying with the terms of their authorisation and the Privacy Act.
Please include the number of audits conducted in the last 24 months and a summary of any
non-compliance found.

NZTA has had processes in place to conduct audits since 2023, and any instances of suspected
irregularities are ful y investigated and may be subject to increased audit requirements.

To provide additional context to this part of your request, the Registers Ecosystem Privacy Uplift
(REPU) programme has been established to increase the assurance and strengthen controls around
authorised parties that have access to information from the Motor Vehicle Register, particularly where
it includes personal information.

The current process for accessing this information ensures that applicants have a valid and
appropriate need for this information, as wel  as key privacy management processes. The programme
wil  strengthen this process and put in place lifecycle management and proactive oversight of access
to this data. This wil  include a robust assurance framework and schedule of audit activities for those
with access to this data, including regular independent verification that use of the Registers is for an
appropriate and approved purpose.

In addition, increased monitoring wil  be built into planned technology upgrades which wil  provide
NZTA with real-time information about the use of our Registers, to proactively identify areas for further
investigation. There wil  be compliance and enforcement policies and processes, where confirmed

2

misuse of the Registers wil  result in clear and harsh penalties, including suspension of access. Note
that NZTA already pursues compliance action when misuse is identified, this planned improvement wil
ensure these activities are proactive and consistent across the range of entities who access NZTA
data.

These improvements wil  result in a variety of audit and compliance activities, depending on the risk
profile of the data being accessed and the performance of those entities who have been approved to
utilise it. Consistently poor performance wil  also result in compliance action.

NZTA is reviewing this area of its business systemically, to ensure we have robust, maintainable, and
proactive measures to ensure appropriate and safe use of the personal information we hold. We are
working with the Office of the Privacy Commissioner to ensure this work is compliant and in line with
good practice. We take our role as a steward of this information seriously, which is reflected in the
priority placed on this programme of work.

Because the new compliance approach is stil  being formulated, and the documentation which exists is
in the beginning stages of creation and in draft form, this information has been withheld under section
9(2)(g)(i) of the Act to maintain the effective conduct of public affairs through the free and frank
expression of opinions by or between or to Ministers of the Crown or members of an organisation or
officers and employees of any department or organisation in the course of their duty.

For further context to your request for details about audits, as part of the changes being implemented
under the REPU programme, al  authorised entities must submit an annual report confirming
compliance with their terms and conditions. This process currently involves a compliance declaration
form, compliance actions, and spot checks.

Third-party portal providers are also required, under their terms and conditions, to complete sample
audits. Previous NZTA internal audits have required high volume data requests, which became
inefficient, therefore a revised review has been initiated through REPU which has resulted in remedial
actions and ongoing process improvements.

We are in the process of completing the 2025 audit of all users and are working through the analysis.
This is expected to take several months and therefore we cannot provide audit outcomes at this time.

As outlined above, NZTA is still working on finalising the new compliance framework through the
REPU programme. As such, NZTA is not in a position to release any audit information at this time.

Therefore, this part of your request has been refused under section 18(e) of the Act as the information
does not exist.

4. Complaints Process: Please provide information on the process for a member of the public
to lodge a complaint about a company's use of this authorised access. Please also provide the
number of complaints received in the last 24 months and a summary of their outcomes.

NZTA complaint information has been released to you in Attachment 6.

Please note, the records from November 2023 to November 2024 are limited due to how complaint
information was recorded in our systems. We have provided to you what was readily retrievable.

3

Further, due to the way complaints are recorded in our system, we cannot guarantee complete
accuracy in the number of complaints provided to you.

To provide context, we did attempt to refine this part of your request for complaint information, to be
for complaint information from November 2024 to 21 November 2025. However, you requested that
we provide what we can for the original timeframe of your request (the last 24 months).

5. Revocation of Access: Please state the criteria and process for revoking a company's
authorised access. Please state how many companies have had their access revoked in the
last 5 years.

To provide context, revocation is not a term used in the section 241 process. Instead, relating to
compliance, entities either have their access suspended or cancel ed. A suspension is when we
withhold access to the MVR until we are satisfied that the authorisation wil  be used for the appropriate
purposes or in line with their terms and conditions. Whereas cancel ation then occurs when the issues
raised for suspension have not been resolved within the timeframe given for rectification.

There are also other scenarios which cause the list of authorised parties to fluctuate. These include
changes made by representative bodies (additional, removal and changes in their membership or
need to access information from the MVR), removals of those who are no longer a registered company
or registered as a financial service provider, or where terms and conditions have expired.

As outlined above, through the REPU programme, we have introduced an annual compliance
declaration form. If the form is not completed within a certain time, we suspend the entity. The form
then remains available for a certain period of time for suspended entities to complete to apply for
reinstatement. Reinstatement approval is based on the answers being compliant with the terms and
conditions. If the suspended entity doesn’t complete the form within the reinstatement period, access
is cancelled.

As outlined under part 3 of this request, the documentation which underpins this new process is stil  in
development and in draft form, so it has been withheld under section 9(2)(g)(i) of the Act to maintain
the effective conduct of public affairs through the free and frank expression of opinions by or between
or to Ministers of the Crown or members of an organisation or officers and employees of any
department or organisation in the course of their duty.

In terms of your request for information about how many companies have had their access revoked in
the last 5 years, we do not hold detailed records this, as revocation is not a term which is utilised in
terms of section 241 access to the MVR.

As noted above, we suspend entities to ensure compliance or cancel an entities authorisation where
access is no longer required or requirements for access no longer are met - eg. if a company is no
longer registered.

Noting, these changes have only been implemented in the last two years, so we do not hold records of
when access was cancelled prior to 2024, because this information was not recorded. If a company no
longer required their authorisation or the company was no longer registered, their authorisation would
be cancel ed. However, there was no centralised reporting for these cancel ations.

4

Based on the above, we can only provide the following information regarding entities whose access
was removed because their authorisation was suspended or cancel ed for 2024 and 2025:
•  2024: 72 entities cancel ed.
•  2025: 69 entities suspended.

Noting, the suspension activities in 2025 relate to the annual reporting and the compliance declaration
form process which we have introduced through the REPU programme. There have not been any
cancellations yet, as these entities are stil  within the reinstatement period mentioned above, where we
are awaiting their annual compliance declaration forms.

With respect to the information that has been withheld from this request, I do not consider there are
any other factors which would render it desirable, in the public interest, to make the information
available.

Under section 28 of the Act, you have the right to ask the Ombudsman to review my decision to
withhold and refuse some information from this request. The contact details for the Ombudsman can
be located at www.ombudsman.parliament.nz.

In line with NZTA policy, this response wil  soon be published on our website, with personal
information removed.

If you would like to discuss this reply with NZTA, please contact Ministerial Services, by email to
[NZTA request email].

Yours sincerely

Tracy Moore
Head of Experience, Integration and Support

5