S241 Applications
Standard Terms Answers Guidance Document
Gemma Rush
12 April 2022
1.0
Purpose
The purpose of this document is to create consistency across the processing of Standard Terms
applications as part of the 2022 renewal. This document wil provide sample answers and outline to those
processing the applications what type of responses we are seeking from the applicant.
Questions – Page 2
Company Name
We are looking for the legal name of the company. This wil need to be checked against the companies
register
https://companies-register.companiesoffice.govt.nz/. If it’s not clear who the application is for, we
wil need to ask. For example: sometimes car dealers wil apply under their trading name, but they are
registered as a sole trader (i.e. they’re registered with the Motor Vehicle Traders Register under their own
name not a company name). In those instances our authorisation would have to be under the sole trader’s
name as the authorised party should also be registered as a vehicle trader.
Trading As Name
Any other names the company is known by. This is used to add to the authorisation list if the application is
granted, so that the anyone viewing the list can confirm whether they are authorised, based on the name
they are commonly known by in the community.
Company Number
under the Official Information Act 1982
If this is not known or completed on the form it can be searched for in the Companies Register.
Motor Vehicle Trader Number/Financial Service Provider Number
If the applicant is a motor vehicle trader or financial service provider this number should be used to verify
on the motor vehicle traders register
http://www.motortraders.govt.nz/cms/banner_template/MVTRSCHREG
or financial service providers register
https://fsp-register.companiesoffice.govt.nz/ that the company is
Released
currently registered. If this is not known or completed on the form it can be searched for in the appropriate
register. For MVT and FSP applications, the applicant must be registered for their application to be
considered under Standard Terms.
Waka Kotahi NZTA Customer Number
If there is a history with Waka Kotahi this would be a useful detail to know.
Motochek Account Number
This wil indicate whether the applicant is, or has been in the past, a user of Motochek. If the application is
granted, this wil guide us as to the appropriate instructions to give the applicant for next steps, and
whether we need to notify Motochek administration of the approval and new expiry date.
What is the nature of the business?
If this is not clear from the name of the business or the companies register, this should give us
confirmation of what kind of business the applicant operates.
What locations does the business operate from?
If there is more than one address supplied, refer to the companies register for the address to include in the
applicant spreadsheet and on the final decision letter.
How long has the business been operating?
This can alert us to potential questions we would like to ask. For example, if the business has been
1982
operating for many years, but has only now requested an authorisation for the first time, it may prompt us
to seek further information. We could ask questions along the lines of:
How they had previously been operating and why that is no longer appropriate? or
Act
What has changed in their business model that means they now require an authorisation? or
Have they added new products or services that require this?
Company contact name, phone number and email address
If possible, as wel as a specific person, we would like a shared inbox, so that we are able to contact them
easily in future if the individual contact person has moved on.
How many staff or agents are likely to have access to the register?
We are checking for any obvious anomalies, for example if the business is a smal company that operates
Information
one service station, but they say they’l have 20 staff with access, this would be unusual.
What are the roles of those likely to have access?
There is no correct answer for this, but a common-sense approach can be taken. It would be reasonable
to see the company director, management, administration, sales or operational staff roles accessing the
Official
information, but not janitorial or maintenance staff for example.
the
Questions – Page 3
What training wil you give those who are likely to have access on the proper handling of the
information from the register?
under
We are looking for detailed and specific answers here, with supporting evidence. Questions to think about
can be as fol ows:
What does the training consist of?
How does the applicant ensure that this is consistent across all staff who may have access?
Have training materials been supplied?
Is a record keep of when training and refresher training has been completed by staff?
Do staff sign off a statement to confirm they have completed and that they understand the training?
Released
Does the business use any of the training modules on the OPC website (Privacy 101 and ABC modules)?
Do you have current training documentation that includes reference to privacy (if so provide this)?
How wil the training incorporate real world example scenarios to test the employees understanding?
How often wil training/refresher training be undertaken?
If you are not satisfied that the answer provided is thorough enough, use the above questions within your
email to request more information from the applicant.
Waka Kotahi NZ Transport Agency
Standard Terms
Answers Guidance Document.docx - 2
What controls do you have in place to ensure that those who are likely to have access handle the
information properly?
We are looking to understand what measures the applicant has or wil put in place to prevent breaches of
the authorisation. Questions to think about can be as follows:
How wil the information be kept confidential?
Is there any reference to the handling of personal information in the employee code of conduct or other
policy documents?
Is so have they supplied a copy of these documents?
What is the training schedule and what role is responsible for managing this?
Who is responsible for onboarding new staff and removing access once they have left the business or
moved on to a role where access is no longer necessary?
How does the applicant ensure that logins are not shared between staff members?
What is the policy in relation to information retention, when is this destroyed/deleted and how is this done
1982
securely?
What sort of record keeping logs do you have to ensure you have oversight of each enquiry made?
Can you supply evidence of your record keeping processes?
Act
If you are not satisfied that the answer provided is thorough enough, use the above questions within your
email to request more information from the applicant.
What disciplinary measures can you take against those who do not handle the information from
the register properly?
We are looking to see not only what the applicant would do in this scenario, but it also can be used to see
an indication of how seriously they view privacy. Questions to think about can be as follows:
Would you issue a verbal/written warning?
Could this lead to termination of employment?
Information
If the employee has been warned, are they required to complete any sort of re-training before accessing
the register again? (Such as the OPC modules or internal training programmes)
If you are not satisfied that the answer provided is thorough enough, use the above questions within your
email to request more information from the applicant.
Official
Questions – Page 4
the
What is your estimated volume of plate enquiries each year?
If this is a low volume, for example less than 50 per year, we should consider whether it may be
appropriate to direct the applicant to apply on a case-by-case basis via the MR31 application process
under
https://www.nzta.govt.nz/vehicles/how-the-motor-vehicle-register-affects-you/requesting-register-
information/. Do you currently use the register?
This may be a yes if they are currently authorised, or if they currently access vehicle information via
Motochek or another portal.
If yes, what do you currently use the register for?
Released
If they have not held an authorisation previously and indicate this is to obtain personal information this
may require further investigation. Applicants wil sometimes be confused about what information comes
from the Motor Vehicle Register. This wil commonly arise from “al in one” services that col ate information
from other sources into a vehicle report, for example via portals such as Carjam or Motorweb. In this part
we need to focus on the personal information coming from the Motor Vehicle Register.
What do you intend to use the register for?
Waka Kotahi NZ Transport Agency
Standard Terms
Answers Guidance Document.docx - 3
We are looking here for the specific purposes they may need to obtain name and address information, and
for how this information would be used following that. A short answer like “current owner information” does
not tell us why they want it and what they intend to use that information for. For example, a finance
company may seek access to check if a vehicle is stil in the person’s name who obtained a loan from
them. While this is an acceptable answer in part, we need to find out more about what they would do with
that information next, for example, passing the details on to a debt col ection company to locate and
repossess the vehicle.
What are your reasons for not col ecting the information directly from the individual concerned?
We want to know why this won’t work for the reason why they are asking for access. For some applicants,
the answer here wil be that it’s not possible as they do not have direct contact, for example a self-service
petrol station. For other applicants, it may be the information can be obtained but needs to be verified. If
there is an opportunity for the information to be obtained from the individual, then this should be done by
the applicant, if that is not possible, we are seeking an explanation as to why not.
1982
What are your reasons for not col ecting the information from a source other than the register?
There may be no other source that has accurate or up to date information, and this can be an acceptable
Act
answer, but we do want the applicant to think about any other possible methods they could use here.
What are your reasons for not seeking confirmation of the registered person through the Waka
Kotahi free online service?
This refers to the data match available on our website or Motochek at no cost
https://www.nzta.govt.nz/confirm. This does rely on the knowledge of the plate number
and the name or
driver licence number of the registered person by the user. While this service is extremely useful, it must
be entered 100% correctly to return the result, so an applicant may mention that it is not suitable for this
reason.
Information
What are your reasons for not asking for the information through the Official Information Act
1982?
The standard response is that this is a cumbersome and lengthy process. It can take up to 20 working
days for the OIA team to respond, so it is a fair answer for the applicant to say that they need the
Official
information in a more timely manner.
How wil you tel the persons whose information has come from the register about the fact that the
the
register was the source of the information?
For this and the following two questions, we are not asking if the applicant wil do this, we are saying that
they must, and we require the specific details of how they are going to do it. It is not an acceptable answer
for the applicant to say:
They wil not tell people under
They will only tell people if/when they are asked
They wil tell people verbally
The conditions wil state that the user must notify registered persons of this in writing either on their
website of physical signage on their premises. We need confirmation of which of these they wil do, see
the wordbank for a suggestion of how to ask about this.
Questions – Page 5
Released
How wil you tel the persons whose information has come from the register about what you use
the information for?
See above question.
How wil you tel the persons whose information has come from the register about the fact that
they can notify the Registrar that they do not wish to have their names and addresses made
available under an authorisation?
Waka Kotahi NZ Transport Agency
Standard Terms
Answers Guidance Document.docx - 4
See above question.
What physical and computer security systems do you have in place to ensure that information
from the register is kept secure?
We are seeking to understand as much as possible about the computer systems that wil help to protect
personal information. Questions to think about can be as follows:
Is access restricted to a certain physical area (eg computers in a back office, which has a combination
locked door)? Could members of the public access this?
Are al computers or devices password protected?
Is there any encryption or additional protections applied to personal data if it needs to be stored?
Is there firewal and antivirus protection instal ed to prevent the data from being hacked or corrupted?
How does the software securely delete personal data once it has been used to fulfil the purpose for which
it was obtained?
If you are not satisfied that the answer provided is thorough enough, use the above questions within your
1982
email to request more information from the applicant.
Act
What physical and computer security systems do you have in place to ensure that information
from the register is only used for the purpose or purposes specified in the authorisation?
We are seeking to understand as much as possible about how the physical and computer systems may
prevent use of the information for purposes outside of those specified. Questions to think about can be as
follows:
Can any staff access the information on a portable device such as a laptop or mobile phone?
If so, is access to work systems locked after certain hours or when the person logs out for the day?
Do al staff have individual logins?
If you are not satisfied that the answer provided is thorough enough, use the above ques
Information tions within your
email to request more information from the applicant.
Questions – Page 6
Have you ever been found to have breached any of the information privacy principals in the
Official
Privacy Act 2020 or previous privacy legislation?
Ideal y this should be “no”. If we’re told otherwise, we’re going to have to ask the Panel about it before we
send to our advising agencies. This gives an op
the portunity for the applicant to disclose any past issues.
When the advising agencies, in particular the Office of the Privacy Commissioner, review the application,
they can let us know if the applicant has omitted any previous breaches that have been reported to or
investigated by them.
Have you ever been found, in proceedings of any kind, to have breached any confidentiality
under
obligation?
This is similar to the above, it gives the applicant the chance to be honest and upfront with us in the first
instance. Ideally this should be “no”. If we’re told otherwise, we’re going to have to ask the Panel about it
before we send to our advising agencies.
Do you have a credit rating and, if so, what is it?
We do not currently have a method to verify this response, however if this is answered in the negative and
Released
there are other concerns with the application, it could add weight to a decision to decline an application.
How long do you want the authorisation to last (maximum of 5 years)?
Most applicants wil request a 5 year period, to get the most value for money before they need to reapply
and pay another application fee. While we can ask the question, and the applicant can indicate what they
like, it is ultimately Waka Kotahi’s decision about the period that we approve an applicant for.
Waka Kotahi NZ Transport Agency
Standard Terms
Answers Guidance Document.docx - 5
Document Outline
