Dear New Zealand Police,

Please provide

a) The current assessments including impact assessments relating to OnDuty app.

Additionally please provide;

b) Access control assessment that has been done to protect it from unauthorized use.

Third please provide

c) The list / spreadsheet of all the parties that are linked to the system e.g. data exchange and their relevant statutory enabled privacy commissioner vetting.

Yours faithfully,

Miss M Quicken

Dear Ministerial Services,

Re: https://fyi.org.nz/request/33843-onduty-...

Time is running out on this - I should have been provided an answer by March 24 2026.

Could we please have an update? Thanks

Yours sincerely,

Miss M Quicken

Dear Ministerial Services,

Re: OnDuty Bill of Rights & Human Rights Assessment
fyi: https://fyi.org.nz/request/33843-onduty-...

This OIA was raised on 24 February 2026 and this is very late to start asking questions now after two months.

These are very standard documents that are generally labeled in government systems as such and I am surprised that I need to clarify what I am asking.

Just to provide some clarity one each point - see inline:

• What specific assessments or impact assessments you are seeking in relation to the OnDuty app (for example, whether these relate to human rights, privacy, operational, security, or other matters)

Priority is with human rights & privacy. There are multiple aspects and these should have been released proactively when the police adopted the posture with onDuty app.

Impact Assessments other than human rights & privacy typically have scope & sections relating to human rights & privacy on their impact so generally these should be included as part of the request.

• What you mean by an “access control assessment” (for example, whether you are seeking a formal assessment document, a summary of controls, or another type of information)

This is a standard document trail that gets done as part of the reviews when any new technology is introduced that has an impact to safety & privacy of general public.

Access control is meant to mitigate and / or limit the mis-use of the system outside it's intended scope.

There is significant history internationally where staff members of police have mis-used information collected and even sold the information to bad actors.

Yes, the ones you have listed are typically included as are documents that ensure the implementation ensures mis-use is minimized if not eliminated.

• What level of detail you are seeking in relation to third parties linked to the system, and what do you mean by “statutory enabled Privacy Commissioner vetting”.

https://www.privacy.org.nz/about-us/info...

When and if you receive or send data from / to another agency there is a specific statutory requirement to do this vetting.

https://www.legislation.govt.nz/act/publ...

I am asking the evidence that you both listed where the information is sent and from which other sources you used which are liable to this statutory requirement.

And that you followed the process with the privacy commissioner as is required given the sensitivity of the data.

Yours sincerely,

Miss M Quicken

Dear Ministerial Services,

Also just to clarify one more point

* What level of detail you are seeking in relation to third parties linked to the system

I would like to have
- The organisation name
- Start & end dates and;
- What classification / type of information is either matched, received or shared
- Is information matching used and what identifiers are used to match?
- Is the data being sent to the organization ?
- Is the data being received by the organization ?

Yours sincerely,

Miss M Quicken