Office of the Privacy Commissioner
PO Box 10094, Wellington 6140
privacy.org.nz
7 April 2026
Spencer Jones
By email only to:
[FYI request #33981 email]
Tēnā koe
Official Information Act Request (Our Ref: OIA/0521)
We refer to your Official Information Act request received on 9 March 2026. You requested
information from 1 January 2020 to the present concerning smart meter data, advanced
metering infrastructure (AMI), electricity-sector privacy issues, and related regulatory
oversight.
Your request was for the following information:
1. Any internal briefings, legal analyses, position papers, guidance drafts, or
correspondence concerning whether smart meter data may constitute personal
information under the Privacy Act 2020.
2. Any records concerning collection, storage, retention, sharing, secondary use,
disclosure, profiling, consent, or downstream analytics involving smart meter or AMI
data.
3. Any interagency correspondence with MBIE, the Electricity Authority, Ministry of
Health, Health NZ, ESR, or electricity retailers/distributors concerning privacy risks or
safeguards associated with smart meter data.
4. Any complaint trend summaries, issue notes, enquiry logs, investigation records (in
aggregated or anonymised form if necessary), or guidance development work
relating to electricity retailers, metering providers, or smart meter data practices.
5. Any documents considering whether current privacy law and the Information Privacy
Principles provide adequate safeguards for granular electricity-consumption data,
inferred behavioural data, occupancy patterns, or related household analytics.
6. Any draft or final guidance documents prepared for the electricity sector on privacy
compliance, consent, data minimisation, retention, access, correction, or disclosure
in relation to metering data.
Response to your request – information
Some information is publicly available as follows:
OIA/0521/A1167881
link to page 2 link to page 2
2
Privacy Commissioner’s guidance and case note
For question 1, see OPC’s short guidance on smart meters and privacy issues with the link
to a 2015 case note.
1 Privacy Commissioner’s submission to the Electricity Authority’s consultation on retail market
monitoring
For question 3 see the Privacy Commissioner’s 2024 submission to the Electricity Authority
responding to its consultation on improving retail market monitoring.
2 In that submission
(paras 12-14), we discussed information from smart meters as needing to be treated as
personal information in the context of proposed data collection by the Authority:
12. The level of privacy risk depends on how much information is involved, how sensitive it is,
and how easily it can be linked to identifiable individuals. The retail electricity market involves
everyone in New Zealand, and the information includes sensitive details such as debts and
medical dependency status, so the key question for privacy risk is how easily this information
can be linked to identifiable individuals. Our understanding of the proposed notice is that the
key fields which could link information to individuals are:
• the ICP number associated with a home or business, and
• the customer identifier (for example a retailer’s customer number).
13. It is very easy to link these identifiers with other personal information. As well as electricity
retailers having internal records linking these details with personal information such as bil ing
details and history, the Electricity Authority offers a public website to look up street addresses
by ICP number and vice versa, and it might be possible to do this in an automated way.
14. We agree that information collected under the proposed notice needs to be treated as
personal information to manage privacy risks. Given current and growing access to
automation tools, it is likely possible to link ICP level information to individuals in ways that
harm privacy interests at scale, for example third parties could potentially gather ICP level
information to build credit profiles on people based on this information.
Privacy Commissioner’s media response
For question 6, in 2022, we responded to a media request about smart meter data and our
response is
attached.
Summary information - Privacy complaints and breach notifications (question 4)
OPC has received around 36 privacy breach notifications relating to energy companies.
In relation to information about our investigations and enquiry logs, please see the summary
table below.
1
https://www.privacy.org.nz/resources-and-learning/knowledge-base/view/169/
2 https://www.privacy.org.nz/assets/DOCUMENTS/Submissions/2024-02-29-PC-Submission-
Electricity-Authority-retail-market-monitoring-A972678.pdf
OIA/0521/A1167881
3
Summary table of enquiries, concerns and complaints about electricity retailers
OPC ref. 136676
2020-01-09 Online electricity retailer asking for
advice about retention of information
about former customers.
OPC ref. 141311
2020-01-19 Retailer asking for privacy advice
about promotional and marketing
activities
OPC ref. 31150
2020-05-06 Disclosure of address to ex-partner
where a protection order in place.
OPC ref. 139188
2020-08-09 Concerns about power companies’
representatives having access to
customer data and electricity provider
and asking if personal data can be
deleted.
OPC ref. 140410
2020-11-12 Smart metering company wanting
privacy advice – general privacy
advice provided about IPPs.
OPC ref. 141686
2021-02-19 Concerns about new home having
smart meter and surveil ance
OPC ref. 31693
2021-03-02 Investigation of principle 6 access
complaint.
OPC ref. 31671
2021-03-24 Concern about pricing enquiries
leading to credit enquiries.
In this case the company agreed to
remove the credit enquiry from
customer’s credit report.
OPC ref. 142332
2021-03-26 Concerns about electricity retailer
standard terms and conditions.
Resolved by activating opt out from
marketing.
OPC ref. 142529
2021-04-12 Complaint about incorrect
outstanding debt on account affecting
credit score.
OPC ref. 147026
2022-05-03 Concerns about principle 6 access
requests for audio recordings, with
electricity provider agreeing to
provide notes and calls.
OPC ref. 32325
2022-07-19 Principle 6 access request to
electricity co after it rang her mother’s
home asking if she wanted to set up a
OIA/0521/A1167881
4
power account – information released
to requester following investigation.
OPC ref. 148455
2022-09-05 Enquiry about collection of personal
information to open an account with
utility provider and credit check.
OPC ref. 149320
2022-11-17 Concerns about fraudulent account
activity, request to remove credit
check affecting credit rating.
OPC ref. 32769
2023-09-04 Complaint about fraudulent activity on
electricity account and access
requests for account information
raising concerns under privacy
principles 6-8. Complaint settled
between the parties.
OPC ref. 153668
2024-02-22 Incorrect meter configuration –
access and correction concerns.
Also raised with Utilities Disputes and
Electricity Authority.
OPC ref. 157216
2025-01-05 Complaint from customer about delay
in responding to his requests for call
recordings in connection with
payment dispute.
OPC ref. 33411
2025-06-04 Complaint about electricity retailer
linking a new business account in
error with the customer’s former and
closed account linked to a former
work address, with adverse
consequences.
OPC ref. 160463
2025-09-15 Privacy concerns as a result of
notification of a privacy breach by
unauthorised third party. Provided
guidance on how to raise concerns.
OPC ref. 160749
2025-10-15 CCTV camera query and whether the
biometrics code applies
OPC ref. 162506
2025-12-19 Request for privacy advice relating to
Solar Streets.
Response to your request - decision
Your request is granted to the extent set out above.
Apart from published outcomes, the Privacy Commissioner is subject to an obligation of
secrecy under section 206 of the Privacy Act and is not able to comment specifically on
OIA/0521/A1167881
link to page 5 link to page 5 link to page 5 link to page 5 link to page 5
5
investigations of agencies or privacy breach notifications. The investigation process is
confidential to ensure that the Privacy Commissioner can effectively carry out his role and
exercise his functions under the Privacy Act. Therefore, your request for records of
investigations is otherwise refused under section 18(c)(i) of the Official Information Act on
the basis that release of this information would be contrary to another enactment (i.e. section
206 of the Privacy Act).
Otherwise, your request is refused under section 18(e) of the Official Information Act on the
basis that following a search of our records, we do not hold the information requested.
Further information and your related OIA request
In 2017, the Privacy Commissioner published an open letter relating to the bulk disclosure of
household level smart meter data under Use of System Agreements. This letter is
attached
and was publicly reported on at that time.
3
As this predates the timeframe for your OIA request, the supporting information held by OPC
is out of scope of this request. We are stil considering your related OIA request of 13 March
2026. Can you please confirm if you are seeking information held by OPC relating to the
Commissioner’s open letter and we wil consider if the supporting information may be within
scope of that request.
Conclusion
While there is limited information that we are able to provide you in response to your
request, you may be interested in the following articles:
(a) Privacy and security of advanced metering infrastructure (AMI) data and network: a
comprehensive review (12 April 2024);
4
(b) Ethical considerations in advanced metering infrastructure integration: a systematic
review (November 2024);
5
(c) Smart Meter Data Privacy: A Survey (University of Auckland);
6
(d) AI and privacy concerns: a smart meter case study (29 July 2021).
7
If you are not satisfied with this response to your request, under section 28 of the Official
Information Act 1982 you have the right to ask the Ombudsman to investigate and review
our decision on your request, however we would appreciate the opportunity to discuss this
with you first.
Nāku iti noa, nā
Liz MacPherson
Deputy Privacy Commissioner
Encls.
3
https://www.stuff.co.nz/business/industries/93086386/privacy-commissioner-calls-for-assurance-on-
smart-meter-details
https://www.rnz.co.nz/news/national/331836/privacy-call-to-limit-power-usage-monitoring
4
https://link.springer.com/article/10.1186/s44147-024-00422-w
5
https://www.sciencedirect.com/science/article/pi /S2211467X24002803
6
https://www.cs.auckland.ac.nz/~asghar/papers/Asghar-CST17-pre-print-Smart-Meter-Privacy.pdf
7
https://www.emerald.com/jices/article-abstract/19/4/492/225368/AI-and-privacy-concerns-a-smart-
meter-case-study?redirectedFrom=fulltext
OIA/0521/A1167881
