Office of the Privacy Commissioner
PO Box 10094, Wellington 6140
privacy.org.nz
15 April 2026
Spencer Jones
By email only to:
[FYI request #34078 email]
Tēnā koe
Official Information Act Request (Our Ref: OIA/0523)
We refer to your two Official Information Act requests to OPC concerning smart meter data,
advanced metering infrastructure (AMI) and related privacy issues.
Your first request dated 9 March 2026 covered the period from 1 January 2020. We
responded to that request on 7 April 2026.
This letter responds to your second request dated 13 March 2026 that covers the period
from 1 January 2015:
Under the Of icial Information Act 1982, I request the following information from 1
January 2015 to the present concerning smart meter data, advanced metering
infrastructure (AMI), and privacy governance in New Zealand.
Please provide:
1. Any internal briefings, legal analyses, issue papers, or correspondence concerning
whether smart meter data may constitute personal information under the Privacy Act
2020.
2. Any records concerning privacy risks associated with:
•
granular electricity consumption data,
•
occupancy pattern inference,
•
behavioural profiling,
•
data sharing,
•
secondary use,
•
retention,
•
or downstream analytics involving smart meter data.
3. Any inter-agency correspondence with MBIE, the Electricity Authority, Ministry of
Health, Health NZ, ESR, or electricity retailers/distributors concerning privacy issues
associated with smart meter or AMI data.
OIA/0523/A1171371
link to page 2
2
4. Any complaints trend summaries, enquiry summaries, anonymised issue notes, or
guidance development documents relating to smart meter data or electricity-sector
metering information.
5. Any draft or final guidance concerning consent, transparency, minimisation, access,
correction, retention, disclosure, or safeguards in relation to smart meter data.
6. Any records considering whether existing privacy law adequately addresses inferred
information generated from metering data, even where the raw data itself may appear
technical or operational in nature.
Response to your request – information
Privacy Commissioner’s submission to the Electricity Authority’s consultation on multiple
trading relationships
The Privacy Commissioner’s 2018 submission to this consultation is publicly available from
the Electricity Authority’s website.
1
Privacy Commissioner’s 2017 open letter
We attached the Commissioner’s open letter to our response to your previous OIA request.
The initial context for the development of the open letter is set out below:
Nearly al residential properties have meters which record total electricity consumption at an
address. Traditional y, these meters were analogue and needed to be manual y checked each
month by a meter reader. Analogue meters are being replaced with ‘smart’ meters that
collect at half hourly intervals what power is being used. This data is sent in one package
from each meter once a day – not real time. Approximately 70% of households now have
smart meters, this wil rise to 90% within 2 years according to the Electricity Retailers
Association of NZ, ERANZ.
Electricity retailers who administer the meters to their customers are getting increasing
demand from electricity distributors for the detailed half hourly data the meters are collecting.
The Distributors are requesting it under the provisions contained in their contracts with the
retailers that state the latter wil provide data for ‘network planning’ purposes.
Retailers believe the detailed data is being used for other purposes, including customer
surveys and potential business expansion. The retailers consider that the Distributors do not
need household specific data in order for them to do network planning but rather need grid
level or relay box level data.
The retailers are concerned that should there ever be a data breach or if their customer data
is used inappropriately by the distributors that this could cause their business significant
harm. They also don’t think that their customers would want them providing this highly
detailed data to the distributors without a clear purpose.
1 https://www.ea.govt.nz/projects/al /evolving-multiple-trading-and-switching/consultation/multiple-trading-
relationships/
OIA/0523/A1171371
3
International context
Smart meters are broadly similar to IP addresses in that they collect potentially
sensitive information about households rather than individuals (but their data could
be linked to individuals with additional context).
On 19 October 2016, the Court of Justice of the European Union published its
judgment in
Case 582/14 – Patrick Breyer v Germany, in which it held that IP
addresses are personal data in certain circumstances.
Personal data are defined in
Article 2(a) of the Directive as "any information relating
to an identified or identifiable natural person (‘data subject'). An identifiable person is
one "who can be identified, directly or indirectly […]" (emphasis added). Further
analysis of the issue of identifiability is provided by the EU's
Article 29 Working Party,
in its
Opinion 4/2007. Where a piece of information (such as an IP address) does not directly identify a
person, that piece of information wil nevertheless be personal data in the hands of
any party that can lawfully obtain sufficient additional data to link the information to a
person's real world identity. On the other hand, that same piece of information wil not
be personal data in the hands of a party that has no legal means of obtaining
sufficient additional data to make such a link.
News Media
GCHQ were consulted on the security of smart meters in the UK, predominantly from
a concern that they could be hacked to turn them off and therefore cut power supply
to mil ions of UK citizens however it appears likely if you could hack them to turn
them of you could hack them for information. I’m unsure if GCSB has been
consulted on the roll out of smart meters in NZ.
http://www.dailymail.co.uk/news/article-3501918/GCHQ-steps-fear-11bn-smart-meters-
installed-millions-homes-hacked-leading-gas-supplies-cut-off.html
Russian hackers penetrate US power grid -
https://www.washingtonpost.com/world/national-security/russian-hackers-penetrated-us-
electricity-grid-through-a-utility-in-vermont/2016/12/30/8fc90cc4-ceec-11e6-b8a2-
8c2a61b0436f_story.html?utm_term=.0f3b01eb4127
Concern over amount of data collected by smart meters and privacy implications –
http://news.nationalgeographic.com/news/energy/2012/12/121212-smart-meter-privacy/
European Data Protection Supervisor concerned about smart meters -
https://www.theguardian.com/environment/2012/jul/01/household-energy-trackers-
threat-privacy
Case Note on Smart meters by Victorian Privacy Commissioner -
http://www.smartmeters.vic.gov.au/privacy
OIA/0523/A1171371
4
Have we received any related complaints or enquiries?
Between Feb 2011 and Oct 2015 we have received 37 enquiries about smart meters
we have also investigated one complaint during this period.
I have broken down the topics of the enquiries below, some fell into two categories
so have been recorded below more than once.
Number
Subject
14
Concerned about detailed col ection
2
Concerned about government agency using data
1
Use of contractors to administer smart meters
5
General inquiry about roll out of smart meters
2
Concerned about ‘radiation’ emitted from meter affecting health
2
Query about complaint process re smart meters
12
Query whether smart meter data is personal information
5
Case note query
1
Security of col ected data
The one complaint relates to ability for power companies to collect data, the OPC
response noted that the frequency of collection does not change their lawful purpose
for collecting it e.g. bil ing. We found no breach and as a result wrote a case note.
One of the people responsible for a number of the above enquiries noted that the
Electricity Authority provided advice on their website that people have a right of
access to their meter data – our case note somewhat conflicts with this advice as we
noted that because the data is for a household it is unlikely to be considered
‘personal information’.
OPC developed its position and considered further international research which is referred to
in the open letter:
Information disclosed by retailers is identified by an ICP (Installation Control Point)
number which effectively identifies a property. Meters also have serial numbers, which
wil serve the same purpose. Consumption information tied to an ICP number may be
personal information if that information is able to be tied to an individual or individuals.
Our current legal position around smart meters is outlined in the case note we
released in 2015 -
https:/ www.privacy.org.nz/news-and-publications/case-notes-and-
court-decisions/case-note-251185-2015-nz-privcmr-3-use-of-smart-meters-by-utility-
companies/:
In its raw form, the data collected by advanced meters may not identify a particular person at all.
The data collected in its raw form appears as a series of numbers like “20130542399”. No
customer data is stored at the meter, ensuring that customers cannot be identified at the site.
However, usage information collected from smart meters is personal information once it is
associated with an account holder. This is particularly so if only one person lives at a residential
address; any data collected from that address wil also be about the resident/account holder.
OIA/0523/A1171371
link to page 5 link to page 5 link to page 5
5
When more than one individual lives at an address the data is less likely to identify the power
usage of one of those residents. However, it wil be linked to the account holder. Power
companies therefore wil need to comply with the Privacy Act.
The Electricity Authority says in its online guidance about smart meters:
Electricity retailers are required to outline al the purposes it has for your smart meter data in their
privacy policy. This is readily available to you on their website and you can request it by contacting
your retailer.
In New Zealand a University of Auckland academic conducted a review of privacy and
technology issues around smart meters and noted “There is general consensus that
smart meter data should be managed according to the provisions foreseen for
personal data"
.2
In 2011 the Article 29 Working Party released a Working Paper, “Privacy by Design
and Smart Metering: Minimize Personal Information to Maintain Privacy” with 8
recommendations setting out a privacy by design approach to ensure that electricity
consumers would have the privacy of their data respected without the need to take any
specific actions. In particular it noted that “research has shown that utilities may not
need detailed energy consumption information about individual consumers to perform
load balancing functions. To achieve as lit le personal data flow as possible utilities
may use techniques such as anonymisation, pseudonymisation, or data aggregation”.
Following that the EU Data Protection Supervisor prepared a 2012 opinion on the
Commission Recommendation on preparations for the roll-out of smart metering,
concluding: “Considering the risks to data protection, one of the key pre-conditions for
the rollout of smart metering systems is to ensure a high level of protection of personal
data.”
3
A 2014 report on smart meters by US consumer protection advocate KT Weaver
highlighted concerns about smart meters in a US context, proposing that the meters
might constitute an unreasonable search and seizure.
4
Transparency reporting suggests that electricity retailers are wil ing to disclose
information, sometimes after receiving a production order but often upon request. The
Hager case is relevant, where Westpac disclosed information about Mr Hager
following a Police request. While this is not indicative of how any particular agency wil
act in response to a Police request, there are privacy risks from bulk disclosure that
could be reduced by that information being deidentified.
2 https://www.cs.auckland.ac.nz/~asghar/papers/asghar12-smartgridsec.pdf
3
https://secure.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Consultation/Opinions/201
2/12-06-08_Smart_metering_EN.pdf
4 https://skyvisionsolutions.files.wordpress.com/2014/08/utility-smart-meters-invade-privacy-22-aug-2014.pdf
OIA/0523/A1171371
link to page 6
6
Summary information - Privacy complaints and breach notifications (question 4)
In relation to information about our investigations and enquiry logs, please see the summary
provided in our earlier response. We have summarised some further privacy concerns below
for the period of your second request:
Summary table of enquiries, concerns and complaints about electricity retailers
1
OPC ref. 108197
2015-04- Concerns about having a
27
smart meter including
concerns about surveil ance
2
OPC ref. 124989
2017-06- Concerns about collection of
29
information by smart meters,
security of smart meter data
and sharing data
3
OPC ref.
2017-10- Query about case note
17
251185 [2015] NZ PrivCmr 3
– see below
4
OPC ref. C/30571
2019-07- Concerns about unauthorised
OPC ref 134615
22
changes to customer contact
details. OPC investigated the
company’s response to
customer’s IPP 6 access
request.
As noted in the table above (row 3), in 2017 we received an enquiry about OPC’s 2015 case
note about smart meter data
5 and our response to that enquiry is set out below:
Kia ora,
Thank you for your enquiry regarding Case Note 251185 [2015] NZ PrivCmr 3. In
summary, you have queried a statement in this case note that "in its raw form, the
data collected by advanced meters may not identify a particular person at all. The
data collected in its raw form appears as a series of numbers like “20130542399”. No
customer data is stored at the meter, ensuring that customers cannot be identified at
the site."
You also noted in your enquiry that you have recently requested your electricity
usage data from your power provider and have not received a response to this
request – but that you are not making a complaint to this of ice at this time.
The questions you have asked are:
- Is the ICP number visible to anyone who looks at an electricity meter?
- Is the meter’s serial number visible to anyone who looks at a meter?
- Is the data encrypted when sent from the meter to the metering company?
My staff have been in touch with the Electricity Authority to assist me in my response
to your enquiry. From our enquiries I can advise:
5 https://www.privacy.org.nz/resources-and-learning/case-notes-and-court-decisions/case-note-
251185-2015-nzprivcmr-3-use-of-smart-meters-by-utility-companies/
OIA/0523/A1171371
link to page 7 link to page 7
7
- The ICP number is not programmed into the meter, the meter is identified with
the serial number of the device which is shown on the front of the meter.
- Al information (“comms”) from a smart meter are end to end encrypted and all
smart meters are password locked.
An ICP number does not uniquely identify a person, it uniquely identifies a meter
connected to a household. However, as noted in our case note, “usage information
collected from smart meters is personal information once it is associated with an
account holder”.
Response to your request - decision
Your request is granted to the extent set out above.
Apart from published outcomes, the Privacy Commissioner is subject to an obligation of
secrecy under section 206 of the Privacy Act. Therefore, your request for correspondence is
refused under section 18(c)(i) of the Official Information Act on the basis that release of this
information would be contrary to another enactment (i.e. section 206 of the Privacy Act).
Otherwise, your request is refused under section 18(e) of the Official Information Act on the
basis that following a search of our records, we do not hold the information requested.
Conclusion
While there is limited information that we are able to provide you in response to your
requests, you may be interested in the Supreme Court decision in
R v Alsford [2017] NZSC
42. As the Privacy Commissioner was an intervenor in this case, there is a summary on our
website.
6 In considering the privacy implications of electricity consumption data when this is
obtained by the Police for investigative purposes, the court noted that smart meter data may
collect power consumption data in a way that reveals intimate details of a person’s lifestyle
and other choices.
7 If you are not satisfied with this response to your request, under section 28 of the Official
Information Act 1982 you have the right to ask the Ombudsman to investigate and review
our decision on your request, however we would appreciate the opportunity to discuss this
with you first.
Nāku iti noa, nā
Liz MacPherson
Deputy Privacy Commissioner
6 https://www.privacy.org.nz/resources-and-learning/court-decisions/alsford-v/
7 Footnote 96.
OIA/0523/A1171371
