Privacy Commissioner - Te Mana Matapono Matatapu

Part 5 Procedural provisions relating to access to and correction of personal information

33  Application
This Part of this Act applies to the following requests (in this Act referred to as information privacy requests):
(a) A request made pursuant to subclause (1)(a) of principle 6 to obtain confirmation of whether or not an agency holds personal information:
(b) A request made pursuant to subclause (1)(b) of principle 6 to be given access to personal information:
(c) A request made pursuant to subclause (1) of principle 7 for correction of personal information.

34  Who may make requests
An information privacy request may be made only by an individual who is—
(a) A New Zealand citizen; or
(b) A permanent resident of New Zealand; or
(c) An individual who is in New Zealand.

35  Charges
(1) Subject to section 36 of this Act, a public sector agency shall not require the payment, by or on behalf of any individual who wishes to make an information privacy request, of any charge in respect of—
(a) The provision of assistance in accordance with section 38 of this Act; or
(b) The making of the request to that agency; or
(c) The transfer of the request to any other agency; or
(d) The processing of the request, including deciding whether or not the request is to be granted and, if so, in what manner; or
(e) The making available of information in compliance, in whole or in part, with the request; or
(f) In the case of a request made pursuant to subclause (1) of principle 7,—

(i) The correction of any information in compliance, in whole
 or in part, with the request; or
(ii) The attaching, to any information, of a statement of any
 correction sought but not made.

(2) Subject to subsection (4) of this section, an agency that is not a public sector agency shall not require the payment, by or on behalf of any individual who wishes to make an information privacy request, of any charge in respect of—
(a) The provision of assistance in accordance with section 38 of this Act; or
(b) The making of the request to that agency; or
(c) The transfer of the request to any other agency; or
(d) The processing of the request, including deciding whether or not the request is to be granted and, if so, in what manner.

(3) An agency that is not a public sector agency may require the payment, by or on behalf of any individual who wishes to make a request pursuant to subclause (1)(a) or subclause (1)(b) of principle 6 or pursuant to principle 7, of a charge in respect of—
(a) The making available of information in compliance, in whole or in part, with the request; or
(b) In the case of a request made pursuant to subclause (1) of principle 7,—

(i) The correction of any information in compliance, in whole or in
 part, with the request; or
(ii) The attaching, to any information, of a statement of any
 correction sought but not made.

(4) Where an agency that is not a public sector agency makes information available in compliance, in whole or in part, with an information privacy request, the agency may require the payment of a charge in respect of the provision of assistance, by that agency, in accordance with section 38 of this Act, in respect of that request.

(5) Any charge fixed by an agency pursuant to subsection (3) or subsection (4) of this section or pursuant to an authority granted pursuant to section 36 of this Act in respect of an information privacy request shall be reasonable, and (in the case of a charge fixed in respect of the making available of information) regard may be had to the cost of the labour and materials involved in making information available in accordance with the request and to any costs incurred pursuant to a request of the applicant for the request to be treated as urgent.

(6) The provisions of subsections (3) to (5) of this section, in so far as they relate to the fixing, by any agency that is not a public sector agency, of any charge in respect of any information privacy request, shall apply subject to any provisions to the contrary in any code of practice issued under section 46 of this Act and for the time being in force.

Compare: 1982 No 156 ss 15(1A), (2), 24(1); 1989 No 122 s 2

36  Commissioner may authorise public sector agency to charge
(1) Where a public sector agency satisfies the Commissioner that the agency is commercially disadvantaged, in comparison with any competitor in the private sector, by reason that the agency is prevented, by subsection (1) of section 35 of this Act, from imposing a charge in respect of any of the matters referred to in paragraph (e) or paragraph (f) of that subsection, the Commissioner may authorise that agency to impose a charge in respect of either or both of those matters.

(2) The Commissioner may impose in respect of any authority granted pursuant to subsection (1) of this section such conditions as the Commissioner thinks fit.

(3) The Commissioner may, at any time, revoke any authority granted to an agency pursuant to subsection (1) of this section, but shall not revoke any such authority without giving the agency an opportunity to be heard.

37  Urgency
If an individual making an information privacy request asks that his or her request be treated as urgent, that individual shall give his or her reasons why the request should be treated as urgent.

Compare: 1982 No 156 s 12(3); 1987 No 174 s 10(3)

38  Assistance
It is the duty of every agency to give reasonable assistance to an individual, who—
(a) Wishes to make an information privacy request; or
(b) In making such a request, has not made the request in accordance with the requirements of this Act; or
(c) Has not made his or her request to the appropriate agency,—
to make a request in a manner that is in accordance with the requirements of this Act or to direct his or  her request to the appropriate agency.

Compare: 1982 No 156 s 13; 1987 No 174 s 11

39  Transfer of requests
Where—
(a) An information privacy request is made to an agency or is transferred to an agency in accordance with this section; and
(b) The information to which the request relates—

(i) Is not held by the agency but is believed by the person dealing with
 the request to be held by another agency; or
(ii) Is believed by the person dealing with the request to be more
 closely connected with the functions or activities of another agency,
 — the agency to which the request is made shall promptly, and in
 any case not later than 10 working days after the day on which the
 request is received, transfer the request to the other agency and
 inform the individual making the request accordingly.

Compare: 1982 No 156 s 14; 1987 No 174 ss 12, 57(1)

40  Decisions on requests
(1) Subject to this Act, the agency to which an information privacy request is made or transferred in accordance with this Act shall, as soon as reasonably practicable, and in any case not later than 20 working days after the day on which the request is received by that agency,—
(a) Decide whether the request is to be granted and, if it is to be granted, in what manner and, subject to sections 35 and 36 of this Act, for what charge (if any); and
(b) Give or post to the individual who made the request notice of the decision on the request.

(2) Where any charge is imposed, the agency may require the whole or part of the charge to be paid in advance.

(3) Where an information privacy request is made or transferred to a Department, the decision on that request shall be made by the chief executive of that Department or an officer or employee of that Department authorised by that chief executive, unless that request is transferred in accordance with section 39 of this Act to another agency.

(4) Nothing in subsection (3) of this section prevents the chief executive of a Department or any officer or employee of a Department from consulting a Minister or any other person in relation to the decision that the chief executive or officer or employee proposes to make on any information privacy request made or transferred to the Department in accordance with this Act.

Compare: 1982 No 156 s 15; 1987 No 8 s 8(1); 1987 No 174 ss 13, 57(1)

41  Extension of time limits
(1) Where an information privacy request is made or transferred to an agency, the agency may extend the time limit set out in section 39 or section 40(1) of this Act in respect of the request if—
(a) The request is for a large quantity of information or necessitates a search through a large quantity of information, and meeting the original time limit would unreasonably interfere with the operations of the agency; or
(b) Consultations necessary to make a decision on the request are such that a proper response to the request cannot reasonably be made within the original time limit.

(2) Any extension under subsection (1) of this section shall be for a reasonable period of time having regard to the circumstances.

(3) The extension shall be effected by giving or posting notice of the extension to the individual who made the request within 20 working days after the day on which the request is received.

(4) The notice effecting the extension shall—
(a) Specify the period of the extension; and
(b) Give the reasons for the extension; and
(c) State that the individual who made the request for the information has the right, under section 67 of this Act, to make a complaint to the Commissioner about the extension; and
(d) Contain such other information as is necessary.

Compare: 1982 No 156 s 15A; 1987 No 8 s 9(1); 1987 No 174 s 14

42  Documents
(1) Where the information in respect of which an information privacy request is made by any individual is comprised in a document, that information may be made available in one or more of the following ways:
(a) By giving the individual a reasonable opportunity to inspect the document; or
(b) By providing the individual with a copy of the document; or
(c) In the case of a document that is an article or thing from which sounds or visual images are capable of being reproduced, by making arrangements for the individual to hear or view those sounds or visual images; or
(d) In the case of a document by which words are recorded in a manner in which they are capable of being reproduced in the form of sound or in which words are contained in the form of shorthand writing or in codified form, by providing the individual with a written transcript of the words recorded or contained in the document; or
(e) By giving an excerpt or summary of the contents; or
(f) By furnishing oral information about its contents.

(2) Subject to section 43 of this Act, the agency shall make the information available in the way preferred by the individual requesting it unless to do so would—
(a) Impair efficient administration; or
(b) Be contrary to any legal duty of the agency in respect of the document; or
(c) Prejudice the interests protected by section 27 or section 28 or section 29 of this Act and (in the case of the interests protected by section 28 of this Act) there is no countervailing public interest.

(3) Where the information is not provided in the way preferred by the individual requesting it, the agency shall, subject to section 32 of this Act, give to that individual—
(a) The reason for not providing the information in that way; and
(b) If that individual so requests, the grounds in support of that reason, unless the giving of those grounds would itself prejudice the interests protected by section 27 or section 28 or section 29 of this Act and (in the case of the interests protected by section 28 of this Act) there is no countervailing public interest.

Compare: 1982 No 156 s 16; 1987 No 8 s 4(2); 1987 No 174 s 15

43  Deletion of information from documents
(1) Where the information in respect of which an information privacy request is made is comprised in a document and there is good reason for withholding some of the information contained in that document, the other information in that document may be made available by making a copy of that document available with such deletions or alterations as are necessary.

(2) Where a copy of a document is made available under subsection (1) of this section, the agency shall, subject to section 32 of this Act, give to the individual—
(a) The reason for withholding the information; and
(b) If the individual so requests, the grounds in support of that reason, unless the giving of those grounds would itself prejudice the interests protected by section 27 or section 28 or section 29 of this Act and (in the case of the interests protected by section 28 of this Act) there is no countervailing public interest.

Compare: 1982 No 156 s 17; 1987 No 8 s 4(2); 1987 No 174 s 16

44  Reason for refusal to be given
Where an information privacy request made by an individual is refused, the agency shall,—
(a) Subject to section 32 of this Act, give to the individual—

(i) The reason for its refusal; and
(ii) If the individual so requests, the grounds in support of that
 reason, unless the giving of those grounds would itself
 prejudice the interests protected by section 27 or section 28
 or section 29 of this Act and (in the case of the interests
 protected by section 28 of this Act) there is no countervailing
 public interest; and

(b) Give to the individual information concerning the individual's right, by way of complaint under section 67 of this Act to the Commissioner, to seek an investigation and review of the refusal.

Compare: 1982 No 156 s 19; 1987 No 8 s 4(2); 1987 No 174 s 18

45  Precautions
Where an information privacy request is made pursuant to subclause (1)(b) of principle 6, the agency—
(a) Shall not give access to that information unless it is satisfied concerning the identity of the individual making the request; and
(b) Shall ensure, by the adoption of appropriate procedures, that any information intended for an individual is received—

(i) Only by that individual; or
(ii) Where the request is made by an agent of the individual,
 only by that individual or his or her agent; and

(c) Shall ensure that, where the request is made by an agent of the individual, the agent has the written authority of that individual to obtain the information or is otherwise properly authorised by that individual to obtain the information.

Compare: 1982 No 156 s 25; 1987 No 174 s 24