Source: Privacy Commissioner
This guidance is intended for advocates who aren’t lawyers but who are representing people in their privacy concerns.
Access to personal information
Tailoring your access request will make it more likely you’ll get relevant information without delay.
Access requests can take time for an agency to deal with, so we recommend making a request for specific documents if that is what your client wants. This should be the quickest way to get a response at no charge. If you can’t do that, then we suggest you ask for the information within scope of what you want (limit this to within a period of time or make it about an issue). You cannot impose your own timeframe on an agency. The agency is required to respond to you in 20 working days and make a decision, but that does not mean they will always be able to provide the information at the same time.
We encourage you to be pragmatic and focus on solutions. If you ask for a long meandering or highly specific list that can be a problem. Koso v MBIE (opens to PDF, 133KB) is a good example of this.
Either be specific, “I want the emails between these people between these dates” or broad, “all personal information held about X between these dates.”
If you ask for “everything held” where there is going to be a search through a lot of information that isn’t personal to the requester, but has their name on it (for example an employee/employer request for all emails) that might mean any personal information is not readily retrievable and the request could be refused. The case note ‘Academic denied request for 12,000 work emails‘ is a good example of this.
If you need the information urgently, explain to the agency why are making your request urgent, so that the agency can take this into account (as outlined in Koso v MBIE (opens to PDF, 133KB)).
If you need the information for another process (for example the Employment Relations Authority (ERA) or court proceedings) then use that process. The Privacy Commissioner’s processes can’t align with other agencies’ timeframes and you could be entitled to different (potentially broader) information, and different assessments will apply (see ERA power to order docs/info under s160).
You can only request information about your client. Policy documents, information about a redundancy etc. might be information you could or should be given access to as an employee, but it is not information you are entitled to request under IPP6, unless it contains personal information.
If you don’t get a response, follow up with the agency. We have a small number of investigators and if you can potentially solve the issue for the person you’re representing by sending an email, we would expect you to do so in the first instance. This will also help us assess your complaint if you have made efforts to follow up and have still had no response.
Information missing
We don’t know what’s missing or should be held by an agency. We have limited investigative resources to ask an agency ‘are you sure that’s everything’ so if you haven’t got all the information your client is expecting to receive, then we need to see some evidence we can base an investigation on. For example, is there a reference in an email to a discussion/meeting/attachment that you’ve not received, or are you aware of further correspondence for some other reason?
Other privacy complaints
Tell the agency what you want to resolve your privacy concern. If you have emailed the agency saying “respond by X date or I will file a complaint with OPC” doesn’t mean we can investigate your complaint. Explain to that agency what it can do to resolve the concerns you have raised. An investigation by our Office is not a “resolution” that the agency can provide to you.
Read more about our approach to settling privacy complaints.
We understand that privacy might only be a small part of a broader dispute. Please be ready to explain your privacy complaint in a simple and brief way.
Professionalism/courtesy
Resolving complaints can be hard work for everyone involved, and it is important that everyone remains civil towards each other. OPC has developed a Service Charter setting out the way we will work with people, and what we expect in terms of behaviour.
We understand that you want to provide advocacy for your client, but ours is not an adversarial process. We see people get better results when they come to us with reasonable and realistic expectations. Remember that your behaviour could affect your client’s ability to engage with the agency, and access our process.
If your correspondence with us or the agency is rude, abusive, or threatening, we may not be able to accept your complaint.
Contacting us
We cannot communicate with you on behalf of someone else without a signed authority form (opens to PDF, 116KB).
When you get in contact with us, it’s more important to show us the important documents than it is to explain all of the background. We need to see some evidence of what you’re raising concerns about. This could include a copy of the information request, your complaint to the agency, any response received from it, and evidence that you’ve followed up or explained the outstanding concerns to the agency. If you include all of the relevant information from the outset, you will get a response more quickly.
We recommend identifying the key questions or issues and then explaining your position on each one. You should list the key facts that support your answer in a way that specific and clear.
We recommend that you don’t use AI to make your complaint. Read our information about using Artificial Intelligence (AI) to work with us.
There are a number of reasons that we may decide not to investigate a complaint. For example it happened more than 12 months ago, or there haven’t been reasonable efforts to resolve the complaint with the agency first. We also have a discretion not to investigate if it is not necessary in the circumstances. Read more about why we might not investigate.
Thank you to Robin Arthur of the ERA for the inspiration to create this document. Robin’s good work is also relevant and can be read on their website (opens to PDF, 124KB).