How you can access your information and correct it if necessary
Overview
Your right to have access to information that’s about you
Privacy Act 2020, s 22, Principle 6
If a government agency, business or other organisation holds information about you, you have the right to:
- get them to confirm whether or not they hold the information, and
- have access to that information.
However, there are certain situations where the organisation can refuse to give you access to the information (see: “When can my request be refused?” below).
If you are given access, you should also be told of your right to ask for the information to be corrected (see: “How can I correct information held about me when it’s wrong?” below).
Requests for access to personal information can be made verbally or in writing. Although your right to see the information is given by the Privacy Act, you don’t have to specifically mention the Privacy Act when you ask.
Note: The Privacy Act uses the term “personal information” as a key term in this area. This doesn’t necessarily mean information that is particularly private or sensitive – it means information that’s about an identifiable individual person.
How long do they have before they must reply to me?
Whoever holds the information has to respond to your request as soon as practical, and not later than 20 working days after receiving it.
Will I have to pay anything for the information?
The rules are different for public and private organisations:
- Public-sector agencies like government departments can’t charge for giving people access to their information unless they have permission from the Privacy Commissioner to charge a fee. The Commissioner will only give this permission if the agency would be commercially disadvantaged compared with a private-sector competitor if they had to provide the information free of charge.
- Businesses and other private-sector organisations can require you to pay a reasonable charge. If you think the amount is unreasonable, you can complain to the Privacy Commissioner (see: “Complaining about a breach of your privacy”).
What happens after I request access to my information?
If the organisation decides to withhold some or all of the information from you, they have to tell you of that decision and the reasons for it. If you’re unhappy with the decision, you can complain to the Privacy Commissioner (see: “Complaining about a breach of your privacy”).
Usually, the organisation must make the information available in the way that you prefer – such as by giving you a written copy. However, the organisation might sometimes be able to justify giving access in a different way – for example, getting you to come in and look at the information if you’ve requested access to a particularly large amount of information.
When can my request be refused?
Privacy Act 2020, ss 46, 49–53
An organisation can refuse your request to have access to your own information, but only if it’s for a reason under the Privacy Act. These reasons include that giving you the information would:
- pose a risk to New Zealand’s security or defence,
- undermine the enforcement of the law,
- endanger the safety of any individual,
- involve the unjustified disclosure of information about someone else,
- be harmful to any person’s physical or mental health (based on discussions with the person’s doctor),
- not be in your interests (but only if you’re under 16),
- breach legal professional privilege (that is, the information was communicated between a lawyer and client, or the information was obtained for court proceedings), or
- fall within the exemption for “evaluative” material – for example, information that one of your referees for a job application has given the prospective employer. In this case, the employer would be justified in refusing to tell you what the reference said.
How can I correct information held about me when it’s wrong?
Privacy Act 2020, ss 22, 59-65, Principle 7
If an organisation holds information about you and you think the information is wrong, you’re entitled to ask them to correct it.
The organisation doesn’t have to change it if they think the information is correct, but they’ll have to tell you that this is their decision. In that case, you have the right to get them to attach a statement to the original information that will set out the correction you requested, but that the organisation decided not to make.
For example, if the organisation that has your information is a mental health service, and you disagree with a particular diagnosis that’s in your file, you can get them to attach a statement from you saying what your disagreement is. This way, your statement should always be read with the original information that you disagree with.
