How you can access your information and correct it if necessary
Overview
Your right to have access to information that’s about you
Privacy Act 2020, s 22 principle 6
If a government agency, business or other organisation holds information about you, you have the right to:
- get them to confirm whether or not they hold the information, and
- have access to that information.
However, there are certain situations where the organisation can refuse to give you access to the information (see below, “When can my request be refused?”).
If you are given access, you should also be told of your right to ask for the information to be corrected (see below, “How you can correct information held about you”).
Requests for access to personal information can be made verbally or in writing. Although your right to see the information is given by the Privacy Act, you don’t have to specifically mention the Privacy Act when you ask.
Note: The Privacy Act uses the term “personal information” as a key term in this area. This doesn’t necessarily mean information that is particularly private or sensitive – it means information that’s about an identifiable individual person.
How long do they have before they must reply to me?
The information-holder must respond to your request as soon as practicable, and not later than 20 working days after receiving it.
Will I have to pay anything for the information?
The rules are different for public and private-sector organisations.
- Public-sector agencies such as government departments can’t charge for giving people access to their information, unless they have permission from the Privacy Commissioner to charge a fee. The Commissioner will only give this permission if the agency would be commercially disadvantaged compared with a private-sector competitor if it has to provide the information free of charge.
- Businesses and other private-sector organisations can require you to pay a reasonable charge. If you think the amount is unreasonable, you can complain to the Privacy Commissioner (see “Complaining about a breach of your privacy” in this chapter).
What happens after I request access to my information?
If the organisation decides to withhold some or all of the information from you, it must tell you of that decision and the reasons for it. If you’re unhappy with the decision, you can complain to the Privacy Commissioner (see “Complaining about a breach of your privacy” in this chapter).
Usually the organisation must make the information available in the way that you prefer – such as by giving you a written copy. In other cases, the organisation may be able to justify giving access in a different way – for example, getting you to come in and look at the information instead, if it’s a particularly large amount of information.
When can my request be refused?
Privacy Act 2020, ss 46, 49–53
An organisation can refuse your request to have access to your own information, but only if it’s for a reason under the Privacy Act. These include that giving you the information would:
- pose a risk to New Zealand’s security or defence
- undermine the enforcement of the law
- endanger the safety of any individual
- involve the unjustified disclosure of information about someone else
- be harmful to any person’s physical or mental health (based on discussions with the person’s doctor)
- not be in your interests (but only if you’re under 16)
- breach legal professional privilege (that is, the information was communicated between a lawyer and client, or the information was obtained for court proceedings)
- is “evaluative” material – for example, information that one of your referees for a job application has given the prospective employer. In this case, the employer would be justified in refusing to tell you what the reference said.
How you can correct information held about you when it’s wrong
Privacy Act 2020, s 22 principle 7; ss 59–65
If an organisation holds information about you and you think it’s wrong, you’re entitled to ask them to correct it.
They’re not legally required to change it if they think the information is correct but they’ll have to tell you that this is their decision. In that case, you have the right to get them to attach a statement to the original information, saying what the correction was that you wanted but that wasn’t made.
For example, if the information-holder is a mental health service, and you disagree with a particular diagnosis that’s in your file, you can get them to attach a statement from you saying what your disagreement is. This way, your statement should always be read with the original information that you disagree with.
