How you can access your information and correct it if necessary
Your right to have access to information that’s about you
If a government agency, business or other organisation holds information about you, and in such a way that it can be readily retrieved, you have the right to:
- get confirmation from the organisation about whether or not it holds the information, and
- have access to that information.
There are, however, some situations where the organisation can refuse to give you access to the information (see below, “When your request to have access to your information can be refused”).
If you are given access, you should also be told of your right to ask for the information to be corrected (see below, “How you can correct information held about you”).
When your request to have access to your information can be refused
There are various grounds on which an organisation can refuse your request to have access to your own information. These include that giving you the information would:
- pose a risk to New Zealand’s security or defence
- undermine the enforcement of the law
- endanger the safety of any individual
- involve the unjustified disclosure of information about someone else
- be harmful to any person’s physical or mental health (based on discussions with the person’s doctor)
- not be in your interests (but only if you’re under 16)
- breach legal professional privilege (that is, the information was communicated between a lawyer and client, or the information was obtained for court proceedings)
- is “evaluative” material – for example, information that one of your referees for a job application has given the prospective employer, in which case the employer would be justified in refusing to tell you about the contents of the reference you were given.
Procedure for dealing with requests for access
If you’ve asked for access to information that an organisation holds about you, they must respond to your request as soon as is practicable, and not later than 20 working days after receiving it.
If the organisation decides to withhold some or all of the information from you, it must tell you of that decision and the reasons for it. If you’re unhappy with the decision, you can complain to the Privacy Commissioner (see “Complaining about a breach of your privacy” in this chapter).
Usually the organisation must make the information available in the way that you prefer – for example, giving you a copy of the information. In some cases, however, the organisation may be able to justify giving access in a different way – for example, getting you to come in and look at the information instead, if you’ve asked for a particularly large amount of information.
Note: Requests for access to personal information can be made verbally or in writing. You don’t have to specifically mention the Privacy Act.
Can I be charged for being given access to my information?
The rules on charging are different for public and private-sector organisations:
- Public-sector bodies such as government departments can’t charge for giving people access to their personal information, unless they have permission in advance from the Privacy Commissioner. The Privacy Commissioner will only allow this if satisfied that the organisation will be commercially disadvantaged in comparison with a private-sector competitor if it has to provide the information for free.
- Businesses and other private-sector organisations can require you to pay a reasonable charge. If you think the amount is unreasonable, you can complain to the Privacy Commissioner (see “Complaining about a breach of your privacy” in this chapter).
How you can correct information held about you
If an organisation holds information about you and you believe the information is wrong, you’re have the right to ask them to correct the information.
If they disagree that the information is incorrect, and refuse to change it, they must tell you that this is their decision. In that case, you have the right to get them to attach a statement to the original information, saying what the correction was that you wanted but that wasn’t made. For example, if the information-holder is a mental health service, and you disagree with a particular diagnosis that’s in your file, you can get them to attach a statement from you saying what your disagreement is. The statement has to be attached in such a way that it will always be read with the information that you disagree with.