Our website uses cookies to give you the best experience and for us to analyse our site usage. If you continue to use our site, we will take it you are OK about this. Click on More for information about the cookies on our site and what you can do to opt out.

We respect your Do Not Track preference.



Access to information can take several forms:

  • giving a reasonable opportunity to look at a document, or listen to or view a recording
  • giving a copy of a document
  • giving a summary of the information
  • providing a transcript
  • giving the information orally


Almost everyone who holds personal information is an 'agency' under the Privacy Act.

An agency can be a public sector body like:

  • a government department; or
  • a Minister of the Crown.

Or it can be a private sector body like:

  • a company;
  • a business;
  • a club; or
  • a charity or other non-profit body.

Even an individual person is an agency (but see section 56 for further details about when an individual person might not be liable for privacy breaches).

However, the Act specifically excludes some people and organisations from being agencies. This means they are not governed by the privacy principles.

Section 2 of the Act (under 'agency') sets out the complete list of exclusions. For example, these are not agencies under the Act:

  • an MP (acting in his or her capacity as an MP);
  • a court or tribunal (as regards its judicial activities);
  • the news media (as regards their news activities); or
  • the Ombudsmen.

Other privacy rules may cover what these people and organisations can do. See here for information on other privacy rules, and for some useful links.


To collect information, the agency must, in some way, ask to get it.

This includes setting up equipment to record anything that happens in an area.

It is not a "collection" if the agency is just given information that it did not ask for.


An agency that holds personal information shall, if requested by the individual concerned, take such steps (if any) to correct that information. The information held should be accurate, up to date, complete, and not misleading. (See principle 7).


Information is disclosed when it passes to a person who did not know it before.

A disclosure does not have to be deliberate.

'Information matching programmes'

(Also known as data matching programmes)
Information matching / data matching programmes

Systems for bulk comparison of personal information.

Information matching programmes can be conducted manually or electronically. They are designed to produce or verify information that can then be used to take adverse action against an individual.

'Interference with privacy'

For there to be an interference with privacy, two things are needed:

1. A breach

  • of a privacy principle
  • or a rule of a Code of Practice
  • or an information matching rule


2. harm (or likely harm) resulting from that breach.

Harm can be things like:

  • not having the personal information requested (as long as the agency was wrong to refuse access)
  • financial loss
  • loss of a benefit
  • adverse effect on interests
  • significant humiliation, significant injury to feelings (the word "significant" is important - there must be a high level of humiliation etc)


A real risk that something may happen, supported by evidence.

Importantly, the risk does not have to be 'more likely than not' to eventuate. It just needs to be a distinct or significant possibility.

See for instance Commissioner of Police v Ombudsmen [1998] 1 NZLR 385; M v Ministry of Health CRT [1997] 12; Nicholl v Chief Executive of Work and Income (6 June 2003) High Court, Rotorua, AP 255/01, Hansen J.

'Personal information'

Information about a living human being.

The information needs to identify that person, or be capable of identifying that person.

So, for example, personal information is not

  • information about a company
  • information about a deceased person
  • statistical information that is not capable of identifying anyone
  • photographs, tape recording etc that are not capable of identifying anyone

'Publicly available information'

Information contained in

  • a book
  • magazine
  • newspaper
  • website
  • public register
  • any other type of publication that is available (or will be available) to members of the public generally