• Home /
• Privacy Act 2020 /
• Privacy Act 2020 and the Privacy Principles /
• Principle 6 - Access to personal information /
• Frivolous, vexatious or trivial

Privacy Act 2020

Section 53(h) allows an organisation to withhold personal information from the individual concerned if the request is frivolous or vexatious, or the information requested is trivial.

Frivolous or vexatious

It is not common for organisations to be able to withhold information on this ground. However, it is an important protection against requests that are made for malicious or other improper reasons.

An organisation cannot use this refusal ground simply because a requester is an annoying or even malicious individual. Unpleasant individuals are still entitled to access their personal information. It is the request that needs to be vexatious or frivolous before the information can be withheld.

The test for vexatiousness is essentially:

• Is the requester only making the request to cause trouble, or might there be a genuine reason for the request?

Factors possibly indicating vexatiousness include:

• Multiple requests for the same information without any apparent reason for this
• A history of using information from one request to demand more information - for instance, one complaint leading to another, and another
• Unreasonably abusive or aggressive behaviour and no apparent genuine need for the information
• Clear intention to use the request to divert the organisation's resources, upset people etc.
   

The information is trivial

It is even less common for an organisation to refuse a request on the ground that the information concerned is trivial. Organisations should be slow to use triviality as a reason for refusal - what seems trivial to the organisation may be important to the requester.

Factors possibly indicating that the information is trivial include:

• It is a very small item of information contained within a large amount of information
• It is a seemingly innocuous piece of information that the requester already knows or has access to
• The information does not really say anything about the requester. For example the requester's name may be in the subject line of an email, but the email is actually about something else, or involves trivial administrative arrangements such as setting a meeting time with the requester
   

Privacy Act 2020 reference:

See also:

Case Note 18109

Return to the principle 6 page