Our website uses cookies so we can analyse our site usage and give you the best experience. Click "Accept" if you’re happy with this, or click "More" for information about cookies on our site, how to opt out, and how to disable cookies altogether.
We respect your Do Not Track preference.
Charges should be the exception, not the rule. In most circumstances, an agency shouldn’t be charging a fee to people for accessing or correcting their personal information. The spirit of the Privacy Act is to allow people to access and correct their own information. This means ensuring as few barriers as possible – including cost.
However, there are some circumstances where it may be okay for an agency to charge people to access or correct their information and there are special rules that apply to health or credit agencies.
Read a copy of our guidance, Charging for personal information under the Privacy Act: a guide for agencies (PDF, 517KB).
Private sector agencies may impose a charge for:
Public sector agencies cannot charge a person for accessing their personal information, or for attaching a statement of correction to that information,* unless the Privacy Commissioner has authorised that agency to impose a charge.
*The Privacy Commissioner can authorise a public sector agency to charge, but to do so the Commissioner must be satisfied that the public sector agency will be commercially disadvantaged in comparison with any private sector competitor. Generally, a public sector agency is unlikely to have a commercial position or private sector competitor and is therefore unlikely to be able to apply for such authorisation.
See a flowchart about who can charge for access to personal information.
The Health Information Privacy Code limits the circumstances where a health agency can charge a person for providing their health information.
Public sector health agencies (like Health New Zealand) cannot charge a person requesting their health information or seeking a correction to their information.
Private sector health agencies (like a GP, private clinic, health insurer) can only charge in relation to a request for a person’s health information if:
If the charge is likely to exceed $30, you need to give the person an estimate of the charge before dealing with the request. You can request the payment be made before you provide the information to the person.
Under the Credit Reporting Privacy Code, credit reporters cannot charge for:
Credit reporters can charge a maximum of $10.00 (including GST) if a person requests their credit information is made available to them within three working days.
An agency can only charge to provide someone with their personal information, and not for assessing whether the agency will provide that information. For example, if you think you can withhold some information, you cannot charge for the time it takes to determine what withholding grounds apply to the relevant information, even though this may be time-consuming.
The table below provides some examples of what you can charge for. This list is not determinative – if you have any questions about what you can charge for, you can get in touch with us, and we will do our best to help you.
|
Can charge |
Cannot charge |
| • Cost of photocopying or scanning the documents. • Cost of a USB stick or postage. • Time spent locating the relevant information. • Time spent physically redacting the information. |
• Time spent reviewing the information to determine whether any withholding grounds apply. • If an agency refuses a request. • Time spent transferring a request to another agency. |
Any charge imposed must be reasonable. This is because the right to access your personal information is one of the fundamental rights set out in the Privacy Act. What is reasonable will depend on the specific factors of each request and you will need to consider each charge as it comes up. A reasonable charge can often be lower than the actual cost in responding to a request.
The Privacy Act says you may want to consider:
Other factors you may want to consider include:
The Office of the Privacy Commissioner and the Human Rights Review Tribunal have previously relied on the amounts indicated in the Ministry of Justice charging guidelines for handling Official Information Act requests as a reference for requests under the Privacy Act.
Those guidelines, which also provide that a charge should represent a reasonable fee for access, state that:
We would consider this a useful starting point when thinking about a request under the Privacy Act. However, it is important to remember you need to assess each situation based on its facts. In many cases the amount you can charge will be less than what these guidelines suggest. It is rare that a higher charge will be justifiable.
If you’re going to impose a charge, you generally need to have already made the decision to either release some or all the information or have decided to attach the statement of correction.
Sections 44 and 45 of the Act set out how you must respond to a request for information. If you decide to release information and impose a charge, you must tell the requester:
You can also charge for aiding someone when they want to make an access request or attach a statement of correction. Often this will be done at the same time you decide to release the information, but if it comes before you still need to tell the requester about this as above.
If a person is unhappy with your decision to charge them for their information or for correction, or if they are unhappy with the amount proposed, they can make a complaint to our Office.
If the Privacy Commissioner considers the charge is unreasonable, they can make a binding determination on how much an agency can charge. It may also be an interference with a person’s privacy, if you decide to charge, or decide to charge an unreasonable amount, without a proper basis for that decision.
The Human Rights Review Tribunal has considered charges in the following case:
The Privacy Commissioner has also made a number of determinations with respect to charges. We have some case notes which consider charges here:
Read a copy of our guidance, Charging for personal information under the Privacy Act: a guide for agencies (PDF, 517KB).
Download a printable PDF version of this flowchart (PDF, 827KB).
