Privacy Act

At a glance

The Privacy Act 2020 governs how Immigration New Zealand (INZ) collects, uses, discloses, and stores personal information about visa applicants and others. INZ must comply with the Act's information privacy principles, including obligations to provide access to and correction of personal information. The operational manual references the Act at section A7 but does not contain separate privacy instructions beyond that reference. Section A7.5 clarifies that the manual does not replace the Ministry of Business, Innovation and Employment's Privacy Act Policy; that policy must be consulted directly. The Act's objectives, set out in section A7.1, are to promote and protect individual privacy by providing a framework for protecting an individual's right to privacy of personal information, including the right of access, and by giving effect to internationally recognised privacy obligations and standards such as the OECD Guidelines and the International Covenant on Civil and Political Rights. [A7] [A7.1] [A7.5]

Definition

The Privacy Act 2020 establishes a set of information privacy principles that apply to every agency, including INZ. Its objectives, as described in A7.1, are to provide a framework for protecting an individual's right to privacy of personal information, including access rights, and to give effect to international privacy obligations and standards. Those principles cover:

• lawful, necessary, and transparent collection of personal information;
• limits on use and disclosure;
• the right of individuals to access and correct their personal information;
• requirements for secure storage and retention.

Section A7 of the operational manual acknowledges that the Privacy Act applies to INZ's activities. The manual does not provide additional or alternative privacy rules; it relies on the statutory framework. [A7] [A7.1]

Application in decisions

When processing applications and conducting investigations, INZ handles personal information in accordance with the Privacy Act. This includes ensuring that personal information is collected directly from the individual where possible, used only for the purposes for which it was collected, and disclosed only when permitted by law. Individuals may request access to personal information held about them and may seek correction of incorrect information. The Act also provides a right to complain to the Privacy Commissioner if an individual believes their privacy has been breached. [A7]

Disclosure to other Government agencies

Some Government agencies have statutory authority to request information from INZ. For example, the Ministry of Social Development (MSD) may, under schedule 6, clause 2 of the Social Security Act 2018, require any person (including an officer or employee of the Crown) to provide information. Similarly, section 17 of the Tax Administration Act 1994 gives comparable power to Inland Revenue officers. [A7.75]

Providing information in response to such a written request that details the statutory authority is not a breach of privacy. Section 24 of the Privacy Act 2020 states that nothing in IPP 6, 11, or 12 limits or affects a provision in any New Zealand enactment that authorises or requires personal information to be made available. [A7.75] INZ may lawfully disclose personal information to those agencies when the request meets the statutory requirements. [A7.75]

Disclosure overseas under the Immigration Act

Section A8.75 (previously A7.80) outlines the procedure for disclosing information overseas under section 305 of the Immigration Act 2009. Unlike routine Privacy Act requests, these disclosures are governed by the Immigration Act's specific framework and require a step‑by‑step assessment before information is released. [A8.75][A7.80]

The following steps must be considered when releasing information overseas under section 305 [A7.80][A8.75]:

1. Identify the agency, body or person that is to receive the information.
2. Identify the information to be disclosed and confirm it falls within section 306(1) of the Act.
3. Determine whether an existing information‑sharing agreement covers the receiving entity and whether it applies in the circumstances.
4. If no agreement applies, consider whether an agreement should be developed.
5. For one‑off disclosures, check that the release strictly complies with the requirements of section 305(7) and (8).

If INZ officers are unsure whether to release information under an agreement or on a one‑off basis, they must contact the Ministry of Business, Innovation and Employment Legal Services for advice. [A7.80][A8.75]

Who may make a request

Under section A7.10 of the operational manual, requests under Information Privacy Principles 6 (access) and 7 (correction) may only be made by the individual concerned. [A7.10] An individual may authorise an agent to receive the information on their behalf. [A7.10]

New Zealand‑based lawyers holding a current practising certificate and licensed immigration advisers do not require written authority to act when representing their clients before the Ministry of Business, Innovation and Employment. They may request their client's personal information without a separate authority. [A7.10] However, if INZ has information suggesting the client may not be represented by that lawyer or adviser, an authority to act may be requested before releasing the information. [A7.10]

Identity verification before disclosure

Before releasing any personal information, INZ staff must be satisfied that the requestor is the individual the information is about, or an authorised agent acting on that individual's behalf. [A7.15]

• Staff must be assured of the identity of the individual making the request before releasing information. [A7.15]
• Access must not be granted unless INZ is satisfied that the information will be received only by the individual it is intended for or by that individual's agent if the agent makes a request on behalf of the client. [A7.15]
• Staff must be satisfied that agents have the written authority of the individual concerned or are otherwise appropriately authorised to receive the information. [A7.15] This is consistent with the agent authority requirements under A7.10, where lawyers and licensed immigration advisers do not require written authority but may be asked to provide one if there is doubt. [A7.10]
• If a request is made by telephone or letter, staff must not release any information without first confirming the identity of the person making the request. [A7.15]

Reasonable assistance and transferring requests

Reasonable assistance must be given to the person making a request to ensure it is made in accordance with the Privacy Act and to the appropriate agency. [A7.20]

If the information is held by another agency or is more closely connected with the functions of another agency, the request must be transferred promptly, but not later than 10 working days, and the requestor informed in writing. [A7.20][A7.25]

Which office processes the request

The office nearest to where the client lives will normally process the information request. If there is an undecided visa or compliance application, the office that is processing that application will handle the request. [A7.40]

The processing office must obtain all INZ physical and electronic files and information, regardless of location — including files held at other INZ offices, MFAT posts, Archives, Online, National Office, or temporarily with the Immigration and Protection Tribunal pending the outcome of an appeal. [A7.40]

If a request must be forwarded to another office (because the client lives in that office's area or an undecided visa or compliance action exists there), the forwarding office must:

• lodge the request on AMS and fax a copy to the relevant office promptly;
• advise the requestor of the office to which the request has been sent; and
• transfer any physical or electronic files. [A7.40]

The time for responding to the request starts from the date the request is first received by INZ, so forwarding must be done promptly to avoid delay. [A7.40]

Requests received by National Office or the Immigration and Protection Tribunal

National Office does not normally deal with requests for client information under the Privacy Act. Requests received by those offices will usually be forwarded to the relevant processing branch. [A7.45]

The Immigration and Protection Tribunal does not process requests for information held on INZ files. [A7.45] However, the Tribunal is required to provide INZ with a copy of the appeal and decision, and these should be on the relevant INZ file. With respect to refugee or protection decisions, only a copy of the decision is required to be provided. [A7.45]

Time limits for responding to requests

Requests actioned by INZ must be responded to as soon as reasonably practicable, but not later than 20 working days from receipt. [A7.25]

If an extension of time is notified under section 48 of the Privacy Act, the person requesting the information must be advised of the right to complain about the extension to the Privacy Commissioner. Only one extension may be notified. [A7.25]

Urgent requests

Reasons why a request is urgent must be given and these should be taken into account when responding to the request. [A7.30] See also Privacy Act 2020 ss 41, 60.

Charges for information

INZ, as a public sector agency, cannot charge for a request made under the Privacy Act. [A7.35] This includes any request for access to or correction of personal information. See also Privacy Act 2020 section 66.

Form in which the information is released

Information should be provided in the way preferred by the individual requesting it unless doing so would impair efficient administration, be contrary to any legal duty of INZ in respect of the document, or prejudice one of the interests protected by the withholding provisions of the Privacy Act. [A7.50]

Normally, INZ provides:

• a photocopy of the information requested, including a print of the Customer Interaction Notes from AMS, the Client Information Report, and the Application Information Report for each application; or
• a reasonable opportunity to inspect documents, or to listen to or view recordings; or
• an excerpt or summary of the information if some information is being withheld or deleted from a document. [A7.50]

Release of information originating from the New Zealand Police

Standard New Zealand Police certificates may be released. [A7.55] Any other information originating from the New Zealand Police or Interpol should not be released without first consulting the Privacy Officer at Police National Headquarters, Wellington. [A7.55] Alternatively, the request may be transferred to the New Zealand Police National Headquarters for handling. [A7.55]

Withholding information

INZ may refuse to disclose personal information in certain circumstances. Section A7.60 sets out non‑exhaustive guidelines for withholding information under the Privacy Act 2020. [A7.60]

The reasons for withholding include:

• disclosure would be likely to prejudice the maintenance of the law, including preventing, investigating, and detecting offences, and the right to a fair trial (this includes information that would be likely to identify informants, or restricted information such as risk advice); [A7.60]
• disclosure would be likely to pose a serious threat to the life, health, or safety of any individual, or to public health or public safety, or create a significant likelihood of serious harassment of an individual; [A7.60]
• the information is about another person who is the victim of an offence or an alleged offence, and disclosure would cause significant distress, loss of dignity, or injury to feelings; [A7.60]
• the information relates to the physical or mental health of the requestor and disclosure would be likely to prejudice the health of that individual (note: requires consultation, where practicable, with the individual's health practitioner); [A7.60]
• the individual concerned is under the age of 16 and disclosure would be contrary to their interests; [A7.60]
• the information is about an individual who has been convicted of an offence or is or has been detained in custody, and disclosure would be likely to prejudice safe custody or rehabilitation; [A7.60]
• disclosure would breach legal professional privilege (the confidentiality of dealings between client and lawyer, including requests for legal advice and the advice itself); [A7.60]
• disclosure would be likely to prejudice New Zealand's security or defence or the international relations of the New Zealand Government; [A7.60]
• disclosure would be likely to prejudice the entrusting of confidential information to the New Zealand Government by other governments or international organisations (it may be possible to release a summary of the information but withhold the identity of the source); [A7.60]
• release would disclose a trade secret or would be likely unreasonably to prejudice the commercial position of the person supplying or who is the subject of the information, and there is no countervailing public interest consideration; [A7.60]
• the information is not readily retrievable or does not exist or cannot be found (this can only be used after a thorough, fully documented search); [A7.60]
• disclosure would constitute contempt of Court or of the House of Representatives (for example, where a Court has made an order prohibiting publication of a person's name or other details). [A7.60]

Certain personal information is excluded from disclosure altogether: information contained in any communication between the Office of the Ombudsman and INZ, or the Office of the Privacy Commissioner and INZ, relating to an investigation under the Ombudsmen Act, the Official Information Act, or the Privacy Act 2020. [A7.60]

Reasons for refusal and right to complain to the Privacy Commissioner

If information is withheld, the following must also occur [A7.65]:

• the reasons why that information has been withheld must be given, with reference to the appropriate section of the Privacy Act 2020 (a copy of the withheld information must be placed in a secure folder) [A7.65];
• the requestor must be advised of the right to seek an investigation and review of the refusal by writing to the Privacy Commissioner [A7.65].

This ensures that the requestor is informed of the basis for withholding and the available remedy under the Privacy Act. [A7.65]

Right to request correction of personal information

In all responses to information requests — regardless of whether any information has been withheld — the requester must be advised of the right under information privacy principle 7 to request correction of personal information, and to request that there be attached to the information a statement of the correction sought but not made. [A7.70] This obligation applies to every response, not merely those that include a refusal. See also Privacy Act 2020 ss 22, 63, 64.

The Privacy Commissioner under the Privacy Act 2020

Under the Privacy Act 2020, the Privacy Commissioner has the following functions [A10.1]:

• Making public statements on matters affecting individual privacy.
• Investigating complaints about breaches of privacy.
• Building and promoting an understanding of the privacy principles.
• Monitoring and examining the impact that technology has on privacy.
• Developing codes of practice for specific industries or sectors.
• Examining draft legislation for its possible impact on individual privacy.
• Monitoring data matching programmes between government departments.
• Inquiring into any matter where it appears that individual privacy may be affected.
• Receiving reports of notifiable privacy breaches.
• Monitoring and enforcing compliance with the Privacy Act.
• Reporting to government on matters affecting privacy, both domestic and international.

The Privacy Commissioner also acts under sections 17, 20, 71, and 72 of the Privacy Act 2020. [A10.1]

Interpretation & edge cases

Because the operational manual contains no further detail on privacy beyond the A7 reference, officers and advisers must consult the Privacy Act 2020 directly and any published INZ privacy policies. Section A7.5 explicitly states that the operational manual does not replace the Ministry of Business, Innovation and Employment's Privacy Act Policy; therefore that policy must be consulted alongside the Act. [A7.5] The interaction between privacy and the fairness/natural justice obligations in A1 is important: where personal information is potentially prejudicial to an applicant, fairness principles may require disclosure to the applicant even if privacy considerations would otherwise restrict disclosure. INZ must balance its privacy obligations with its duty to act fairly. [A7]

Citations

• A7 — Privacy Act
• A7.1 — Objectives of the Privacy Act 2020
• A7.5 — Privacy Act Policy
• A7.10 — Who may make a request under the Privacy Act 2020
• A7.15 — Establishing identity
• A7.20 — Reasonable assistance and transferring requests
• A7.25 — Time limits
• A7.30 — Urgent requests
• A7.35 — Charges for information
• A7.40 — Which Branch responds to the request
• A7.45 — Requests to National Office or the Immigration and Protection Tribunal
• A7.50 — Form in which the information may be released
• A7.55 — Release of information originating from the New Zealand Police
• A7.60 — Guidelines for withholding information
• A7.65 — Reasons for refusal to be given and right of complaint to the Privacy Commissioner
• A7.70 — Right to request correction of information
• A7.75 — Requests for information by other Government agencies
• A7.80 — Disclosure of information overseas under section 305 of the Immigration Act 2009
• A8.75 — Disclosure of information overseas under section 305 of the Immigration Act 2009
• A10.1 — Privacy Act 2020