This is our policy for how we respond to, and report on, requests from government agencies for your personal information. This policy helps us maintain a consistent approach to dealing with government agencies and considering when it is necessary to release private information. It guides our internal practices and processes to protect private information that we hold.
This policy makes it clear:
The situations in which we will release personal information in response to requests from government agencies
that we will decline requests where we are not convinced that there is adequate reason to disclose personal information, or that we use this policy for requests and orders for personal information, metadata and content of communications.
Court orders and other powers
We are required to share your information with government agencies when:
we are served with a court issued warrant or production order the government agency is using a power given to them by law, (which requires information to be disclosed when requested).
Every government agency which requests personal information must tell us the legal grounds for the request.
Voluntarily releasing customer information
As a responsible corporate citizen we may voluntarily release personal information to government agencies, either on request, or as we judge necessary. We will only voluntarily release information in line with GDPR.
GDPR sets out the exceptions that enable organisations (public or private) to share information and potentially breach an individuals privacy. We take these exceptions seriously, and have carefully considered when we think it is necessary to disclose personal information in order to maintain the law and avoid harm to New Zealand society.
It is our policy to only voluntarily release personal information in the following situations;
- We will confirm that a person is a customer of our company (to assist preliminary criminal investigations).
- We will release personal information when we believe there is a serious threat to an individual (for example a missing persons case, a suspected homicide or a medical emergency).
- We will share personal information if we think it is necessary to protect public health or safety (e.g. a bomb threat, or potential disease outbreak).
- When we are involved in a criminal or civil court case and personal information is needed to assist the court.
We assess each request separately and government agencies must provide us with sufficient information for us to be confident that releasing the information is justified and reasonable given the circumstances.
If these questions are not adequately answered, or the request does not relate to the situations listed above, then we will not provide personal information.
We commit to publicly report every year on the number and type of requests for personal information that we received from government agencies. We do this to provide transparency about our processes for managing requests and to help New Zealanders understand the scope and scale of personal information that government agencies aquire from New Zealand organisations.
Sometimes we are prohibited from disclosing the existence of a warrant. This usually happens in national security cases and is outside of our control.
How government agencies can seek your information from us
This is a high level summary of the types of powers that government agencies can use. It is meant to help inform your customers about the categories of requests that you receive. This section supports the information that you will display in your transparency report.
Warrants and other Court orders
Court orders can compel us to provide a government agency with specific information. Types of court orders include:
- Search warrants
- Production orders
- Domestic and foreign intelligence warrants
There are also legal powers agencies can use to compel us to release certain information for specific purposes. These powers include the Tax Administration Act (e.g. to uncover fraud or tax evasion), and the Social Securities Act (e.g for welfare fraud investigations).
Requesting voluntary disclosure
In the absence of a court order or statutory power we have discretion to release customer information under GDPR. GDPR provides that an agency that holds personal information shall not disclose the information unless the agency believes, on reasonable grounds, that an exception applies.
These exceptions require us to believe (based on evidence we have or that is given to us) that releasing the personal information is necessary given the circumstances. The situations in which we would release personal information are set out above, in this policy.