Skip to main content

Disclaimer: Educational purposes only. Not legal advice. Consult a qualified NZ legal practitioner for your specific circumstances.

SimplifiedLaw.co.nz
general

Can a business charge you to access your personal data?

Key Takeaway

In New Zealand, individuals generally have a right to access their personal information held by a business. A business typically cannot charge for this access, but there are specific, limited exceptions, particularly for private sector agencies where the information is not readily retrievable, or for repetitious requests. Any charge must be reasonable.

Accessing Your Personal Data from a Business in New Zealand

Individuals in New Zealand generally have the right to request access to personal information that businesses, known as "agencies" under the law, hold about them. An "agency" is any person or body of persons, whether corporate or unincorporate, and includes government departments, public sector organisations, and private sector businesses [Source: Privacy Act 2020, s 7]. "Personal information" refers to information about an identifiable individual [Source: Privacy Act 2020, s 7].

The Right to Access Personal Information

The fundamental right to access one's own personal information is established by Information Privacy Principle 6 (IPP 6). This principle states that an individual has the right to request from an agency whether it holds personal information about them, and if so, to access that information [Source: Privacy Act 2020, s 22, IPP 6].

Can a Business Charge for Access?

Generally, an agency must not charge an individual for making a request for their personal information, or for making that information available [Source: Privacy Act 2020, s 45(1)]. This means that in most cases, businesses are expected to provide individuals with access to their personal data free of charge.

However, there are specific, limited circumstances where an agency may impose a charge for providing access to personal information:

  1. Non-Public Sector Agencies and Readily Retrievable Information: A private sector agency (i.e., not a public sector agency like a government department) may charge if the information is not readily retrievable. "Readily retrievable" means the information cannot be retrieved by a quick and simple operation [Source: Privacy Act 2020, s 45(2)].
  2. Repetitious or Unreasonable Requests: An agency may charge if the information has already been provided to the individual in response to a previous request, and the agency considers the subsequent request to be repetitious or unreasonable [Source: Privacy Act 2020, s 45(3)].

Limits on Charges

Where an agency is permitted to charge for access, any charge imposed must be reasonable and must not be excessive [Source: Privacy Act 2020, s 45(4)]. Before an agency makes information available or imposes a charge, it must inform the individual of the estimated charge [Source: Privacy Act 2020, s 45(5)].

Making an Access Request

A request for access to personal information must be made in writing [Source: Privacy Act 2020, s 50(1)]. While the Act does not specify a particular format, it is advisable to clearly state that it is an access request under the Privacy Act 2020.

Time Limits for Response

An agency is required to respond to an access request as soon as reasonably practicable, and in any case, no later than 20 working days after the day on which the request is received [Source: Privacy Act 2020, s 46(1)].

Grounds for Refusal

The Privacy Act 2020 outlines specific and limited grounds under which an agency may refuse to provide access to personal information. These grounds include, for example, if providing the information would endanger the safety of any individual, or would involve an unwarranted disclosure of the affairs of another individual [Source: Privacy Act 2020, s 49]. If an agency refuses an access request, it must provide the reasons for refusal [Source: Privacy Act 2020, s 55].

Redress for Concerns

If an individual is dissatisfied with an agency's decision regarding their access request, including a decision to impose a charge, they may make a complaint to the Privacy Commissioner [Source: Privacy Act 2020, s 67, s 69]. The Privacy Commissioner has powers to investigate and resolve such complaints.

When to Seek Independent Legal Advice

Individuals who are unsure about their rights concerning access to personal data, have had an access request refused, or believe an imposed charge is excessive, may seek independent legal advice. Information and guidance can be obtained from the Office of the Privacy Commissioner, or free advice may be available from Community Law Centres.

Key Resources