Government requests for personal information to be tracked

Privacy Commissioner John Edwards at their Wellington office. Photo / Mark Mitchell

The number of times agencies such as the Police and Inland Revenue receive personal data from a range of companies is to be revealed.

Companies that hand over the information - often without a warrant or the knowledge of the customer - will now be asked to provide a record of requests to the Office of the Privacy Commissioner, which will publish a record.

Senior lawyers, privacy advocates and companies have concerns about the growth in government requests for company records and personal data.

Instead of seeking a legal order, police have asked companies to hand over the information to assist with the "maintenance of the law" - requests that carry no legal force but are regularly complied with.

Privacy Commissioner John Edwards said businesses increasingly hold a large amount of personal information that can be useful to the government's law enforcement and national security activities.

"Agencies such as the Police, Inland Revenue, the Ministry of Social Development, and a host of others have powers to obtain information from corporations, about individuals, often without the knowledge of those involved," Mr Edwards said in a speech to an annual gathering of New Zealand's intelligence community in Wellington.

"Transparency reporting, publishing reports of how often these requests or demands are made, and how many individuals are affected was initiated by Google, and others such as Facebook, Vodafone, TradeMe, and others have followed suit."

Mr Edwards said his office has been working on a pilot transparency reporting project, and had found an initial group of agencies and stakeholders generally supportive.

"This year we intend to trial asking companies to keep a standardised record of requests for information from law enforcement agencies and to report this information to us. We will then publish this information."

A range of agencies have been citing clauses in the Privacy Act to get people's personal details. Clauses in Principle 11 allowed personal information to be provided if it was for "the maintenance of the law", "protection of the public revenue", to "prevent or lessen a serious threat" to individuals and similar clauses.

Mr Edwards told the Herald that the move to publish a record of how many requests for information had been granted was not born from a concern that police or other agencies were behaving inappropriately.

"No. Because I don't know. This is the thing - we don't have much information. If we get a first round of transparency reporting from a whole bunch of agencies, that's not going to tell us very much either.

"But I think over time there will be trends. And there will be some value for people in that - knowing, whether a particular law enforcement agency is too quick to go to a telecommunications provider, for example, instead of using other methods of investigation."

Mr Edwards said reaction from companies approached had so far been mixed, and any reporting would be voluntary.

Those who agree would be asked to provide standardised information such as the number of requests received, the number of individual records the requests relate to, and the outcome.

In March, the Herald reported that police were regularly seeking personal data from airlines, banks, electricity companies, internet providers and phone companies.

Of New Zealand companies, TradeMe is unusual in its public declaration of Principle 11 clause requests it receives.

Police made warrantless requests for information on 1663 occasions ending June 2014, while other government agencies made 641 requests.