I recommend taking it to the Ombudsman on the following grounds:
- the grounds cited do not appear to be relevant to all the information requested. In particular, its hard to see how disclosing the data gathered and how long it is retained for would prejudice either the maintenance of the law or the commercial operations of the Council. Its just a straight privacy request. Likewise the type of card used.
- s6(a), maintenance of the law: it is unclear what harm would be done here. Disclosure would not obviously e.g. threaten fair trial rights or police operations to detect crime. Insofar as it might, that harm must be shown to be "likely"; if its not obvious that it threatens those interests, its even less obvious that such harm would likely occur.
- for s7(2)(h) , they need to not just claim it prejudices commercial activities, but that such prejudice is likely to occur, and that it is not outweighed by the public interest in release. They appear not to have considered the latter (which is automatic grounds for complaint), and again its difficult to see what the prejudice is, let alone its likelihood. If the concern is that if they reveal this information, then the weakness of their security will be exposed, as recently happened in Christchurch, then that in fact points to a strong public interest in release, in that it enables the system to be made secure, and those responsible for the implementation of an insecure system to be held accountable by the public - which is precisely what the Act is for (see the purpose clause).

If this fails, then you can extract the information another way: a straight-out Privacy Act request for all information associated with your card. That should show what is collected and how long it is retained for, at the least.

I've sent a complaint to the Ombudsman, mainly concerning the denial of my point about the data collection, the lateness of the reply, and that I wasn't informed about my right to make a complaint to the Ombudsman if I was dissatisfied with the outcome (section 18 (b), Local Government Official Information and Meetings Act 1987)

Just a quick update, Ombudsmen still hasn't started looking into this case so no word yet.

Their response isn't comprehensive or particularly explanative and its brevity only barely just meets a level of adequacy to answer your points. A long ten months to wait to get a paltry response from officials who are paid by the Otago ratepayers.