A guide to charging for personal information under the
Privacy Act 2020 for agencies
Charges should be the exception – not the rule!
In most circumstances, an agency should not be charging a fee to a requester for
accessing or, if the information is not correct or up to date, correcting, their
personal information. The spirit of the Privacy Act 2020 (Privacy Act) is to allow
people to have access to and correct their personal information. This means there
should be as few barriers as possible – including cost.
However, there are some circumstances where it may be appropriate for an agency
to charge people to access or correct their personal information. This guide aims
to help you understand when you can charge and what you can charge for under
the Privacy Act.
Who can charge? – Section 66
Private sector1 agencies may impose a charge for:
• Making information available, in whole or in part, with respect to a request.
• Providing assistance to a person who wants to or is making a request for
information, or a request for correction – but only if an agency is making
some information available.
• Attaching a statement of correction to personal information.
Public sector2 agencies cannot charge a person for accessing their personal
information, or for attaching a statement of correction to that information, unless
the Privacy Commissioner has authorised that agency to impose a charge.3
There are special rules that apply to health or credit agencies.
What can I charge for?
An agency can only charge to provide someone with their personal information,
and not for assessing whether the agency will provide that information. For
example, if you think you can withhold some information, you cannot charge for
the time it takes to determine what withholding grounds apply to the relevant
information, even though this may be time-consuming.
1 See section 7 of the Privacy Act for the definition of private sector agency
2 See section 7 of the Privacy Act for the definition of public sector agency
3 Under section 67 the Privacy Commissioner can authorise a public sector agency to charge, if the
Commissioner is satisfied the public sector agency will be commercially disadvantaged in comparison
with any private sector competitor. Generally, a public sector agency is unlikely to have a commercial
position or private sector competitor and is therefore unlikely to be able to apply for such
authorisation.
The table below provides some examples of what you can charge for. This list is not
determinative – if you have any questions about what you can charge for, you can
get in touch with us and we will do our best to assist you.
Can charge
Cannot charge
• Cost of photocopying or
• Time spent reviewing the
scanning the documents
information to determine
whether any withholding
• Cost of a USB stick or postage
grounds apply
• Time spent locating the relevant
• If an agency refuses a request
information
• Time spent transferring a
• Time spent redacting
request to another agency
information from a document
where there is good reason to
withhold it
Charges must be reasonable
Any charge imposed must be reasonable. This is because the right to access your
personal information is one of the fundamental rights set out in the Privacy Act.
What is reasonable will depend on the specific factors of each request and you will
need to consider each charge as it comes. A reasonable charge can often be lower
than the actual cost in responding to a request.
The Privacy Act says you may want to consider:
• The cost of labour and materials involved in making the information
available
• Any costs involved in making the information available urgently.
Other factors you may want to consider include:
• Is the information where it should be? - You can’t charge more because you
have poor retention or information management policies.
• Are you making the information available in the form requested? Is there an
alternative and less expensive way of making the information available that
you can discuss with the requestor? – For example, providing the
information by email, or couriering a USB stick, will often be a less expensive
option. If the person is happy to receive the information by email, you should
not be charging for the cost of photocopying and posting the documents.
2
The Office of the Privacy Commissioner and the Human Rights Review Tribunal
have previously relied on the amounts indicated in the Ministry of Justice
charging
guidelines for handling Official Information Act4 requests as a reference for
requests under the Privacy Act.
Those guidelines, which also provide that a charge should represent a reasonable
fee for access, state that:
• The first hour of staff time is free
• The first 20 pages of photocopying are free
• After the first hour, you can charge $38 per half hour of staff time
• After the first 20 pages you can charge 20 cents per page
We would consider this a useful starting point when considering a request under
the Privacy Act. However, it is important to remember you need to assess each
situation based on its specific facts. In many cases the amount you can charge will
be less than what these guidelines suggest, it is rare a higher charge will be
justifiable.
Charge means release
If you are going to impose a charge, you generally need to have already made the
decision to either release some or all the information or decided to attach the
statement of correction.
Sections 44 and 45 of the Act set out how you must respond to a request for
information. If you decide to release information and impose a charge, you must
tell the requester: 5
• Whether you are imposing a charge
• How much that charge is
• Whether they must pay you in advance (whether partially or in full)
• That they have a right to make a complaint to our Office about the charge
You can also charge for providing assistance to someone when they want to make
an access request or attach a statement of correction. If want to charge for this
assistance before
you have made your decision, you will need to tell the requester
the above information then.
4 https://www.justice.govt.nz/about/official-information-act-requests/directory-of-official-
information/charging-guidelines-for-oia-requests/
5 Section 45(1) Privacy Act 2020
3
What if the requester disagrees with a decision to charge or the amount?
If a person is unhappy with your decision to charge them for their information or
for correction, or if they are unhappy with the amount proposed, they can make a
complaint to our Office.
If the Privacy Commissioner considers the charge is unreasonable, the
Commissioner can make a binding determination on how much an agency can
charge. 6
It may also be an interference with a person’s privacy, if you decide to charge, or
decide to charge an unreasonable amount, without a proper basis for that decision.
7
Other useful links
The Human Rights Review Tribunal has considered charges in the following case:
•
Director of Human Rights Proceedings v Schubach [2015] NZHRRT 4 –
where a lawyer required a charge of $800 before releasing personal
information. The Tribunal found an interference with privacy and required
the lawyer to release the information without charge. It also awarded
around $11,000 in damages to the individual.
We have some case notes which consider charges here:
•
Case note 294559 – A law firm wanted to charge $19,000 for information.
The Commissioner found a reasonable charge was $7.99 – the cost of a USB
stick. The Tribunal also awarded damages – see our write up
here8.
•
Case Note 204595 – the Commissioner found a reasonable charge of $150
for access to personal information held by an accountant (being about 500
pages of information). The fee amounted to one chargeable hour of time
spent photocopying.
•
Case Note 7844 – Taking into account the cost of photocopying and
associated labour, the Commissioner found a reasonable charge for
information held by a private sector company to be $122.65.
If you have any questions about charging someone for accessing and correcting
personal information, please contact us using o
ur online enquiries form or on 0800
803 909.
6 Section 93(3) Privacy Act 2020
7 Section 69(3)(c) Privacy Act 2020
8 https://privacy.org.nz/blog/tribunal-awards-20000-against-law-firm/
4
Specialist agencies – health information and credit information
Health Information
The Health Information Privacy Code9 limits the circumstances where a health
agency can charge a person for providing their health information.
Public sector health agencies (like Health New Zealand) cannot impose a charge
on a person requesting their health information or seeking correction.
Private sector health agencies (like a GP, private clinic, health insurer) can only
impose a charge for access to health information if:
• It has already made the same or substantially the same health information
available to the individual, in response to a request, within the last 12 months
• It is providing a copy of an x-ray, a video recording, an MRI scan photograph,
a PET scan photograph, or a CAT scan photograph.
o The rationale behind this is to cover the cost of file. If the individual
has requested the health agency email them these scans, we would
generally consider the charge unnecessary.
If the charge is likely to exceed $30, you need to give the person an estimate of the
charge before dealing with the request. You can request the payment be made
before you provide the information to the person.
Credit information
Credit reporters cannot charge for:10
o Responding to a request for confirmation a credit reporter holds any credit
information about them or for access to their credit information no later
than 20 working days.
o Correcting any credit information.
o Providing the individual with a copy of any corrected information under rule
7(8)(b).
Credit reporters can charge if a person requests their credit information is made
available to them within 3 working days. This charge cannot be more than $10.
(including GST).
9 See cl 6 Health Information Privacy Code 2020
10 See cl 6 Credit Reporting Privacy Code 2020
5
Charging at a quick glance
Public Sector Agency (including Health)
You can only charge if the Commissioner
You
CANNOT charge an individual for the
authorised you under section 67 of the
costs involved in:
Privacy Act where there is commercial
- Responding to a request under
disadvantage with any private sector
principle 6 or rule 6
competitor.
- Correcting information under principle
7 or rule 7
Private Sector Agency
You can charge a
reasonable amount for:
You
CANNOT charge an individual for the
- Providing assistance to a person
costs involved in:
wishing to or making a request ONLY if - Processing a request for personal
information is made available
information
- Making information available
- Correcting information following a
- Attaching a statement of correction
principle/rule 7 request
under principle or rule 7
Credit Reporter
You can charge no more than $10 if the
You
CANNOT charge an individual for the
individual requests their credit
costs involved in:
information be made available
within
- Providing assistance
three working days
- Responding to a request
- Correcting information
- Attaching a statement of correction
Private Sector Health Agency
You can charge a
reasonable amount for
You
CANNOT charge an individual for the
providing access to:
costs involved in:
- An X-Ray, video recording, MRI, PET or
- Providing assistance
CAT Scan photograph,
- Responding to a request to any other
- The same or substantially the same
information
health information already made
- Correcting information
available after a request made within
- Attaching a statement of correction
the last 12 months,
- Principle or rule 7
6
