From:
S241
To:
s 9(2)(a)
"[email address]"
Subject:
New Application - Auror Limited
Date:
Monday, 23 May 2022 1:53:00 pm
Attachments:
Auror Limited Draft Terms and Conditions.docx
Re NZTA CA05 Application - Auror Limited.msg
image003.png
Kia ora
We have received the attached non-standard application for Auror Limited. They currently have
an authorisation which is due to expire on 13 September 2022:
https://gazette.govt.nz/notice/id/2017-au4742
ACT 1982
We have no concerns with their application, and there have been no previous complaints in
relation to their access.
Attached is a draft set of terms and conditions we’ve prepared, with some expansion on the
existing purpose to define how the personal information obtained can be used by Auror. We
propose to grant the application for a period of 5 years.
Can you please review the attached and provide your comments and/or recommendations on or
before the close of business on 6 June 2022.
INFORMATION
Thank you
Kind regards
Gemma Rush (she/her)
Senior Case Officer, Exemptions & Registers Integrity
Te Roopu Waeture | Regulatory Services
Waka Kotahi NZ Transport Agency
Palmerston North
Private Bag 11777, Palmerston North 4442, New Zealand
twitter |
youtube | facebook
RELEASED UNDER THE OFFICIAL
Pursuant to section 241 of the Land Transport Act 1998 and my delegated authority, I authorise the
User - for the Specified Purpose, during the Term, and on the Conditions below - to have access to
the names and addresses of persons currently registered to motor vehicles:
• Who are currently registered in respect of a motor vehicle; and
• Who have not instructed the Registrar of Motor Vehicles that they do not wish to have their
names and addresses made available under section 241(1).
Person (User): Auror Limited
ACT 1982
Purpose(s):
Where the occupant(s) of a motor vehicle have failed to pay the full amount for goods or services
obtained from a fuel supplier, where Auror Limited has entered into a contract with that fuel
supplier instructing them to instructing them to investigate fuel theft at a service station.
In order for Auror Limited to:
• To send a letter to the registered person advising them of the failure to pay and requesting
payment (including details of possible methods of making payment); or
• Provide the registered person information to debt collection services for the purposes of
lawfully collecting the debt
INFORMATION
Term: Commencing on [date] this notice expires at midnight on [date] but may be revoked at any
time.
Definitions:
authorised access means access or use of information that has been authorised under the terms of
this notice
Failed to pay the full amount for goods or services means: the occupant(s) has ether:
• obtained/received/taken goods or services without attempting to pay for them; or
• Has paid the full amount for one or more of the goods or services obtained but has failed to
pay for other goods or services also obtained, for example has paid for an item purchased
at the fuel station but has failed to pay for the fuel obtained from the service station; or
• has claimed that they do not have enough money to pay for the goods or services obtained,
and has then left with these goods or services, without having paid the full amount for
them.
For the avoidance of doubt, this excludes underpayment by occupants as the result of an error by a
fuel supplier or their employees or agents, information must not be accessed for this purpose.
notice means the
Gazette notice providing authorised access under section 241 of the Land
Transport Act 1998 to the User
personal information means the names and addresses of persons:
• who are currently registered in respect of a motor vehicle; and
• who have not instructed the Registrar of Motor Vehicles that they do not wish to have their
names and addresses made available under section 241(1)
Waka Kotahi means the New Zealand Transport Agency
RELEASED UNDER THE OFFICIAL
unauthorised access means access or use of information that is not authorised access
User means Auror Limited authorised by Waka Kotahi under Section 241 for these terms and
conditions
Conditions:
General
1. The User must only access information for the specified purpose.
2. Information must only be accessed by the User on its own behalf.
3. Information obtained under this authorisation shall not be disclosed to any third party
unless such disclosure is necessary to achieve a specified purpose.
Notifying relevant person that their information was accessed
4. The User must notify every person of which they have accessed their person information
from the motor vehicle register that:
a. The User obtained their information from the motor vehicle register; and
b. The relevant gazette notice under which the User had the authority to do this; and
c.
What the information was used for; and
d. The person can notify the Registrar that they do not wish to have their names and
addresses made available under an authorisation.
5. A notification made under clause 4 must be made in writing and a copy of the notification
ACT 1982
must be kept on record in accordance with clauses 12-14.
Security systems
6. Each individual person who can access the motor vehicle register on behalf of the User
must be provided with unique and identifiable log-in details that must be used each time
the individual person accesses the register. These unique details must not be shared with
any other person.
7. The User must have adequate systems and policies in place that prevent unauthorised
access from occurring, including to:
a. provide security of information technology and data against unauthorised access;
and
INFORMATION
b. ensure all staff members who use or have access to the motor vehicle register have
completed training that complies with clauses 10 and 11; and
c.
ensure information accessed from the motor vehicle register is limited to
information needed to achieve the specific purpose for which the information is
accessed; and
d. ensure personal information is retained no longer than is necessary for the specific
purpose for which information is accessed; and
e. assist the User to identify unauthorised access, or suspected unauthorised access,
including having individual log-ins under clause 6.
Privacy breaches
8. If the User suspects that unauthorised access has occurred (including by any staff, whether
or not acting within the authority of the User), the User must notify Waka Kotahi as soon as
practicable but no later than 7 days, after forming a suspicion.
9. If the User finds that unauthorised access has occurred, the User must immediately notify
Waka Kotahi and the Privacy Commissioner.
Training
10. Staff of the User must not have access to the motor vehicle register unless they have
completed training in accessing information in accordance with section 241 and the terms
of this notice, including training on:
a. when the User can access information under section 241; and
b. how to ensure record keeping requirements are met; and
c.
how to ensure information that is obtained from the motor vehicle register is
protected; and
RELEASED UNDER THE OFFICIAL
d. when and how to safely destroy information that was obtained from the motor
vehicle register; and
e. Obligations under the Privacy Act 2020 and information privacy principles,
including as set out in learning modules and information made available by the
Office of the Privacy Commissioner.
11. All staff must complete a refresher training course every 6 to 12 months after the date that
they last completed the training course.
2
Record keeping and auditing
12. The User must keep a record of every time it accesses the motor vehicle register.
13. The record must be kept for a period of at least 18 months from the date of access.
14. The record must include:
a. the date the motor vehicle register was accessed; and
b. the relevant plate number for the information accessed; and
c.
the individual log-in that accessed the motor vehicle register on behalf of the User;
and
d. the reason the User accessed the information, including an explanation and
supporting material establishing that the specific circumstances fell within the
specified purpose; and
e. A copy of a notification made under clauses 4 and 5.
ACT 1982
15. Records must be made available to Waka Kotahi on request, as soon as practicable but no
later than:
a. 7 days after the date of the request - if the request is in relation to an incident or
suspected incident; or
b. 10 working days - if the request is for monitoring or auditing purposes.
16. The User must also provide such information as Waka Kotahi reasonably considers relevant
to determining whether and how the User complies with these conditions.
17. Names and addresses obtained from the register must not be retained for longer than
required to achieve the specified purpose.
Reporting
INFORMATION
18. Every 12 months the User must provide Waka Kotahi with a report containing:
a. evidence that clauses 12 to 17 have been complied with; and
b. a record of staff training that has taken place in accordance with the requirements
in clauses 10 and 11 over the last 12 month reporting period; and
c.
all actions taken in relation to all instances, or suspected instances, of
unauthorised access over the last 12 month reporting period.
Fees
19. The User must pay the applicable fees for accessing the motor vehicle register.
Other
20. If the User or any staff (whether or not acting within the authority of the User) breach any
conditions, then Waka Kotahi may immediately suspend or cancel the User’s access to
personal information on the motor vehicle register (under section 241(6) or (2)).
21. Nothing in this notice affects the User’s obligations under the Privacy Act 2020.
Sign off
(Director of Land Transport/Senior Manger Vehicle and Driver Licencing)
RELEASED UNDER THE OFFICIAL
3
Document Outline
