From:
Emily Moon
To:
Gemma Rush
Cc:
Melissa Burns;
Juliet Esposito
Subject:
RE: 241 Templates and Guidance
Date:
Monday, 16 May 2022 5:15:03 pm
Attachments:
image001.png
image002.jpg
Template of Standard core conditions of 241 access.docx
Hi Gemma
I suspect Juliet and I will struggle to get to these applications this week – Out of Scope
With that in mind, perhaps it
would be best if you proceed with these applications without Juliet and I as the “panel”.
ACT 1982
However, given they are already in my inbox, I have had quick a look at your emails (without
carrying out any substantive review or opening at the attachments) and make the following
comments:
Out of Scope
INFORMATION
Auror
- If you are happy with their application and don’t need further detail, then no need
to ask for further information
- I’d be happy to review draft Ts&Cs if you can put some together – I’ve attached the
standard template that Juliet and I have worked off in the past, you can tailor it to
suit
Out of Scope
Thanks!
Ngā mihi
Emily
Emily Moon (she/her) BA, LLB
Legal Counsel, Commercial
Corporate Support
DDI +s 9(2)(a)
/ M s 9(2)(a)
RELEASED UNDER THE OFFICIAL
From: Gemma Rush <[email address]>
Sent: Monday, 16 May 2022 4:53 pm
To: Juliet Esposito <[email address]>; Emily Moon <[email address]>
Cc: Melissa Burns <[email address]>
Subject: RE: 241 Templates and Guidance
Hi Juliet
I really appreciate the time and effort yourself and Emily have given to put together the guidance
document and templates for us, thank you.
I’m just wondering where that leaves us in terms of the applications already send through to
your recommendations? This includes the
, Auror Limited and
Out of Scope
Out of Scope
.
ACT 1982
Kind regards
Gemma Rush (she/her)
Senior Case Officer, Exemptions & Registers Integrity
Te Roopu Waeture | Regulatory Services
Waka Kotahi NZ Transport Agency
Palmerston North
Private Bag 11777, Palmerston North 4442, New Zealand
twitter |
youtube | facebook
INFORMATION
From: Juliet Esposito <[email address]>
Sent: Thursday, 12 May 2022 4:48 PM
To: Gemma Rush <
[email address]>
Cc: Melissa Burns <[email address]>; Emily Moon <[email address]>
Subject: 241 Templates and Guidance
Hi Gemma
Emily and I have been working on some guidance material and templates to provide your team
in the section 241 space. Our intention is for legal to now step off the section 241 panel but
remain involved in any compliance action/241 breaches/investigations that occur.
Of course, we are still more than happy for your team to send us specific legal questions that
come up at any time.
Training to provide new section 241 panel members/those processing applications
For the new panel members/those working in the section 241 space, we are happy to:
provide the attached guidance material and templates
provide a presentation/training session (if you think that would be helpful)
RELEASED UNDER THE OFFICIAL
Shadow the first couple of 241 panel meetings and provide any feedback/assistance.
Happy to get together to discuss a plan for the above (or hear any ideas on what training you
might like us to provide).
We do note that we are providing guidance material / templates that may differ from what is
provided in the guidance material that MoT provided Waka Kotahi in 2011, and that Waka Kotahi
are required to use its best endeavours to follow this guidance, as a condition of the delegation.
However, given that material is somewhat out of date, and the business needs guidance in this
area, we have provided the attached. If Waka Kotahi are currently not following the MoT
guidance material, then the risk likely remains the same. The conditions of the delegation should
likely be dealt with as part of the overall matter of revamping/resourcing this area, which I
understand is going to go to the board shortly.
It has been a pleasure working on the panel with you Gemma and of course always hear to help
with any issues.
ACT 1982
Thank you,
Juliet Esposito (she/her)
Legal Counsel Regulatory, Legal Team
Corporate Support
Email: [email address]
Phone (DDI): s 9(2)(a)
Mobile: s 9(2)(a)
INFORMATION
Waka Kotahi NZ Transport Agency
Chews Lane Office, 50 Victoria Street
Private Bag 6995, Wellington 6141, New Zealand
RELEASED UNDER THE OFFICIAL
Pursuant to section 241 of the Land Transport Act 1998 and my delegated authority, I authorise the
User - for the Specified Purpose, during the Term, and on the Conditions below - to have access to
the names and addresses of persons currently registered to motor vehicles:
• Who are currently registered in respect of a motor vehicle; and
• Who have not instructed the Registrar of Motor Vehicles that they do not wish to have their
names and addresses made available under section 241(1).
Person (User):
ACT 1982
Purpose(s):
Term: Commencing on xxxxx, this notice expires at midnight on xxxxx but may be revoked at any
time.
Definitions:
INFORMATION
authorised access means access or use of information that has been authorised under the terms of
this notice
unauthorised access means access or use of information that is not authorised access
notice means the
Gazette notice providing authorised access under section 241 of the Land
Transport Act 1998 to the User
personal information means the names and addresses of persons:
• who are currently registered in respect of a motor vehicle; and
• who have not instructed the Registrar of Motor Vehicles that they do not wish to have their
names and addresses made available under section 241(1)
Waka Kotahi means the New Zealand Transport Agency
User means xxxxxx authorised by Waka Kotahi under Section 241 for these standard terms and
conditions
Conditions:
General
1. The User must only access information for the specified purpose.
2. Information obtained under this authorisation shall not be disclosed to any third party
unless such disclosure is necessary to achieve a specified purpose.
RELEASED UNDER THE OFFICIAL
Notifying relevant person that their information was accessed
3. The User must notify every person of which they have accessed their person information
from the motor vehicle register that:
a. The User obtained their information from the motor vehicle register; and
b. The relevant gazette notice under which the User had the authority to do this; and
c. What the information was used for; and
d. The person can notify the Registrar that they do not wish to have their names and
addresses made available under an authorisation.
4. A notification made under clause 3 must be made in writing and a copy of the notification
must be kept on record in accordance with clauses 11-13.
Security systems
5. Each individual person who can access the motor vehicle register on behalf of the User
ACT 1982
must be provided with unique and identifiable log-in details that must be used each time
the individual person accesses the register. These unique details must not be shared with
any other person.
6. The User must have adequate systems and policies in place that prevent unauthorised
access from occurring, including to:
a. provide security of information technology and data against unauthorised access;
and
b. ensure all staff members who use or have access to the motor vehicle register have
completed training that complies with clauses 9 and 10; and
c. ensure information accessed from the motor vehicle register is limited to
INFORMATION
information needed to achieve the specific purpose for which the information is
accessed; and
d. ensure personal information is retained no longer than is necessary for the specific
purpose for which information is accessed; and
e. assist the User to identify unauthorised access, or suspected unauthorised access,
including having individual log-ins under clause 5.
Privacy breaches
7. If the User suspects that unauthorised access has occurred (including by any staff, whether
or not acting within the authority of the User), the User must notify Waka Kotahi as soon as
practicable but no later than 7 days, after forming a suspicion.
8. If the User finds that unauthorised access has occurred, the User must immediately notify
Waka Kotahi and the Privacy Commissioner.
Training
9. Staff of the User must not have access to the motor vehicle register unless they have
completed training in accessing information in accordance with section 241 and the terms
of this notice, including training on:
a. when the User can access information under section 241; and
b. how to ensure record keeping requirements are met; and
c. how to ensure information that is obtained from the motor vehicle register is
protected; and
d. when and how to safely destroy information that was obtained from the motor
vehicle register; and
e. Obligations under the Privacy Act 2020 and information privacy principles,
RELEASED UNDER THE OFFICIAL
including as set out in learning modules and information made available by the
Office of the Privacy Commissioner.
10. All staff must complete a refresher training course every 6 to 12 months after the date that
they last completed the training course.
Record keeping and auditing
11. The User must keep a record of every time it accesses the motor vehicle register.
12. The record must be kept for a period of at least 18 months from the date of access.
2
13. The record must include:
a. the date the motor vehicle register was accessed; and
b. the relevant plate number for the information accessed; and
c.
the individual log-in that accessed the motor vehicle register on behalf of the User;
and
d. the reason the User accessed the information, including an explanation and
supporting material establishing that the specific circumstances fell within the
specified purpose; and
e. A copy of a notification made under clauses 3 and 4.
14. Records must be made available to Waka Kotahi on request, as soon as practicable but no
later than:
a. 7 days after the date of the request - if the request is in relation to an incident or
ACT 1982
suspected incident; or
b. 10 working days - if the request is for monitoring or auditing purposes.
15. The User must also provide such information as Waka Kotahi reasonably considers relevant
to determining whether and how the User complies with these conditions.
16. Names and addresses obtained from the register must not be retained for longer than
required to achieve the specified purpose.
Reporting
17. Every 12 months the User must provide Waka Kotahi with a report containing:
a. evidence that clauses 11 to 16 have been complied with; and
b. a record of staff training that has taken place in accordance with the requirements
INFORMATION
in clauses 9 and 10 over the last 12 month reporting period; and
c.
all actions taken in relation to all instances, or suspected instances, of
unauthorised access over the last 12 month reporting period.
Fees
18. The User must pay the applicable fees for accessing the motor vehicle register.
Other
19. If the User or any staff (whether or not acting within the authority of the User) breach any
conditions, then Waka Kotahi may immediately suspend or cancel the User’s access to
personal information on the motor vehicle register (under section 241(6) or (2)).
20. Nothing in this notice affects the User’s obligations under the Privacy Act 2020.
Sign off
(Director of Land Transport/Senior Manger Vehicle and Driver Licencing)
RELEASED UNDER THE OFFICIAL
3
Document Outline
