The Statutes Amendment Bill (currently awaiting first reading) includes some small but useful changes to the Privacy Act 2020.
One of these is that the Bill will reinstate a ground for refusing a request to access information that was omitted when the 2020 Act was redrafted: that the information is not held in a way that is readily retrievable. This is an important exception for agencies to have available in complex digital information environments, where an agency may technically “hold” the information but be unable to retrieve it (either at all, or at least without disproportionately expensive forensic effort). The omission from the new Act has created some difficulties in practice.
Importantly, though, this exception is targeted at situations where it is genuinely impractical to ask the agency to go to the lengths necessary to retrieve the information. It is important to interpret it strictly – exactly as the 1993 Act did – so that people’s rights to access their information are not undermined. For example, agencies cannot claim that information is ‘not held in a way that is readily retrievable’ simply because their record keeping is scattered or inefficient, their access request processes are sub-par, or their information management systems are inadequate. It will not automatically apply simply because retrieval might take a lot of time, money or effort. Nor will it apply simply because a third party (such as a cloud storage company) holds the information on behalf of the agency. Being able to retrieve information quickly and easily if there is a request should be a core aspect of the contract that an agency has with any third party provider.
The Bill also contains some other welcome changes, such as clarifying when an agency is acting as an “agent” for someone else, and giving the Commissioner some additional flexibility about deciding not to investigate matters where that would be inappropriate.