Who can access my records?

What Privacy Act principles allow other people to access my records?

Knowing that other people have access to records about you that you may not have accessed yet, can bring up a range of emotions. Find out what help and support is available to you.

The Privacy Act 2020open_in_new controls how organisations can collect, use, share and store personal information.

 
Principle 11 of the Privacy Act (‘Disclosure of personal information’) explains who an organisation can give access to records about you. Principle 11 means that generally, an organisation cannot give another person or organisation access to your information unless there is a legal reason.  

Principle 10 explains how an organisation can use your personal information. Principle 10 means that organisations can generally only use personal information for the purpose it was collected, and there are limits to using personal information for different purposes. 

Who can access my records? 

The people who may be able to access your records include: 

• you
• anyone you give permission to access the records (for example, you could give a whānau member permission to request your records for you)
• staff at the organisation that holds records about you, who need to access your information to do their job. For example, if you request your records from Oranga Tamariki:
  • a staff member will read a copy of your records as they may need to redact some information before giving the copy to you
  • a staff member will check your identity before giving you a copy of your records. They may do this by asking you questions that only the person the records are about, could answer correctly
• staff at the place where you are or were (for example, if you are in a hospital, hospital staff involved in your treatment have access to your hospital records)
• your lawyer and / or the record holder’s lawyer, if you are taking legal action against the record holder or have asked a lawyer to help request your records for you
• the administrator of your estate, after you have died 
• your legal representative according to your enduring power of attorney, if you have lost mental capacity
• if you are a survivor of abuse in care and are a complainant in a criminal case against the abuser, the abuser’s lawyer may ask the Court for access to records about you. 

Some government agencies can share your records with other agencies 

Some government agencies are allowed to, or are required to, share your personal information with another government agency under the Privacy Act or other legislation.

For example, the Ministry of Social Development, Oranga Tamariki, the Ministry of Justice and other agencies can share information to protect children and young people from family violence. 

MSD Historic Claims and Oranga Tamariki can share information with the Police 

If reports of abuse or other criminal offending about a person are made, than MSD Historic Claims and Oranga Tamariki may need to share that information with the Police. 

What can I do if someone has wrongly accessed my records? 

If you are worried that an organisation has given a person or another organisation access to your records when they should not have, you can first contact the organisation who holds your records.  

If you are unhappy with the organisation’s response to your concerns, you can make a complaint to the Office of the Privacy Commissioner.  

Learn how to make a complaint with the Privacy Commissioner. 

Some historical records were wrongly made publicly accessible 

In 2019, Archives NZ and Oranga Tamariki discovered that some historical records in the Archives collection that had individuals’ personal details, had been mistakenly classified as open-access'.

This meant people could access these records without permission from Oranga Tamariki, who was the controlling agency for the records.  

In their media release, they said they were correcting this and encouraged other agencies to review the classification of records they have transferred to Archives NZ.