Your responsibilities

Charges should be the exception, not the rule. The spirit of the Privacy Act 2020 is to allow people to have access to and correct their personal information. This means there should be as few barriers as possible – including cost.

In most circumstances, agencies should not be charging people to access or correct their personal information. However, there are some circumstances where it may be appropriate for an agency to charge, and there are special rules that apply to health or credit agencies.

A PDF version of our full guidance is available here.

Public sector agencies

Public sector agencies like government departments can only charge people for accessing or correcting their personal information if they have been specifically authorised to do so by the Privacy Commissioner.

Private sector agencies

Private and not-for-profit sector agencies (organisations and businesses) cannot charge for:

Responding for a request from an individual for their personal information
Assessing whether they will provide that information
Processing a request for personal information
Correcting an individual’s personal information

Agencies may charge a reasonable amount for:

The cost of labour and materials involved in making information available
Costs involved in making information available urgently
Attaching a statement of correction to an individual’s personal information

Health agencies

The Health Information Privacy Code limits the circumstances where a health agency can charge a person for providing their health information.

Public sector health agencies (like Health New Zealand) cannot charge a person requesting their health information or seeking a correction to their information.

Private sector health agencies (like a GP, private clinic, health insurer) can only charge in relation to a request for a person’s health information if:

It has already made the same, or substantially the same, information available to the same individual within the last 12 months
It is providing a copy of an x-ray, a video recording, an MRI scan photograph, a PET scan photograph, or a CAT scan photograph.

If the charge is likely to exceed $30, you need to give the person an estimate of the charge before dealing with the request. You can request the payment be made before you provide the information to the person.

Credit reporters

Under the Credit Reporting Privacy Code, credit reporters cannot charge for:

Responding to a request for confirmation a credit reporter holds any credit information about them
Providing access to a person’s credit information within the usual timeframe (i.e. as soon as practicable and no later than 20 working days)
Correcting any credit information
Providing the individual with a copy of any corrected information

Credit reporters can charge a maximum of $10.00 (including GST) if a person requests their credit information is made available to them within three working days.

Any charges must be reasonable

If you are going to impose a charge, you generally need to have already made the decision to either release some or all of the information or decided to attach the statement of correction, and you must have notified the requestor in advance.

We and the Human Rights Review Tribunal have previously relied on the amounts indicated in the Ministry of Justice charging guidelines for handling Official Information Act requests as a reference for requests under the Privacy Act.

Those guidelines state that:

The first hour of staff time is free
The first 20 pages of photocopying are free
After the first hour, you can charge $38 per half hour of staff time
After the first 20 pages you can charge 20 cents per page

We would consider this a useful starting point when considering a request under the Privacy Act. However, it is important to remember you need to assess each situation based on its specific facts. In many cases the amount you can charge will be less than what these guidelines suggest, it is rare a higher charge will be justifiable.

If the requestor is unhappy with your decision to charge them for their information or for correction, or if they are unhappy with the amount proposed, they can make a complaint to our Office.

Further information

The Human Rights Review Tribunal has considered charges in the following case:

Director of Human Rights Proceedings v Schubach [2015] NZHRRT 4 – where a lawyer required a charge of $800 before releasing personal information. The Tribunal found an interference with privacy and required the lawyer to release the information without charge. It also awarded around $11,000 in damages to the individual.

The Privacy Commissioner has also made a number of determinations with respect to charges. We have some case notes which consider charges here:

Case note 294559 – A law firm wanted to charge $19,000 for information. The Commissioner found a reasonable charge was $7.99 – the cost of a USB stick. The Tribunal also awarded damages – see our write up here.
Case Note 204595 – the Commissioner found a reasonable charge of $150 for access to personal information held by an accountant (being about 500 pages of information). The fee amounted to one chargeable hour of time spent photocopying.
Case Note 7844 – Taking into account the cost of photocopying and associated labour, the Commissioner found a reasonable charge for information held by a private sector company to be $122.65.