Most of us have probably done it at some point. Used our work email address for something that has absolutely nothing to do with work. A recent case from the Office of the Privacy Commissioner is a useful reminder that where personal information is stored can matter just as much as what the information is about.

Artificial Intelligence is rapidly changing the way organisations create, store, analyse, and use information. While much of the discussion has focused on productivity, automation, and innovation, another trend is beginning to emerge behind the scenes, a noticeable increase in Privacy Act requests for copies of personal information.

Recently a Facebook group that was informal, member-driven, and private became the subject of a legal ruling under the Privacy Act 2020. The case involving the “Bad Tenants, New Zealand (Landlords Only)” group, and the $7,500 award against its administrator for failing to comply with a privacy request.

There’s a quiet shift likely to happen with the introduction of IPP3A. Not the kind that arrives with urgency or sweeping change programmes, but something more subtle, something that shows up gradually, in inboxes and workflows, in small moments that start to accumulate. Whereas your organisation used to historically get a scattering of privacy requests this now becomes more frequent. What was once manageable starts to feel persistent. And processes that have quietly worked in the background begin to show their limits.

When organisations see a rise in access, correction, deletion, or opt-out requests, the first instinct is to consider how to streamline the Privacy Request Process. This is important, but they’re rarely the sole solution.

More and more organisations are encouraging their people to contribute beyond their day jobs including joining charity boards, helping professional associations, or volunteering in community roles. It’s a positive trend that builds capability, networks, and a sense of purpose. But there’s a quiet privacy risk that often goes unnoticed.

The Privacy Act gives people a broad right to access their personal information to provide transparency, accountability, and fairness. The act sets the rules for what you can redact when someone makes a privacy request. You can redact information on a number of grounds including that it would breach another person’s privacy, compromise an investigation, endanger someone’s safety, or reveal privileged legal advice.