When Police Come Knocking
It’s a scenario that makes many organisations pause: the police call, email or turn up asking for personal information. There’s a strong instinct to help, however, there’s the requirement to protect the privacy of the people whose information you hold.
This is where Information Privacy Principle 11 (IPP11) of the Privacy Act 2020 comes into play. IPP11 states organisations can only disclose personal information for the purpose it was collected. Any disclosure outside that requires an exception to apply. When managing law enforcement requests, the two most relevant exemptions are:
where disclosure is necessary for the maintenance of the law, or
where disclosure is necessary to prevent or lessen a serious threat to someone’s life, health, or safety.
That word necessary is critical. It sets a threshold that stops disclosure from becoming routine or open-ended.
Unless Police produce a warrant or production order then provision of personal information to them is voluntary. The Office of the Privacy Commissioner (OPC) has been clear that organisations shouldn’t feel pressured into handing over information “just because the police ask.”
OPC are clear that each and every voluntary request needs to be considered on its merits and the individual circumstances.
It is recommended that you:
Take the time to confirm which exception under IPP11 the police believe applies and more importantly why.
Ask for requests in writing wherever possible — it helps avoid misunderstandings and creates a clear record. In urgent, life-or-death cases, oral requests may be justified, but document them afterwards.
Provide only what is needed, not an entire file if a single detail is enough.
This isn’t about obstructing the police. It’s about ensuring that when information is disclosed, it is done lawfully, proportionately, and with accountability.
The increasing focus in New Zealand on the use of Automatic Number Plate Recognition (ANPR) by Police (https://www.rnz.co.nz/news/political/573368/europe-wouldn-t-allow-police-surveillance-like-nz-s-privacy-commissioner-lawyer-says) highlights why case-by-case consideration under IPP11 is so important.
Police may approach an organisation, perhaps a shopping centre or private car park, seeking access to plate logs or CCTV footage that includes vehicle details. The temptation might be to hand over everything. However, disclosure must fit an IPP11 exception, and therefore it must be limited to what is genuinely necessary for that investigation. That might mean providing footage for a specific time window, or releasing details of a single vehicle, rather than opening up an entire dataset on an ongoing basis.
By embedding thoughtful processes, documenting decisions, and applying the law consistently, organisations can support legitimate investigations while protecting the trust of the people whose information they hold.