Privacy Act requests
You may ask GCSB for personal information that you think we might hold about you. This type of information request is covered by the Privacy Act 1993.
How do I request information about myself?
You can contact us in a number of ways to request information
- Email: firstname.lastname@example.org
- Telephone: (04) 472 6881
- Postal address: GCSB, PO Box 12209, Thorndon, Wellington 6144
We would like:
- Your full name
- Your date of birth and place of birth
- Contact address (email or postal)
- Details of your request, including a specific timeframe if appropriate
(for example, any information that we may hold about you for the period from 1 January 2010 to 31 December 2015)
We may ask you for more details.
Alternatively, you can use the AboutMe (Request My Info Tool) on the Office of the Privacy Commissioner’s website, which contains a form that you can fill in. It will automatically emailed to us.
We will acknowledge your request and are required by law to give you our decision on your request as soon as possible, and no later than 20 working days after we receive your request.
We will also let you know within ten working days if we need to transfer your request to another agency.
If we need more time to make our decision on your request, we will let you know and will give you an idea of how long it will take. You can complain to the Office of the Privacy Commissioner if you are not happy with our decision to extend the time.
If you would like to request information about someone else, such as a deceased relative, this type of request is treated as an OIA request. You should follow the guidance set out in the OIA section.
The objectives of GCSB are to contribute to the national security of New Zealand; the international relations and well-being of New Zealand; and the economic well-being of New Zealand.
Everything that we do needs to be in accordance with New Zealand law and New Zealand’s human rights obligations, and is subject to a very stringent warranting and oversight regime.
We aim to be as open as possible about our work. Due to the sensitive nature of what we do, however, revealing details about what we do or do not know can prejudice New Zealand’s interests. We could be the target of co-ordinated information requests from people who want to know if they are under investigation, and who may share responses with each other to draw conclusions about what we are or are not aware of or the nature of our capabilities.
This means that sometimes we may need to respond to a request for information with “we can neither confirm nor deny the existence or non-existence of information”. The following points can, however, provide reassurance about the protections that are in place for New Zealanders:
- GCSB (and the New Zealand Security Intelligence Service) must obtain a Type 1 intelligence warrant to authorise them to carry out otherwise unlawful activities for the purpose of collecting information about or to do any other thing directly in relation to New Zealanders;
- GCSB (and NZSIS) can only obtain a Type 1 intelligence warrant when the activity is either:
- Necessary to contribute to the protection of national security and identifies, enables the assessment of, or protects against any of the harms listed in section 58(2) of the Intelligence and Security Act; or
- Will contribute to the international relations and wellbeing of New Zealand or the economic wellbeing of New Zealand and there are reasonable grounds to suspect that the New Zealander (or in some limited situations, a class of New Zealander) is acting, or purporting to act, for or on behalf of a foreign person, foreign organisation, or designated terrorist entity.
- A Type 1 intelligence warrant must be jointly issued by the Minister responsible for both agencies and a Commissioner of Intelligence Warrants, and is subject to review by the Inspector-General of Intelligence and Security;
- GCSB carries out information assurance and cyber security activities, which may involve collecting information about New Zealanders. Those activities must be lawful (such as carried out with consent), or authorised by an intelligence warrant; and
- GCSB (and NZSIS) are also subject to the Privacy Act 1993, including Information Privacy Principles that limit the purposes for which agencies may collect, use, and disclose personal information.
The attached fact sheet is something that we have prepared to provide information to the public about how we apply section 32 of the Privacy Act 1993 when responding to Privacy Act requests, and why we sometimes use the response “neither confirm nor deny”.