Access to Information’s intent

This Data Protection and Use Policy (DPUP) Guideline recommends a proactive and pragmatic approach to ensuring that people understand and can exercise the options they have to:

• access their information
• request corrections to it
• in some cases, change it themselves.

This helps to address trust and confidence problems that can arise when people feel they have no practical or easy way to understand or control what’s happening with their information.

It’s recommended that agencies put these practices in place proactively and regularly. Use them to promote the rights people have and enable people to understand and exercise those rights at a time that works for them.

This Guideline supports the Privacy Act 2020 requirements for access and correction.

• Information Privacy Principle 6: Access to personal information — Privacy Commissioner
• Information Privacy Principle 7: Correction of personal information — Privacy Commissioner

Access to Information’s key concepts

Take regular, proactive and practical steps to engage with people about what information is held about them, and to enable them to access it and ensure its accuracy.

This helps to build trust and confidence by:

• reducing people’s concerns and frustrations
• supporting them with a sense of empowerment.

It can also help to ensure that agencies act on accurate information and people receive the most appropriate services for their situation.

Helping people understand their rights

People who use agency services may not understand what rights they have to:

• see the personal information that has been collected about them or is about them
• ask for that information to be corrected
• express a preference as to how they’d like to access their information.

Understanding these rights is important. Uncertainty may deter people from providing the information in the first place, or from accessing a service they need.

If an agency is proactive, and makes the process as easy as possible, service users are more:

• empowered
• confident that correct information will be used for the purpose it was collected for
• confident that agencies act on accurate information and the services they receive are the most appropriate for their situation.

Important reasons for this Guideline

• For many people, their information is an important part of their story and who they are. They want to feel confident their information is respected and treated with care. This includes enabling them to understand what information is held about them and why, and that such information is relevant and appropriate for the purpose it was collected for.
• Even where people broadly understand their rights, they may not understand how to exercise them or there may be a lack of practical opportunity to exercise them.
• When people are in a crisis or vulnerable situation, they may not initially be concerned about how they can access and request correction of their information. However, it is usually still important at the appropriate time to proactively ensure they understand and can exercise their rights to access and request corrections to their personal information.
• The difficulty people face in accessing their information can result in them having to repeatedly relive experiences. Sometimes retelling their story can be harmful for them. If they have already told their story to one agency and can get a copy to provide to another, it can save them from having to relive aspects of a traumatic experience.
• People sometimes assume that government agencies can share, access and exchange information about them without constraint. Enabling people to more readily understand what is known about them, and by which agencies, can reduce the sense of disempowerment this assumption causes.