Can a business give my information to Police without telling me?

Two kinds of Police request

Legal demands. Search warrants, production orders and specific statutory powers must be complied with, subject to any valid privilege claim. You may not be told, especially if telling you would affect an investigation.

Voluntary requests. Police often ask organisations for information informally. The Privacy Commissioner’s guidance is that these don’t legally compel release. An organisation can decline, or release only if a principle 11 exception (or another law) gives it a basis, and it must be able to justify the disclosure if there’s a complaint.

The “maintenance of the law” exception

The exception most often used is that not disclosing would prejudice the maintenance of the law, including preventing, detecting, investigating and prosecuting offences. The Commissioner says:

• It’s not a general right for law enforcement to get information or routine help.
• The organisation must reasonably believe disclosure is necessary, with a direct link between disclosing and avoiding the prejudice.
• Police should explain the offence and why the information is relevant. “Simply asserting that the information is needed for a police investigation is not enough.”
• Sensitive or broad information, such as health records, phone data or bank transactions, is usually better sought through a warrant or production order.

There’s also a serious threat exception, for preventing or lessening a serious threat to someone’s life or health or to public safety.

What you can do

• Ask the organisation whether it has disclosed your information to Police, using an access request. It may refuse to say if telling you would prejudice an investigation, but it must tell you it’s withholding information and why.
• Complain to the organisation, then the Privacy Commissioner, if you think information was shared without a proper basis.

For organisations

Before releasing information to Police voluntarily, check what’s being asked for and why, whether there’s a legal demand or an exception, whether you can limit the scope, and whether the information is sensitive enough to insist on a production order. Record your decision and reasons at the time.