Privacy Commissioner - Te Mana Matapono Matatapu

Skip to content

Information cannot be found or retrieved

An agency can refuse a request if the information is not "readily retrievable", does not exist or cannot be found, or the agency dealing with the request does not believe that another agency would have the information. Agencies cannot provide what they do not have or cannot locate. 

• What does "readily retrievable" mean?
• What does an agency have to do in order to show that information "cannot be found"?
  

What does "readily retrievable" mean?
A number of factors will determine whether information is readily retrievable, including the amount of time, and cost, required to retrieve the information and the manner in which the relevant information is stored.

A lot of information is technically "retrievable". For instance, even if information has been deleted from a computer, it can often be retrieved. Doing so, though, is often difficult, is a specialist job, and can be very costly. The results may also be imperfect, particularly if the information has been deleted some time ago.

It may also be difficult to retrieve physical documents particularly if they date back a long way and the records of where they are are not clear. Agencies need to try their best to get information for requesters, but there is only so far that they can reasonably be required to go.

In short, is it realistic to ask the agency to retrieve the information to respond to the request? If so, the information is "readily retrievable". A number of factors will help to determine whether information is readily retrievable, including the amount of time and cost required to retrieve the information, when the information dates from, and so on.

Agencies that cannot retrieve information do not necessarily escape liability though.  Agencies need to have good information storage systems that enable them to retrieve information when it is needed. While in an individual circumstance information may not in fact be retrievable, the Commissioner may ask whether it should have been retrievable. If the answer is yes, the agency may have breached principle 5.

What does an agency have to do in order to show that information "cannot be found"?
The agency must be able to show that it has taken all reasonable steps in searching for the information. The search must be "intelligent, rather than mechanical" - for instance, the agency needs to ask the appropriate people whether they have the information,  and follow other obvious lines of enquiry. It's not enough to assume that the information should be in a particular place.

If an agency is able to show that it has tried its best and it really cannot find the information, then section 29(2)(b) will apply. However, the Commissioner may decide to investigate whether there are any systemic problems relating to the way in which the agency stores and secures its information. Again, agencies should have good information storage systems so that they can find information if it is needed, for whatever reason (principle 5).

References

Privacy Act 1993
Section 29(2)
An agency may refuse a request made pursuant to principle 6 if -

(a) The information requested is not readily retrievable; or
(b) The information requested does not exist or cannot be found;

Case Notes:
Case note 0575

HRRT/Court cases: