Email this page

Send this page to a friend.

This page is printer friendly.

Neither confirm nor deny

This allows an agency to neither confirm nor deny the existence or non-existence of information that has been requested.

Doesn't this section contradict the purpose of principle 6 of the Act: the right to know what an agency holds about you?
A fundamental part of principle 6 is the right of an individual to know whether or not an agency holds information about them. A person cannot ensure that the information held about them is correct and used appropriately if they do not know whether or not an agency holds such information. In this way, the Act ensures that agencies, public or private, are accountable to the individuals whose personal information they hold and may use.

By necessity, the operation of section 32 overrides this fundamental right. Section 32 does, therefore, have the potential for misuse. However, this potential is not as wide as it might seem since section 32 only applies in very limited circumstances.

Can any agency rely on section 32?
No. It is important that section 32 is used only in exceptional circumstances. To date, it has been raised only in relation to information held by the New Zealand Security Intelligence Service and, very occasionally, the Police.

In Australia and the United Kingdom, the regulatory bodies dealing with decisions made under their specific information privacy legislation take decisions to "neither confirm nor deny" very seriously indeed. Most often, agencies seek to rely on the "neither confirm nor deny" policy when protecting national security interests. For example, in Baker v Secretary of State for the Home Department [2001] UKHRR 1275, the UK Information Tribunal considered that the neither confirm nor deny policy was necessary in cases where secrecy was essential to the operations of an agency - in this case the Security Service - in order to safeguard national security. In Est v Department of Family Services & Aboriginal & Islander Affairs [1995] QICmr 20, the Queensland Information Commissioner held that the "neither confirm nor deny" response should be reserved for use only where special circumstances make its use necessary and appropriate".

When can an agency refuse to tell me whether they hold information about me?
In order for an agency to rely on section 32, it must show that the interests protected by a withholding provision - contained in sections 27, 28 and 29 of the Act - would be likely to be prejudiced by the disclosure of the existence or non-existence of such information. In other words, there is a two step test that an agency must satisfy before it can refuse to tell you whether it holds information about you. Using section 27(1)(c) as an example, the test works like this:
1. the release of information about you would be likely to prejudice the maintenance of the law, and so could be withheld under section 27(1)(c); and
2. the knowledge of whether or not the agency even holds such information about you would have the same effect as the knowledge of the content of that information: it would be likely to prejudice the maintenance of the law.

In this way, only certain information can be subject to section 32 and it will only apply in very exceptional circumstances.

References

Privacy Act 1993
Section 32
Information concerning existence of certain information
Where a request made pursuant to principle 6 relates to information to which section 27 or section 28 of this Act applies, or would, if it existed, apply, the agency dealing with the request may, if it is satisfied that the interest protected by section 27 or section 28 of this Act would be likely to be prejudiced by the disclosure of the existence or non-existence of such information, give notice in writing to the applicant that it neither confirms nor denies the existence or non-existence of that information.

Compare: 1982 No 156 s 10; 1987 No 8 s 4(2); 1987 No 174 s 8

Case Notes:
Case Note 0635