Pursuant to section 241 of the Land Transport Act 1998 and my delegated authority, I authorise the User – for the Specified Purpose, during the Term, and on the Conditions below – to have access to the names and addresses of persons currently registered to motor vehicles:

• who are currently registered in respect of a motor vehicle; and
• who have not instructed the Registrar of Motor Vehicles that they do not wish to have their names and addresses made available under section 241(1).

Person: Fuel Suppliers

Purpose(s):

Where the occupant(s) of a motor vehicle have failed to pay the full amount for goods or services obtained from a fuel supplier at a service station:

1. to send a letter to the registered person advising them of the failure to pay and requesting payment (including details of possible methods of making payment); or
2. to refer the information to a debt collector for the purpose of lawfully collecting the debt.

Term: Commencing on 1 November 2022, this notice expires at midnight on 31 October 2027 but may be revoked at any time either generally or in relation to a specific fuel supplier.

Definitions:

authorised access means access or use of information that has been authorised under the terms of this notice.

Failed to pay the full amount for goods or services means: the occupant(s) has either:

• obtained/received/taken goods or services without attempting to pay for them; or
• has paid the full amount for one or more of the goods or services obtained but has failed to pay for other goods or services also obtained, for example has paid for an item purchased at the fuel station but has failed to pay for the fuel obtained from the service station; or
• has claimed that they do not have enough money to pay for the goods or services obtained, and has then left with these goods or services, without having paid the full amount for them.

For the avoidance of doubt, this excludes underpayment by occupants as the result of an error by a fuel supplier or their employees or agents, information must not be accessed for this purpose.

Fuel supplier means a fuel retailer as defined in the Fuel Industry Act 2020, being a person that carries on a business of selling and supplying engine fuel to end users; but does not include a person who sells and supplies engine fuel only as an incidental part of their primary business of hiring, leasing, or selling motor vehicles.

notice means the Gazette notice providing authorised access under section 241 of the Land Transport Act 1998 to the named portal provider

personal information means the names and addresses of persons:

• who are currently registered in respect of a motor vehicle; and
• who have not instructed the Registrar of Motor Vehicles that they do not wish to have their names and addresses made available under section 241(1).

Service station means a site used for the sale of fuel to the public, and for which a test certificate is issued pursuant to section 82 of the Hazardous Substances and New Organisms Act 1996.

unauthorised access means access or use of information that is not authorised access.

User means a person or company authorised by Waka Kotahi under section 241 for these standard terms and conditions.

Waka Kotahi means the NZ Transport Agency.

Conditions

Approval Process

A User may only access information under this authorisation if it has been through the approval process.

The approval process means:

• the User has individually applied for access (in accordance with section 241 of the Land Transport Act 1998) and has been individually approved; or
• the User is a member of a representative body with disciplinary powers, which has applied for access (in accordance with section 241 of the Land Transport Act 1998) in its name (to be used by its members) and that body has been approved; or
• the User is a member of a representative body which has applied for access (in accordance with section 241 of the Land Transport Act 1998) in the name of its individual members, and that access has been approved for those individual members.

General

1. The User must only access information for the specified purpose.

2. Information obtained under this authorisation shall not be disclosed to any third party unless such disclosure is necessary to achieve a specified purpose.

Statement on Access to Information

3. The User must display a general statement (on the User’s website or by physical signage on the relevant site) that advises the registered persons of the following:

1. that their name and address may be obtained from the motor vehicle register; and
2. the relevant gazette notice under which the User is authorised to access the information; and
3. the circumstances in which this may occur and what the information will be used for; and
4. that any person can notify the Registrar that they do not wish to have their name(s) and address(es) made available under an authorisation.

4. A copy of the general statement displayed in accordance with clause 3 must be kept on record in accordance with clauses 11–13.

Security Systems

5. Each individual person who can access the motor vehicle register on behalf of the User must be provided with unique and identifiable log-in details that must be used each time the individual person accesses the register. These unique details must not be shared with any other person.

6. The User must have adequate systems and policies in place that prevent unauthorised access from occurring, including to:

1. provide security of information technology and data against unauthorised access; and
2. ensure all staff members who use or have access to the motor vehicle register have completed training that complies with clauses 9 and 10; and
3. ensure information accessed from the motor vehicle register is limited to information needed to achieve the specific purpose for which the information is accessed; and
4. ensure personal information is retained no longer than is necessary for the specific purpose for which information is accessed; and
5. assist the User to identify unauthorised access, or suspected unauthorised access, including having individual log-ins under clause 5.

Privacy Breaches

7. If the User suspects that unauthorised access has occurred (including by any staff, whether or not acting within the authority of the User), the User must notify Waka Kotahi as soon as practicable but no later than seven days, after forming a suspicion.

8. If the User finds that unauthorised access has occurred, the User must immediately notify Waka Kotahi and the Privacy Commissioner.

Training

9. Staff of the User must not have access to the motor vehicle register unless they have completed training in accessing information in accordance with section 241 and the terms of this notice, including training on:

1. when the User can access information under section 241; and
2. how to ensure record keeping requirements are met; and
3. how to ensure information that is obtained from the motor vehicle register is protected; and
4. when and how to safely destroy information that was obtained from the motor vehicle register; and
5. obligations under the Privacy Act 2020 and information privacy principles, including as set out in learning modules and information made available by the Office of the Privacy Commissioner.

10. All staff must complete a refresher training course every 6 to 12 months after the date that they last completed the training course.

Record Keeping and Auditing

11. The User must keep a record of every time it accesses the motor vehicle register.

12. The record must be kept for a period of at least 18 months from the date of access.

13. The record must include:

1. the date the motor vehicle register was accessed; and
2. the relevant plate number for the information accessed; and
3. the individual log-in that accessed the motor vehicle register on behalf of the User; and
4. the reason the User accessed the information, including an explanation and supporting material establishing that the specific circumstances fell within the specified purpose; and
5. a copy of the general statement required by clause 3.

14. Records must be made available to Waka Kotahi on request, as soon as practicable but no later than:

1. 7 days after the date of the request – if the request is in relation to an incident or suspected incident; or
2. 10 working days – if the request is for monitoring or auditing purposes.

15. The User must also provide such information as Waka Kotahi reasonably considers relevant to determining whether and how the User complies with these conditions.

16. Names and addresses obtained from the register must not be retained for longer than required to achieve the specified purpose.

Reporting

17. Every 12 months the User must provide Waka Kotahi with a report containing:

1. evidence that clauses 11 to 16 have been complied with; and
2. a record of staff training that has taken place in accordance with the requirements in clauses 9 and 10 over the last 12 month reporting period; and
3. all actions taken in relation to all instances, or suspected instances, of unauthorised access over the last 12 month reporting period.

Fees

18. The User must pay the applicable fees for accessing the motor vehicle register.

Other

19. If the User or any staff (whether or not acting within the authority of the User) breach any conditions, then Waka Kotahi may immediately suspend or cancel the User’s access to personal information on the motor vehicle register (under section 241(6) or (2)).

20. Nothing in this notice affects the User’s obligations under the Privacy Act 2020.

Dated this 21st day of September 2022.

SUE HARDIMAN, Senior Manager – Vehicle and Driver Licensing, Waka Kotahi – NZ Transport Agency.