Pursuant to section 241 of the Land Transport Act 1998 and my delegated authority, I authorise the User – for the Specified Purpose, during the Term, and on the Conditions below – to have access to the names and addresses of persons currently registered to motor vehicles:

• who are currently registered in respect of a motor vehicle; and
• who have not instructed the Registrar of Motor Vehicles that they do not wish to have their names and addresses made available under section 241(1).

Person: Registered Financial Service Providers

Purpose(s):

• When assessing an application to provide finance in relation to a vehicle, to confirm the person registered to that vehicle is the same person to which finance is being proposed to be provided to; or
• where the Registered Financial Services Provider has an existing security interest on the Personal Properties Securities Register (PPSR) or similar security interest for a vehicle, to confirm the registered person of that vehicle is the person to whom the Registered Financial Services Provider has provided finance for in relation to that vehicle.

Person: Registered Financial Service Providers who are Insurers

Purpose(s):

• where a motor vehicle has been involved in an incident resulting in damage or loss to the insurer’s client, to contact the registered person of that motor vehicle to resolve any financial matters arising out of the incident; or
• when assessing an application to provide an insurance policy in relation to a motor vehicle, to ensure the applicant is the registered person of that motor vehicle; or
• when verifying entitlement to make a claim or receive a payment under an insurance policy that applies to a motor vehicle, to ensure the registered person of that vehicle is the person to which that insurance policy applies.

Term: Commencing on 1 November 2022, this notice expires at midnight on 31 October 2027 but may be revoked at any time either generally or in relation to a specific financial service provider.

Definitions:

authorised access means access or use of information that has been authorised under the terms of this notice.

Financial Service Provider has the same meaning as in section 4 of the FSP Act.

Insurer has the same meaning as in section 4 of the Financial Service Providers (Registration and Dispute Resolution) Act 2008 (FSP Act).

notice means the Gazette notice providing authorised access under section 241 of the Land Transport Act 1998 to the named portal provider.

personal information means the names and addresses of persons:

• who are currently registered in respect of a motor vehicle; and
• who have not instructed the Registrar of Motor Vehicles that they do not wish to have their names and addresses made available under section 241(1).

Registered Financial Service Provider and Provider means a Financial Service Provider registered under section 16(1) of the FSP Act.

unauthorised access means access or use of information that is not authorised access.

User means a person or company authorised by Waka Kotahi under Section 241 for these standard terms and conditions.

Waka Kotahi means the New Zealand Transport Agency.

Conditions:

Approval Process

A User may only access information under this authorisation if it has been through the approval process.

The approval process means:

• the User has individually applied for access (in accordance with section 241 of the Land Transport Act 1998) and has been individually approved; or
• the User is a member of a representative body with disciplinary powers, which has applied for access (in accordance with section 241 of the Land Transport Act 1998) in its name (to be used by its members) and that body has been approved; or
• the User is a member of a representative body which has applied for access (in accordance with section 241 of the Land Transport Act 1998) in the name of its individual members, and that access has been approved for those individual members.

General

1. The User must only access information for the specified purpose.

2. Information obtained under this authorisation shall not be disclosed to any third party unless such disclosure is necessary to achieve a specified purpose.

Statement on Access to Information

3. The User must display a general statement (on the User’s website or by physical signage on the relevant site) that advises the registered persons of the following:

1. That their name and address may be obtained from the motor vehicle register; and
2. The relevant gazette notice under which the User is authorised to access the information; and
3. The circumstances in which this may occur and what the information will be used for; and
4. That any person can notify the Registrar that they do not wish to have their name(s) and address(es) made available under an authorisation.

4. A copy of the general statement displayed in accordance with clause 3 must be kept on record in accordance with clauses 11–13.

Security Systems

5. Each individual person who can access the motor vehicle register on behalf of the User must be provided with unique and identifiable log-in details that must be used each time the individual person accesses the register. These unique details must not be shared with any other person.

6. The User must have adequate systems and policies in place that prevent unauthorised access from occurring, including to:

1. provide security of information technology and data against unauthorised access; and
2. ensure all staff members who use or have access to the motor vehicle register have completed training that complies with clauses 9 and 10; and
3. ensure information accessed from the motor vehicle register is limited to information needed to achieve the specific purpose for which the information is accessed; and
4. ensure personal information is retained no longer than is necessary for the specific purpose for which information is accessed; and
5. assist the User to identify unauthorised access, or suspected unauthorised access, including having individual log-ins under clause 5.

Privacy Breaches

7. If the User suspects that unauthorised access has occurred (including by any staff, whether or not acting within the authority of the User), the User must notify Waka Kotahi as soon as practicable but no later than 7 days, after forming a suspicion.

8. If the User finds that unauthorised access has occurred, the User must immediately notify Waka Kotahi and the Privacy Commissioner.

Training

9. Staff of the User must not have access to the motor vehicle register unless they have completed training in accessing information in accordance with section 241 and the terms of this notice, including training on:

1. when the User can access information under section 241; and
2. how to ensure record keeping requirements are met; and
3. how to ensure information that is obtained from the motor vehicle register is protected; and
4. when and how to safely destroy information that was obtained from the motor vehicle register; and
5. obligations under the Privacy Act 2020 and information privacy principles, including as set out in learning modules and information made available by the Office of the Privacy Commissioner.

10. All staff must complete a refresher training course every 6 to 12 months after the date that they last completed the training course.

Record Keeping and Auditing

11. The User must keep a record of every time it accesses the motor vehicle register.
12. The record must be kept for a period of at least 18 months from the date of access.
13. The record must include:

1. the date the motor vehicle register was accessed; and
2. the relevant plate number for the information accessed; and
3. the individual log-in that accessed the motor vehicle register on behalf of the User; and
4. the reason the User accessed the information, including an explanation and supporting material establishing that the specific circumstances fell within the specified purpose; and
5. a copy of the general statement required by clause 3.

14. Records must be made available to Waka Kotahi on request, as soon as practicable but no later than:

1. seven days after the date of the request – if the request is in relation to an incident or suspected incident; or
2. 10 working days - if the request is for monitoring or auditing purposes.

15. The User must also provide such information as Waka Kotahi reasonably considers relevant to determining whether and how the User complies with these conditions.
16. Names and addresses obtained from the register must not be retained for longer than required to achieve the specified purpose.

Reporting

17. Every 12 months the User must provide Waka Kotahi with a report containing:

1. evidence that clauses 11 to 16 have been complied with; and
2. a record of staff training that has taken place in accordance with the requirements in clauses 9 and 10 over the last 12 month reporting period; and
3. all actions taken in relation to all instances, or suspected instances, of unauthorised access over the last 12 month reporting period.

Fees

18. The User must pay the applicable fees for accessing the motor vehicle register.

Other

19. If the User or any staff (whether or not acting within the authority of the User) breach any conditions, then Waka Kotahi may immediately suspend or cancel the User’s access to personal information on the motor vehicle register (under section 241(6) or (2)).
20. Nothing in this notice affects the User’s obligations under the Privacy Act 2020.

Dated this 21st day of September 2022.

SUE HARDIMAN, Senior Manager – Vehicle and Driver Licensing, Waka Kotahi – NZ Transport Agency.