Pursuant to section 241 of the Land Transport Act 1998 and my delegated authority, I authorise the User – for the Specified Purpose, during the Term, and on the Conditions below – to have access to the names and addresses of persons currently registered to motor vehicles:

• who are currently registered in respect of a motor vehicle; and
• who have not instructed the Registrar of Motor Vehicles that they do not wish to have their names and addresses made available under section 241(1).

Person: Registered Motor Vehicle Traders

Purpose(s):

• To confirm the vendor is the registered person of a motor vehicle that the Motor Vehicle Trader is proposing to purchase.
• To assist in verifying that a change of registered person has been completed correctly for transaction in which the Motor Vehicle Trader is the purchaser or seller.
• In the case of Wholesalers only, where a motor vehicle is the subject of a safety recall listed in the safety recalls portal, to contact the registered person to advise them of any required actions in relation to the vehicle’s safe operation.

Term: Commencing on 1 November 2022, this notice expires at midnight on 31 October 2027 but may be revoked at any time either generally or in relation to a specific motor vehicle trader.

Definitions:

authorised access means access or use of information that has been authorised under the terms of this notice.

Motor Vehicle Trader and Trader means a person registered under the Motor Vehicle Sales Act 2003 to carry out the activities described in section 7 of that Act.

notice means the Gazette notice providing authorised access under section 241 of the Land Transport Act 1998 to the named portal provider.

personal information means the names and addresses of persons:

• who are currently registered in respect of a motor vehicle; and
• who have not instructed the Registrar of Motor Vehicles that they do not wish to have their names and addresses made available under section 241(1).

unauthorised access means access or use of information that is not authorised access.

User means a person or company authorised by Waka Kotahi under section 241 for these standard terms and conditions.

Waka Kotahi means the NZ Transport Agency.

Wholesaler has the same meaning as in section 6 of the Motor Vehicle Sales Act 2003.

Conditions

Approval Process

A User may only access information under this authorisation if it has been through the approval process.

The approval process means:

• the User has individually applied for access (in accordance with section 241 of the Land Transport Act 1998) and has been individually approved; or
• the User is a member of a representative body with disciplinary powers, which has applied for access (in accordance with section 241 of the Land Transport Act 1998) in its name (to be used by its members) and that body has been approved; or
• the User is a member of a representative body which has applied for access (in accordance with section 241 of the Land Transport Act 1998) in the name of its individual members, and that access has been approved for those individual members.

General

1. The User must only access information for the specified purpose.

2. Information obtained under this authorisation shall not be disclosed to any third party unless such disclosure is necessary to achieve a specified purpose.

Statement on Access to Information

3. The User must display a general statement (on the User’s website or by physical signage on the relevant site) that advises the registered persons of the following:

1. That their name and address may be obtained from the motor vehicle register; and
2. the relevant gazette notice under which the User is authorised to access the information; and
3. the circumstances in which this may occur and what the information will be used for; and
4. that any person can notify the Registrar that they do not wish to have their name(s) and address(es) made available under an authorisation.

4. A copy of the general statement displayed in accordance with clause 3 must be kept on record in accordance with clauses 11–13.

Security Systems

5. Each individual person who can access the motor vehicle register on behalf of the User must be provided with unique and identifiable log-in details that must be used each time the individual person accesses the register. These unique details must not be shared with any other person.

6. The User must have adequate systems and policies in place that prevent unauthorised access from occurring, including to:

1. provide security of information technology and data against unauthorised access; and
2. ensure all staff members who use or have access to the motor vehicle register have completed training that complies with clauses 9 and 10; and
3. ensure information accessed from the motor vehicle register is limited to information needed to achieve the specific purpose for which the information is accessed; and
4. ensure personal information is retained no longer than is necessary for the specific purpose for which information is accessed; and
5. assist the User to identify unauthorised access, or suspected unauthorised access, including having individual log-ins under clause 5.

Privacy Breaches

7. If the User suspects that unauthorised access has occurred (including by any staff, whether or not acting within the authority of the User), the User must notify Waka Kotahi as soon as practicable but no later than seven days, after forming a suspicion.

8. If the User finds that unauthorised access has occurred, the User must immediately notify Waka Kotahi and the Privacy Commissioner.

Training

9. Staff of the User must not have access to the motor vehicle register unless they have completed training in accessing information in accordance with section 241 and the terms of this notice, including training on:

1. when the User can access information under section 241; and
2. how to ensure record keeping requirements are met; and
3. how to ensure information that is obtained from the motor vehicle register is protected; and
4. when and how to safely destroy information that was obtained from the motor vehicle register; and
5. obligations under the Privacy Act 2020 and information privacy principles, including as set out in learning modules and information made available by the Office of the Privacy Commissioner.

10. All staff must complete a refresher training course every 6 to 12 months after the date that they last completed the training course.

Record Keeping and Auditing

11. The User must keep a record of every time it accesses the motor vehicle register.

12. The record must be kept for a period of at least 18 months from the date of access.

13. The record must include:

1. the date the motor vehicle register was accessed; and
2. the relevant plate number for the information accessed; and
3. the individual log-in that accessed the motor vehicle register on behalf of the User; and
4. the reason the User accessed the information, including an explanation and supporting material establishing that the specific circumstances fell within the specified purpose; and
5. a copy of the general statement required by clause 3.

14. Records must be made available to Waka Kotahi on request, as soon as practicable but no later than:

1. seven days after the date of the request – if the request is in relation to an incident or suspected incident; or
2. 10 working days – if the request is for monitoring or auditing purposes.

15. The User must also provide such information as Waka Kotahi reasonably considers relevant to determining whether and how the User complies with these conditions.

16. Names and addresses obtained from the register must not be retained for longer than required to achieve the specified purpose.

Reporting

17. Every 12 months the User must provide Waka Kotahi with a report containing:

1. evidence that clauses 11 to 16 have been complied with; and
2. a record of staff training that has taken place in accordance with the requirements in clauses 9 and 10 over the last 12 month reporting period; and
3. all actions taken in relation to all instances, or suspected instances, of unauthorised access over the last 12 month reporting period.

Fees

18. The User must pay the applicable fees for accessing the motor vehicle register.

Other

19. If the User or any staff (whether or not acting within the authority of the User) breach any conditions, then Waka Kotahi may immediately suspend or cancel the User’s access to personal information on the motor vehicle register (under section 241(6) or (2)).

20. Nothing in this notice affects the User’s obligations under the Privacy Act 2020.

Dated this 21st day of September 2022.

SUE HARDIMAN, Senior Manager – Vehicle and Driver Licensing, Waka Kotahi – NZ Transport Agency.