AI-crafted privacy requests strain New Zealand firms under the Privacy Act
Generative AI lets individuals draft extensive privacy access requests in minutes, while agencies in New Zealand may need weeks to comply, prompting regulatory scrutiny.
As generative AI tools become commonplace, individuals can now produce comprehensive privacy access requests in a matter of minutes, but New Zealand agencies often need weeks to gather, filter and evaluate the requested data. Under Information Privacy Principle 6 of the Privacy Act, agencies must respond within 20 working days, yet wide-ranging requests are described by the Office of the Privacy Commissioner as “taxing” and frequently of limited value to requestors.
Similar challenges have been reported in the United Kingdom, where the Information Commissioner’s Office warned that AI-generated requests can be overly long, repetitive and hard to parse. The legislation still requires “reasonable assistance” and allows refusals when information is not readily retrievable or the request is frivolous, but agencies cannot deem a request vexatious solely because it was AI-produced. Private-sector bodies may levy reasonable charges for the labour involved, guided by historic Ministry of Justice fee structures, though they cannot charge for legal judgment on withholding grounds. Some organisations are exploring AI tools to automate document identification, deduplication and redaction, easing the compliance burden while preserving necessary legal oversight.
Why it matters
AI-driven privacy requests could overwhelm businesses, raising costs and prompting new regulatory guidance.
In this story
