Broad swathes of people's personal data are being sought regularly by police from airlines, banks, electricity companies, internet providers and phone companies without search warrants by officers citing clauses in the Privacy Act.
Senior lawyers and the Privacy Commissioner have told the Herald of concerns over the practice which sees the companies voluntarily give the information to police.
Instead of seeking a legal order, police have asked companies to hand over the information to assist with the "maintenance of the law", threatened them with prosecution if they tell the person about whom they are interested and accept data with no record keeping to show how often requests are made.
The request from police carries no legal force at all yet is regularly complied with.
How does this happen? Because of the public's respect for the police, or at least for the job they do. But its a blatant end-run around the law. We have a right in this country against unreasonable search and seizure. And with no warrants, we have no way of determining whether such police "requests" (backed by their uniform, and an implied threat of arrest for non-cooperation) are in any way reasonable.
The Search and Surveillance Act 2012 gives police an easy way of accessing personal information held by third parties, in the form of a production order. But even then the oversight is insufficient, because the police don't keep records of how many production orders they obtain. But what we do know about production orders is that they are being used for dubious and petty purposes, including spying on journalists who embarass the Prime Minister. Clearly, more oversight is required. And if they're that lax in exercising their legal powers, I shudder to think how bad they are in exercising informal ones.
The good news is that the Privacy Commissioner is looking into it, and considering becoming a central register for such requests. Hopefully they'll also be providing advice to agencies on their duties in regards to such requests, when they can accept them, and when they should demand a production order, so agencies can have some confidence about protecting their customer's privacy.