A request made via FYI, the public OIA request site, has uncovered the NZSIS-Police Joint Operating Strategy and Information Sharing Protocol. Most of this is the usual stuff about protecting classified information. But it also in places purports to over-ride the Official Information Act, potentially resulting in unlawful OIA decisions.
The protocol explicitly acknowledges the OIA and Privacy Acts. But it also follows the "originator control" (ORCON) principle common to spy agencies, and explicitly states that when information is subject to an OIA request:
Disclosure or acknowledgement of the existence of that information must not occur without the written authorisation from the source Party.This is contrary to the OIA. While it is proper to consult the originating agency about a request (and this may result in a transfer), the processing agency must ultimately make its own decision, and its assessment of the interests at stake. The originating agency cannot veto release. In fact, this seems to be exactly the sort of illegal secrecy contract ruled out by Wyatt Co (NZ) Ltd v Queenstown-Lakes District Council, except it is the government agreeing secrecy with itself, rather than an outside party (which makes it even more dubious). Which means that any refusal of a request for information under this protocol should be immediately challenged with the Ombudsman.
(This is a similar issue to that of "security of information" agreements, except again, its the government agreeing secrecy with itself, rather than with an outside party. A perfect example of how spy-thinking infects and corrupts our democracy).
