The purpose of the confirmation service is to allow an agency or intermediary to check whether an individual's identity information is consistent with any recorded information.

(1) An agency or intermediary may use the confirmation service for an identity information check if—

• (a) the agency has obtained the individual's consent before the check is carried out; and

• the individual has consented (in written or electronic form) to the check before it is carried out; and

• (b) the agency or intermediary has given the confirmation service an assurance (in written or electronic form) that the individual has consented to the check; and

• (c) the agency or intermediary is a party to a confirmation agreement that complies with section 11; and

• (ca) in the case of an intermediary, the identity information check is on behalf of an agency that has been approved by the responsible officials under section 11B(a) and is listed as such in the confirmation agreement between the intermediary and the responsible officials; and

• (d) the check is carried out in accordance with the agreement; and

• (e) the agency or intermediary has made an arrangement to pay or has paid any fees and charges payable under the agreement.

(2) For the purposes of subsection (1)(a), an agency may obtain an individual's consent on an individual may consent to an identity information check on—

• (a) a one-off basis (that is, for each identity information check); or

• (b) an ongoing basis (that is, for a series of identity information checks, whether repeated or otherwise).

(3) An individual who consents to an identity information check may withdraw the consent before—

• (a) the check is carried out, in the case of a consent given on a one-off basis; or

• (b) all of the checks, or any further checks, are carried out, in the case of a consent given on an ongoing basis.

(1) If the conditions specified in section 8 have been complied with, an agency or intermediary must, in order to use the confirmation service for an identity information check, submit an individual's identity information by any electronic or other means approved by the responsible officials.

(2) On receiving the individual's identity information, the confirmation service must carry out a search of any or all of the applicable databases (as the case may be) for any recorded information about the individual.

(3) If it is impracticable for the confirmation service to comply with subsection (2) for any reason, the confirmation service must advise the agency or intermediary that the identity information check cannot be processed and may ask the agency or intermediary to resubmit the individual's identity information.

(4) The confirmation service must not, at any stage, supply to the agency or intermediary any recorded information about the individual who is the subject of the search.

(5) However, subsection (4) does not limit or prevent the disclosure of—

• (a) information, under section 78K of the Births, Deaths, Marriages, and Relationships Registration Act 1995, that the individual is dead or that name change information exists in relation to the individual:

• (b) any information about the status of any other recorded information in relation to the individual (for example, whether a passport has been cancelled).

(6) After carrying out the search referred to in subsection (2), the confirmation service must supply to the agency or intermediary information about the search result and, in particular, whether any or all of the individual's identity information submitted to the service is consistent with any recorded information.

(7) Without limiting subsection (6), the information that may be supplied under that subsection generally includes, subject to subsection (4), one of the following search results:

(8) For the purposes of subsections (6) and (7), identity information may be treated as consistent with recorded information despite any variation between them because of pronunciation or punctuation.

(1) The responsible officials may enter into a confirmation agreement with an agency or intermediary if satisfied that it is appropriate to do so after having regard to the following:

• (a) the nature of the agency's or intermediary's undertaking or activity and whether the agency or intermediary has a genuine need to use the confirmation service in carrying out that undertaking or activity:

• (b) the agency's or intermediary's policies and practices in relation to—

  • (i) the security of information; and

  • (ii) the privacy of individuals:

• (c) any other matter that the responsible officials consider to be relevant.

(2) For the purposes of subsection (1), a confirmation agreement must be entered into by—

• (a) the Registrar-General, if the agreement relates to identity information checks against any recorded information under the Births, Deaths, Marriages, and Relationships Registration Act 1995:

• (b) the chief executive, if the agreement relates to identity information checks against any recorded information under either or both of the Citizenship Act 1977 and the Passports Act 1992.

(3) To avoid doubt, the responsible officials—

• (a) have the sole discretion to decide whether to enter into a confirmation agreement with an agency or intermediary; and

• (b) may decide not to do so if either or both of them, as the case may be, are not satisfied in accordance with subsection (1).

(1) A confirmation agreement must be in writing.

(2) A confirmation agreement must—

• (a) state the purpose of the agreement; and

• (b) specify which of the applicable databases it applies to.

(3) In addition, a confirmation agreement must specify the following terms or conditions:

• (a) how an agency may use the confirmation service; and

• (b) the conditions for using the confirmation service, including the conditions specified in section 8; and

• (c) the manner in which the agency may obtain an individual's consent for an identity information check, including the requirement to use a form (if any) approved for the purpose by the responsible officials; and

• (d) the circumstances in which an individual's consent for an identity information check that is given on an ongoing basis must be treated as having expired (for example, if the individual ceases to be a customer of the agency or if a certain period of time has elapsed since the date on which the consent was given); and

• (e) the procedures that an agency must follow before taking adverse action against an individual as a result of using the confirmation service, including the requirement to give the individual a reasonable opportunity to make submissions or to be heard; and

• (f) an alternative process for dealing with an individual whose identity information cannot be confirmed using the confirmation service because, for example, there is no recorded information about the individual or the individual has not given his or her consent to an identity information check; and

• (g) the fees and charges payable for using the confirmation service and the manner in which those fees and charges are to be paid; and

• (h) the grounds on which the agreement may be terminated, including the grounds that—

  • (i) the responsible officials are no longer satisfied that section 10(1) can continue to be complied with in respect of the agency; and

  • (ii) the agency has breached, or is likely to breach, the agreement; and

• (i) the process that must be followed by the responsible officials before exercising any right to terminate the agreement; and

• (j) the process for monitoring the agency's compliance with the terms or conditions of the agreement, including the requirement for the agency to keep, for monitoring purposes, records in respect of identity information checks and the requirement to provide those records to the responsible officials when requested; and

• (k) the requirement that the responsible officials consult the Privacy Commissioner about the terms or conditions of confirmation agreements, including the consultation requirements in sections 12 and 13.

(4) A confirmation agreement may specify any other terms or conditions that the responsible officials consider to be appropriate.

(5) A confirmation agreement may specify different terms or conditions from those contained in another confirmation agreement even though the agencies concerned belong—

• (a) in the same class; or

• (b) in different classes.

(6) A confirmation agreement may be varied by further agreement between the parties.

(1) A confirmation agreement must be in writing.

(2) A confirmation agreement must—

• (a) state the purpose of the agreement; and

• (b) specify which of the applicable databases it applies to.

(3) A confirmation agreement must also specify the following terms or conditions:

• (a) how an agency or intermediary may use the confirmation service; and

• (b) the conditions for using the confirmation service, including the conditions specified in section 8; and

• (c) the fees and charges payable for using the confirmation service and how those fees and charges are to be paid; and

• (d) the grounds on which the agreement may be terminated, including the grounds that—

  • (i) the responsible officials are satisfied, having regard to the matters in section 10(1), that it is no longer appropriate to continue with the agreement; and

  • (ii) the agency or intermediary has breached, or is likely to breach, the agreement; and

• (e) the process that must be followed by the responsible officials before exercising any right to terminate the agreement; and

• (f) the process for monitoring the agency's or intermediary's compliance with the terms or conditions of the agreement, including the requirement for the agency or intermediary to keep, for monitoring purposes, records in respect of identity information checks and the requirement to provide those records to the responsible officials when requested; and

• (g) the requirement that the responsible officials consult the Privacy Commissioner about the terms or conditions of confirmation agreements, including the consultation requirements in sections 12 and 13.

(4) A confirmation agreement may specify any other terms or conditions that the responsible officials consider to be appropriate.

(5) A confirmation agreement may specify different terms or conditions from those contained in another confirmation agreement even though the agencies or intermediaries concerned belong—

• (a) in the same class; or

• (b) in different classes.

(6) A confirmation agreement may be varied by further agreement between the parties.

(7) This section does not prevent an intermediary from entering into a confirmation agreement as an agency that submits an individual's identity information for an identity information check for its own purposes, rather than on behalf of another agency.

(8) To avoid doubt, if an intermediary wishes to submit an individual's identity information for an identity information check for its own purposes, the intermediary must enter into a confirmation agreement as an agency, rather than in its capacity as an intermediary.

In addition to the requirements in section 11, a confirmation agreement with an agency must specify—

• (a) how the agency must obtain an individual's consent for an identity information check, including the requirement to use a form (if any) approved for the purpose by the responsible officials; and

• (b) how an individual may withdraw his or her consent for an identity information check; and

• (c) the circumstances in which an individual's consent for an identity information check that is given on an ongoing basis must be treated as having expired (for example, if the individual ceases to be a customer of the agency or if a certain period of time has elapsed since the date on which the consent was given); and

• (d) an alternative process for dealing with an individual whose identity information cannot be confirmed using the confirmation service because, for example, there is no recorded information about the individual or the individual has not given his or her consent to an identity information check; and

• (e) the procedures that an agency must follow before taking adverse action against an individual as a result of using the confirmation service, including the requirement to give the individual a reasonable opportunity to make submissions or to be heard.

In addition to the requirements in section 11, a confirmation agreement with an intermediary must specify—

• the requirement that the responsible officials must, having regard to the matters in section 10(1), approve an agency on whose behalf the intermediary is proposing to submit an individual's identity information for an identity information check before the intermediary enters into a separate agreement with that agency; and

• the requirement that the intermediary must—

  • list every agency that has been approved under paragraph (a) in its confirmation agreement; and

  • remove an agency from that list if the agency's approval under that paragraph is withdrawn by the responsible officials because the grounds in section 11(3)(d) on which a confirmation agreement may be terminated would have existed had the confirmation agreement been entered into directly with the agency; and

• the requirement that the intermediary must not submit an individual's identity information for an identity information check—

  • on behalf of an agency that has not been approved by the responsible officials under paragraph (a) or an agency whose approval under that paragraph has been withdrawn by the responsible officials; and

  • if the intermediary has not entered with that agency into a separate agreement that complies with paragraph (d); and

  • if that separate agreement is not in force (that is, if it has expired or has been revoked); and

• the requirement that the intermediary and the agency must enter into a separate agreement that must—

  • be in writing; and

  • include, subject to any necessary modifications, the terms or conditions set out in sections 11(3)(b) and (d) to (f) and 11A; and

• the condition that the intermediary must provide a copy of the separate agreement between the intermediary and an agency to the responsible officials when requested to do so (but subject to the right of the intermediary to withhold any commercially sensitive information); and

• the condition that the intermediary must not retain, use, or store for its own purposes any information derived from an identity information check that was obtained on behalf of an agency.

(1) The responsible officials may develop standard terms or conditions for a confirmation agreement that apply, or are proposed to apply, to particular agencies or intermediaries or classes of agencies or intermediaries, but must consult the Privacy Commissioner while doing so.

(2) If the responsible officials are proposing to enter into a confirmation agreement that will contain terms or conditions that are materially different from the standard terms or conditions developed under subsection (1), the responsible officials may develop alternative terms or conditions for the proposed agreement, but must consult the Privacy Commissioner about those terms or conditions before entering into the agreement.

(3) If the responsible officials are proposing to vary a confirmation agreement by amending any terms or conditions developed under subsection (1) or (2) that are contained in the agreement, the responsible officials must consult the Privacy Commissioner about the proposed amendments to those terms or conditions before varying the agreement.

(4) However, the requirement to consult the Privacy Commissioner under subsection (3) does not apply if the variation relates to—

• (a) the fees and charges payable under the agreement; or

• (b) terms or conditions that are minor or incidental in nature; or

• (c) any changes to a confirmation agreement that relate to additions to, or deletions or substitutions from, the list of agencies approved under section 11B(a).

The responsible officials must consult the Privacy Commissioner if either or both of the responsible officials, as the case may be, are proposing to enter into a confirmation agreement that will allow a comparison of an individual's photographic image against any photographic images of that individual that are included in any recorded information about him or her.

(1) If section 12(1) or (2) does not apply, the responsible officials must consult the Privacy Commissioner about the terms or conditions of a confirmation agreement.

(2) The responsible officials must also consult the Privacy Commissioner if either or both of the responsible officials, as the case may be, are proposing to enter into a confirmation agreement that will allow a comparison of a photograph submitted by an individual for the purposes of an application under the Citizenship Act 1977 or the Passports Act 1992 (for example, an application for a grant of New Zealand citizenship or for a New Zealand passport) included in any recorded information about him or her against a copy of that photograph provided by the individual to an agency.

(1) The Privacy Commissioner may, at intervals not shorter than 12 months, require the responsible officials to—

• (a) review the terms or conditions of any confirmation agreement (whether or not they are standard terms or conditions developed under section 12); and

• (b) report on the outcome of the review to the Privacy Commissioner.

(2) If, after a review under subsection (1), the Privacy Commissioner and the responsible officials agree that amendments to the terms or conditions of a confirmation agreement are required, the responsible officials must vary the confirmation agreement to include the amendments to the terms or conditions.

(3) To avoid doubt, a variation to a confirmation agreement under subsection (2) applies only if the agency or intermediary that is party to the agreement agrees to it.

(1) A confirmation agreement may require the agency or intermediary that is party to the agreement to pay fees and charges to the responsible officials for using the confirmation service.

(2) The fees and charges—

• (a) must be set at a level that is no more than is necessary to cover the cost of providing the confirmation service; and

• (b) may be set using different methods for different agencies or different classes of agencies.

The responsible officials must—

• (a) maintain a list of agencies that are party to a confirmation agreement; and

• (a) maintain a list of—

  • agencies and intermediaries that are party to a confirmation agreement; and

  • agencies that have been approved under section 11B(a) in relation to each intermediary that has entered into a confirmation agreement.

• (b) publish that list on an Internet site that is under the responsible officials' control in an electronic form that is publicly accessible (at all reasonable times) and is free of charge.

The Privacy Commissioner may, at intervals not shorter than 12 months, require the responsible officials to provide the Privacy Commissioner with a report on the operation of the confirmation service.

(1) There is no cause of action against the Crown, or a Minister of the Crown, or the responsible officials, or a delegate of the responsible officials, or an employee or a contractor of the department, to recover damages for any loss or damage that is due directly or indirectly to the use of the confirmation service for an identity information check.

(2) Subsection (1) applies whether the loss or damage is caused by any person taking any action or failing to take any action, so long as the act or omission occurred in the exercise or performance of his or her functions, duties, or powers under any of the following:

• (a) this Act:

• (b) the Births, Deaths, Marriages, and Relationships Registration Act 1995:

• (c) the Citizenship Act 1977:

• (d) the Passports Act 1992.

(3) A person is not exempted from liability under subsection (1) for any act or omission to act that constitutes bad faith or gross negligence on the part of that person.

(1) If there is any inconsistency between this Act and any of the following Acts, or any regulations made under the following Acts, this Act prevails:

• (a) the Births, Deaths, Marriages, and Relationships Registration Act 1995:

• (b) the Citizenship Act 1977:

• (c) the Passports Act 1992:

• (d) the Privacy Act 1993.

(2) However, despite subsection (1), this Act must be read subject to sections 76, 77, and 86 of the Births, Deaths, Marriages, and Relationships Registration Act 1995. Accordingly, nothing in this Act authorises the giving of permission to inspect, or the disclosure of, any document containing information to which those sections apply.

(3) Sections 68 and 78(6) to (8) of the Births, Deaths, Marriages, and Relationships Registration Act 1995 apply for the purposes, and in connection with the operation, of the confirmation service.

The amendments specified in the Schedule are amended in the manner indicated in that schedule.