15 May 2026

OIA26-0274: Response to your OIA request. The corporations won’t respond if you are not a lawyer

Share on Facebook Share on X Interactive reader

Dear Mr McCarthy,

Thank you for your response dated 15 May 2026 regarding OIA26-0274.

I request reconsideration and clarification of MPI’s response.

The response contains several important admissions:

1. MPI states that, other than lawyers, it is not common for people to be authorised to receive information from MPI on behalf of someone else.

2. MPI states that the OIA team does not have a documented process for confirming that someone is authorised to receive information on behalf of someone else.

3. MPI states that formalising this process is on the OIA team’s work programme.

4. MPI states that there are no instruments of delegation relating to a general decision-making power to recognise or reject an agent or representative.

Those admissions create a serious procedural fairness issue. MPI appears to be requiring compliance with an internal process while also confirming that no documented process or delegation instrument presently exists.

For clarity, my request was not simply a repeated request for Mr van den Bogaart’s personal information. It sought MPI’s own records, including policies, guidelines, manuals, internal instructions, legal guidance, emails, notes, decision records, privacy breach assessments, training material, and delegation material relevant to MPI’s handling of authority-to-act and representative recognition issues.

Those categories are separate from the question of whether personal information about Mr van den Bogaart should be released to me. MPI may redact personal information where a lawful withholding ground applies, but that does not justify refusing the whole request as vexatious under section 18(h).

Accordingly, please clarify:

1. What specific searches were undertaken for records relating to MPI’s handling of authorised representatives or agents?

2. What business units, teams, inboxes, systems, or staff were searched?

3. Whether MPI searched Legal Services, the Privacy team, the OIA team, investigator training records, and any case-management systems relevant to Gary van den Bogaart or Tracy Lynch.

4. Whether any documents exist recording MPI’s decision to accept, reject, question, or alter its position regarding my authority to act.

5. Whether any internal emails, file notes, legal advice requests, privacy team advice, or decision records exist concerning this authority issue.

6. If MPI says no such records exist, please confirm whether MPI’s position is that decisions about representative authority were made without any recorded decision note, internal reasoning record, or delegated decision-maker record.

7. In relation to the section 18(h) refusal, please identify the basis on which MPI concluded the request was vexatious, given that the request sought MPI’s own administrative records and decision-making material.

8. In relation to the section 18(e) refusals, please provide a description of the reasonable search undertaken and why MPI is satisfied the information does not exist or cannot be found.

9. In relation to training material, MPI states that investigator training identifies where legislation allows service of documents on a lawyer/representative. Please provide that training extract, with any necessary redactions.

10. In relation to MPI’s statement that no delegation instruments exist, please confirm who made or approved the operative decision not to recognise me as authorised, and under what role, policy, statutory power, or administrative authority that decision was made.

This is a request for clarification and reconsideration before escalation to the Ombudsman.

MPI’s response raises a broader concern that MPI may be applying an unpublished, undocumented, and non-delegated administrative standard to prevent recognised representatives from communicating on behalf of affected persons.

Please treat this as urgent, as the matter concerns access to information, procedural fairness, privacy compliance, and representative authority.

Yours sincerely,

Tracy Lynch

This was the original request reply.

Ministry for Primary Industries
Charles Fergusson Building
38-42 Bowen Street
PO Box 2526
Wellington 6140, New Zealand
mpi.govt.nz
OIA26-0274
15 May 2026
Tracy Lynch
[email protected]
Dear Tracy,
Thank you for your email of 2 April 2026 requesting information relating to information on
agency recognition, privacy matters, and information handling. Your request has been
considered under the Official Information Act 1982 (OIA).
You requested the following:
1. Recognition of authorised representatives
Please provide:
• All policies, guidelines, manuals or internal instructions relating to recognition of
authorised representatives or agents.
• Any internal legal guidance on when MPI may refuse to communicate through an
authorised representative.
• All internal emails, notes, reports, or communications discussing whether Tracy Lynch
was authorised to act for Gary Van den Bogaart.
• Any documents explaining why MPI accepted or rejected her authority at different
times.
• Any documents showing when MPI communicated with Tracy Lynch as Gary Van den
Bogaart’s representative.
• Any documents explaining any change in MPI’s position regarding recognition of her
authority.
2. Privacy breach matters
Please provide:
• All documents relating to any incident where MPI sent incorrect information or
attachments to Tracy Lynch.
• Any privacy breach assessments completed under the Privacy Act 2020.
• Any internal reports, emails, or incident records relating to this matter.
• Any assessment of whether the incident constituted a notifiable privacy breach.
• Any communications with the Office of the Privacy Commissioner regarding this
incident.
• Any internal policies relating to handling misdirected emails or privacy breaches.
3. Phone and communications information
Please provide:
• Any documents showing whether MPI requested, obtained, or considered obtaining
phone or telecommunications information relating to Tracy Lynch or Gary Van den
Bogaart.
• Any applications for call data, subscriber information, or telecommunications
metadata.
• Any legal authority relied upon for obtaining such information.
2
• Any communications between MPI and New Zealand Police or telecommunications
providers relating to communications data.
4. Banking and financial information
Please provide:
• Any documents showing whether MPI requested, obtained, or considered obtaining
banking or financial information relating to the above individuals.
• Any production orders or legal authorities relied upon.
• Any communications between MPI and financial institutions relating to financial data.
5. Training and investigator guidance
Please provide:
• Any training material provided to MPI investigators relating to dealing with
representatives or agents.
• Any guidance relating to handling privacy incidents.
• Any policies relating to investigator communications with members of thepublic.
6. Decision authority
Please provide:
• Documents identifying who within MPI has authority to decide whether someone is
recognised as an agent or representative.
• Any delegation instruments relating to these decisions
I’ve addressed each of your questions below under the headings used in your request.
1. Recognition of authorized representatives
Other than lawyers, it is not common for people to be authorized to receive information from
MPI on behalf of someone else. Accordingly, the OIA team at MPI (who are also responsible
for processing Privacy Act requests) do not have a documented process for confirming that
someone is authorized to receive information on behalf of someone else. Formalizing this
process is on the OIA team’s work program. Currently, the team rely on guidance from the
Office of the Privacy Commissioner and advice from the Privacy team at MPI when required.
However, to ensure compliance with the Privacy Act 2020, MPI must satisfy ourselves that
the person who the information is about understands and genuinely consents to another
person receiving information about them. We’ve told you several times about the process
that we need you to follow. We need a statement from the person who the information is
about that authorizes you to receive information on their behalf, along with identity evidence
and contact details of the person. Depending on the context, MPI may contact the person to
ensure they understand and genuinely consent to another person receiving information about
them.
Our obligations under the Privacy Act 2020 also mean that we may ask for consent more
than once. This could happen if a person authorizes you to receive information on their
behalf, but the authorization was received a long time ago or in a different context or both.
Asking for consent a second time (for example after five years since the first consent was
granted) ensures that the person who the information is about is still happy for you to receive
information on their behalf. This doesn’t mean that the release of information under the first
consent was a breach of privacy. It just means that MPI needs assurance that the consent is
ongoing so that we can continue to release information.
3
If MPI is not satisfied that the person who the information is about understands and
genuinely consents to another person receiving information about them, we will ask for
consent to be provided. In this situation, it would be a breach of the Privacy Act 2020 for MPI
to release personal information to a third party until we have received appropriate
authorization. You will be aware that Mr van den Bogaart is now legally represented and MPI
has been specifically advised that you are not authorized to receive information on his
behalf.
In a letter dated 11 March 2026, you were advised that an issue of whether you are
authorized to receive information on behalf of someone else can be easily resolved by
providing evidence of the authorization. We told you that further requests on this issue,
without providing the required authorization, may be considered for refusal under section
18(h) of the OIA.
We have interpreted this part of your request to relate to the issue of whether you are
authorized to receive information on behalf of Gary van den Bogaart. It appears that it is your
view that you are authorized to receive information on his behalf. The easiest way to confirm
your authorization is by providing the evidence we have asked for. Our view is that it is
vexatious to continue making multi-part OIA requests relating to this issue while not providing
evidence that could easily resolve the issue.
Accordingly, part one of your request (other than the information provided above) is declined
under section 18(h) of the OIA.
2. Privacy breach matters
Your request for this information is refused under section 18(e) of the OIA because, despite a
reasonable search, we have not located any relevant information.
3. Phone and communications information
4. Banking and financial information
Your request for this information as it relates to Gary van den Bogaart is declined under
section 9(2)(a) of the OIA. You will be aware that Mr van den Bogaart is now legally
represented and MPI has been specifically advised that you are not authorized to receive
information on his behalf.
Your request for this information as it relates to yourself is refused under section 18(e) of the
OIA because, despite a reasonable search, we have not located any relevant information.
5. Training and investigator guidance
MPI’s training for investigators identifies where legislation allows for the service of
documents on a lawyer/representative instead of on a suspect/defendant. The training does
not expand on this, it only states that it can be done, and where to find the legislation that
provides for it.
To ensure compliance with the Privacy Act 2020, MPI must satisfy ourselves that the person
providing authorization understands and genuinely consents to another person representing
them. MPI investigators can refer to guidance from the Office of the Privacy Commissioner
and advice from the Privacy team at MPI when required.
Information about Privacy and Security at MPI, including MPI’s privacy policy, is publicly
available at the following link: https://www.mpi.govt.nz/about-this-site/privacy-and-security.
4
6. Decision authority
Respecting individuals’ privacy and ensuring that information is stored securely and shared
appropriately is the responsibility of everyone working at MPI. No one at MPI should release
private information to a third party unless they are satisfied that the person who the
information is about understands and genuinely consents to another person receiving
information about them. There are no instruments of delegation relating to a general
decision-making power to recognise or reject an agent or representative, so this request is
declined under section 18(e) of the OIA.
Where we have stated above that information is withheld, MPI is satisfied that, in the
circumstances of this case, the withholding of the information is not outweighed by other
considerations which render it desirable in the public interest to make the information
available.
Should you have any concerns with this response, I would encourage you to raise these with
the Ministry for Primary Industries at [email protected]. Alternatively, you
are advised of your right to also raise any concerns with the Office of the Ombudsman.
Contact details are: Office of the Ombudsman, PO Box 10152, Wellington 6143 or at
[email protected].
Yours sincerely,
Peter McCarthy
Director Legal Services