Ka pēhea te whakawhanake kaupapahere rapu mōhiohio OIA

How to develop an OIA information search policy

Archives New Zealand has developed this resource to assist organisations meet their obligations under the Official Information Act 1982 (OIA) when processing requests for information. Guidance specific to the Privacy Act 2020 will be developed separately.

Information and records are at the core of an organisation’s business and are a key strategic asset. They are evidence of an organisation’s actions, decisions and processes, and may be subject to requests for access or to official scrutiny. Information assets, like any other asset of an organisation, need to be identified and managed to get the best value from them and organisations are expected to know where and how their information assets are held so they can be appropriately accessed and used. An information search policy not only utilises the benefits of identifying and managing information and records as an asset, it provides guidance and support for staff working in organisations who may be involved in undertaking a search for information within the scope of an OIA request.

There is a risk of organisations not being able to identify all information assets falling within the scope of an OIA request, not only due to the way information assets are stored and managed but also how information assets are searched for. The Public Records Act 2005 (PRA) requires the creation of full and accurate records and it is good practice for organisations to fully document the steps taken to search for information when processing an OIA request. A record of searches is useful, particularly when managing complex requests or when later explaining the search that was undertaken. For example, if a person who makes an OIA request subsequently complains to the Ombudsmen, it is the organisation who bears the onus of establishing that all reasonable steps have been taken to find the requested information before refusing access on the basis that the information provided represents the full extent of the information held, or the information cannot be found or does not exist (s.18(e) OIA).

Organisations can use this factsheet to develop an information search policy or best practice guidance for staff on how to determine whether they hold the information that has been requested. This should cover three main issues:

• the extent to which the organisation is obliged to extract and compile information in response to an OIA request;

• how the organisation may respond in different circumstances, for example, where the information is incomplete, unrecorded, inaccurate or deleted; and

• the searches for information that the organisation is expected to conduct.

An information search policy:

• helps organisations meet regulatory requirements, and the accountability expectations of government and the public

• promotes good information and records management practices

• provides best practice guidance for staff on where they are expected to search for information and how to do so

• contributes to efficient OIA searches

• supports internal monitoring for compliance.

Organisations should undertake a reasonable search on a flexible and common-sense interpretation of the terms of the request. What constitutes a reasonable search will depend on the circumstances of each request and will be influenced by the normal business practices in the organisation’s operating environment. If it is truly not clear what information the requestor wants, for example, if there are two equally tenable interpretations of a request, the organisation should not assume the requestor’s intentions but should instead use the mechanisms contained with the OIA (i.e., s13. 15(1AA) and (1AB), 18A and 18B) to clarify what is sought.

Under section 13 of the OIA, organisations have a duty to give ‘reasonable assistance’ to a person who:

• wishes to make a request in accordance with section 12 of the OIA

• in making such a request, has not done so in accordance with the requirements in that section; or

• has not made the request to the appropriate organisation.

The Office of the Ombudsman advise that reasonable assistance is more than telling a requestor that their request is not specific. In line with the purposes of the OIA and the ‘principle of availability’ (s.5 OIA), all reasonable assistance should be taken to help the requestor clarify their request so that it is specific enough for the organisation to identify the information sought.

At a minimum, the organisation should take comprehensive steps to locate information, having regard to:

• the subject matter

• previous OIA requests

• the skills and knowledge of staff who may be subject matter experts and/or responsible for information management and able to assist with the existence and location of information

• current and past information and records management systems

• authorised retention and disposal policies and practices, and

• the age of the information.

It is important that staff working in organisations who may be involved in undertaking information searches are supported by tools, training and resources that enable them to not only work effectively, but also ensure any OIA requests are processed in accordance with the requirements of the Act. While the OIA does not impose explicit information and records management requirements on organisations, the PRA does mandate that public sector organisations create and maintain full and accurate records of their affairs, and that these are identifiable, retrievable, accessible and useable.[1]

An information search policy should provide internal guidance for staff in circumstances where, for example:

• the requested information is incomplete or inaccurate

• the information has been amended or deleted after a request has been received

• the information has been legally destroyed, for example, if there are questions about whether the destruction was authorised under the PRA

• new information has been received or created after receipt of the request but before a reply has been sent that the responding organisation may choose to add as contextual information

• the information is held but has not yet been documented, for example, a record in writing of a phone call

• the extent to which staff responsible for processing OIA requests have full permissions and access to information held by the organisation or can gain access as required, and

• the requested information is created or held by contracted service providers.

This checklist sets out the steps an organisation should follow to ensure that all reasonable efforts are taken to find information within the scope of an OIA request.

• An OIA request should be interpreted as extending to any information that might reasonably be taken to be included within the description the OIA requestor has used.

• If there are genuine difficulties in identifying what information is within scope of the OIA request, organisations should go back to the requestor to clarify what is sought rather than assume.

• If not the OIA staff, identify who within the organisation may have the appropriate level of institutional knowledge and/or recordkeeping skills and training to undertake the search.

• All reasonably likely locations where information may be located should be searched by an organisation. This may include the following (if applicable):

  • case management systems

  • information and/or records management systems

  • line of business (LoB) systems (for example, finance systems, HR systems etc)

  • information saved on computers, electronic devices such as tablets, smartphones and apps (for example, emails, text messages etc) including personal devices, personal email accounts, etc, providing the information was sent, received or created in an official capacity

  • information saved on portable media devices including personal devices providing the information was sent, received or created in an official capacity

  • hardcopy files stored in safes, compactus, tambours, desk drawers, offsite storage etc

  • if applicable, backup systems

  • if applicable, consider whether the scope of the OIA request requires an organisation to ask a contracted service provider to provide information created by or in the possession of the contractor or sub-contractor to the organisation

  • consult with relevant officials about organisation recollection (i.e., the OIA applies to information irrespective of whether it has been documented, for example, including information contained in an official’s head)

• It is good practice to create internal records of the locations that have been searched. If an organisation needs to replicate the response or if the requestor complains to the Ombudsman, the organisation can show that reasonable efforts were made to identify the requested information. These records may include search minutes, internal emails, file notes kept by individuals, and document:

  • the date searches were undertaken

  • the person(s) and/or team(s) who undertook the searches

  • the scope and if applicable, details of any request clarifications

  • the locations searched

  • description of the searches /search terms used

  • the time taken to conduct the searches

  • the outcomes of the searches

  • if applicable, reasons as to why no information was found (for example, the information does not exist – either because it never did or because it has been legally destroyed).

Archives New Zealand has developed a template to assist organisations in documenting the steps taken in locating information within the scope of an OIA request (see section 6).

• An organisation’s letter[2] communicating its decision on an OIA request should contain enough detail to enable the requestor to understand the reason for the decision.

• Although communicating the steps undertaken to find information is not a requirement under the OIA, organisations may choose to detail these, as well as the outcome of any attempt(s) to consult the requester, in the response letter in particular if the OIA request is being refused under section 18(e) or (f). These details may include:

  • the date searches were undertaken

  • description of the searches /search terms used

  • the outcomes of the searches

  • if applicable, reasons as to why no information was found (for example, the information does not exist – either because it never did or because it has been legally destroyed

  • if applicable, reasons as to why information cannot be made available without substantial collation or research

Archives New Zealand has developed an internal template to assist organisations in documenting the steps taken in searching for information within the scope of an OIA request.

Scope of OIA request:

If applicable, details of any OIA request clarifications:

Searches undertaken:

Additional comments (for example, interpretation of the scope of the OIA request, additional details of searches conducted, an explanation as to why no information found (for example, the information does not exist - either because it never did or because it has been legally destroyed etc):

Records of the above searches have been created or maintained: Yes/No

[1] Information and records management standard (16/S1).

[2] The Office of the Ombudsman provides various template letters on their website that can be used by organisations to help respond to OIA requests.