Police are being called on to urgently overhaul their vetting service, which runs checks on more than half a million New Zealanders each year.
A review by the Privacy Commissioner and Independent Police Conduct Authority has found areas where the law is unsatisfactory and puts the service in a very difficult and legally risky position.
Among problems the review raised is that in some cases police had been disclosing information even though people had not given their consent.
In a statement issued today, police admitted the efficiency and integrity of the service needed to be improved, and a clear statutory framework should be developed.
However, the statement also said Police had already made some changes to the vetting service, and more were coming.
A police 'vet' is a review of all information held by police when agencies are carrying out security checks on potential employees, or volunteers working with vulnerable people.
Police carry out about 500,000 vets each year. The report found most were dealt with quickly, but there were questions about some of the more complex cases.
The review made a number of recommendations about how police should deal with 'intelligence' that cannot be verified and information that may be subject to suppression orders.
The review said in some cases police could be in breach of the Bill of Rights Act if they tell employers there is relevant information about the person they can't disclose because of suppression orders.
It said the individual has no opportunity to explain or refute the information.
In other cases, police provided government agencies information that was suppressed by courts, arguing that doing so did not breach a ban on publication.
Privacy Commissioner John Edwards told Morning Report the service needed a clear legal framework.
"A lot of people, I think, have the impression that a police vet is a record of criminal conviction. It actually goes much wider than that, and police are entitled to look at any information they have about you," he said.
"We congratulate the police for calling us in to say 'let's have a first-principles review'" - Privacy Commissioner John Edwards
"It could lead to information being provided that you didn't even know police had - that police may not have verified.
"So that's the concern that we've got, that in those marginal cases where police can't vouch for the validity or the accuracy of the information they've got and it could be prejudicial."
The review said police should also not include information about an individual's mental health unless it indicated a risk to other people.
It found legislation should be introduced to give police a clear legal mandate to carry out the checks as "the lack of a clear statutory framework for vetting creates uncertainty about what information can be considered as part of the vetting process".
And it concluded there was also "uncertainty" about how police determine what information is "relevant" for a particular vetting application.
The report said because of the lack of clear legislative or policy direction on how police vetting checks are to be undertaken, or the manner in which police responses should be provided, that gave rise to "uncertainties and legal risks for all parties".
"We think that there should be a clear statutory framework for vetting, and we support the proposal [currently under consideration by the police] that a programme of work be undertaken to develop recommendations to government for the enactment of legislation."
The report made other recommendations, including making sure only approved agencies could access the police vetting service, that processes police use for vetting are consistent and transparent, that police make sure appropriate authorisation has been obtained by the subject, and making the process as fast as possible.
Police national communications manager Steve Kehoe told Morning Report he was confident the service was already efficient.
"We have a main focus of ensuring the safety of the most vulnerable in our community is protected" - Superintendent Steve Kehoe
"We have over half a million people per year are submitted to a vet," he said.
"Of those half a million vetting requests, maybe 200 per year end up at what we call the vetting review panel."
"And that panel is made up of senior people within police ... and those people go through what is called untested information."
He said police welcomed the report, and took the privacy of people very seriously.
"So we go through that evidence and that's where we have to strike that balance between ensuring that the safety of the vulnerable people in our community is maintained equally, as I said earlier, with the privacy of the individuals."
However, striking that balance could mean seeking out and providing information that would not necessarily hold up in court.
"Quite often we have to look at the reasons why the court case did not actually proceed or in fact and acquittal was achieved at court.
"So the burden of proof in a criminal court is beyond reasonable doubt, and I think there's an acceptance in the report that we don't necessarily have to apply that standard of proof."
He also wanted to offer assurance that when organisations made requests, it was checked whether they fit the criteria necessary before a vet was done.