The Inspector-General of Intelligence and Security has revealed the SIS unlawfully accessed Customs data for almost 20 years.
Cheryl Gwyn said the SIS had direct access to a dedicated Customs computer terminal. Photo: RNZ / Diego Opatowski
Cheryl Gwyn said the SIS had direct access to a dedicated Customs computer terminal which contained information on passenger movements in and out of New Zealand, including information relating to many New Zealanders.
She said the data was accessed between 1997 and 2016.
"I have found that at the time there was no lawful basis under the Customs legislation, the New Zealand Security Intelligence Service Act, or any other legislation, for NZSIS to access the CusMod data.
"Nor do I accept that this was legitimate 'ask and answer,' as the Service asserted."
'Ask and answer' is shorthand for the lawful process by which any person or agency can ask any other person or agency for information.
It is up to the requested body to decide whether to disclose the information.
Ms Gwnn said in the legislation in force at the time, which contained detailed information access provisions for various government agencies, there was no scope for 'ask and answer' to operate alongside that regime.
"In any event, NZSIS did not make case-specific requests for information."
However, the law was changed earlier this year to legalise the SIS's access to the Custom's databases.
Director General of Security Rebecca Kitteridge said the new law explicitly confirmed NZSIS's authority to access the databases for specific purpose related to individuals of concern.
"In doing so, the Intelligence and Security Act 2017 provides a clear and robust framework for the SIS to operate within.
"I am pleased that in her report the Inspector-General recognised that the NZSIS did not wilfully break the law."
Ms Kitteridge said the issues identified in the report were largely legacy issues and relate to a period when the law was unclear, and when the NZSIS had challenges with resources and capability.
NZSIS Minister Andrew Little said the accessing of data was very disappointing.
"I've made it clear to both the directors general of both the services, and the agency, that i expect them to be fully compliant with the law at all times. They are now, and the reason we have the Inspector-General is to make sure there is a good check and balance on those services complying with the law."