An officer working for the Privacy Commission has questioned the way Corrections dealt with video footage of a prison attack.
Benjamin Lightbody of Northland was brain damaged in the May 2013 attack and wants the footage to help him get legal aid in his bid to claim $5 million compensation from Corrections for not keeping him safe.
The director of Human Rights Proceedings has received the Privacy Commission's report and is to decide whether to take legal action against the department.
The report called the Lightbody case an important one for public debate about what Crown agencies do with CCTV footage of people.
The Commission described how an inmate smashed a pool ball into the right-side temple of Benjamin Lightbody within an hour of him arriving at Mount Eden prison.
He collapsed, but the guards employed in the prison, which was then privately run by Serco, did not intervene.
Two CCTV cameras in the prison yard caught the assault.
Lightbody made it back to his cell, where his cellmate found him and raised the alarm.
But Corrections denied it had any footage from the cell of that, even though it had given such video to police investigating the assault.
"One of the clips from police shows the department's staff entering your cell to check on you, then ambulance officers arriving and taking you out of the unit on a stretcher," wrote Riki Jamieson-Smyth, the Commission's manager of investigations, in the report she sent to Lightbody.
She said that Corrections had still not confirmed the pod camera's existence, and concluded that either the department still had the footage and was holding it back for no lawful reason or it had lost or deleted it when it should have kept it safe.
As for footage shot in the yard of the attack itself, Corrections told the Commission only footage from the first camera was kept and given to police.
Footage from the second camera was not saved and was automatically overwritten after two weeks, it said.
Ms Jamieson-Smyth did not believe it.
"I am not persuaded the footage from camera two was not saved initially," she wrote.
"Nor am I satisfied that the department believed on reasonable grounds the footage from camera two was not relevant to the investigation and prosecution of the assault on you.
"At some point it appears the footage from camera two was saved so still photos could be taken. The fact that the Department obtained and has kept photos from camera two indicates that it considered the footage was relevant."
Shortly after the Lightbody attack, Serco was investigated and fined by Corrections for having inadequate supervision at Mt Eden so that the jail was unsafe - a fact uncovered by RNZ.
Corrections' argument against releasing any footage from within jails was that it could undermine safety by disclosing the location of CCTV cameras and the department's response tactics.
The Privacy Commission's report said that was a legitimate worry, but that the footage of the Lightbody assault did not risk disclosing this.
It concluded that Corrections interfered with Lightbody's privacy by deleting, or losing footage of the assault and its aftermath.
Benjamin Lightbody told RNZ he expected to get help from university forensics experts to determine how much editing Corrections has done on the video footage.
Serco said all its guards got extra training after the prison inspector's investigation of the attack, procedures were updated and one staff member was dismissed.
Corrections would not comment because there could be further proceedings, but previously it has said that a thorough investigation of the attack identified failings on Serco's part.
A year after the Lightbody attack, Corrections ordered an investigation that found there were fightclubs operating at Mt Eden. It then sat on those findings for 12 months until prisoners posted video on YouTube, in July 2015, of fightclubs taking place.