The Privacy Act creates a right of access and an obligation to respond promptly. The decision is then reviewable by the Privacy Commissioner, and his decision can then be reviewed by the HRRT and (eventually) the courts.

So yeah, there's nothing preventing Fisher refusing on either an accurate or nonsensical ground to provide the information, and it would then be up to the judge to decide whether Dotcom is obliged to make a complaint about the refused request (and maybe go on to appeal it).

"- Section 2 of the Act states that a "news medium" is "an agency" whose business, or part of whose business, consists of a news activity;
- Section 2 defines "news activity" as the act of preparing, gathering or disseminating news or current affairs; and
- Justice Winkelmann has acknowledged (at paragraph 66) that an individual can be "an agency" for the purposes of the Act.

When you put these things together you should reach the conclusion that a freelance journalist or author can be a "news medium" for the purposes of the Privacy Act 1993. It would be interesting to see the point argued on appeal."

This is correct: a GP and a plumber are both agencies, even though they might work as sole practitioners of their profession.

The key point to note here is that the defence (the Crown) has deliberately suggested a long, complicated, unsound and kinda dumb route and the judge has picked up on it. Now Dotcom has to either expensively appeal on the point of law or take the lengthy route proposed by the judge. Clever lawyering on their part, whether or not it stands up on appeal.

To put it another way: Kim's 'right' is to make an access request. It's not to actually have every bit of information about him, that's something that gets decided by the PC/Courts. So once he's made his access request and Fisher has said 'no' on whatever grounds he thinks appropriate, then Dotcom would be justified in saying 'I exercised my right under the Act, here's what Fisher gave me, but I didn't get all the information, sorry Court'.

To take it further would be to obligate Dotcom to pursue it through the courts until he gets every single bit of info that is held about him.

"But if the Crown lawyers had gone to the front door and sought third-party discovery from Fisher, wouldn't Fisher have a stronger case that it was BoRA-prohibited unreasonable search and seizure (BoRA only applies to the Crown)? Dotcom's access to Fisher's material isn't unreasonable search and seizure, because a) Dotcom is not the Crown; and b) he has (now) a right to request it."

It's dumb on practical grounds, in that it's using a mechanism (p6 access request) that is unsuited to the task it's being asked to accomplish. Discovery is the right mechanism, even if it's hard and might not work.

If Dotcom asks for it the presumption is that Fisher will provide every bit of information about him that he has, subject to Fisher being able to refuse where an exception under sections 27 to 29 of the Act. The main exception is 29(1)(a), that disclosure would be an unwarranted disclosure of someone else's affairs. But it is up to Fisher what he actually releases, and the only avenue is then for Dotcom himself to make a complaint about how his request was dealt with. And it's then up to the Privacy Commissioner (who is after all an -independent- crown entity) to decide how he deals with the complaint - there are various options, including passing it on to the HRRT, dismissing it, agreeing with one or other of the parties. He's notionally bound to agree with the judge on the interpretation of the law, but there is always wiggle room.

I know the Privacy Act very well: with all respect to the judge, it's a fairly nonsensical judgment: being obligated to exercise a right under penalty of contempt of court is a terribly clunky way of enforcing discovery.

If the author declines to provide the information, is Dotcom obligated to make a complaint under s67? What if the author only provides it in part, citing ss27-29 of the Privacy Act (s29(1)(a) seems germane)? And even if the Privacy Commissioner thinks the information should be provided to Dotcom, his opinion isn't binding. So even if the Privacy Commissioner decides the complaint has merit, is Dotcom obliged to take it to the Human Rights Review Tribunal, and on to (eventually) the Supreme Court to enforce provision?