The investigators Thompson and Clark used their access to match names with number plates in more than 4000 searches since 2011, targeted at environmental protesters.
Inquiry head Doug Martin (centre), Simon Mount QC (left) and State Service Commissioner Peter Hughes discuss an report into the use of external security consultants. Photo: RNZ / Emma Hatton
The State Services Commission's report says most of these searches were probably illegal, even though Thompson and Clark argued they were doing them on behalf of the police and MBIE.
The government agencies categorically denied this.
"Based on the information we've got it appeared to us that many, maybe even most, of the searches of the database in relation to Greenpeace were outside the lawfully permitted purposes of access to the motor vehicle register," said the lawyer who investigated the surveillance, Simon Mount.
Those lawful purposes were preparing evidence related to criminal offences, detection and investigation of suspected fraud, enforcing court orders and judgements, and when acting as a contracted agent on behalf of government agencies to help with law enforcement.
The motor vehicle register was tightened in 2011. Before then anyone could obtain both vehicle and personal information.
Now, the former's still available but to get a an owner's details, you must use the Official Information Act - or get approval for authorised access from the Secretary for Transport who consults with the Privacy Commissioner, the Chief Ombudsman, and the Commissioner of Police.
Thompson and Clark used their authorised access to target Greenpeace protesters, a Kaikōura swim protest in 2014, a protest against Todd Energy and an Oil Free Seas Summit protest.
The firm claimed it was helping government agencies enforce the Crown Minerals Act, relating to threats against the oil and gas industry.
In 2013 the company was a registered informant for the police who headed up the Minerals Exploration Joint Intelligence Group, set up to co-ordinate intelligence for enforcing laws around prospecting offshore.
Thompson and Clark made its searches over a six-year period, from 2011 till last year.
The Transport Agency did one single check on what they were doing, over a month-long period in 2013, and raised no issues.
"The inquiry looked at NZTA and whether they were supplying effective oversight of access to the Motor Vehicle Register, and we concluded that they were not," Simon Mount said.
It was only after Thompson and Clark tried to renew its access to the motor vehicle register last year that it came unstuck.
It applied to broaden the access, to use it to "identify registered persons of motor vehicles involved in activity likely to impact assets and facilities of Thompson and Clark clients involved in lawful, permitted activity in the oil and gas, energy sector".
That unsettled the agency, which looked deeper, and happened upon the welter of protest-targeted searches, and ended the firm's access.
However, the agency already knew it had been remiss.
"NZTA were aware that their administration of those databases was loose," said the inquiry report's co-author Doug Martin.
"They'd had a major report, which identified many of the shortcomings and they were, to be fair, moving to tighten up in the last 12 to 18 months."
The inquiry found the agency's driver licence register was also misused, at least once, to give personal information to Thompson and Clark, in what was a "serious breach" of the code of conduct.
The agency told RNZ it had now put extra protections around both the Motor Vehicle and Driver Licence Registers and added more frequent auditing.
It and the NZTA board chair Michael Stiassny declined an interview.
It remains unclear just how the agency will now audit the 2200 or so people and companies who still have authorised access to the motor vehicle register; many of these are motor vehicle dealers, insurance companies, finance companies, and petrol stations.
But the authorised list also includes more than 60 private investigators and their companies, who mostly come under the notice number 5939.
The purposes those investigators are allowed to use the register for include "when acting as a contracted agent" to help government agencies enforce the law, the same as for Thompson and Clark. Most of the authorisations last for five years.
However, while the agency held no records of what Thompson and Clark searched for, under the tightening-up, investigators now have to keep their own search records for 12 months.
"Those records need to show date, plate number, and the purpose of accessing the information. Those records are to be provided to the NZ Transport Agency on request, to assist with any audit process," the authorisation notice says.
"The personal information obtained under this authorisation shall not be disclosed to any third party unless such disclosure is necessarily incidental to achieving a specified purpose."
