The review said the current guidelines were not strong enough and a legal framework was needed to protect against privacy breaches and ensure Police Vetting Service staff were not in a legally risky position.
While consent has to be given for vetting, Privacy Commissioner John Edwards said many people believed the checks were only for criminal records.
"Actually, the police will look deep into their files and any contact they've had with police might be taken into account. So if there's information police have access to that hasn't been tested by the court, that could be highly prejudicial, that the person might not even have been aware of, then that presents problems."
The review said in some instances the police released information that had not been verified. "Reliance on this material can be very prejudicial to the individual concerned and leave them with very little ability to counter the prejudicial effect of a negative vet."
The reviewers were particularly concerned police sometimes released mental health information saying police were not qualified to make judgments on its relevance. It recommended such information be released only on the advice of a mental health specialist.
Another concern was the handling of information which had been suppressed by the courts.
The review team said a higher test of relevance should be applied to information that was suppressed and where a final suppression order had been made to protect someone who had been acquitted, there should be a strong presumption against release.
Edwards said there had been complaints to both agencies about the vetting system from people who believed irrelevant or inaccurate material was being provided to employers.
The review proposed police give advance notice of a vetting report in which some information might not be expected by the person being vetted to give them a chance to explain or withdraw.
It recommended new legislation to set out the ambit and powers of police vetting.
Police undertake pre-employment vetting for organisations such as Immigration NZ and Child Youth and Family as well as for licensing bodies such as for taxi drivers. Schools must also vet new employees and the Vulnerable Children's Act has extended that to all people who come into contact with children at the workplace.
It also recommended police stop advising an agency that it had further information which could not be disclosed, saying it was a "fundamental breach of natural justice and poses a substantial risk that their livelihood or career may be destroyed by allegations that could have been rebutted if they had been known".
Instead it proposed a blanket statement on all vetting reports advising that sometimes police held information which it could not release.
