She said the NZSIS had ignored requests for information on how much data it held and she had asked again for it to be provided within three months.
It is unclear what Gwyn could do if it continued to ignore her.
The inquiry came about when a new law allowing the intelligence service access to government databases raised questions about existing access.
That was in 2014 but the review has dragged on while the NZSIS sought alternative legal opinions, commissioned an "independent review" and, according to the Inspector General, simply delayed responding.
The questions raised were around access to Customs NZ and Immigration NZ databases, which cover a huge amount of personal information about anyone traveling to or from New Zealand.
The NZSIS had access to the data since 1997 through a "CusMod" terminal in the service's offices.
It allowed intelligence staff to create a travel alert for an individual by entering a name and other identifying features, or to search past travels to gather information.
A halt was called to access to the terminal to gather data on November 24, 2014.
"This was the result of concerns identified by various Government agencies involved as to the legal basis upon which NZSIS access occurred," Gwyn's report said.
On December 12, 2014, a new law came into effect leading to an agreement that allowed NZSIS access to the terminal under strict conditions. It lasted a year.
The new rules limited to five the number of intelligence service staff who could access the terminal, limited use to counter-terrorism investigations and also restricted the amount of information NZSIS could access.
Gwyn found, and the NZSIS conceded, that the rules were never followed.
Contrary to its undertaking, the NZSIS pulled details "about particular individuals' travel movements", never set up access rules around the terminal allowing continued broad use of it and sought data other than for counter-terrorism investigations.
The NZSIS then went on to ignore a Memorandum of Understanding it signed in August 2015, under which it agreed to provide a list of those who would access the terminal.
On June 15, 2016, NZSIS was again told to stop accessing Customs' data.
Gwyn said the access to the terminal before 2014 was unlawful - but that the NZSIS carried on acting unlawfully even when told what it had to do to stay inside the law.
An investigation by the NZSIS internal team that monitors compliance with the law, took place between June and August 2016, after which limited and legal access to the data took place.
Gwyn said she had no idea how much data the NZSIS had "unlawfully obtained" and how it was intending to handle that data.
She said she gave the NZSIS a report in May 2016 detailing why accessing Customs' data was unlawful, with a recommendation it report on how much information it held.
She said the NZSIS had not provided her with any information on that. She said the service had also ignored recommendations to talk with her office and the Privacy Commissioner over the "unlawful" access to data.
"I understand that this is because the Service does not consider its 'travel alert' access to have been unlawful."
She said she was concerned at the NZSIS "failure" to move quickly enough to seek legal advice.
Gwyn said she was also concerned the NZSIS did not directly respond to concerns over why it believed it was lawful to access the information.
She said she "found the Service reluctant in its engagement with me" and she had been "delayed and waylaid" by NZSIS' "lack of precision and forthrightness".
Gwyn said the NZSIS had "obstructed" her ability to access "original and unredacted documents".
The NZSIS had specifically refused to provide the "independent" report it commissioned into access of the data, and had also withheld its legal advice.
Gwyn said the NZSIS position was that it had the legal right access the data because it was allowed to ask any agency for information, and there were waivers through the Privacy Act for intelligence agencies.
But she said there was no basis for the NZSIS to receive the data on a "large scale, systematic basis". It could only do so in specific cases where it was able to show good reason for seeking the information.
She also said the areas of the Privacy Act quoted by the NZSIS were exemptions but not general rights of access.
"This was systemic unlawful access on a large scale. The access since late 2014 is more troubling again, as the Service was, from that point, expressly on notice that access – unless properly empowered and regulated – was unlawful; or putting it at its best from the service's perspective, very likely to be unlawful.
"The NZSIS' failures over the best part of two years to adhere to the terms of the interim agreement and the MOU are significant and hard to fathom."
The access to the Customs data had been made legal with the passing of a new law, which meant there were "direct access agreements" that governed access to the system. Gwyn said "the legislation was necessary to avoid on-going illegality".
The NZSIS has also accessed Immigration NZ data since 2011 for airline passenger lists. New legislation also meant the Immigration NZ data could be accessed.
Opposition NZSIS spokesman Chris Finlayson said he had not read the reports and asked the NZ Herald to call back when he had.
