A report under subsection (1) must not include personal information (within the meaning of the Privacy Act 1988).