How to complain to the NZ Privacy Commissioner
Who is the Privacy Commissioner?
The Office of the New Zealand Privacy Commissioner was established by the PRIVACY ACT 1993 to, among other things, deal with complaints of breaches of the privacy principles contained in the Act. The Act establishes principles to guide the collection, use and disclosure by public and private organisations of information relating to individuals ("personal information").
How do I make a complaint?
If you suspect that your privacy rights under the Act have been breached you can contact the Privacy Commissioner's via their complaint web page. The Privacy Commissioner's website gives you information on the privacy principles and on how to go about making a complaint.
What information do I need to include in my complaint?
The Office of the Privacy Commissioner has stated that complaints should include the following information:
- a brief description of the action that you are complaining about
- the relevant dates
- the name and address of the agency that you are complaining about (and the names of any people within the agency who have been involved with your complaint)
- copies of relevant correspondence between you and the agency
How do I find out about my privacy rights?
Section 6 of the PRIVACY ACT 1993 sets out 12 "Information Privacy Principles". The Privacy Act applies to all individuals and organisations, both public and private, that hold "personal information", which means information about an identifiable individual.
The 12 principles set out rules about:
- the purpose for which personal information can be collected
- the sources from which personal information can be collected
- the steps that must be taken when information is being collected from an individual
- the manner in which personal information can be collected
- how personal information should be stored
- the right to have access to personal information that is held about you (see How to obtain personal information held by government departments)
- the right to have corrections made to personal information held about you
- the obligation of information-holders to ensure that personal information is accurate
- the obligation of information-holders to retain personal information only for as long as is necessary
- limits on the use of personal information
- limits on the disclosure of personal information
- the way personal information is identified
What are the grounds for making a complaint to the Privacy Commissioner?
You can complain to the Privacy Commissioner if you believe that your rights under the PRIVACY ACT 1993 have been interfered with. There are two broad categories of complaints:
Access to or correction of personal information: You may complain to the Commissioner if you have made a request for access to personal information held about your or to have your personal information corrected, and the agency in question has made a decision on your request or failed to respond within the time limit.
- Other breaches of privacy: You may complain if an agency has breached one of the 12 privacy principles or a code of practice, and the breach has done or may do one of the following:
- caused you loss, detriment, damage or injury
- adversely affected your rights, benefits, privileges, obligations or interests
- caused you significant humiliation, significant loss of dignity or significant injury to your feelings
How will the Privacy Commissioner deal with my complaint?
If the Commissioner decides that your complaint has merit, he or she will first attempt to resolve the matter between you and the agency in question, without using the formal machinery of the PRIVACY ACT 1993. The Commissioner's role is to be investigative and impartial; the Commissioner does not act as an advocate for either side.
If this is not successful, the Commissioner may decide to refer your complaint to the Director of Human Rights Proceedings, who may in turn decide to take your case to the Human Rights Review Tribunal.
If your complaint isn't referred to the Human Rights Review Tribunal, you have the option of taking proceedings to the Tribunal yourself.
What can the Human Rights Review Tribunal do if it finds in my favour?
If the Tribunal finds on the balance of probabilities that your privacy rights under the Act have been breached, it can do one or more of the following:
- award you damages to compensate you for:
- monetary loss or expenses
- the loss of any benefit, monetary or otherwise
- humiliation, loss of dignity, and injury to feelings
- make a declaration that the agency's action was an interference with privacy
- make an order restraining the agency from continuing or repeating the interference, or from engaging in similar conduct
- order the agency to remedy the interference, or to redress any loss or damage you have been caused, or both
- You should bear in mind that the Privacy Commissioner must also have regard to other interests such as national security and human rights, and these may compete with an individual's privacy rights. This could limit your rights of access to personal information.
- The Office of the Privacy Commissioner can give you more detailed information on the privacy principles in the Act and your rights under them. You may also wish to obtain legal advice on your rights under the Act.
- Awards of damages by the Human Rights Review Tribunal have generally been low.