How to complain to the Privacy Commissioner

Who is the Privacy Commissioner?

The Office of the Privacy Commissioner was established by the PRIVACY ACT 1993 to, among other things, deal with complaints of breaches of the privacy principles contained in the Act. The Act establishes principles to guide the collection, use and disclosure by public and private organisations of information relating to individuals ("personal information").

How do I make a complaint?

If you suspect that your privacy rights under the Act have been breached you can call the Privacy Commissioner’s information hotline on 09 302 8666 (for Auckland callers) or 0800 803 909 (for other areas). The Privacy Commissioner’s staff will be able to give you information on the privacy principles that appear to be relevant to your situation and on how to go about making a complaint, but they are not permitted to express any view about whether there has in fact been a breach in your particular case.

If you then wish to make a complaint, you may do so either orally or in writing, but the Commissioner’s office prefers that you do so in writing, by one of the following methods:

• by writing to:

• by sending a fax to 09 302 2305
• by emailing your complaint to privacy@iprolink.co.nz (if emailing, make sure you supply a postal address and phone number)

What information do I need to include in my complaint?

The Office of the Privacy Commissioner has stated that complaints should include the following information:

• a brief description of the action that you are complaining about
• the relevant dates
• the name and address of the agency that you are complaining about (and the names of any people within the agency who have been involved with your complaint)
• copies of relevant correspondence between you and the agency

For more information on making complaints, see the Privacy Commissioner’s website at www.knowledge-basket.co.nz/privacy.

How do I find out about my privacy rights?

Section 6 of the PRIVACY ACT 1993 sets out 12 "Information Privacy Principles". The Privacy Act applies to all individuals and organisations, both public and private, that hold "personal information", which means information about an identifiable individual.

The 12 principles set out rules about:

• the purpose for which personal information can be collected
• the sources from which personal information can be collected
• the steps that must be taken when information is being collected from an individual
• the manner in which personal information can be collected
• how personal information should be stored
• the right to have access to personal information that is held about you (see How to obtain personal information held by government departments)
• the right to have corrections made to personal information held about you
• the obligation of information-holders to ensure that personal information is accurate
• the obligation of information-holders to retain personal information only for as long as is necessary
• limits on the use of personal information
• limits on the disclosure of personal information
• the way personal information is identified

What are the grounds for making a complaint to the Privacy Commissioner?

You can complain to the Privacy Commissioner if you believe that your rights under the PRIVACY ACT 1993 have been interfered with. There are two broad categories of complaints:

• Access to or correction of personal information: You may complain to the Commissioner if you have made a request for access to personal information held about your or to have your personal information corrected, and the agency in question has made a decision on your request or failed to respond within the time limit. (see How to obtain personal information held by government departments)
• Other breaches of privacy: You may complain if an agency has breached one of the 12 privacy principles or a code of practice, and the breach has done or may do one of the following:
• caused you loss, detriment, damage or injury
• adversely affected your rights, benefits, privileges, obligations or interests
• caused you significant humiliation, significant loss of dignity or significant injury to your feelings

How will the Privacy Commissioner deal with my complaint?

If the Commissioner decides that your complaint has merit, he or she will first attempt to resolve the matter between you and the agency in question, without using the formal machinery of the PRIVACY ACT 1993. The Commissioner’s role is to be investigative and impartial; the Commissioner does not act as an advocate for either side.

If this is not successful, the Commissioner may decide to refer your complaint to the Director of Human Rights Proceedings, who may in turn decide to take your case to the Human Rights Review Tribunal.

If your complaint isn’t referred to the Human Rights Review Tribunal, you have the option of taking proceedings to the Tribunal yourself.

What can the Human Rights Review Tribunal do if it finds in my favour?

If the Tribunal finds on the balance of probabilities that your privacy rights under the Act have been breached, it can do one or more of the following:

• award you damages to compensate you for:
• monetary loss or expenses
• the loss of any benefit, monetary or otherwise
• humiliation, loss of dignity, and injury to feelings
• make a declaration that the agency’s action was an interference with privacy
• make an order restraining the agency from continuing or repeating the interference, or from engaging in similar conduct
• order the agency to remedy the interference, or to redress any loss or damage you have been caused, or both

Cautionary notes

• You should bear in mind that the Privacy Commissioner must also have regard to other interests such as national security and human rights, and these may compete with an individual’s privacy rights. This could limit your rights of access to personal information.
• The Office of the Privacy Commissioner can give you more detailed information on the privacy principles in the Act and your rights under them. You may also wish to obtain legal advice on your rights under the Act.
• Awards of damages by the Human Rights Review Tribunal have generally been low.