Privacy Issues

Next steps to take if you believe that your privacy has been breached.

Who do I go to?

Who do I go to?

The Privacy Commissioner(external link) if you believe a company has interfered with your privacy.

The Human Rights Review Tribunal (HRRT)(external link) if the Privacy Commissioner decides that your privacy has not been interfered with and you disagree. 

The Office of the Ombudsman(external link) for guidance on Official Information Act (OIA) requests or if you are not happy with an agency response or lack of response to your request.

What kind of problems do they handle?

What kind of problems do they handle?

Generally, the Privacy Commissioner handles complaints that an agency has interfered with privacy by breaching one of the privacy principles.

Any breach must have caused you some kind of harm, such as: 

  • financial loss
  • breach of your rights
  • damage to an interest you have
  • significant humiliation, loss of dignity or injury to your feelings.

 The Commissioner’s privacy principles set out your rights in relation to your personal information and how agencies collect, store, use and disclose that information.

You don’t have to have suffered any harm if your complaint is about access to or correction of personal information. 

Several privacy codes of practice apply to specific industries. These codes include:

 The Tribunal can award various remedies after hearing a case, including: 

  • a declaration that the agency breached the law
  • an order preventing repetition of the breach
  • an order to do something to rectify the breach
  • damages
  • an award of costs against the losing party. 
What do I need to do?

What do I need to do?

  1. Contact the privacy officer at the agency holding your personal information if you think the agency has interfered with your privacy. Follow that agency’s complaints process. 
  2. Contact the Privacy Commissioner if you’re unhappy with the result of any complaint. Follow the Privacy Commissioner’s complaints process to make your complaint(external link)
  3. If you’re unhappy with the Privacy Commissioner’s opinion or refusal to investigate your complaint, you may apply for a hearing with the Human Rights Review Tribunal (HRRT). Find out more about the HRRT’s hearing process(external link).
What else do I need to consider?

What else do I need to consider?

The Privacy Commissioner can’t award you compensation or fine the agency for any breaches. 

Although there’s no time limit for making a complaint to the Privacy Commissioner, the length of time before you complained may influence the Commissioner’s decision on whether or not to investigate.

This complaints process is free for you.

The Commissioner will try to resolve the dispute initially using mediation or conciliation. If this is not successful, the Commissioner will do a formal investigation, which may result in a settlement. 

If no settlement is reached, the Commissioner will release a final opinion, but this is not binding on either party.

The HRRT has the power to make a binding decision on the parties, including awarding compensation.

You can’t go to the Disputes Tribunal or to court to complain about a breach of your privacy.

Where can I get more information?

Where can I get more information?

Office of the Privacy Commissioner

See Ask us a question (external link)which answers your questions about the Privacy Act. There is also information about how to make complaints (external link)about breaches of the Act.

Visit the website(external link)
Phone: 0800 803 909

Human Rights Review Tribunal

Provides information on the tribunal and the process of making a claim.

Visit the website(external link)
Phone: (04) 462-6660

Office of the Ombudsman

Provides information on how to raise a complaint about a government department or how an investigation was carried out.

Visit the website(external link)
Phone: 0800 802 602