Privacy Commissioner - Te Mana Matapono Matatapu

Skip to content

A Guide to the Privacy Act 1993

Personal information held by agencies

The Privacy Act controls how "agencies" collect, use, disclose, store and give access to "personal information".

Personal information is information about identifiable, living people.

Almost every person or organisation that holds personal information is an "agency". So, for example, the Privacy Act covers government departments, companies of all sizes, religious groups, schools and clubs.

Only a few organisations and people are exempt from the Act. Other rules exist to govern how they manage personal information. Among the most important exceptions are:

• Members of Parliament, when they are acting as MPs;
• Courts and tribunals, in relation to their judicial functions;
• The news media when they are conducting their news activities.

Individuals who collect or hold personal information for their own personal, family or household affairs are also exempt from the Act.

The privacy principles

At the heart of the Privacy Act are twelve information privacy principles. The privacy principles govern:

• Collection of personal information (principles 1-4);
• Storage and security of personal information (principle 5);
• Requests for access to and correction of personal information (principles 6 and 7; plus parts 4 and 5 of the Act);
• Accuracy of personal information (principle 8);
• Retention of personal information (principle 9);
• Use and disclosure of personal information (principles 10 and 11); and
• Using unique identifiers (principle 12).

These principles reflect internationally accepted standards for good personal information handling.

On occasion, other laws may override the Privacy Act.

For the text of the privacy principles, or for more information, go to the website under Privacy Act and Codes/Privacy Principles.

The Privacy Commissioner

The current Privacy Commissioner is Marie Shroff.

The Office of the Privacy Commissioner is an Independent Crown Entity. It is funded by the State, but is independent of government or Ministerial control.

What the Privacy Commissioner does

The Privacy Commissioner has a range of functions. These include:

• monitoring proposed legislation to see if it affects the privacy of individuals, and commenting on any privacy problems that do arise;
• being consulted on policy developments which have an impact on privacy;
• undertaking education on privacy;
• overseeing information matching programmes;
• being aware of technological developments which can affect privacy;
• issuing codes of practice, which modify the privacy principles and which apply to a particular industry or topic;
• investigating complaints about interferences with privacy. An interference with privacy can occur when:

(a) an agency wrongfully refuses to give an individual access to information about them, or wrongfully refuses to correct information about them; or
(b) an individual suffers some form of harm as a result of a breach of a privacy principle, rule, or a code of practice or information matching provision.

Complaints

For full details, see the fact sheet on complaints. Briefly, though, if you have a complaint about an interference with your privacy, first contact the agency and see if you can resolve the matter yourself. Each agency should have a privacy officer - a person who knows about the agency's responsibilities under the Privacy Act. That person should be able to help you.

If you contact our enquiries line, we may also be able to provide some information to help you. We cannot give you legal advice, but we can point you in the right direction.

Contact details

If you have a general enquiry, go to our website at www.privacy.org.nz, call our enquiries team on 09 302 8655 (freephone 0800 803 909 if you are calling from outside Auckland), or email us on enquiries@privacy.org.nz.

If you have a complaint about privacy that you have not managed to resolve with the agency, you can make a formal complaint to us. We have a form to assist you, and information about complaints which you can download from the website (under "Your Privacy/How To Complain"). You can also ring us and we will send you a form. Alternatively, simply write to the Privacy Commissioner at PO Box 10-094, Wellington explaining your complaint.

For all other correspondence to the Commissioner, you can also write to the Commissioner at this address.