Reviewed for relevance April 2025.

Mrs Patel was outraged. She’d visited her GP for a follow-up check after her hand surgery, and he’d asked her about her history of depression. She didn’t think she’d had anything of the sort, and decided to ask the receptionist for a copy of all her medical notes to see what else was in there. The young receptionist assured her that the doctor owned the notes so she couldn’t have them. 

Complaints are valuable assets for every organisation. There is no better way to highlight and fix problems in an organisation’s systems and processes. This is what we tell the agencies we investigate, and many of them take the opportunity to learn from complaints to improve their practices. It’s also a view that was echoed in an excellent Auditor-General report about ACC’s complaint’s processes.   

Our office is proud of the work we do in the area of dispute resolution. Where it is appropriate, we try and bring complainants and respondents together, in person or by phone, to resolve privacy disputes. Last year, we closed 827 complaint files and of these, nearly half were achieved with a settlement between the parties involved.

Updated by our Guidance team in March 2025.

The Wellington High Court's decision to classify Nicky Hager as a journalist in relation to the publication of Dirty Politics, and therefore entitled to assert privilege under s.68 of the Evidence Act 2006 echoes our Office’s decision to do the same, in a complaint made against him by blogger Cameron Slater. This is important because the Privacy Act only applies to agencies – and the definition of “agency” excludes “ in relation to its news activities, any news medium.”  Journalists working in their capacity in the news media do not come under my office’s remit. 

So you are hiring. What do you need to do to meet your privacy obligations? Here’s an easy checklist of do’s and don’ts. They all relate back to the 12 privacy principles that guide the collection, use, storage and disposal of personal information.   

A complainant seeking $100,000 in damages for Westpac’s disclosure of a debit card statement to his employer has had his case dismissed by the Human Rights Review Tribunal.