Office of the Privacy Commissioner | A Guide to the Privacy Act 1993
Personal information held by agencies
The Privacy Act controls how 'agencies' collect, use, disclose, store and give access to 'personal information'.
The privacy Codes of Practice do the same, but they apply to specific areas - particularly health, telecommunications and credit reporting.
Personal information is information about identifiable, living people.
Almost every person or organisation that holds personal information is an 'agency'. So, for example, the Privacy Act covers government departments, companies of all sizes, religious groups, schools and clubs.
Exemptions from the Act
Only a few organisations and people are not 'agencies'. Other rules exist to govern how they manage personal information, so the Privacy Act does not cover what they do. Organisations that aren't covered by the Privacy Act include:
Members of Parliament, when they are acting as MPs. It's up to Parliament or political parties to discipline MPs for breaches of privacy
courts and tribunals, in relation to their judicial functions. You have to challenge judicial decisions through the normal processes, such as an appeal
The news media when they are conducting their news activities. The Press Council, the Broadcasting Standards Authority and the courts govern the news media.
In addition:
if another law is inconsistent with the Privacy Act, that other law will trump' the Privacy Act
individuals who collect or hold personal information for their own personal, family or household affairs are exempt
in special circumstances, the Commissioner can authorise agencies to collect, use or disclose information even when that would usually breach principles 2, 10 or 11.
The privacy principles
At the heart of the Privacy Act are twelve privacy principles. The privacy principles cover:
collection of personal information (principles 1-4)
storage and security of personal information (principle 5)
requests for access to and correction of personal information (principles 6 and 7, plus parts 4 and 5 of the Act)
accuracy of personal information (principle 8)
retention of personal information (principle 9)
use and disclosure of personal information (principles 10 and 11), and
using unique identifiers (principle 12).
There are also four principles covering public registers.
These principles reflect internationally accepted standards for good personal information handling.
The Privacy Commissioner
The current Privacy Commissioner is Marie Shroff.
The Office of the Privacy Commissioner is an Independent Crown Entity. It is funded by the State, but is independent of government or Ministerial control.
What the Privacy Commissioner does
The Privacy Commissioner has many responsibilities. These include:
monitoring proposed legislation to see if it affects the privacy of individuals, and commenting on any privacy problems
being consulted on policy developments that have an impact on privacy
providing education about privacy
overseeing information matching programmes
being aware of technological developments that can affect privacy
issuing codes of practice, which modify the privacy principles and which apply to a particular industry or topic
investigating complaints about interferences with privacy. An interference with privacy can occur when:
(a) an agency wrongfully refuses to give an individual access to information about them, or wrongfully refuses to correct information about them, or
(b) an individual suffers some form of harm as a result of a breach of a privacy principle, rule, or a code of practice or information matching provision.
Contact us
If you have a general enquiry, search the website for the information you are looking for, call our enquiries team on free phone 0800 803 909 (or 09 302 8655 if you are calling from Auckland), or email us at enquiries@privacy.org.nz.
If you have a complaint about privacy that you have not managed to resolve with the agency, you can make a formal complaint to us. We have information about complaints to assist you and a form which you can download. You can also ring us and we will send you a form. Alternatively, write to the Privacy Commissioner at PO Box 10-094, Wellington 6143, explaining your complaint.
For all other matters, you can also write to us at the above address.