What is an adverse consequence or harm?

For an individual to make a complaint that their privacy has been interferred with, they need to show that there has been a breach of a privacy principle and that it has caused them harm. There are three kinds of harm, which can be considered when deciding whether someone’s privacy has been interfered with:

1. Specific damage – this could be financial loss, but could also include other forms of damage, such as loss of employment or physical injury.     
       
2. Loss of benefit – this is where the agency’s actions have adversely affected, or may adversely affect, the rights, benefits, privileges, obligations or interests of the individual.                                                                                                                                                   
3. Emotional harm – where the action has resulted in, or may result in, significant humiliation, significant loss of dignity or significant injury to the individual’s feelings. Mere embarrassment or annoyance is not enough – any emotional harm needs to be ‘significant’. 

An individual does not need to have been harmed to complain about the way an agency has responded to their requests for access to or correction of their personal information.

Updated October 2025