Principle 12: “Unique identifiers”

Can an agency give me an ID number?
Making a Complaint
I am not happy with the way my information has been dealt with by an agency, what can I do?
What if I am not happy with what the Privacy Commissioner does?

A unique identifier is a name or number other than your usual name, used by an agency to identify you. Examples include:

• Bank account number;
• IRD number;
• Passport number;
• Driver’s license number

Can an agency give me an ID number?

Sometimes an agency will give you a number instead of using your name. Examples are you IRD number and your driver’s licence number. The agency cannot give you an ID number unless it is absolutely essential for it to function efficiently, for example, to prevent confusion if there are two Joe Smiths on its records. It cannot give you the same number as one you have already been given by another agency, e.g. IRD cannot give you the same number WINZ has given you.

Making a Complaint

You can make a complaint to the Privacy Commissioner about any action which seem to be an interference with your privacy. Two conditions must be satisfied before an interference with your privacy can be said to have occurred. First, the agency must have breached an information privacy principle or rule from a code of practice. Second, the breach must:

• have caused loss, detriment, damage or injury to you, or may do so; or
• have adversely affected your rights, benefit, privileges, obligations or interests, or may do so; or
• have resulted in significant humiliation, loss of dignity or injury to your feelings, or may do so

It is also an interference with your privacy, of an agency refuses your request (or breaches the correct procedures):

• for access to your personal information (Principle 6)
• for correction of your personal information (Principle 7)

and there is no proper basis for the decision.

I am not happy with the way my information has been dealt with by an agency, what can I do?

If you think an agency has not followed one of these rules, call the agency and ask to have it put right. You can write a letter setting this out instead. State what your complaint is and what you want the agency to do about it. For example, you can ask for an apology, or a promise that they will not do the same thing again. You can also ask for compensation if you have lost money because of the agency’s action. If the agency does not reply, or will not do anything, or you do not want to complain to the agency, you can complain to the Privacy Commissioner. If the agency will not give you some information you have asked for, or will not let you correct your information, you can ask it to reconsider or complain to the Privacy Commissioner.

There is no set way to make a complaint. Just state the facts and the harm you have suffered. You might have had your rights breached, suffered financial loss, humiliation or hurt feelings. You have two options in making a complaint:

1. Where possible, you should contact the agency and ask it to put the matter right. You should state clearly what you want the agency to do about your complaint. For example, do you want the agency to apologise for the action or to assure you that the action will not happen again?

2. If the agency does not reply or you are not happy with its reply, you can complain to the Privacy commissioner. But, if you do not wish to go to the agency first, you may go directly to the Privacy Commissioner.

You can also take the privacy matters to the court. You would need to talk to a lawyer about this. Complaints about anything that you think is an invasion of your privacy should be put in writing and posted to:

The Privacy Commissioner
PO Box 466
Auckland
Fax: (09) 302 2325
Phone: 0800 803 909
(09) 302 8655
E-mail: privacy@iprolink.co.nz Complaints may also be made to the Wellington office: The Privacy Commissioner
PO Box 10094
Wellington
Fax: (04) 474 7595
Phone: (04) 474 7590
Email: privacy@atrix.gen.nz

When making a complaint, you should include:

• a brief description of the action complained about;
• relevant dates;
• the name and address of the agencies complained about ( and the name of the people within the agency who have been involved with your complaint); and
• copies of relevant correspondence

What if I am not happy with what the Privacy Commissioner does?

In some cases, the Privacy Commissioner may refer your complaint to the Director of Human Rights Proceedings. The Director of Human Rights Proceedings will decide whether to take the case to the Complaints Review Tribunal. However, not all complaints can be referred to the Director of Human Rights Proceedings. Check the Privacy Commissioner website: www.privacy.org.nz for more information on this.