Privacy Act 2020

Principle 13 sets restrictions on assigning identifying numbers and other unique identifiers to individuals. The principle states that an organisation can only assign unique identifiers to people when it is necessary for its functions.

Unique identifiers are individual numbers, references, or other forms of identification allocated to people by organisations as a way to uniquely identify the person to the organisation assigning the identifier. Examples include driver’s licence numbers, passport numbers, IRD numbers, or National Health Index (NHI) numbers.

An organisation cannot assign a unique identifier to a person if that unique identifier has already been given to that person by another organisation. For example, this prevents the Government from giving you one personal number to use in all your dealings with government agencies.

However, an organisation can record (and use) a person’s unique identifier so that they can communicate with another organisation about the individual.

Organisations must also take reasonable steps to protect unique identifiers from misuse and make sure they verify someone’s identity before assigning a unique identifier.

Further information

What is a ‘unique identifier’?
Can I send National Health Index (NHI) numbers to another DHB by email?
Because loss or disclosure of a unique identifier could create a risk of identity theft or unauthorised access to sensitive information, care should be taken when using and storing them. For example, if you are sending information by email that includes unique identifiers use encrypted or secure email technology and password protect any attachments.
Is Trade Me allowed to list real estate agents’ licence numbers?
The Justice Sector Unique Identifier Code 2020 gives certain agencies involved in the justice sector with a partial exemption from privacy principle 13.
The Superannuation Schemes Unique Identifier Code 2020 provides agencies involved with certain superannuation schemes with a potential exemption from information privacy principle 13.

Privacy Act 2020 reference

Information privacy principle 13
Unique identifiers
(1)	An agency (A) may assign a unique identifier to an individual for use in its operations only if that identifier is necessary to enable A to carry out 1 or more of its functions efficiently.
(2)	A may not assign to an individual a unique identifier that, to A’s knowledge, is the same unique identifier as has been assigned to that individual by another agency (B), unless—
	(a)	A and B are associated persons within the meaning of subpart YB of the Income Tax Act 2007; or
	(b)	the unique identifier is to be used by A for statistical or research purposes and no other purpose.
(3)	To avoid doubt, A does not assign a unique identifier to an individual under subclause (1) by simply recording a unique identifier assigned to the individual by B for the sole purpose of communicating with B about the individual.
(4)	A must take any steps that are, in the circumstances, reasonable to ensure that—
	(a)	a unique identifier is assigned only to an individual whose identity is clearly established; and
	(b)	the risk of misuse of a unique identifier by any person is minimised (for example, by showing truncated account numbers on receipts or in correspondence).
(5)	An agency may not require an individual to disclose any unique identifier assigned to that individual unless the disclosure is for one of the purposes in connection with which that unique identifier was assigned or is for a purpose that is directly related to one of those purposes.