Our website uses cookies to give you the best experience and for us to analyse our site usage. If you continue to use our site, we will take it you are OK about this. Click on More for information about the cookies on our site and what you can do to opt out.
We respect your Do Not Track preference.
Choose one of the following ways to lodge a complaint with us:
- Mail it to us at Office of the Privacy Commissioner, PO Box 10094, Wellington 6143;
- Fax it to us at 04 474 7595; or
- Email it to enquiries@privacy.org.nz;
The quickest way for us to consider your complaint is for you to lodge it online or to complete and return our complaint form.
The notes below provide guidance on the information we ask you to provide. If you prefer not to lodge your complaint online or use our complaint form, we would still need you to provide this information for us to be able to consider your complaint.
If you choose to email your complaint to us and it contains highly personal or sensitive information, we recommend that you use our public key to encrypt it first.
Before making a complaint, check AskUs, or consult the questions below, to make sure that a Privacy Act complaint is right for your circumstances. Or send us an email: enquiries@privacy.org.nz.
We ask for the following information in our complaint form. If you choose not to lodge your complaint online or use our form, we would still need you to provide this information for us to be able to consider your complaint.
In most cases where a breach of the Privacy Act is alleged, it is appropriate for you to first contact the agency responsible for the information and allow it an opportunity to explain or fix the issue(s) for you. We might decline to investigate your issue(s) until you have made contact with the responsible agency.
“Agency” is the word we use for the company, organisation or person you are complaining about. We will need to tell the agency about your complaint.
If the agency has a privacy officer, that is the best person to talk with. If the agency does not have a privacy officer, talk to someone senior like the manager.
If you are not satisfied with the agency’s response, then send in a complaint. Give us as much relevant information as you can – this will speed up any investigation.
Include with your complaint copies of all letters, emails and other documents you have written and/or received about your complaint.
If you don’t have anything in writing, tell us:
If you haven’t yet contacted the agency, tell us why. Unless there are circumstances that prevent you from trying to resolve your issue(s) with the agency first, we might decide not to investigate your complaint until you have done so.
We need to keep in contact with you whilst we are considering your complaint. Since you may not want other people to know that you have made a complaint, give us contact details we can use to get in touch with you confidentially.
You do not need to appoint a representative or employ a lawyer in order to make a complaint to us.
If, however, you are using someone to act for you, like an advocate, a family member, a friend or lawyer, we need their details to be able to contact them about your complaint.
If your representative is not a lawyer, we also need you to complete and return to us our Representative Authority Form. It confirms to us that your representative has your authority to act on your behalf and have access to information about you. If your representative is a lawyer, they are already legally authorised to act for you so you do not need to also complete the Representative Authority Form.
If you believe that someone or an organisation has breached your privacy and you want us to investigate what happened, we will need to talk to that person and/or the organisation concerned. We also need to know what your relationship is to that person or organisation (e.g. employee, client, family member or patient) so that we know what the context is. This helps us to clarify how the law might apply to your situation.
Explain as clearly as possible:
Tell us exactly, for example, what information was collected, disclosed and/or used so as to breach your privacy, why and by whom. Give us any background information that might help explain your complaint and/or supporting documents that show what happened.
It is important that we understand how the agency’s actions have affected you. The law requires us to take this into account in assessing if there has been an interference with your privacy.
Under the Privacy Act, an interference with privacy usually only occurs when an agency has breached a privacy principle and has also caused some sort of harm.
The only exceptions are in cases involving access to, and correction of, your personal information where harm is not relevant.
Harm can be:
Breaches of the privacy principles are serious and should be brought to the attention of the Privacy Commissioner. Even if, legally speaking, there is no “interference with an individual’s privacy”, the Commissioner might still want to follow up with the agency concerned how they can improve the way they deal with personal information.
Tell us how you have been affected and provide evidence if you have any.
Think about what would make the problem go away for you.
People ask for different things. Maybe an apology is in order. This is all many people want. You may want an undertaking that the same thing won’t happen to you again – or that it won’t happen to someone else. Maybe a meeting with the agency would resolve the problem. You may be able to think of something else which will allow you to move forward.
As often as possible and unless you have serious objections, we will try and meet with you and the respondent agency to try and resolve your complaint.
Here are a few useful FAQs about making a complaint. Take a look at AskUs to find detailed answers to more than 300 more questions.
The Privacy Commissioner has broad powers to enquire into any matter if he believes that the privacy of the individual is being, or is likely to be, infringed.
Yes. Anyone can complain to the Privacy Commissioner that an action by another person or organisation is an "interference with privacy" under the Privacy Act.
An "interference" with privacy is a legal term that involves two aspects. First, there must be a breach of the law and, second, there must be some harm that arose from it.
The breach may be of
The breach must have led to (or may lead to)
Importantly, there is no requirement to show harm in a complaint about access to or correction of personal information.
No.
Absolutely. The Privacy Commissioner encourages people to try to resolve matters themselves before making a complaint to his Office. An early and informal resolution can save time, stress and money.
First, you should ask the individual or organisation who you think is at fault to put the matter right. You should also say what you want it to do - for instance, make an apology, or give an assurance it will not happen again.
If you don't think you know enough about privacy yet to resolve things yourself, give us a call on 0800 803 909 and we'll try to give you information to help you.
