privacy data-protection new-zealand
What prosecution can one expect for violation of information privacy principles in New Zealand?
<p>I recently received a marketing letter in my mailbox from a building supplies company that I had never dealt with. Upon contacting them I found out that they had bought a database of people who had been issued with building consent from local council (I recently obtained a building consent indeed, but the papers I submitted had nothing regarding privacy or handling of personal information).</p>

<p>So, what essentially happened is that somebody at the council let my data out and it ended up on the market. This seems to be in violation of <a href="http://www.legislation.govt.nz/act/public/1993/0028/232.0/DLM297038.html" rel="nofollow noreferrer">Principle 5: Storage and security of personal information</a>, however, upon quick digging through <a href="http://www.legislation.govt.nz/act/public/1961/0043/137.0/DLM327382.html" rel="nofollow noreferrer">Crimes Act 1961</a> I could not immediately spot what kind of punishment one might earn by such violation.</p>

<p>Is there a legal mechanism to stop what happened from happening in the future? If I complain to the <a href="https://www.privacy.org.nz" rel="nofollow noreferrer">Privacy Commissioner</a>, what would likely happen?</p>

<p>The Crimes Act doesn't do anything nonsensical like try to list every crime and the penalty for it. It tends to record most of what was previously left to common law alone and put it in statute, though there's still a lot of gapfilling and disconnect between the two.</p>

<p>Instead you need the <a href="http://www.legislation.govt.nz/act/public/1993/0028/232.0/DLM296639.html" rel="nofollow noreferrer">Privacy Act</a>, in particular sections 85 <em>Powers of Human Rights Review Tribunal</em> and section 88 <em>Damages</em> describe what may be set as penalties or corrections.</p>

<p>A complaint to the Privacy Commissioner is likely to result in an investigation by office of the Privacy Commissioner, provided you <a href="https://www.privacy.org.nz/your-rights/how-to-complain/" rel="nofollow noreferrer">do what they need from you first</a>.</p>
