If you think that one of the rules in the Privacy Act has been breached in your case, you should usually start by complaining directly to the particular government agency, business or other organisation that you’re unhappy with. Sometimes letting them know what the problem is can resolve it without having to take it further. If you complain directly to the Privacy Commissioner’s office, they may decide not to deal with your complaint until you’ve tried to resolve the problem with the relevant organisation.

All organisations should have someone who’s been appointed as a privacy officer to deal with privacy issues, and they will be the best person to talk to about the problem. You can ask who the organisation’s privacy officer is, and then complain to them directly, either verbally or in writing. If the organisation doesn’t have a privacy officer, then talk to a manager or other senior person there.

Privacy Act 2020, s 201

Every organisation must appoint someone to be its privacy officer. The privacy officer’s responsibilities include:

• encouraging the organisation to comply with the privacy laws
• dealing with requests made to the organisation about individuals’ information
• working with the Privacy Commissioner when the Commissioner investigates complaints
• otherwise making sure that the privacy laws are complied with.

In that case you can complain to the Privacy Commissioner.