I recently received a marketing letter in my mailbox from a building supplies company that I had never dealt with. Upon contacting them I found out that they had bought a database of people who had been issued with building consent from local council (I recently obtained a building consent indeed, but the papers I submitted had nothing regarding privacy or handling of personal information).

So, what essentially happened is that somebody at the council let my data out and it ended up on the market. This seems to be in violation of Principle 5: Storage and security of personal information, however, upon quick digging through Crimes Act 1961 I could not immediately spot what kind of punishment one might earn by such violation.

Is there a legal mechanism to stop what happened from happening in the future? If I complain to the Privacy Commissioner, what would likely happen?

1 Answer 1


The Crimes Act doesn't do anything nonsensical like try to list every crime and the penalty for it. It tends to record most of what was previously left to common law alone and put it in statute, though there's still a lot of gapfilling and disconnect between the two.

Instead you need the Privacy Act, in particular sections 85 Powers of Human Rights Review Tribunal and section 88 Damages describe what may be set as penalties or corrections.

A complaint to the Privacy Commissioner is likely to result in an investigation by office of the Privacy Commissioner, provided you do what they need from you first.

  • So might the breach amount to crime, or would it not go beyond civil wrongdoing?
    – Greendrake
    Jun 6, 2018 at 7:42
  • Civil wrongdoing only.
    – user4657
    Jun 6, 2018 at 8:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .