I recently received a marketing letter in my mailbox from a building supplies company that I had never dealt with. Upon contacting them I found out that they had bought a database of people who had been issued with building consent from local council (I recently obtained a building consent indeed, but the papers I submitted had nothing regarding privacy or handling of personal information).
So, what essentially happened is that somebody at the council let my data out and it ended up on the market. This seems to be in violation of Principle 5: Storage and security of personal information, however, upon quick digging through Crimes Act 1961 I could not immediately spot what kind of punishment one might earn by such violation.
Is there a legal mechanism to stop what happened from happening in the future? If I complain to the Privacy Commissioner, what would likely happen?