Australian Privacy Principle 9 - Adoption, Use or Disclosure of Government Related Identifiers
A Government Related Identifier (GRI) is a code which identifies a person, and is used by a government body. Eg: tax file number, licence numbers, Medicare number, Passport number and Centrelink reference number. Excluded from this are the individual’s name and ABN.
Adoption of government related identifiers
9.1 An organisation must not adopt a government related identifier of an individual as its own identifier of the individual unless specially required or authorised by law, or subject to a judicial order.
According to the OAIC, to adopt is to organise information about a person with reference to the number. Also according to OAIC, this is simply to prevent general use of GRI’s. Not really a privacy rule at all in that case.
Use or disclosure of government related identifiers
9.2 An organisation must not use or disclose a government related identifier of an individual unless:
it is reasonably necessary for the verification of the individual’s identity, for the purposes of the organisation's activities or functions; or
it is reasonably necessary for the organisation to fulfil its obligations to a government or a body acting on behalf of the government (an agency).
it is required or authorised by or under an Australian law or a court/tribunal order; or
a permitted general situation exists as per s 16A.
it is reasonably necessary for enforcement related activities conducted by an enforcement body (Eg: the police) or
regulations apply which prescribe the particular identifier, the organisation (or type of organisation) and the relevant circumstances.