Reading time: 5 minutes

If your business needs to keep track of your customers and their information, you may use unique identifiers to do so. You assign a unique identifier to a customer, and you can use that for reference in your business purposes. Many organisations and businesses do this, particularly when dealing with large volumes of data. However, unique identifiers still classify as personal information. Therefore, your business needs to take heed of its privacy responsibilities when dealing with it. In New Zealand, privacy law dictates how your business should handle unique identifiers. This article will explain what they are and what you should not do when collecting unique identifiers from your customers.

What Is a Unique Identifier?

A unique identifier is an identifying reference or tag that is usually a string of numbers or letters. You assign this identifying tag to an individual, and it is unique to that person. Many organisations and businesses will use these identifiers for organisational and reference purposes. Some examples of assigned unique identifiers include:

  • driver’s licence numbers;
  • IRD numbers;
  • student ID numbers; or
  • passport numbers.

If necessary, your business may collect customers’ existing unique identifiers or assign your own number. Identifiers can be used as a reference point for a particular customer when referring to them in your business’ computer systems. Each customer has a different number, and no two are the same. 

For example, you may assign each client a unique identifier for efficient storage and retrieval of client files. This could be a unique number or alphanumeric code, which you can use to search up that particular client in your databases.

Every individual has a set of unique identifiers attached to them, which your business may need access to. This is information that identifies a living individual, so it qualifies as personal information. Therefore, you need to take due care when dealing with unique identifiers so that you operate in line with your privacy law obligations as an agency.

When To Assign Unique Identifiers

You should not arbitrarily assign customers with a unique identifier. You need to have an identifiable purpose for assigning your customers’ unique identifiers. This means a unique identifier is necessary for efficiently carrying out one of your business functions. 

For example, you may collect cookies from online customers for web analytics purposes with your customers’ consent. You may use unique identifiers to signify an individual customer’s behaviour when collating usage data from multiple devices. This is a clear purpose, as you are analysing customer behaviour for marketing decisions.

You cannot assign a customer with a unique identifier that another agency has already given them unless you:

  • are associated entities for tax purposes; or
  • will only use the identifier for statistical/research purposes.

When Collecting Unique Identifiers

You generally cannot ask a customer to disclose a unique identifier that has been assigned to them by another agency. You can only do so when the customer gives you the identifier for the purpose it was assigned to them or for another related purpose.

For example, the New Zealand Transport Authority (NZTA) assigns individuals with driver’s licence numbers for identifying information regarding driving and its related laws. When you ask for a driver’s licence for a photo ID, this is not related to those legal purposes. Therefore, you cannot ask for or retain the specific number assigned to a customer’s licence.

How to Deal With Unique Identifiers

To keep in line with your privacy obligations when handling unique identifiers, whether they be your own or another agency’s, you must ensure you:

  • only assign a unique identifier to an individual with a clearly established identity; and
  • minimise any risk of misuse of unique identifier.

For example, you may only display an abbreviated version of a client’s unique identifier on receipts and similar documentation. This way, you can ensure that only intended parties will have access to a client’s full unique identifier.

Unique identifiers are personal information. Therefore, you should assign this data the same security and handling protocols as you would with other personal information. Try to anonymise any personally identifiable information attached to these identifiers where you can. You should also make sure you:

  • inform customers when using their unique identifiers, and why;
  • protect databases of client identifiers;
  • secure online connections when customers give you their unique identifiers; and
  • get consent when disclosing identifiers.

Key Takeaways

Unique identifiers are usually an alphanumeric tag or reference that your business may use to distinguish between its clients in your systems. You may also need to collect clients’ unique identifiers with other agencies when doing so for the purpose that identifier was assigned. Unique identifiers are personal information. Therefore you need to take steps to comply with your privacy law obligations when handling them. If you would like more information or help with handling unique identifiers at your business, contact LegalVision’s privacy lawyers on 0800 005 570 or fill out the form on this page.

Frequently Asked Questions

What is a unique identifier?

A unique identifier is an identifying tag or reference assigned to a person, usually made up of letters or numbers. Examples could include driver’s licence numbers, serial numbers, or student ID numbers.

Would my business use a unique identifier?

Your business may use unique identifiers for organising client files or providing an alternate reference for customers rather than their name.

Are unique identifiers personal information?

Unique identifiers qualify as personal information because they identify a living individual. Therefore you must comply with privacy law when using them.

When can I assign a unique identifier to a customer?

You can assign a unique identifier to a customer when you need it for legitimate business purposes. This can include making your systems more efficient.

About LegalVision: LegalVision is a tech-driven, full-service commercial law firm that uses technology to deliver a faster, better quality and more cost-effective client experience.

The majority of our clients are LVConnect members. By becoming a member, you can stay ahead of legal issues while staying on top of costs. From just $119 per week, get all your contracts sorted, trade marks registered and questions answered by experienced business lawyers.

Learn more about LVConnect

Need Legal Help? Get a Free Fixed-Fee Quote

If you would like to receive a free fixed-fee quote or get in touch with our team, fill out the form below.

  • 2019 Top 25 Startups - LinkedIn 2019 Top 25 Startups - LinkedIn
  • 2020 Excellence in Technology & Innovation – Finalist – Australasian Law Awards 2020 Excellence in Technology & Innovation Finalist – Australasian Law Awards
  • 2020 Employer of Choice – Winner – Australasian Lawyer 2020 Employer of Choice Winner – Australasian Lawyer
  • 2021 Fastest Growing Law Firm - Financial Times APAC 500 2021 Fastest Growing Law Firm - Financial Times APAC 500
  • 2021 Law Firm of the Year - Australasian Law Awards 2021 Law Firm of the Year - Australasian Law Awards
  • 2020 Law Firm of the Year Finalist - Australasian Law Awards 2020 Law Firm of the Year Finalist - Australasian Law Awards