(1) The Registrar must take reasonable steps to protect a record of student identifiers kept by the Registrar:
(a) from misuse, interference and loss; and
(b) from unauthorised access, modification or disclosure.
(2) If any other entity keeps a record of student identifiers, the entity must take reasonable steps to protect the record:
(a) from misuse, interference and loss; and
(b) from unauthorised access, modification or disclosure.
(3) Subsection (2) does not apply to an individual who keeps a record of the student identifier of the individual.
Note: A contravention of this section is taken to be an interference with the privacy of an individual for the purposes of the Privacy Act 1988 (see section 23 of this Act).