The Ministry of Social Development has been systematically misusing its powers.
Commissioner John Edwards has concluded that the ministry has been unjustifiably intruding on the lives of beneficiaries.
Since 2012, the ministry has been bypassing beneficiaries and going to third parties for information.
Mr Edwards said that's allowed fraud investigators to collect large amounts of highly sensitive information about beneficiaries without their knowledge.
The information collected included text messages, domestic violence and other police records, banking information and other billing records.
As part of the inquiry, Mr Edwards said they reviewed MSD files that contained text messages between couples, of a sexual or intimate nature.
"In one instance, a beneficiary described to us how MSD obtained, from a telecommunications company, an intimate picture shared by that individual with a sexual partner. The photograph was then produced at an interview by MSD investigators seeking an explanation for it."
Mr Edwards said thousands of beneficiaries had likely been affected by the practice, which had infringed their privacy.
"Due to poor record keeping practices and inconsistencies between fraud teams, we have been unable to establish whether the ministry has been bypassing beneficiaries in all fraud investigations or only those categorised as 'high risk'," he said.
Mr Edwards also pointed out that MSD investigated thousands of fraud allegations each year.
Of those, a large proportion result in no formal finding of fraud.
MSD deputy chief executive Viv Rickard said changes would be made in response to the Privacy Commissioner's report.
They included amending processing to ensure staff made case-by-case decisions on whether to go to the client or to a third party, and to make sure the right amount of information was collected.
All requests for information to telecommunications companies and the police have been suspended, pending a review of the ministry's code of conduct.
An independent assessment of the ministry's fraud practices and policies has also been commissioned.
"We take a prevention-first approach, using conversations with clients and data matching agreements to detect and stop anomalies early. We don't investigate lightly," Mr Rickard said.
"We will need to continue to go directly to outside parties for information without going to the client first, where we believe there is a risk of collusion, evidence tampering, witness intimidation, or we can't locate the client."
Mr Rickard said the practice introduced in 2012, in response to the then National Government's approach of taking a harder line on benefit fraud and speeding up investigations.
"Ninety-five percent of the time people didn't provide the necessary information when we asked them directly, meaning we had to go to third parties anyway, delaying investigations," he said.
The ministry would apologise - on a case-by-case basis - to individuals who had their privacy breached while they were being investigated for fraud.
"We need to ensure that when we're investigating matters we act reasonably, we act within the guidelines and we act within the legislation and I think that's unequivocal," Mr Rickard said.
"When we've done things wrong and individuals have been impacted, I'm always quite happy to front and apologise."
Auckland Action Against Poverty coordinator Ricardo Menendez-March welcomed the Privacy Commissioner's report and said it was time the government stopped intruding into people's private lives.
"Our government agencies should be there to support people, not to intimidate them into talking about what happens in the bedroom," he said.
This article was first published on Radio NZ.