Privacy Act 2020, s 22 Principle 13(5)
A business or other organisation can’t require you to disclose to them a unique identifier assigned to you by some other organisation unless giving it to them is one of the purposes for which the identifier was assigned to you by the other organisation in the first place (or is related to one of those purposes).
In the case of a mobile phone company that required a customer to let it keep a photocopy of the customer’s driver’s licence, the Privacy Commissioner’s view was that it was reasonable for the company to simply sight the licence to confirm the customer’s identity, but that keeping a copy, or otherwise recording the licence number, wasn’t justified.