She used this date to apply for an Ethiopian passport and birth certificate for the boy, which were used by Immigration New Zealand (INZ) during the refugee application.
A paediatrician appointed by INZ said the boy looked older than his date of birth suggested, but INZ documented his date of birth as early 2000.
In 2012, the teenager, who was thought to be 12, underwent a bone density scan to clarify his age and in 2013 he underwent a dental examination.
Both tests indicated that he was at least three years older than his recorded date of birth, and could have been as old as 18 at the time.
"Officially he was 13 but physically, mentally and emotionally he was at least 16," the Privacy Commissioner said.
Abann Yor, general manager for the Auckland Refugee Community Coalition, said the boy's position was not common and he hadn't heard of the specific problem until today.
Mr Yor said he didn't think the boy was a refugee, but came to New Zealand as part of a family reunification.
He said refugees who arrive in New Zealand without any passports often have to change ages and details through INZ.
"Immigration New Zealand has a right to say 'because you come to New Zealand with a passport given by a different authority, that is the right [birth] date'," Mr Yor said.
"[Migrants] have an obligation to do the right thing... in my point of view, that needs to be respected," he said.
In a statement, INZ said it did not agree with the Privacy Commissioner's finding that it had breached the boy's privacy.
"INZ has some sympathy for the individual concerned, but there are important principles at stake, namely evidence of identity standards and the integrity of the immigration system."
INZ said the boy's official identity document - his Ethiopian passport - was the cause of his situation.
"If his official identify document still shows his date of birth as early 2000, the remedy lies in the amendment or replacement of his passport.
"A person's date of birth is a fundamental cornerstone of identity and should not be able to be 'corrected' unless through verifiable accurate records - INZ cannot and should not rely on a 'best guess'."
The Privacy Act allows anyone to ask an agency to change incorrect information about them, but the Act does not force the agency to correct the information.
INZ offered to add a 'correction requested but not granted' note to the boy's file, but the commissioner said this didn't go far enough.
"The incorrect birth date caused harm on an ongoing basis, and would continue to do so unless it was amended," the commissioner said.
"Attaching a note would add information about the dispute, but it would not actually address the underlying issue."
INZ breached a principle of the Privacy Act by recording the complainant's birth date without checking its accuracy, the commissioner found.
The case has been referred to the Director of Human Rights Proceedings, who may decide to refer it to the Human Rights Review Tribunal.
