PRIVATE healthcare agencies should not be given access to personal identity numbers without legislation to protect personal details, the Data Protection Commissioner (DPC) has warned.