Category: MIL-OSI

Source:

We often get asked about how much a complaint is “worth” in settlement terms, by both complainants and respondents. Very few of our complaints settle for money. The resolution is usually non-financial, like the release of information or a sincere apology. Read about cases where apologies had an effect. 

However, we want to make sure our process is fair for both parties, and so we’ve put together some information on recent settlements under the Privacy Act.

Our process is focused on resolving complaints, but there is no easy formula for ‘valuing’ a complaint. In the past we’ve seen settlements including financial compensation, apologies, donations to social service agencies, arrangements for the installation of security systems, commitments to staff training, policy changes, and even a fruit basket or restaurant vouchers. What the parties settle on is entirely up to them and will depend on a number of factors including the harm experienced by the complainant, the nature of the breach, and the willingness to resolve the complaint.

Harm

There are three kinds of harm under section 66 of our Act which can be considered when deciding whether someone’s privacy has been interfered with:

1. Specific damage – this could be financial loss, but could also include other forms of damage, such as loss of employment or physical injury;  
2. Loss of benefits – this is where the agency’s actions have adversely affected, or may adversely affect, the rights, benefits, privileges, obligations or interests of the individual; and
3. Emotional harm – where the action has resulted in, or may result in, significant humiliation, significant loss of dignity or significant injury to the individual’s feelings. Mere embarrassment or annoyance is not enough – any emotional harm needs to be ‘significant’.

The Tribunal

If no reasonable settlement is reached through our process, the complainant will be entitled to take their complaint to the Human Rights Review Tribunal. The Tribunal has the same monetary jurisdiction as the District Court (up to $350,000) and is able to award damages and compel parties to take action. It’s worth noting, however:

• there may be a significant wait time to get a hearing,
• proceedings are generally public,
• there can be significant costs associated with the process, and
• you can have costs awarded against you if you are unsuccessful.

For these reasons, complaints generally settle for a ‘discount’ if settled before reaching the Tribunal.

Awards in the Tribunal vary substantially, and are fact-dependent. Again this makes it difficult to accurately assess what a complaint is ‘worth’ in money terms. In Hammond v Credit Union Baywide [2015] NZHRRT 6, the Tribunal reviewed recent awards and summarised:

[176] From this general overview it can be seen that awards for humiliation, loss of dignity and injury to feelings are fact-driven and vary widely. At the risk of over-simplification, however, it can be said there are presently three bands. At the less serious end of the scale awards have ranged upwards to $10,000. For more serious cases awards have ranged between $10,000 to about (say) $50,000. For the most serious category of cases, it is contemplated awards will be in excess of $50,000.

Most of the complaints we deal with are not factually similar to the case referenced above, but the comments are useful in setting out the current state of settlements in the Tribunal where there has been a serious interference with privacy. To reach the top band, there will usually have to be some very bad behaviour on the part of the respondent agency.

Other recent cases in the Tribunal that discuss harm include:

Recent OPC settlements

Below is a summary of some settlements our Office has facilitated. As mentioned above, complaints that settle without having to go to the Tribunal usually do so for a “discount”. This is not a complete or comprehensive scale, but may help you understand what some other complaints have settled for.

• $17,000 where a government department disclosed a man’s address to his brother, who was about to be released from prison and against whom he had a protection order;
• $15,000 when, on three separate occasions, an agency failed to check the complainant’s updated address details and posted personal information to an outdated address;
• $14,000 where a DHB sent a patient’s medical records (concerning a termination of pregnancy) to her parent’s address after she had twice requested they update their records;
• $10,000 where a staff member of the agency inappropriately accessed the complainant’s sensitive health information;
• $8,000 where the respondent disclosed the complainant’s health information and details of follow up support that needed to occur to a large group of people;
• $6,000 where the respondent sent the complainant’s information to another patient due to an incorrectly addressed envelope;
• $6,000 where an agency twice sent sensitive information to a woman’s work address in the knowledge that the workplace had a policy of opening all incoming mail;
• $5,750 where the contact details of the complainant were disclosed to a third party who used this information to harass the complainant;
• $3,678 where a debt collector used a man’s information for a purpose other than the one they had collected it for, using it to contact his family and friends (the amount was a write-off of the debt he owed);
• $3,275 where a government agency collected a lot more information from a man than they needed over a number of years, and refused to provide him with its services unless he kept giving them the information;
• $3,000 where the details of an employment investigation into the complainant’s conduct were accessible to all staff in the organisation; 
• $2,200 where an agency failed to respond to an access request from an ex-employee, and also disclosed information about the man to their clients;
• $2,000 when a medical centre dropped a patient’s mental health records off to his letterbox but when he went to get them they weren’t in his box;
• $2,000 where an agency failed to take steps to stop their employee from looking up a woman’s file in their database and disclosing the information to people she knew;
• $2,000 where the respondent inadvertently disclosed the complainant’s personal information by sending her a letter in a windowed envelope which was then viewed by another person;
• $2,000 where a retail store posted a picture of a young girl online, wrongly accusing her of theft;
• $900 where an employer posted information about one of her employees on a Facebook group page, complaining about her work ethic and performance.

As you can see, there is a range, even for similar factual circumstances. It is important to provide evidence of real costs – such as doctor’s visits and counselling sessions – as well as a described experience of significant emotional harm. The threshold is high, and requires more than a fleeting feeling of upset or distress. This is information the respondent agency will have to consider in determining what they are able to offer.

It is important to remember that when you complain to our Office, it is very unlikely the outcome will be cash in your pocket. We only facilitate financial settlements where there has been a clear breach of a privacy principle and serious harm that has followed. It’s also relevant to note that even where we have facilitated a settlement, we have no power to enforce it, if either party fails to uphold the agreement. In the unlikely event that happened, you’d need to seek independent advice.

complaints, Human Rights Review Tribunal

Back

Source:

Should a business use social media to shame scam artists, shoplifters or bad debtors? When someone feels ripped off, this appears a natural course of action but it can be risky. Is if you believe you have evidence that a crime has been committed, contact Police.

One business posted personal information on Facebook about someone whom it accused of trying to scam it out of several hundred dollars’ worth of products. The information published online included the man’s driver licence, a bounced cheque and a security camera photo. The business said its intention was to warn other businesses of what the man had done.

When the man discovered what the business had done, he complained to our office. He described his devastation at being publicly shamed on the business’ Facebook page. He lived in a small community and word quickly spread as the post received more than 17,000 likes and attracted dozens of comments about his colourful past. As a result, he and his family had to endure abuse from others in the community. He said his anxiety and depression were triggered because of the Facebook post and online comments and he wanted more than $50,000 in compensation.

Our investigation

We contacted the business to get its response. The business owner explained the events that motivated the Facebook post. The man had arrived and purchased several hundred dollars’ worth of goods but did not have the cash to pay for them. He offered to pay by cheque and refused to leave without the products because he had driven four hours from his home to obtain them. The business owner said the man told him to make a copy of his driver licence and gave his permission to report him to Police if his cheque was dishonoured. They came to an agreement that the man could take half the goods with him. The business would send him the remaining goods after the cheque cleared.

The cheque bounced. The business owner tried calling the man but his phone was switched off. He left several messages but the man never returned his calls. The owner googled the man’s name and discovered he was well known in his area for his scams. The owner wanted other retailers to be aware of the man’s actions and he posted the man’s personal details on the Facebook page. The owner said within an hour, his business was receiving messages and phone calls sharing similar stories about the man’s past behaviour.

Later that day, the business received Facebook messages from the man’s son asking it to remove the post. The owner said he would delete the post and withdraw his Police report if the outstanding sum was paid. After about four hours, even though no payment was received, the owner took down the post. He received a phone call from the man saying he would make an online payment if the business posted an apology. The business owner complied with the apology but no payment arrived.

Principle 11

The owner explained he had relied on principle 11(e)(i) of the Privacy Act to disclose the man’s information on the business’ Facebook page. Principle 11(e)(i) says an agency may disclose personal information to avoid prejudice to the maintenance of the law by a public sector agency including the prevention, detection, investigation, prosecution and punishment of offences.

We acknowledged the man’s actions affected the business financially but principle 11(e)(i) is more usually applied to allow disclosures from businesses to public sector law enforcement agencies, to allow them to do something about the alleged offending. In this case the business had no role in the “maintenance of the law”, and was communicating to the whole world, not just a public sector agency with law enforcement responsibilities. 

The owner said he also relied on principle 11(f)(i) to disclose the man’s information. Principle 11(f)(i) says an agency may disclose personal information if it is necessary to lessen a serious threat to public health or safety. We were not satisfied the man’s actions met the definition of a serious threat.

Acting in good faith

However, while we were not satisfied the business could disclose the man’s personal information on these two grounds, we decided the man had not acted in good faith during the investigation process. He did not pay for the goods he had taken, nor did he return the goods he took. He also failed to provide us with sufficient evidence for us to be able to assess whether or not he had experienced harm as a result of the Facebook post, despite wanting over $50,000 compensation.

We decided it was not appropriate for us to take any further action. Acting in good faith is an important part of participating in our complaints process. It was our view the man fell short of engaging with our office in an open, honest and transparent way and we concluded the complaint by closing the file.

complaints, IPP11 – disclosure, Facebook

Back

Source:

Updated by our Guidance team in March 2025.

The Privacy Act gives people the right to access their information. When a person requests their information, the organisation or business must respond to the request within 20 working days. However, sometimes an organisation wants proof that a person is who they say they are, before they action the request. These cases come to us from time to time, so we thought it would be helpful to explain why an organisation needs to be able to verify a person’s identity.

Under Section 45 of the Privacy Act, when an agency receives an access request for personal information, it must take steps to verify the identity of the requestor, or the person who is acting for the requestor.

Police case

A person complained to us that it was unreasonable that Police ask for photo ID in order to comply with an access request. We said we considered Police’s policy of requiring photo ID an acceptable way of meeting its obligations under section 45 of the Act. We agreed with Police that the purpose of photo ID was to satisfy the officer receiving the access request that the requester was who they claimed to be. Photo ID was the quickest and most accurate way to confirm the identity of a person.

Hospital case

A woman requested a copy of her file from a hospital. The hospital told her they had the file ready, but they would not send it until she completed a form, even though she had already sent her details, a copy of her driver’s licence, and a copy of her name change certificate. She was also told that her signature would be required.

The woman believed the hospital’s refusal to send her information until it had received a completed form was an unnecessary step causing undue delay. We contacted the hospital who said they had told the woman they needed the completed form to make sure there was a record of her request.

Our view was that an agency is entitled to set its own administrative process to make sure it has records of information requests. An agency is also required under the Privacy Act to take appropriate steps to ensure that information intended for a certain person is only received by that person.

Government case

A New Zealander living in another country emailed a request to a New Zealand government agency asking for all the information it held about her. She received a reply that her information was ready to be sent to her, but it could only be delivered by registered mail and only after the woman confirmed in an email that she would not hold the government agency liable or responsible if the information was signed for and opened by another person at her address.

The agency explained to us that it just wanted to ensure the information was sent to the right person because the nature of the information was very sensitive. The agency checked a requestor’s ID carefully before any information was handed over and was cautious in mailing the information out, so we thought that was fair enough.

Risk averse

It is understandable many organisations are risk averse when responding to requests for personal information. Responding to access requests is an obligation that every organisation has to meet, but we’ve seen many examples where organisations haven’t made the necessary checks. The Privacy Act also says organisations have to keep personal information safe, and that has to be balanced with making it accessible to the right person.

You can find more information in our guidance on responding to requests and complaints well.

complaints, IPP6 – access

Back

Source:

When we use the metaphor ‘to come with clean hands’, it means to have done nothing underhand or illegal. It’s a term that applies in the context of resolving privacy disputes. There’s a general expectation that if you make a complaint to our office, you did not bring the breach of privacy upon yourself through your actions.

In a recent case, our complainant was a man who had ripped off a business. He had scammed the business out of several hundred dollars worth of goods but became upset when the business named and shamed him on its Facebook page.

Facebook post

The man claimed he had been left devastated after the business published information about him including photos of his driver’s licence, a bounced cheque, and one taken by a security camera of him at the business. The Facebook post attracted thousands of views and the majority of comments posted by readers were uncharitable to the man – to put it mildly – with many people referring to his colourful past and previous encounters with the law.

In his complaint to our office, the man said he lived in a small community and word quickly spread of the Facebook post. As a result, he and his family had to endure abuse from others in his community. He said his anxiety and depression hit a new low because of the Facebook post and online comments. The man said he wanted more than $50,000 in compensation from the business.

No cash or credit

When we contacted the business, the business owner explained the events that prompted the Facebook post. The man had arrived and wanted to purchase the goods but did not have the cash or credit to pay for them. He offered instead to pay by cheque and refused to leave without the products because he had driven four hours from where he lived. The man gave his permission for the business to keep a copy of his driver’s licence and to report him to Police if his cheque was dishonoured. The two parties came to an agreement that the man could take half the goods he wanted to buy and the rest would be sent to him after the cheque cleared.

The cheque bounced. The business tried many times to call the man’s mobile but the calls were not answered or messages responded to. When the business owner googled the man’s name, he discovered he was well known in his area for his scams. Within an hour of posting the man’s information on Facebook page, the business was receiving messages and phone calls from people wanting to share similar stories about the man’s past behaviour.

Apology

Later that day, the business received Facebook messages from the man’s son asking it to remove the post. The business owner said he would delete the post and withdraw his Police report, if the debt was paid. But hours later, even though no payment was received, the business owner took down the post. He then received a phone call from the man saying he would make an online payment if the business posted an apology. The business owner complied with an apology but still no payment arrived.

We asked the business owner what the grounds he relied on were for disclosing the man’s information on Facebook. Principle 11 of the Privacy Act says an agency that holds personal information should not disclose the information unless one of the exceptions to the principle applied. The business owner said the main exception he relied on was disclosure was necessary to lessen or prevent a serious threat.

Good faith

We didn’t agree. We were not satisfied the man’s actions met the definition of serious threat. However, while we were not satisfied the business could disclose the man’s information, we decided the man had not acted in good faith in dealing with us. He had not paid for the goods he had taken, nor did he return the goods. He also failed to provide us with evidence to assess whether or not he had experienced harm as a result of the Facebook post, despite wanting over $50,000 in compensation from the business.

We decided to close the file. Acting in good faith is an important part of participating in our complaints process. In our view, the man had fallen well short of engaging with us in an open, honest and transparent way. The Privacy Act is not a law that a person can game if you don’t come with clean hands and honest intentions.

Image credit: Clasped hands via Public Domain Pictures

complaints, Facebook, IPP11 – disclosure

Back

Source:

It is said that a sincere apology should include the three Rs – regret, responsibility and remedy. Why apologise and how to do it properly is a subject we’ve discussed before. But we continue to see apologies that fail to convince a complainant. So it’s something we thought we’d revisit in this post because the quality of an apology is an important part of our efforts to resolve privacy complaints.

As a recent case has shown, the sincerity of an apology can affect an agency’s bank balance by lessening the damages awarded. The Human Rights Review Tribunal noted in its decision in Raymond Keith Williams v ACC:

An appropriate and timely apology can be taken into account under s 85(1)(4) of the Privacy Act when considering whether the defendant’s conduct has ameliorated the harm suffered as a result of the breach of privacy.

The Tribunal noted that in AB v Chief Executive, Ministry of Social Development:

… an appropriate apology given at the right time is a matter that can be taken into account under s.85(4) of the Act in considering whether and to what extent the defendant’s conduct has ameliorated the harm suffered as a result of an interference with privacy. In this case, however, we think the apology came far too late to have been of any value in that respect.

In that case, the defendant took one year to acknowledge the breach and another year to apologise for it. The Tribunal considered the apology had no mitigating effect, describing it as having been provided at the “eleventh hour”, after proceedings had been commenced and was considered to be motivated by litigation concerns.

Referring back to Mr Williams v ACC, the Tribunal said:

The circumstances of the present case are the polar opposite in terms of speed, motivation and sincerity.

The apology cannot “erase” the humiliation, loss of dignity or injury to feelings caused by the interference with privacy. Nor is it a “get out of jail free” card. The question in each case is whether and to what degree the emotional harm experienced by the particular plaintiff has been ameliorated. While this is a fact specific inquiry, it can be said that ordinarily an apology must be timely, effective and sincere before weight can be given to it. It is not inevitable an apology, even if sincerely and promptly offered, will ameliorate the emotional harm experienced by the plaintiff. Much will depend on who the particular plaintiff is and the particular circumstances of the case.

The Tribunal awarded Mr Williams $7,500 in damages but it is clear in its reasoning that if ACC had not apologised in such a sincere and timely way, that sum would have been greater.

In another case, a recruitment agency expressed its sincere apologies and stated that the mistake it made was unacceptable, given that confidentiality is vitally important to the nature of its business. The agency also assured our office and the complainant that it had implemented processes to ensure that the mistake would not occur again. The complainant was satisfied and we closed the complaint.

In another example where an apology successfully resolved a dispute after the complainant asked for the apology to come, not from the agency itself, but directly from the person in the agency who breached her privacy. 

Making a sincere apology sounds straightforward but as we see time and time again, many apologies fail to express the three Rs – regret, responsibility and remedy. But getting an apology right could make it easier on everyone – the agency, the complainant and our office – and divert a complaint away from an expensive, time consuming process which ends with an unwelcome sting for your agency.

Image credit: Head of Odysseus via Wikipedia.

complaints, Human Rights Review Tribunal

Back

Source: MetService

Covering period of Wednesday 30th – Friday 2 May – Stormy conditions starting to impact New Zealand today will bring strong damaging winds, heavy rain and choppy seas over the next few days to various parts of the country. MetService has issued numerous Severe Weather Warnings and Watches.
 
North Island
 
Widespread rain is currently affecting many parts of the North Island, with some areas experiencing heavy downpours. These conditions are forecast to become more persistent and spread further across the island by this afternoon (Wednesday).
 
•  A Orange Heavy Rain Warning is in place east of Bay of Plenty, from 10am today valid until 3pm tomorrow.
•  Heavy Rain Watches have been issued for Bay of Plenty and Southern Wairarapa until Wednesday evening. Wellington is also on Watch from 6pm Wednesday until 3pm Friday.
•  Strong to gale-force winds are expected along the Wairarapa and Wellington coastlines, generating rough seas and wave heights of up to 7 metres on Thursday afternoon and a Heavy Swell Warning has been issued.
•  Strong Wind Watch for Auckland, Great Barrier Island, Coromandel Peninsula, and north of Hamilton in Waikato, from 7am to noon Thursday.
 
Conditions in Wellington over the next day and a half will be something to keep a close eye on, as a combination of wet weather, very strong southerly winds, and large waves are expected.
 
The winds are of particular interest. While Wellingtonians are no strangers to blustery days, this event stands out due to the unusually strong southerlies, with gusts of 130 km/h possible. This means that trees and structures that may be accustomed to very strong winds from the north may be more vulnerable to strong winds from the south, making them more prone to damage. These winds will also be whipping up large waves, which may impact travel along coastal roads on Thursday.
 
South Island
 
•  An Orange Heavy Rain Warning for the Kaikōura Coast and ranges plus areas of Canterbury north of Timaru, easing from 6pm Thursday.
•  Orange Road Snowfall Warnings for Porters, Arthur’s, Lewis and Lindis Pass are in force into Thursday.
•  An Orange Heavy Snow Warning for Canterbury High Country, south of the Rangitata River, in place from 9pm tonight (Wednesday) through to 9am on Thursday.
•  Yellow Strong Wind Watches for Buller, Grey, Westland, Nelson Lakes Districts (from noon today), and the Marlborough Sounds (from 6pm today through Thursday afternoon).
 
The South Island is currently experiencing cloudy and wet conditions, with more rain forecast through to Thursday.  For the eastern South Island, this could be a significant weather event, with large amounts of rainfall expected between today and Friday. For regions under Orange Heavy Rain Warnings, possible impacts include areas of flooding, slips, and hazardous driving conditions.
 
MetService meteorologist Kgolofelo Dube says, With the hazardous weather conditions approaching, we strongly encourage all New Zealanders to stay informed by regularly checking the MetService app or website, as well as updates from local Civil Defence and council channels.”
 
Friday looks to be a better day, with rain easing in most areas across the country. However, eastern parts of the North Island and the north-eastern South Island may still experience heavy rain and strong winds.
 
The good news is that by Saturday, more settled conditions are expected to return to most regions, although some areas may still see isolated showers.

Please keep up to date with the most current information from MetService at http://bit.ly/metservicenz  

Source: NZ Music Month takes to the streets

Deputy Prime Minister and Foreign Minister Winston Peters will travel to New Caledonia later this week.

“This visit comes at an important moment in New Caledonia’s history and reinforces New Zealand’s commitment to being a constructive partner in the region for both New Caledonia and France,” Mr Peters says. 

Mr Peters will meet the French Minister for Overseas Territories, Manuel Valls, and the President of the Government of New Caledonia, Alcide Ponga. 

“We are looking forward to meeting the new leadership of the Government of New Caledonia and continuing New Zealand’s warm and long-standing relationship with France.

“New Zealand wants to listen, learn and support New Caledonia’s pathway forward as a neighbour and fellow member of the Pacific Islands Forum.” 

Mr Peters will also visit the Pacific Community (SPC), a leading science and technical agency in the Pacific, and meet with Director-General Dr Stuart Minchin. 

This will be Mr Peters’ third visit to New Caledonia, following previous visits in 2018 and 2024. 

Mr Peters departs New Zealand on Thursday 1 May and returns on Friday 2 May.