Category: MIL-OSI

Source:

The following is a summary of a Human Rights Review Tribunal decision which has since been overturned by the High Court. You can read the High Court decision here [1 October 2018]. The Court of Appeal decision is here [10 November 2020].

In a recent decision, the Human Rights Review Tribunal had to decide whether the transfer of Kim Dotcom’s requests for personal information to the Attorney-General was permitted under section 39 of the Privacy Act and, if it was, whether there was a proper basis for the subsequent refusal of the requests.

In July 2015, Mr Dotcom requested all personal information about him (including information in his previous names) from nearly every government department. Nearly all the Crown agencies transferred their requests to the Attorney General. Mr Dotcom’s requests were refused under section 29(i)(j) of the Privacy Act on the basis that they were vexatious and, due to their broad scope, included information that was trivial.

Transfer of requests

The Crown argued that the Attorney-General was best placed to deal with the information requests in the context of ongoing litigation. However, in hearing the case, the Tribunal considered that section 39(b)(ii) did not allow information privacy requests to be transferred in the context of the Crown’s overall litigation strategy. It determined that the information in question was not more closely connected to the functions or activities of the Attorney-General.

The Tribunal referred to the October 2014 High Court decision Dotcom v USA, where Justice France noted that Mr Dotcom should seek his personal information from the relevant agencies rather than the extradition court.

Whether the requests were vexatious

In the Crown’s view, Mr Dotcom’s requests were intended to disrupt the extradition hearing. However, the Tribunal found Mr Dotcom to be a credible witness and rejected the idea that there was an ulterior purpose to his request.

The Tribunal found that s 29(i)(j) must be applied with caution, particularly when higher courts have directed Mr Dotcom to use the Privacy Act to seek his personal information.

The Tribunal noted that agencies are not well placed to determine whether a request is vexatious as they are not aware of the personal circumstances of the requester. In its view, it must be manifestly clear that the request is vexatious or the information requested is trivial.

Remedies

The remedies were:

• A declaration that there was an interference with Mr Dotcom’s privacy in transferring the requests to the Attorney-General and in refusing the requests on the grounds that they were vexatious.
• An order that the Crown agencies comply with Mr Dotcom’s requests from July 2015 subject to the Privacy Act.

Damages

1. Loss of a benefit

The Tribunal awarded Mr Dotcom $30,000 for loss of a benefit relating to his requests for personal information to multiple agencies in the context of his extradition litigation.

The Tribunal referred to Proceedings Commissioner v Health Waikato where the High Court took a serious view of a refusal to provide personal information in the context of litigation. It found that Mr Dotcom’s case was exceptional because he correctly believes that a wide range of government agencies have personal information about him and at least one agency (GCSB) has previously unlawfully collected information about him.

2. Loss of dignity or injury to feelings

The damages awarded for loss of dignity, or injury to feelings was $60,000.

The Tribunal accepted that Mr Dotcom had “clearly and unambiguously” established loss of dignity and injury to feelings, as defined in Hammond v Credit Union Baywide. It stated that anxiety and stress can amount to injury to feelings and this can be assumed or inferred.

The Tribunal considered Mr Dotcom’s loss of dignity and injury to feelings was substantial and noted the unfounded stigmatisation of his requests as vexatious and not genuine.

A more detailed summary of the decision on our website can be read here.

Image credit: Painted finch via John J Audubon’s Birds of America

IPP6 – access, Human Rights Review Tribunal

Back

Source:

R v Alsford is an important privacy decision. The Supreme Court has clarified the law in relation to voluntary requests for personal information by law enforcement agencies, and affirms the obligations and responsibilities of both the law enforcement requester and the responding agency.

The decision affirms the importance and policy of the Privacy Act, and its relationship with other relevant statutes, including the production order regime in the Search and Surveillance Act 2012, the test for the admissibility of evidence under section 30 of the Evidence Act 2006 and the test for an unreasonable search under section 21 of the New Zealand Bill of Rights Act 1990.

The Privacy Commissioner’s transparency reporting trial revealed confusion in the private sector about the lawful basis for law enforcement requests for personal information.

The Alsford case was a criminal pre-trial matter and it presented an opportunity for judicial clarification. The Privacy Commissioner was granted leave to be heard on the privacy issue. The Court’s decision was released in March 2017, subject to non-publication orders that have now been lifted.

The Court considered whether a production order should have been used to obtain power consumption data from electricity providers in an investigation of suspected cannabis cultivation, and whether the power consumption data was obtained in breach of privacy principle 11(e)(i) of the Privacy Act.

The Police made requests to three electricity providers for power consumption data from the defendant’s properties. All three companies disclosed the information sought under privacy principle 11(e)(i) of the Privacy Act. This manner of obtaining the power consumption information and its use to support subsequent production order and search warrant applications to uncover evidence of offending was one of the grounds of appeal.

The majority of the Supreme Court (4:1) affirmed the Police’s ability, in the circumstances and in the absence of a production order, to ask for power consumption information in the form of monthly aggregated data, despite finding that one of the three requests did not provide sufficient information to justify the resulting disclosure. That particular disclosure was therefore not justified in terms of principle 11(e) and, to that extent, there was a breach of the Privacy Act.

The decision also affirms that where the Police obtain information from service providers about customers on a voluntary basis, they must not infringe section 21 of the New Zealand Bill of Rights Act (the right to be secure against unreasonable search and seizure). 

The Supreme Court decision can be read here. 

Lastly, there is also the Privacy Commissioner’s Commentary on R v Alsford.

Image credit: Kōtuku – Department of Conservation – New Zealand Birds A-Z

legal

Back

Source: NZ Music Month takes to the streets

The Government has agreed to reinstate a total ban on prisoner voting, Justice Minister Paul Goldsmith says.
“Cabinet’s decision will reverse the changes made by the previous government in 2020, which allowed prisoners serving sentences of less than three years to vote.
“Restoring prisoner voting was typical of the previous government’s soft-on-crime approach; we don’t agree with it.
“Citizenship brings rights and responsibilities. People who breach those responsibilities to the extent that they are sentenced to jail temporarily lose some of their rights, including the right to vote.
“The proposed change will establish a consistent approach to prisoner voting, regardless of the length of sentence.
“The Government is committed to restoring law and order, and part of the response is to place a greater emphasis on personal responsibility and accountability. 
“A total prison voting ban for all sentenced prisoners underlines the importance that New Zealanders afford to the rule of law, and the civic responsibility that goes hand-in-hand with the right to participate in our democracy through voting.
“The voting ban will be progressed as part of an electoral amendment bill announced in April and set for introduction later this year. 
“When prisoners have served their time, they will enjoy the full restoration of electoral rights. The Department of Corrections and the Electoral Commission currently coordinate to support prisoners with re-enrolment upon their release, and this work will continue.”
The ban will not be retrospective, meaning prisoners already serving sentences of less than three years at the time the ban comes into force before the 2026 General Election will retain the ability to vote. 
The voting ban will not apply to people detained on remand or serving sentences of home detention.

Source:

The most common complaints we investigate relate to individuals trying to access their personal information. Some of these requests are “empty-your-pocket” requests to the agency – in other words, requests for all the information held about the person concerned by the agency.

The requester is well within their rights to do this. But throughout our investigations we have seen the full spectrum of responses from agencies to these types of requests: some deal with the requests comprehensively; others leave a lot to be desired. Included below are some observations from the access complaints we have assessed.

The legal position

Principle 6

Principle 6 of Privacy Act says that individuals are entitled to have access to their personal information held by an agency. An agency can withhold personal information if one of the withholding grounds listed in the Act applies.

Principle 6 is a strong legal right. There is no limitation upon the extent of personal information which a person can request from the agency. If an individual wants to request everything the agency holds about them, they are free to do so.

What to consider when responding to these requests

Everything means everything

If a requester asks for all information about themselves, the agency needs to assess all the information it holds about the requester – obvious, right? Yet often we see agencies that initially say they have released all information to the requester but, when prompted by our Office to conduct some follow-up enquiries, are later able to locate more information. This suggests that their initial searches were not as thorough as they could have been.

Many agencies will have a designated file (or files) for the individuals that they deal with. In most cases it will not be sufficient for the agency to simply release that file in response to a ‘capture-all’ request. A request for all information held by an agency would by extension include information not necessarily on the individual’s file. The agency should ensure it checks its records for information it holds outside that individual’s file. This includes searching emails, written notes, and even employee memories.

It is important to note that when our Office notifies an agency of a complaint, it then opens up that agency to litigation risk. If we are not able to resolve the matter during an investigation, the complainant is free to take the matter up in the Human Rights Review Tribunal. Therefore, it is best practice for an agency to respond as meticulously as it can when it receives a request for all information to reduce the likelihood of the requester making a complaint to our Office in the first place. Put simply: do it once and do it well.

Ask: why do they want this information?

From a legal perspective, principle 6 is generally not concerned with why an individual wants their information. A person’s motivation for requesting information is only relevant in limited circumstances (for instance, where the requests may reach the threshold for vexatiousness, which is a ground whereby an agency can refuse an access request).

But from a practical perspective, the question of why an individual wants specific information should be at the forefront of the agency’s mind. Rather than attempting to respond to requests blindly, we encourage agencies to try and work with the requester. Can the requester clarify or specify the information they are after? Can you get more details to understand the context of the request? Asking these questions can help agencies to locate the information requested, or even narrow down the scope of the request so it is not too burdensome or time-consuming to respond to.

Transparency around the agency and its decisions

In our experience, many people who make these all-encompassing requests do so because of their lack of knowledge or lack of trust with the agency. Commonly the request is triggered by an event or decision made by the agency that takes the individual by surprise. The individual becomes suspicious of what actions the agency might take in the future, or they speculate about what information the agency holds.

These requests can be taxing for agencies to process, and often the information is not that helpful for the individual in the context of their dispute. There’s a lesson in here for agencies to be as transparent as possible when it makes decisions affecting people.

Utilise our Office

Our investigation of complaints is retrospective by nature. When we investigate, we assess how an agency has already responded to an individual. But this doesn’t mean that we cannot help agencies before this stage. If you are uncertain about how to respond to a request, feel free to contact our Office in the first instance – we are here to help.

Image credit: Request – via Blue Diamond Gallery under Creative Commons Licence

IPP6 – access

Back

Source:

The Human Rights Review Tribunal recently found that the Parole Board breached the Privacy Act when it disclosed an offender’s parole address, with tragic consequences.

Read the full decision: Tapiki and Eru v New Zealand Parole Board [2019] NZHRRT 5 (external link)

The Board agreed to release the offender from prison in large part because his mother, Ms Tapiki, committed to giving her son a fresh start. Ms Tapiki and her friend Ms Eru put careful thought and preparation into a plan to give the offender “a real chance for reintegration into the community and the best possible opportunity for a positive future,” according to the Tribunal decision.

As part of the plan, Ms Tapiki gave up her small flat and Ms Eru agreed to have the offender and Ms Tapiki live with her. A probation officer assessed and approved Ms Eru’s address and the Parole Board made living there a condition of the offender’s release.

The Board disclosed the offender’s release conditions to his victim, as the Parole Act requires. It redacted some information identifying Ms Tapiki, but it didn’t redact the parole address.

After the disclosure, Ms Tapiki and Ms Eru started receiving threats and somebody smashed their letterbox. The Department of Corrections had to move the offender to another town, where he had no support system. He later took his own life.

The Tribunal found that the Board had breached principle 11 by disclosing the parole address. The breach led to significant injury to Ms Tapiki and Ms Eru’s feelings, making it an interference with their privacy. The Tribunal awarded damages of $16,000 to Ms Tapiki and $12,000 to Ms Eru.

Testing the relationship between the Parole and Privacy Acts

When considering the parties’ cases and making its decision, the Tribunal looked at the extent to which the Parole Act overrides the Privacy Act.

The plaintiffs’ case

Ms Tapiki and Ms Eru claimed that disclosing the address breached principle 11 of the Privacy Act. Principle 11 prevents agencies from sharing personal information unless an exception applies.

The Parole Board’s arguments

The Board admitted that it should have redacted the address but argued that principle 11 didn’t apply in this case as per section 7(1) of the Privacy Act. Under section 7(1), nothing in principle 11 overrides other laws that allow or require an agency to share personal information.

The Board argued that section 50 of the Parole Act enabled it to share the information. Section 50(1) requires the Board to disclose offenders’ release conditions to victims. Section 50(2) lets it withhold information that would interfere with another person’s privacy. The Board claimed that these provisions overrode its obligations under principle 11 when disclosing offenders’ release conditions.

Applying the Privacy Act to the Parole Act

The Tribunal emphasised that the Board must apply sections 50(1) and 50(2) of the Parole Act together. This means the Board has “a duty to advise except where disclosing the condition would unduly interfere with the privacy of any other person.” It also noted that section 108(3) states that the Parole Board is subject to the Privacy Act.

The Tribunal’s interpretation of section 7(1) of the Privacy Act was that principle 11 still applies under other laws up to the point where it would lessen or impair those other laws.

The Tribunal found that, since the Parole Board didn’t exercise section 50(2) of the Parole Act, section 50(1) didn’t apply either. Therefore, privacy principle 11 governed the disclosure. This doesn’t lessen or impair section 50, because section 50 requires the Board to consider the privacy interests of other people.

Not applying principle 11 in cases where the Board ignores its section 50(2) obligations would leave a privacy protection “vacuum.” The Tribunal said that the way to avoid this is to recognise “that the intended effect of s 108(3) of the Parole Act and of s 7(1) of the Privacy Act is to ensure IPP 11 applies in all circumstances.” Specific provisions that authorise or require the Board to share personal information only override principle 11 when the Board actually applies them.

Image credit: ‘Parole’ by Nick Youngson CC BY-SA 3.0 ImageCreator

Human Rights Review Tribunal, information sharing, IPP11 – disclosure, law enforcement, breach

Back

Source:

The Human Rights Review Tribunal has dismissed a claim by a prisoner that the Department of Corrections interfered with his privacy by withholding his outgoing prison mail.

The prisoner claimed the department’s actions were in breach of Privacy Act principles 1-4 and 9. He also said the department had breached principle 11 by disclosing the letters to Police.

The matters at issue depended on whether Corrections withholding of the prisoner’s mail was authorised under the Corrections Act and, in particular, whether the department had reasonable grounds to believe that releasing the letters was likely to prejudice the maintenance of the law.

Background

The prisoner was being held on remand for serious offences against his girlfriend and a police officer who attended the callout. While in prison, he wrote to his girlfriend. A police officer became concerned his letters were intended to get her to drop her charges against him. The officer emailed an intelligence officer at the prison and asked for copies of the letters being sent by the prisoner. As a result, the outgoing letters were sent to the Prison Intelligence Unit where they were held.

Soon afterwards, a prison intelligence officer emailed the police officer to say he had permission to provide him with a copy of one letter and a production order would be required for any other letters. Corrections would hold all the letters until a production order was presented.

Meanwhile, the prisoner, who was a prolific letter writer, became suspicious the Department was interfering with his outgoing letters. He had been told by his girlfriend that she had only received one letter from him. The prisoner complained to his prison unit manager. He said the interference with his mail made him angry, anxious, paranoid and upset.

At this stage, Police had yet to provide a production order, so the Department decided to release the mail to the intended recipients. However, the police officer obtained a production order a few days later and served it on the prison. From that time until the expiry date on the production order, the prisoner’s mail was forwarded to the police officer.

Complaint

The prisoner complained to our office that Corrections had breached six of the information privacy principles of the Privacy Act. In his statement, he said his mail:

• had been collected unlawfully, in breach of principle 1
• had been collected indirectly and covertly, in breach of principle 2
• was collected without him being informed, in breach of principle 3
• was collected unlawfully, in breach of principle 4
• was retained without good cause, in breach of principle 9
• was copied and retained and the disclosure of these copied letters breached principle 11.

Privacy Commissioner view

Section 7 of the Privacy Act says if another piece of law allows or requires personal information to be used in a specific way – that will override the general provisions of the Privacy Act.

We concluded that Corrections had not breached principles 1-4 and 9. The Department’s withholding of the letters was permitted under section 108 of the Corrections Act because it believed on reasonable grounds the correspondence was likely to prejudice the maintenance of the law.

Although we did not find an interference with privacy, we issued a certificate of investigation enabling the complainant to take the matter to the Tribunal, should he choose to do so.

Tribunal view

The prisoner then took his complaints in relation to principles 1-4 and 9, to the Tribunal.

The Tribunal agreed with our view about principles 1-4 and 9. It said the prisoner’s mail had been lawfully withheld under section 108 of the Corrections Act.

Section 108(1)(d)(v) is specific. It says a prison manager may withhold mail between a prisoner and another person if it is correspondence that the manager believes on reasonable grounds is likely to prejudice the maintenance of the law (including the prevention, detection, investigation, prosecution, and punishment of offences, and the right to a fair trial).

Based on the information it had received from Police, Corrections believed the prisoner was manipulative, that he had and would continue to try and get the victim to withdraw her complaint. The Police therefore wanted copies of any letters he sent. Despite the screened letters having appropriate content, The Tribunal found that the belief that they could have prejudiced the maintenance of the law remained reasonable.

The Tribunal said the application of section 108 of the Corrections Act and section 7 of the Privacy Act meant no interference with the prisoner’s privacy could be established and dismissed the claim.

Image credit: Letters To Post via Public Domain Pictures

Human Rights Review Tribunal, law enforcement

Back

Source:

When a person makes a request for personal information, the agency responding to the request is entitled to withhold the information, if one of the exceptions to principle 6 of the Privacy Act applies.

One such exception is section 29(1)(b), which allows agencies to withhold “evaluative material”, if a promise was given to the individual that their identity and/or the information they provide would be kept in confidence.

Read section 29(1)(b)

Section 29(1)(b)

Section 29(1)(b) is often relied on by agencies in the employment context where, for example, people provide their opinion in confidence on a colleague’s performance or his or her suitability for a role. This can include pre-employment screening. The person’s opinion or reference is the evaluative material which can be withheld in such situations.

Case note: Man objects to pre-employment screening

A typical scenario might be a job applicant finds that he or she is unsuccessful. Often, applicants will go on to request a copy of any references provided as part of the application process. We will often find that s 29(1)(b) applies in these instances, as there has been a promise of confidentiality given to the person who provided the reference.  

In another complaint, a doctor sought information about an application process after he was not offered an interview for a specialist training programme. We found the specialist college could rely on section 29(1)(b) to withhold the names of his referees and the information they provided. We considered that it was evaluative material and that the referees had relied on a promise of confidentiality when they provided the information during the application process.

Case note: Man seeks information from application process

However, the College was not entitled to withhold the point values, which were numbers representing the overall value of each referee’s response, as the scoring did not identify the referee or give details about what he or she had said.

Other examples

In Director of Human Rights Proceedings vs New Zealand Institute of Chartered Accountants [2015] NZHRRT 54, an accountant requested comments made by peer reviewers in a review of his practice. The Tribunal decided that the NZICA was entitled to withhold the information under section 29(1)(b), saying:

“If the practice reviewers were aware that the information would or could be disclosed to the member concerned, their freedom to frankly record their evaluations and opinions would be undermined.”

Director of Human Rights Proceedings vs New Zealand Institute of Chartered Accountants [2015] NZHRRT 54

This case note discusses a situation where an employer interviewed other employees during an investigation into allegations of sexual harassment. The information was collected in order to determine whether the employee should be dismissed. We were satisfied that the information in the interviews was evaluative material and the employer was entitled to withhold it.

Case note: Employee complains former employer ignored request for employment details

As with all requests for personal information, agencies need to assess the information and the circumstances surrounding its collection when deciding whether they can rely on a Privacy Act exception.

Image by Helix84 [CC0], via Wikimedia Commons

employment, IPP6 – access, IPP11 – disclosure

Back

Source:

Under the Privacy Act, individuals have a right to get access to their personal information. When an agency receives such a request, a recent decision by the Human Rights Review Tribunal shows the agency, where possible, must provide the information in a way that is meaningful and understandable to the requester.

The Tribunal said the Royal Australasian College of Surgeons (RACS) breached the Privacy Act in how it responded to a doctor’s request for personal information. A central issue was that the information was provided to the requester in a form which he could not decipher. 

Background

The doctor had applied for a place in a training programme to become an orthopaedic surgeon. He had applied to the programme repeatedly but had been unsuccessful each time. After his last bid, he made a request to see the personal information held about him by the RACS to understand why he had been rejected yet again.

Twenty working days elapsed. Eleven days later, the RACS responded and emailed the doctor’s personal file to him. Some documents were withheld from him.

Based on the documents provided to him, the doctor believed his application had been unfairly judged. He lodged an appeal with the RACS Appeals Committee and filed a complaint to the Office of the Privacy Commissioner about the withheld documents.

The RACS extended the deadline for the appeal process until the Privacy Commissioner investigation was completed. After our investigation was completed, RACS provided the doctor with information it had initially withheld from him – namely a table of referee scores. The scores formed part of the basis for his failed application.

The doctor said the referee scores were inconsistent with the verbal feedback he had received and were well below his previously achieved scores. There was little meaningful information to contextualise the scores. No information was provided to indicate what the scores had been marked out of, or whether they had been weighted.

The doctor said it was impossible for him to interpret or decipher the referee scores and to see if they had been correctly calculated.

At this stage, we were unable to reach a satisfactory resolution to the complaint and the doctor exercised his right to seek a ruling from the Tribunal.

Tribunal’s view: provide meaningful access

The Tribunal said an important feature of the case was that the personal information the doctor received from RACS could not be deciphered. The doctor hadn’t been given the formula, mechanism or “key” to help him understand how his referee scores were calculated.

The Privacy Act provides that personal information must be given in a form that can be understood (see section 42(1)(c) and (d)). Without such steps, it cannot be said that access to personal information had been given and an agency’s obligations had been met.

The Tribunal ordered the RACS to give the doctor the necessary information to make meaningful the scoring and assessment of his referee scores, such as the scoring mechanism or available formula, as well as the weighting and total points available to the referees in making their scores. This information was to be transparent, intelligible and easily accessible to the doctor.

Image credit: Steel black and white via Pixabay under Creative Commons Licence.

IPP6 – access, Human Rights Review Tribunal

Back