Category: MIL-OSI

Source:

The parents of a profoundly disabled boy took a case to the Human Rights Review Tribunal [2020 HRRT 13] on their son’s behalf in relation to the provision and accuracy of his health information while he was in the custody of IDEA Services.

IDEA Services is New Zealand’s largest provider of services to people with intellectual disabilities and their families. Eamon Marshall was first placed in the custody of IDEA Services when he was 18 months old and was cared for by foster families (under the supervision of IDEA Services) for 11 years.

The proceedings centred on two claims: a breach of rule 6 and rule 8 of the Health Information Privacy Code 1994.

The Marshalls sought $300,000 in damages and a declaration that IDEA Services had interfered with their son’s privacy, causing him to suffer a loss of dignity.

Eamon’s father Glenn Marshall represented his son before the Tribunal.

Facts of the case

In 2015, Eamon’s parents became concerned for their son’s welfare after they suspected he was not receiving the medication he needed in foster care. After the Marshalls complained, IDEA Services conducted an internal investigation into Eamon’s care arrangements and provided a report in December 2015. No summary of the investigation was sent to the parents.

In January 2016, the Marshalls requested the findings of the IDEA Services investigation. On 15 May 2016, the Marshalls made the first of several requests for information under the Health Information Privacy Code 1994.

The Marshalls received a summary of the investigation report. Sometime later, a four-page internal report was released to them stating they had been interviewed during the internal investigation. This had not occurred. When comparing the full report to the summary they had received, the Marshalls formed the view that IDEA Services had been involved in a “cover up”. They made a series of subsequent requests for information from IDEA Services.

Complaint to Privacy Commissioner

The Marshalls believed the response from IDEA Services had been inadequate and in June 2016, they lodged a complaint with the Privacy Commissioner. The Commissioner undertook an investigation and found that IDEA Services had withheld personal information about Eamon that should have been provided. This amounted to an interference with Eamon’s privacy.

There was significant correspondence between the Marshalls and IDEA Services about the information that the Privacy Commissioner had reviewed.

Rule 6 – Access to personal health information

Where health agencies hold health information that is readily retrievable, the individual concerned is entitled to know whether the agency holds the information and to have access to that information. Agencies must decide whether the request is to be granted and must communicate that decision to the requester within 20 working days of receipt of the request (Privacy Act, s 40(1)).

The Tribunal considered the timeline of requests for health information from the Marshalls and the responses from IDEA Services.

Section 22F(1) of the Health Act 1956, together with Rule 11(4) of the HIPC entitles a child’s representative (their parent or guardian) to request access to the child’s health information. Any such request is treated as an access request under Rule 6.

The Tribunal considered the extensive chronology of correspondence between IDEA Services and the Marshalls.

In their correspondence with the Marshalls in June 2016, IDEA Services said that some of the omissions from the files they had provided were inadvertent and not deliberate. They also raised the point that as their organisation’s record keeping was predominantly hard copy based, Eamon’s file was in hardcopy and not all information, such as email correspondence, was “readily retrievable”.

The Tribunal commented that “the matter for consideration is not whether the emails that were not printed and placed on the hard files, were retrievable, but whether they were readily retrievable” [para 85]. The cost and time and manner in which the information was stored were relevant factors. The Tribunal accepted that some of the documents were not readily retrievable, noting that “documents only discovered after a thorough forensic search cannot be said to be readily retrievable” [para 87].

Determination on Rule 6

The Tribunal concluded [para 78], in agreement with the findings of the Privacy Commissioner, that IDEA Services had interfered with the privacy of Eamon Marshall by failing to supply certain personal information without undue delay. Specifically, this was:

• an audit undertaken by its health advisor
• a file note dated 18 April 2016
• file notes made between 10 – 18 December 2015.

Rule 8 – Accuracy of information

Under rule 8 of the Health Code, a health agency must take reasonable steps to check that information is accurate, complete, relevant, up to date and not misleading before it uses or discloses health information. The Tribunal noted that rule 8 “focuses on the reasonableness of the steps taken to check information, having regard to how that information is to be used” [para 107].

Failure to interview

The Marshalls alleged that during the compiling of their internal investigation report, IDEA Services failed to interview or speak to them and that this amounted to a breach of rule 8 [para 111].

IDEA Services accepted that in conducting its investigation it did not interview or speak to the Marshalls. IDEA Services said however the investigator was in regular daily contact with Mr and Mrs Marshall and it was reasonable to assume the she was well acquainted with the Marshall’s concerns. The Tribunal said Mr Marshall had not shown why interviewing him or his wife was a reasonable step to ensure the information in the investigation report was accurate, complete and not misleading [para 112].

Determination on Rule 8

The Tribunal found the plaintiff had not proved a failure to interview Eamon’s parents gave rise to a breach of Rule 8, stating that Mr Marshall had failed to establish why any matters listed in his statement of claim gave rise to a breach of Rule 8. The Tribunal found the evidence on this point to be lacking. The claim of a breach of Rule 8 was therefore unsuccessful.

Apology given

The Tribunal gave significant weight to the apologies the Marshalls received [para 127]. IDEA Services said it had stressed to the Marshalls that they did not intend to withhold any information. They repeatedly apologised to the Marshalls regarding the handling of their request. The CEO also wrote a personal letter to the Marshalls on two occasions in which he offered to meet with them and to engage with an independent mediator.

Damages application dismissed

Although there had been an interference with Eamon’s privacy, the Tribunal noted: “Eamon’s dignity has not been diminished at all by the failure to provide information in a timelier fashion. No evidence has been shown establishing that Eamon suffered any loss of dignity by the delay in providing the documents…” [para 142].

The Tribunal went on to say they saw “no justification for Eamon’s rights to be further vindicated by any additional award of damages” [para 143]. The bid for $300,000 in damages was therefore dismissed.

Costs

Costs were reserved.

Back

Source:

An Auckland Powershop customer did the right thing by checking her credit report after the company said she was in arrears, even though she was up to date with her payments.

The news story this week demonstrates the impact wrong repayment information can have on an individual, particularly when it shows up on their credit report. It also highlights the importance of regularly checking your credit report to ensure the information on it is correct.

Payment arrears

In the story, the Auckland woman was upset to find out her credit report said she had been behind on her Powershop bill repayments for an 18-month period, despite having paid on time each time by direct debit.

Powershop used a system that allowed customers to buy “Powerpack” bundles of electricity when it suited them. It allowed them to have the option to adjust the due date of their payments within a 10-day period. But using this option counted against the Auckland customer by showing her as being behind on her payments, even though she was paying each bill by her adjusted due date.

“If their system is reporting aged debt when it is not aged debt at all, that is a serious issue,” she told Stuff.

Powershop has responded by changing its systems so that customers taking up the offer of payment flexibility are not impacted.

Credit Reporting Privacy Code

By checking her credit report, the customer was exercising a right she has under the Credit Reporting Privacy Code issued by the Privacy Commissioner. Among other things, the Code gives consumers the right to check information that is being collected about their credit worthiness – and their credit score which the credit reporter assigns as a result of that information.

We’ve written before about how the impact of an erroneous credit report on individuals can be extremely distressing. You can read about a significant case here.

As a consumer, it’s important to know what you can do to protect yourself and to ensure that businesses and credit reporters are sharing credit information about you that is correct. Here’s what you need to know:

• Regularly check your credit report, especially if you’re about to seek credit: Your credit information is changing all the time and could have a big impact on you. It’s free to check with a credit reporter so do it regularly.
• You have the right to seek correction of credit information: Inaccurate information could affect your ability to get credit. You can ask credit reporters to correct your information, and they’ll work with credit providers and others to assist you, so contact them and get it sorted before you seek credit. 
• If you believe you’re at risk of identity fraud, ask credit reporters to ‘freeze’ your credit information until the risk has passed: You can ask credit reporters to suppress (‘freeze’) your credit report if you believe you’re at risk of fraud. This will help stop new credit accounts being opened in your name. 

You can find out more on our website, such as:

Image credit: Credit reporting via Marshall Freeman.

 

Credit reporting

Back

Source:

The Human Rights Review Tribunal [2020 HRRT 16] awarded $50,000 to an ACC claimant after it was found to have breached the Privacy Act by destroying his file.

In its decision, the Tribunal said ACC breached the information privacy principles 5 and 6 of the Act. Principle 5 governs the way personal information is stored by an agency. Principle 6 gives individuals the right to access information about themselves.

Historic back injuries

The claimant worked in the boat building industry. He suffered injuries to his back in 1982, 1985 and 2002. As a result of these injuries, he was from time to time in dispute with ACC over issues including cover, payments and whether his vocational independence had been properly assessed.

In 2006, he decided he needed professional advice about his ACC entitlements and hired a lawyer specialising in ACC claims to check whether he had received his proper entitlements and back-dated employment-related compensation.

The lawyer advised him that he could be entitled to more compensation as his claim would go back to the 1980s when he suffered his first injuries.

The lawyer requested a copy of his client’s 1985 file from ACC but was told by the agency that it had been destroyed and no information from it could be provided. But in 2015, the claimant learned by chance from an ACC officer that information about his weekly compensation payments for the 1985 injury were still held by the agency. The records showed that he had received minimum earnings-related compensation on his 1985 claim.

He then made a complaint to the Privacy Commissioner because ACC had not fulfilled his principle 6 request for his original file, and it had not given him his earnings-related compensation record.

After an investigation by the Office of the Privacy Commissioner, the claimant took his case to the Human Rights Review Tribunal.

Principle 5

Principle 5 of the Privacy Act says an agency that holds personal information shall ensure that the information is protected from loss or misuse.

ACC said the 1985 file was destroyed in 2001 or 2002 in line with its document retention policy of the time.

ACC argued that principle 5 applied only to the unintentional destruction files and that there was no breach of the Act.

The Tribunal disagreed. It said restricting principle 5 to accidental, unintended or fortuitous loss was too narrow a reading. Principle 5 was intended to also protect against destruction that was well-motivated but intentional. 

It said ACC must be the default primary holder of relevant information because claimants cannot reasonably be expected to retain medical reports and claim and payment histories over the length of their lives.   

The Tribunal said the documents in the claimant’s 1985 physical file would have included the claim for cover, medical reports obtained by ACC, medical certificates certifying him as unfit for work, calculations of his earnings-related compensation, any decision letters, file notes on conversations with the claimant and so on. This information would be essential to both the claimant and ACC over his lifetime, given the complexity of his claim.

The Tribunal reviewed medical evidence that showed the 1982 and 1985 accidents had led to progressive degeneration in his ability to live and work. But without the file, it was impossible to tell if he had received his correct entitlements.  

The Tribunal found there had been a breach of principle 5 because when ACC destroyed the physical file, the purpose for which the information had been collected had not been spent. By intentionally destroying the file without taking into account the progressive degenerative changes being experienced by the claimant and the likelihood that both he and ACC would need to have continued reference to the contents of the file meant the information was not protected by security safeguards which were reasonable to expect in the circumstances.

Principle 6

Principle 6 of the Act says where an agency holds personal information in such a way that it can be readily retrieved, an individual is entitled to have access to that information.

ACC admitted to the Tribunal that it had breached principle 6. The weekly compensation payments on the 1985 claim were in its system and should have been provided back in 2006.

The agency apologised to the claimant, saying it was human error. It offered to pay him $15,000 for humiliation, loss of dignity and injury to his feelings, and $5000 as a contribution towards the cost of his legal advice.

Remedy

The Tribunal concluded ACC had breached principles 5 and 6 of the Privacy Act and interfered with the claimant’s privacy.

It was satisfied the principle 5 breach had caused him harm as listed in section 66(1)(b)(i)(ii) and (iii) of the Act because it:

• Has caused, or may cause, loss, detriment, damage, or injury to that individual; or
• Has adversely affected, or may adversely affect, the rights, benefits, privileges, obligations, or interests of that individual; or
• Has resulted in, or may result in, significant humiliation, significant loss of dignity, or significant injury to the feelings of that individual.

ACC accepted it had breached principle 6 and offered other mitigating factors:

• It had issued an apology to the claimant
• It was still open to him seeking legal advice on and to make an application for backdated weekly compensation
• Since becoming aware of the breach, ACC had taken steps to minimise further harm to him – arranging for and funding formal mediation and funding his legal representation in that mediation.

The Tribunal said these factors did not sufficiently account for the extraordinarily long time it took ACC to accept the principle 6 breach. The information was requested in 2006, but it took ACC until 2018 to acknowledge it had the information. The belated acknowledgement of the breach by ACC therefore carried little weight.

On the issue of the apology, the Tribunal referred to its 2017 decision Williams v ACC [NZHRRT 26] which said: “The apology cannot erase the humiliation, loss of dignity or injury to feelings caused by the interference with privacy. Nor is it a get out of jail free card.”

The Tribunal noted the delay between the failure to comply with principle 6 and the apology was 12 years. “The injury to the feelings of the claimant have in no way been ameliorated. Too much has gone on for too long for the apologies to have a measurable consequence in the context of the assessment of remedies.”

It also noted the matter of further action by him would be at a high personal cost after he gave evidence he was emotionally and physically drained from his 13-year struggle. He told the Tribunal: “I have lived in my past with too many unpleasant memories for such a long time that I now want to move on.”

Under section 85 of the Act, the Tribunal has the power to grant one or more of the remedies, including damages. In deciding what remedies to grant, it needed to consider ACC’s conduct.

The Tribunal concluded there were no mitigating factors in favour of ACC.

Damages

The Tribunal awarded damages of $40,000 against ACC under sections 85(1)(c) and 88(1)(c) for injury to his feelings.

It awarded damages of $5,000 against ACC under sections 85(1)(c) and 88(1)(b) of the Privacy Act for the loss of benefit that he might reasonably have been expected to obtain but for the interference.

It also awarded $5,000 against ACC under sections 85(1)(d) and (e) as a contribution towards the cost of his legal advice on his entitlement to backdated weekly compensation on his 1985 claim.

Image credit: Chess pieces via Chess.com.

Human Rights Review Tribunal

Back

Source:

A former nurse who waited five years to lodge a privacy complaint with the Privacy Commissioner had her request for judgement rejected by the Human Rights Review Tribunal (HRRT) in March 2020.[1]

Ms Watson was employed by Capital and Coast District Health Board (CCDHB) as a nurse. In May 2012, CCDHB requested Ms Watson’s medical information from Catalyst NZ Ltd (Catalyst), which was managing ACC claims for CCDHB at the time.

Ms Watson did not agree to Catalyst releasing her medical information to CCDHB, but they nonetheless passed it on. She became aware of this fact in March 2013 and, five years later in March 2018, she complained to the Privacy Commissioner.

Shortly after receiving the complaint we advised Ms Watson that we would not investigate it, due to the time that had elapsed since Ms Watson became aware of the breach.

Refusing to take action on a complaint

Under section 71(1)(a) of the Privacy Act 1993, the Commissioner has the discretion to refuse to take action on a complaint if, in the Commissioner’s opinion, the length of time that has passed since a complaint arose means investigating is no longer practicable or desirable.

While the Commissioner has the discretion to investigate complaints many years after they have occurred, we generally refrain from doing so for several reasons. Firstly, when years have elapsed since an incident that triggers a complaint, it becomes difficult for our investigators to collect evidence to determine the facts. It is also unfair to the respondents of complaints to raise matters and ask them to respond to events that happened years ago.

The Privacy Bill currently before Parliament contains a clause (cl 80(1)(e)) that specifically gives the Privacy Commissioner discretion to decline to investigate a complaint where the complainant has known about the matter for more than 12 months.

Following our decision, Ms Watson took her case to the HRRT.

Catalyst, now operating as Employers Mutual Limited (EML), applied to the HRRT to strike-out her claim on the basis that the Tribunal did not have jurisdiction, because the Privacy Commissioner had not investigated the matter (a requirement of the statute).

Tribunal hearing

Ms Watson maintained that even though her claim was not investigated by the Privacy Commissioner, it should still be within the Tribunal’s jurisdiction as it was a matter that had been raised with the Privacy Commissioner; this should be enough to meet the jurisdictional threshold.  

The Tribunal rejected this argument and struck out Ms Watson’s claim. They noted an aggrieved individual can only bring a claim in the Tribunal under the Privacy Act 1993 if:

• There has been an investigation by the Privacy Commissioner; or
• There has been an unsuccessful attempt at conciliation.

If a claim that is filed does not meet these criteria (set out in ss 82 – 83), the Tribunal cannot consider the case. If a claim is outside the Tribunal’s jurisdiction, it must be struck out under s 115A(1) Human Rights Act 1993.

See Re Tai Rakena (Rejection of Statement of Claim) [2017] NZHRRT 27 at [22]-[26] for a further discussion of this issue.

[1] Watson v Employers Mutual Limited (Strike-Out Application) [2020] NZHRRT 10]. 

Back

Source:

There’s a rarely used part of the Privacy Act which agencies can apply to use, if they want to use personal information to tell affected individuals of an entitlement or to redress a wrong.

Under section 54, the Privacy Commissioner may authorise the collection, use or disclosure of personal information under circumstances which would otherwise breach the information privacy principles in the Act – if there is a clear benefit to the individual concerned.

Several years ago, a government agency investigated an anomaly in one of its practices in dealing with its clients. It realised that the practice was not permitted by the agency’s statute or by its policy and procedures.

The agency’s investigation found that several dozen people might have been affected by this unlawful practice. The agency decided the right thing to do was to redress this wrong with these former clients. It wanted to contact the affected individuals to offer monetary compensation for any distress caused. It also wanted to apologise individually for what happened, and to provide access to counselling services.

The agency was able to contact over half the individuals affected but had exhausted the contact details it held for the remaining people. The agency wanted to share some basic details about those people with a small number of other government agencies that it considered were most likely to hold more up to date contact details.

Principle 11

Principle 11 of the Privacy Act puts limits on the disclosure of personal information by agencies. Broadly speaking, an agency should not disclose personal information – unless one of the exceptions in the Act applies.

The agency concluded that none of the exceptions applied that would allow it to disclose the details of the individuals it was trying to locate, or for the other agencies to respond to the request for contact information. It sought the Privacy Commissioner’s special authorisation under section 54 of the Act.

Section 54

The agency made an application to the Commissioner under section 54(1)(b) of the Act, seeking authorisation to disclose the name and date of birth of the remaining individuals to a small number of other government agencies, and for those agencies to respond with any contact details they held for those individuals.

Section 54 acts as a safety valve, giving the Commissioner discretion to authorise agencies to collect, use and disclose information in exceptional but justifiable circumstances where the privacy principles exceptions do not afford enough flexibility.

Section 54(1)(b) says the Commissioner may authorise an agency to collect, use or disclose personal information if the Commissioner is satisfied, in the special circumstances, that the collection, use or disclosure involves a clear benefit to the individual concerned that outweighs any interference with the privacy of the individual.

The sole purpose that the agency sought the authorisation was to enable it to contact the individuals to assess whether they had been affected by this unlawful action. If they were subjected to the unlawful practice, the agency intended to offer financial compensation, an apology and free counselling services.

Commissioner’s authorisation

The Commissioner was satisfied the disclosure of information about the individuals offered a clear benefit to them and that this outweighed any likely interference with their individual privacy.

The Commissioner approved the application subject to a raft of conditions, including that it was a one-off use to be completed within six months, and that the information must be destroyed on completion of matching the data with the other agencies.

As an added precaution, because the context of this disclosure was extremely sensitive, the agency was only allowed to describe to the other agencies in broad terms the purpose for seeking contact details for the named individuals. The personal information relevant to this process would be held separately from the agency’s main administrative system and access restricted to only those staff dealing with the issue.

Finally, contact with the individuals must be made by phone, or in person by a senior official visiting an address – no letters must be sent. This was to reduce the possibility of an accidental data breach.

On completion of the exercise the agency has successfully contacted over half of the individuals to offer compensation and support. This was an excellent result for the agency and the contacted individuals. The result demonstrated the value of section 54 as an important safety valve to allow the Privacy Commissioner the discretion to support appropriate sharing of information in exceptional circumstances.

Image credit: Monarch butterfly on purple cornflower via Flickr (Public domain).

IPP11 – disclosure, IPP4 – manner of collection

Back