Category: MIL-OSI

Source:

In July 2017, our office made two short videos featuring the Privacy Commissioner promoting child safety and describing what people can do if they think a child is at risk. It is a crucial feature of the Privacy Act that people can disclose personal information to prevent or lessen a serious risk or threat to another individual. This is especially the case with children because they are among the most vulnerable members of our community and society.

We were reminded recently by a child protection agency that the short message, although three years old, is continuing to play an important role for them in emphasising that message to people working with children and young people.

Willow Duffy is General Manager of the Safeguarding Children Initiative. It was at her request in 2017 that Privacy Commissioner John Edwards, contributed a video message to dispel some of the misconceptions about sharing personal information.

Willow Duffy says the context behind the videos was the Safeguarding Children Initiative’s research findings that fear of breaching the Privacy Act was one of the main reasons that people didn’t share information about a child who might be at risk and pass on their concerns to social agencies that can do something about it.

“Despite us delivering the messages ourselves, people still were fearful of breaking the privacy legislation. John was going to be in Nelson, and we asked if we could meet with him. During the meeting, I spoke to John about him filming a short video so that our learners could hear the message from the ‘horse’s mouth’.

“Literally, within two weeks, the videos of John popped into my inbox. It has helped people feel confident about sharing information to protect children and made a big difference. The videos of John are in our three eLearning courses, webinars and we use them in our face-to-face training.”

Willow is one of the three Nelson community nurses who founded the Safeguarding Children Initiative, a registered charity that provides child protection training and support to help people and organisations that work with at-risk children. You can find out more about it here. And watch the Commissioner’s videos below!

Back

Source:

We published a case note in March 2019 about a law firm that demanded $19,000 from a former client for the cost of providing the client with his information. After investigating the complaint, the Privacy Commissioner concluded the cost of a USB stick was a reasonable cost, not the $19,000 charge. We wrote about that case here.

The client subsequently took the case to the Human Rights Review Tribunal, which issued its decision last month. You can read the Tribunal’s full decision( Patel v Dean [2020] NZHRRT 37).

In reviewing the case, the Tribunal awarded the former client $20,000 for the law firm’s intransigence in giving him his information.

Background

The case between Mr Patel, and Mr Dean began when Mr Dean provided legal services for Mr Patel and the Vishnu Trust (of which Mr Patel was a trustee) from January 2013 to March 2014.

There arose a dispute between the two over legal fees. Mr Patel considered Mr Dean had overcharged him and the Trust. Mr Dean denied this and in November 2015, he assigned the right to recover the claimed fees to Rajjo Nominees Ltd. Rajjo was a company closely associated with Mr Dean. Mr Dean’s legal executive (who was also his de facto partner) was its sole director and shareholder.

Rajjo placed caveats over 11 of the properties owned by Mr Patel and the Vishnu Trust. The caveats immediately inhibited the use of these properties. In March 2017, Rajjo filed proceedings in the District Court to recover the debt.

In February 2018, Mr Patel made an urgent request to Mr Dean for a copy of his file. He followed this up with two further requests. He received no response, so he complained to our office.

In the same month, Rajjo obtained a sale order from the High Court for the sale of ten of Mr Patel’s and the Trust’s properties to obtain payment of the debt of $111,039.

The trustees of the Vishnu Trust paid the debt in March 2018 to avoid the sale of any properties. Despite the payment, Mr Dean would not agree to removing the caveats on the properties.

Mr Dean replied to Mr Patel’s request for his file in March and said that he would charge him $19,175 for the release of the documents.

In the meantime, Mr Patel applied to the High Court to set aside the judgment debt. The High Court allowed Mr Patel’s application to be stayed to enable him to obtain the documents from Mr Dean.

In September 2018, Mr Dean said the file was available to be picked up and if it wasn’t, it would be destroyed.

In October 2018, the High Court ordered the removal of the caveats on the properties owned by Mr Patel and the Trust. The next day, Mr Dean delivered the file to Mr Patel. But Mr Patel considered that some documents were missing, including records of over 60 phone messages, invoices and potentially other records.

The Tribunal

Mr Patel took his Privacy Act complaint to the Human Rights Review Tribunal because he wanted a full copy of the file, a declaration of an interference with his privacy, and damages of up to $350,000.

Principle 6

The Privacy Act gives individuals the right to request their information under information privacy principle 6. An agency must respond to a request for personal information within 20 working days (section 40(1)). The information does not necessarily have to be provided within the 20 working days, but a decision must be made whether to grant the request, in what manner, and for what charge, if any.

Mr Patel first requested his file on 8 February 2018 and Mr Dean first responded to that request on 29 March 2018. Mr Dean accepted he had not complied with the Act’s timeframe of 20 working days. He blamed a period of ill health for the failure to respond in time and claimed Mr Patel already had the documents in his own records.

The Tribunal considered whether there had been an interference with Mr Patel’s privacy, applying a two-stage test. Firstly, Mr Dean’s failure to respond within the time limit was deemed by section 66(3) of the Act to be a refusal to make information available.

But secondly, could Mr Dean rely on the exceptions in the Privacy Act for his refusal to respond in time? The Tribunal noted ill health is neither a ground for asking for more time or a defence to not giving Mr Patel his information. Whether or not Mr Patel already had the file was irrelevant. If someone asks for their information, they are entitled to receive their file.

The Tribunal determined Mr Dean had interfered with Mr Patel’s privacy.   

Interference with privacy

To award damages, the Tribunal must be satisfied the interference with privacy contributed to or was a material cause of a loss of benefit to Mr Patel.

Mr Patel said the refusal to give him his file denied him the opportunity to have his legal fees independently assessed and to win his court case against Mr Dean in the dispute over the debt.

Mr Patel gave evidence a lawyer had advised him that they would require the full file to independently assess the reasonableness of Mr Dean’s fees and any missing documents would undermine this assessment.

The Tribunal accepted this evidence. The file was relevant and necessary in the court application to set aside the debt. The Tribunal also accepted that if Mr Patel had the file, it might have affected the High Court proceedings. Mr Dean’s failure to provide the file was a material factor in the loss of a benefit to Mr Patel. Mr Patel was entitled to compensation for this loss.

Humiliation and injury to feelings

Mr Patel also claimed damages for humiliation, loss of dignity and injury to feelings.

The Tribunal said it heard clear evidence that Mr Patel suffered immense stress, anxiety and all-consuming worry. The fact that Mr Dean was his former lawyer and that he and Rajjo continued to pursue legal action against Mr Patel, while refusing to provide his file, left Mr Patel feeling “helpless and hopeless”.

He was scared he was going to lose his whole property portfolio once Mr Dean advertised the sale of the properties. This caused him immense upset as it was important the properties provided security for his family after his son died.

Mr Patel also provided medical evidence of the ill-health suffered by him and his wife. Although the stress did not cause their health conditions, they worsened them.

The Tribunal found Mr Patel’s evidence to be credible, and Mr Dean presented no evidence to dispute this.

Mitigating factors

It said there were no mitigating factors in Mr Dean’s conduct. The Tribunal noted he had ignored subsequent requests for the file and did not accept an offer by the NZ Law Society to facilitate his compliance. The value of the sale order on the properties was about $12 million, contrasting sharply with the debt of $111,039. In addition, after the debt was paid, Mr Dean did not agree to remove the caveats on the property. The publicly advertised sale order was humiliating because there was greater public awareness of Mr Patel’s business affairs.

The Tribunal concluded that if Mr Patel had received his file and been successful in setting aside the judgement against him over the debt, then Mr Dean and Rajjo would have been unable to obtain a sale order on the properties. This would have reduced the publicity of Mr Patel’s predicament and his humiliation.

Damages

The Tribunal awarded Mr Patel $5,000 for a loss of benefit for the interference with his privacy and $15,000 for the humiliation and injury to feelings he experienced.

It also ordered Mr Dean to provide a full and complete response to Mr Patel’s original request for his file.

Image credit: NZ Coat of Arms via Wikimedia Commons.

Human Rights Review Tribunal

Back

Source:

We’ll be saying it for the rest of this year because we want everyone to be aware and ready for it when it happens: The new Privacy Act 2020 is coming into effect on 1 December 2020.

As an additional resource to help organisations and businesses understand the changes, we’ve created a detailed table comparing the Privacy Act 2020 with the Privacy Act 1993.

The table is a section-by-section breakdown of both Acts, showing the changes at a granular level. While it may be too much information for a small business owner or the committee of a sports club, it may be helpful to those of you who give legal advice to organisations, and seek to know the changes in more detail.

We’ve created the table because navigating from the old Privacy Act to the new will take some adjustment for organisations, and for our office. You can find the table of comparisons here.

We also have a range of other resources to help you understand these changes before they come into effect, including an e-learning module, a podcast series, videos and blog posts. You can find them here.

We will also soon have a tool called NotifyUs to make it easy for organisations to notify our office of serious privacy breaches. There will be more on that soon.

Back

Source:

International transfers of personal data are under the spotlight again following a recent decision of the European Court of Justice that reviewed the legal means of transferring personal data from the EU to the United States: Data Protection Commissioner v Facebook Ireland and Max Schrems (Case C-311/18; 16 July 2020).

The Schrems litigation has again sent international shock waves in striking down a key EU/US arrangement designed to facilitate data flows known as the Privacy Shield.

Schrems I 2015

To recap, the first Schrems decision of the European Court (2015) was concerned with a complaint by the Austrian privacy advocate Max Schrems about Facebook transferring his personal data to the United States under EU law, relying on the Safe Harbour arrangement between the EU and the US in place at the time.

Mr Schrems argued that the Edward Snowden revelations about United States intelligence agencies indicated a lack of protection against surveillance under US law. In this case, the CJEU invalidated the Safe Harbour arrangement due to a lack of adequate safeguards required under EU law.

More information about the first Schrems decision is available here on our blog.

Following the first Schrems decision, the EU and US negotiated a replacement arrangement in 2016, known as the Privacy Shield. This was developed as a new recognised basis for data flows to meet the requirements of EU law.

Schrems II 2020

The recent Schrems II decision is concerned with the validity of the Privacy Shield. The European Court has now declared this EU/US arrangement is also invalid.

US surveillance powers were again a key issue. The Court considered that certain programmes enabling access by US authorities to personal data transferred from the EU for national security purposes create limits on the protection of that personal data. These limits mean there is a lack of protection that is “essentially equivalent” to EU law, and that data subjects do not have actionable rights before the courts against US authorities.

Standard contractual clauses

The Court in Schrems II also examined the validity of standard contractual clauses as a means of transferring personal data. Transfers on this basis have not been invalidated, but the Court emphasised the obligations on the parties to verify whether there are impediments to complying with these provisions and, if so, the necessity for considering supplementary measures.

More information about Schrems II is available from the European Data Protection Board. 

Does the decision affect personal data transfers between the EU and New Zealand?

Not directly, because transfers of personal data from the EU to New Zealand are conducted on the basis of the adequacy decision in place (article 45 of the EU General Data Protection Regulation).

The European Commission formally ruled in December 2012 that New Zealand’s privacy law provided an ‘adequate level’ of privacy protection to meet European standards.

This adequacy status means that personal data information can legally be sent here from Europe for processing without special additional measures being taken by the European companies.

But the influence of this decision on international data transfers more generally is likely to be significant and we will be monitoring developments in this area and its impact on international consensus building. The Court’s decision is a significant development in the context of international data transfers and is likely to have a lasting impact on the international framework for data flows.

Model contract clauses in New Zealand

We will also be considering the decision in Schrems II as we develop model contract clauses under the new Privacy Act 2020. Now that the new Privacy Act 2020 has been passed (coming into force on 1 December 2020) New Zealand has new limits on international transfers of personal information (new IPP 12).

One way to comply with the new IPP 12 will be by adopting model contract clauses to safeguard personal information when disclosing it to a foreign counterpart or business. 

We have commissioned Chapman Tripp to work with us to develop a set of standard model contractual clauses that will be available free of charge to all businesses needing to transfer personal information to parties in other jurisdictions.

Image credit: Laptop with European Union logo via Norton Rose Fulbright

International, General Data Protection Regulation (GDPR)

Back

Source:

When is information your personal information? Does it include references to other people that just happen to be on a file with your name on it? These are the questions that the Human Rights Review Tribunal, and High Court of New Zealand have considered in the recent decisions in Taylor v Chief Executive of the Department of Corrections ([2018] NZHRRT 35 and Taylor v Chief Executive of the Department of Corrections [2020] NZHC 383.

We have received questions about the impact of these decisions, including whether they change the definition of ‘personal information’ under the Privacy Act. We have also been asked what the decision means for agencies dealing with principle 6 access requests where the information relating to an individual contains details of third parties, especially staff members.  

The High Court decision in Taylor noted that Mr Taylor’s personal information appeared on the same pages as details of Corrections officers. It held that the names of Corrections staff appearing in Mr Taylor’s file were not personal information about Mr Taylor and did not need to be disclosed under the Privacy Act because it was essentially administrative information. The Court said because of that finding, it did not need to reach a view about whether any of the withholding grounds applied.

Was it “mixed information”?

The decision also clarified when information might be considered “mixed information” (information about the requester and another party or parties). In this case, the information was not “mixed information” – and information about Corrections staff did not automatically become Mr Taylor’s information because it appeared on the same page as information about him. This was because the information was not intertwined. It was possible to distinguish and redact details about Corrections staff from the personal information about Mr Taylor without making the substantive content of the documents unintelligible.

Context is important

What the decision in the High Court does not do is represent a significant change to the definition of personal information or say that staff details can never be personal information about a requester. Rather, it points to factors for agencies to consider when cases involve information about the requester and other individuals. The basis for the appearance of staff names on a file needs to be assessed, and that the context of the interaction will help agencies to make this decision.

In other situations, the Court said, information can clearly be about more than one person, such as when there has been a comparison between the complainant and other individuals, or the name of an informant who had provided information about the complainant to a law enforcement or decision-making body.

Applying the definition of ‘personal information’ in light of Taylor

This decision highlights that the context is very important for an agency dealing with personal information:

“ultimately in this case… what is Mr Taylor’s personal information comes down to an examination of the particular information in the particular context.”

Taylor provides guidance when deciding whether third party information can be the information about a requester and can be treated as “mixed information” about more than one person:

• Is the information “essentially administrative” – does the name of the third party appear in connection with the requester’s information because they were carrying out an administrative function, or for some other reason?
• For example, the name of the person who prints emails in order to respond to an access request is administrative information. But the name of a staff member who browses someone’s file without good reason, and the number of times they accessed the file could be personal information of the person who the file belongs to, because that staff member is not undertaking a purely administrative function in the course of their regular employment. (That information could attract the protection of one of the withholding grounds contained in sections 27-29 of the Act.)
• Do the redactions render the communications unintelligible? Do the redactions remove a name and phone number on a document, or do they remove so many details that the information about the requester no longer makes sense? Information that is so intrinsically intertwined will generally be about both the requester and the third party or parties, as that level of connection will indicate either an interaction between the parties or another nexus which means the information is about them both.

Apply correct withholding grounds

If an agency determines that the names or details of other individuals are not the personal information of the requester, then the agency should not assess or withhold this information under the Privacy Act.

In those circumstances, if the agency is subject to the Official Information Act (OIA) they should consider the request under the OIA. The Ombudsman has released guidance on withholding staff names.

You can find a copy of the High Court decision here.

Image credit: RNZ

IPP6 – access, Human Rights Review Tribunal

Back

Source: CTU

This Thursday 1 May (May Day) the union movement are holding a Nationwide Day of Action to fight back against the Government’s anti-worker agenda.

Thousands of workers from a wide range of industries in both the public and private sectors will be taking action including participating in lunchtime hui, stop work meetings, and strike action, with key events in 12 centres from Whāngarei to Invercargill.

“Every year on May Day workers and their unions around the world celebrate the union movement, our history, and our purpose – to build workers’ power and solidarity,” said NZCTU President Richard Wagstaff.

“This year we are coming together to resist the ongoing assault on workers and unions in Aotearoa New Zealand over the past 18 months. This Government has declared war on working people. They are removing our rights, destroying jobs, and ruining the economy.

“We are sending send a strong message to those in power that we demand a better deal for working people, and an end to the attack on unions. We will also be calling on the Government to deliver pay equity and honour Te Tiriti o Waitangi.

“Workers are sick and tired of having their rights trampled on by this Government, and this Thursday will be out in force to demand change,” said Wagstaff.

Details of nationwide events:

In addition to these main events, health unions have organised events at hospitals focusing on workers’ rights and the public health system. Details of those hui can be found here: https://link.nzctu.org.nz/click/sDAAiSKYLKJS.j2KawNATEPiY.fn2P4wBdbh_/2BOtzy1a/3s/www.psa.org.nz/campaigns/fight-back-together-maranga-ake-2025

Source: Palestine Solidarity Network Aotearoa

The Palestine Solidarity Network Aotearoa is demanding the New Zealand government justify its absence from submitters to the International Court of Justice hearings at the Hague into Israel blocking vital supplies entering Gaza.

The ICJ’s ongoing investigation into Israeli genocide in Gaza is now considering the illegality of Israel cutting off all food, water, fuel, medicine and other essential aid entering Gaza since early March.

Countries submitting include the UK, Spain, Belgium and Malaysia.  New Zealand is not on the list for making a submission.

PSNA Co-Chair Maher Nazzal says the New Zealand government has gone completely silent on Israeli atrocities in Gaza.

“A year ago, the Prime Minister and Foreign Minister were making statements about how Israel must comply with international law.”

“They carefully avoided blaming Israel for doing anything wrong, but they issued strong warnings, such as telling Israel that it should not attack the city of Rafah.”

“Israel then bombed Rafah flat.  The New Zealand response was to go completely silent.

“Israeli ministers are quite open about driving Palestinians out of Gaza, so Israel can build Israeli settlements there.  And they are just as open about using starvation as a weapon.”

“Our government says and does nothing.  Chris Luxon had nothing to say about Gaza when he met British Prime Minister Keir Stamer in London earlier in the month.  Yet Israel is perpetuating the holocaust of the 21^st Century under the noses of both Prime Ministers.”

Maher Nazzal says that it is deeply disappointing that a nation which so proudly invokes its history of standing against apartheid and of championing nuclear disarmament, chooses to not even appear on the sidelines of the ICJ’s legal considerations.

“New Zealand cannot claim to stand for a rules-based international order while selectively avoiding the rules when it comes to Palestine.”

“We want the New Zealand government to urgently explain to the public its absence from the ICJ hearings.  We need it to commit to participating in all future international legal processes to uphold Palestinian rights, and fulfil its ICJ obligations to impose sanctions on Israel to force its withdrawal from the Palestinian Occupied Territory.”

“If even small countries, such as Vanuatu, can commit their meagre resources to go to make a case to the ICJ, then surely our government can at the very least do the same.’

See here for the official list of countries and other organisations submitting to the ICJ

https://icj-cij.org/sites/default/files/case-related/196/196-20250423-pre-01-00-en.pdf

Co-National Chair

Palestine Solidarity Network Aotearoa