NZ Engine

Source:

An Auckland Powershop customer did the right thing by checking her credit report after the company said she was in arrears, even though she was up to date with her payments.

The news story this week demonstrates the impact wrong repayment information can have on an individual, particularly when it shows up on their credit report. It also highlights the importance of regularly checking your credit report to ensure the information on it is correct.

Payment arrears

In the story, the Auckland woman was upset to find out her credit report said she had been behind on her Powershop bill repayments for an 18-month period, despite having paid on time each time by direct debit.

Powershop used a system that allowed customers to buy “Powerpack” bundles of electricity when it suited them. It allowed them to have the option to adjust the due date of their payments within a 10-day period. But using this option counted against the Auckland customer by showing her as being behind on her payments, even though she was paying each bill by her adjusted due date.

“If their system is reporting aged debt when it is not aged debt at all, that is a serious issue,” she told Stuff.

Powershop has responded by changing its systems so that customers taking up the offer of payment flexibility are not impacted.

Credit Reporting Privacy Code

By checking her credit report, the customer was exercising a right she has under the Credit Reporting Privacy Code issued by the Privacy Commissioner. Among other things, the Code gives consumers the right to check information that is being collected about their credit worthiness – and their credit score which the credit reporter assigns as a result of that information.

We’ve written before about how the impact of an erroneous credit report on individuals can be extremely distressing. You can read about a significant case here.

As a consumer, it’s important to know what you can do to protect yourself and to ensure that businesses and credit reporters are sharing credit information about you that is correct. Here’s what you need to know:

• Regularly check your credit report, especially if you’re about to seek credit: Your credit information is changing all the time and could have a big impact on you. It’s free to check with a credit reporter so do it regularly.
• You have the right to seek correction of credit information: Inaccurate information could affect your ability to get credit. You can ask credit reporters to correct your information, and they’ll work with credit providers and others to assist you, so contact them and get it sorted before you seek credit. 
• If you believe you’re at risk of identity fraud, ask credit reporters to ‘freeze’ your credit information until the risk has passed: You can ask credit reporters to suppress (‘freeze’) your credit report if you believe you’re at risk of fraud. This will help stop new credit accounts being opened in your name. 

You can find out more on our website, such as:

Image credit: Credit reporting via Marshall Freeman.

 

Credit reporting

Back

Source:

The Human Rights Review Tribunal [2020 HRRT 16] awarded $50,000 to an ACC claimant after it was found to have breached the Privacy Act by destroying his file.

In its decision, the Tribunal said ACC breached the information privacy principles 5 and 6 of the Act. Principle 5 governs the way personal information is stored by an agency. Principle 6 gives individuals the right to access information about themselves.

Historic back injuries

The claimant worked in the boat building industry. He suffered injuries to his back in 1982, 1985 and 2002. As a result of these injuries, he was from time to time in dispute with ACC over issues including cover, payments and whether his vocational independence had been properly assessed.

In 2006, he decided he needed professional advice about his ACC entitlements and hired a lawyer specialising in ACC claims to check whether he had received his proper entitlements and back-dated employment-related compensation.

The lawyer advised him that he could be entitled to more compensation as his claim would go back to the 1980s when he suffered his first injuries.

The lawyer requested a copy of his client’s 1985 file from ACC but was told by the agency that it had been destroyed and no information from it could be provided. But in 2015, the claimant learned by chance from an ACC officer that information about his weekly compensation payments for the 1985 injury were still held by the agency. The records showed that he had received minimum earnings-related compensation on his 1985 claim.

He then made a complaint to the Privacy Commissioner because ACC had not fulfilled his principle 6 request for his original file, and it had not given him his earnings-related compensation record.

After an investigation by the Office of the Privacy Commissioner, the claimant took his case to the Human Rights Review Tribunal.

Principle 5

Principle 5 of the Privacy Act says an agency that holds personal information shall ensure that the information is protected from loss or misuse.

ACC said the 1985 file was destroyed in 2001 or 2002 in line with its document retention policy of the time.

ACC argued that principle 5 applied only to the unintentional destruction files and that there was no breach of the Act.

The Tribunal disagreed. It said restricting principle 5 to accidental, unintended or fortuitous loss was too narrow a reading. Principle 5 was intended to also protect against destruction that was well-motivated but intentional. 

It said ACC must be the default primary holder of relevant information because claimants cannot reasonably be expected to retain medical reports and claim and payment histories over the length of their lives.   

The Tribunal said the documents in the claimant’s 1985 physical file would have included the claim for cover, medical reports obtained by ACC, medical certificates certifying him as unfit for work, calculations of his earnings-related compensation, any decision letters, file notes on conversations with the claimant and so on. This information would be essential to both the claimant and ACC over his lifetime, given the complexity of his claim.

The Tribunal reviewed medical evidence that showed the 1982 and 1985 accidents had led to progressive degeneration in his ability to live and work. But without the file, it was impossible to tell if he had received his correct entitlements.  

The Tribunal found there had been a breach of principle 5 because when ACC destroyed the physical file, the purpose for which the information had been collected had not been spent. By intentionally destroying the file without taking into account the progressive degenerative changes being experienced by the claimant and the likelihood that both he and ACC would need to have continued reference to the contents of the file meant the information was not protected by security safeguards which were reasonable to expect in the circumstances.

Principle 6

Principle 6 of the Act says where an agency holds personal information in such a way that it can be readily retrieved, an individual is entitled to have access to that information.

ACC admitted to the Tribunal that it had breached principle 6. The weekly compensation payments on the 1985 claim were in its system and should have been provided back in 2006.

The agency apologised to the claimant, saying it was human error. It offered to pay him $15,000 for humiliation, loss of dignity and injury to his feelings, and $5000 as a contribution towards the cost of his legal advice.

Remedy

The Tribunal concluded ACC had breached principles 5 and 6 of the Privacy Act and interfered with the claimant’s privacy.

It was satisfied the principle 5 breach had caused him harm as listed in section 66(1)(b)(i)(ii) and (iii) of the Act because it:

• Has caused, or may cause, loss, detriment, damage, or injury to that individual; or
• Has adversely affected, or may adversely affect, the rights, benefits, privileges, obligations, or interests of that individual; or
• Has resulted in, or may result in, significant humiliation, significant loss of dignity, or significant injury to the feelings of that individual.

ACC accepted it had breached principle 6 and offered other mitigating factors:

• It had issued an apology to the claimant
• It was still open to him seeking legal advice on and to make an application for backdated weekly compensation
• Since becoming aware of the breach, ACC had taken steps to minimise further harm to him – arranging for and funding formal mediation and funding his legal representation in that mediation.

The Tribunal said these factors did not sufficiently account for the extraordinarily long time it took ACC to accept the principle 6 breach. The information was requested in 2006, but it took ACC until 2018 to acknowledge it had the information. The belated acknowledgement of the breach by ACC therefore carried little weight.

On the issue of the apology, the Tribunal referred to its 2017 decision Williams v ACC [NZHRRT 26] which said: “The apology cannot erase the humiliation, loss of dignity or injury to feelings caused by the interference with privacy. Nor is it a get out of jail free card.”

The Tribunal noted the delay between the failure to comply with principle 6 and the apology was 12 years. “The injury to the feelings of the claimant have in no way been ameliorated. Too much has gone on for too long for the apologies to have a measurable consequence in the context of the assessment of remedies.”

It also noted the matter of further action by him would be at a high personal cost after he gave evidence he was emotionally and physically drained from his 13-year struggle. He told the Tribunal: “I have lived in my past with too many unpleasant memories for such a long time that I now want to move on.”

Under section 85 of the Act, the Tribunal has the power to grant one or more of the remedies, including damages. In deciding what remedies to grant, it needed to consider ACC’s conduct.

The Tribunal concluded there were no mitigating factors in favour of ACC.

Damages

The Tribunal awarded damages of $40,000 against ACC under sections 85(1)(c) and 88(1)(c) for injury to his feelings.

It awarded damages of $5,000 against ACC under sections 85(1)(c) and 88(1)(b) of the Privacy Act for the loss of benefit that he might reasonably have been expected to obtain but for the interference.

It also awarded $5,000 against ACC under sections 85(1)(d) and (e) as a contribution towards the cost of his legal advice on his entitlement to backdated weekly compensation on his 1985 claim.

Image credit: Chess pieces via Chess.com.

Human Rights Review Tribunal

Back

Source:

A former nurse who waited five years to lodge a privacy complaint with the Privacy Commissioner had her request for judgement rejected by the Human Rights Review Tribunal (HRRT) in March 2020.[1]

Ms Watson was employed by Capital and Coast District Health Board (CCDHB) as a nurse. In May 2012, CCDHB requested Ms Watson’s medical information from Catalyst NZ Ltd (Catalyst), which was managing ACC claims for CCDHB at the time.

Ms Watson did not agree to Catalyst releasing her medical information to CCDHB, but they nonetheless passed it on. She became aware of this fact in March 2013 and, five years later in March 2018, she complained to the Privacy Commissioner.

Shortly after receiving the complaint we advised Ms Watson that we would not investigate it, due to the time that had elapsed since Ms Watson became aware of the breach.

Refusing to take action on a complaint

Under section 71(1)(a) of the Privacy Act 1993, the Commissioner has the discretion to refuse to take action on a complaint if, in the Commissioner’s opinion, the length of time that has passed since a complaint arose means investigating is no longer practicable or desirable.

While the Commissioner has the discretion to investigate complaints many years after they have occurred, we generally refrain from doing so for several reasons. Firstly, when years have elapsed since an incident that triggers a complaint, it becomes difficult for our investigators to collect evidence to determine the facts. It is also unfair to the respondents of complaints to raise matters and ask them to respond to events that happened years ago.

The Privacy Bill currently before Parliament contains a clause (cl 80(1)(e)) that specifically gives the Privacy Commissioner discretion to decline to investigate a complaint where the complainant has known about the matter for more than 12 months.

Following our decision, Ms Watson took her case to the HRRT.

Catalyst, now operating as Employers Mutual Limited (EML), applied to the HRRT to strike-out her claim on the basis that the Tribunal did not have jurisdiction, because the Privacy Commissioner had not investigated the matter (a requirement of the statute).

Tribunal hearing

Ms Watson maintained that even though her claim was not investigated by the Privacy Commissioner, it should still be within the Tribunal’s jurisdiction as it was a matter that had been raised with the Privacy Commissioner; this should be enough to meet the jurisdictional threshold.  

The Tribunal rejected this argument and struck out Ms Watson’s claim. They noted an aggrieved individual can only bring a claim in the Tribunal under the Privacy Act 1993 if:

• There has been an investigation by the Privacy Commissioner; or
• There has been an unsuccessful attempt at conciliation.

If a claim that is filed does not meet these criteria (set out in ss 82 – 83), the Tribunal cannot consider the case. If a claim is outside the Tribunal’s jurisdiction, it must be struck out under s 115A(1) Human Rights Act 1993.

See Re Tai Rakena (Rejection of Statement of Claim) [2017] NZHRRT 27 at [22]-[26] for a further discussion of this issue.

[1] Watson v Employers Mutual Limited (Strike-Out Application) [2020] NZHRRT 10]. 

Back

Source:

There’s a rarely used part of the Privacy Act which agencies can apply to use, if they want to use personal information to tell affected individuals of an entitlement or to redress a wrong.

Under section 54, the Privacy Commissioner may authorise the collection, use or disclosure of personal information under circumstances which would otherwise breach the information privacy principles in the Act – if there is a clear benefit to the individual concerned.

Several years ago, a government agency investigated an anomaly in one of its practices in dealing with its clients. It realised that the practice was not permitted by the agency’s statute or by its policy and procedures.

The agency’s investigation found that several dozen people might have been affected by this unlawful practice. The agency decided the right thing to do was to redress this wrong with these former clients. It wanted to contact the affected individuals to offer monetary compensation for any distress caused. It also wanted to apologise individually for what happened, and to provide access to counselling services.

The agency was able to contact over half the individuals affected but had exhausted the contact details it held for the remaining people. The agency wanted to share some basic details about those people with a small number of other government agencies that it considered were most likely to hold more up to date contact details.

Principle 11

Principle 11 of the Privacy Act puts limits on the disclosure of personal information by agencies. Broadly speaking, an agency should not disclose personal information – unless one of the exceptions in the Act applies.

The agency concluded that none of the exceptions applied that would allow it to disclose the details of the individuals it was trying to locate, or for the other agencies to respond to the request for contact information. It sought the Privacy Commissioner’s special authorisation under section 54 of the Act.

Section 54

The agency made an application to the Commissioner under section 54(1)(b) of the Act, seeking authorisation to disclose the name and date of birth of the remaining individuals to a small number of other government agencies, and for those agencies to respond with any contact details they held for those individuals.

Section 54 acts as a safety valve, giving the Commissioner discretion to authorise agencies to collect, use and disclose information in exceptional but justifiable circumstances where the privacy principles exceptions do not afford enough flexibility.

Section 54(1)(b) says the Commissioner may authorise an agency to collect, use or disclose personal information if the Commissioner is satisfied, in the special circumstances, that the collection, use or disclosure involves a clear benefit to the individual concerned that outweighs any interference with the privacy of the individual.

The sole purpose that the agency sought the authorisation was to enable it to contact the individuals to assess whether they had been affected by this unlawful action. If they were subjected to the unlawful practice, the agency intended to offer financial compensation, an apology and free counselling services.

Commissioner’s authorisation

The Commissioner was satisfied the disclosure of information about the individuals offered a clear benefit to them and that this outweighed any likely interference with their individual privacy.

The Commissioner approved the application subject to a raft of conditions, including that it was a one-off use to be completed within six months, and that the information must be destroyed on completion of matching the data with the other agencies.

As an added precaution, because the context of this disclosure was extremely sensitive, the agency was only allowed to describe to the other agencies in broad terms the purpose for seeking contact details for the named individuals. The personal information relevant to this process would be held separately from the agency’s main administrative system and access restricted to only those staff dealing with the issue.

Finally, contact with the individuals must be made by phone, or in person by a senior official visiting an address – no letters must be sent. This was to reduce the possibility of an accidental data breach.

On completion of the exercise the agency has successfully contacted over half of the individuals to offer compensation and support. This was an excellent result for the agency and the contacted individuals. The result demonstrated the value of section 54 as an important safety valve to allow the Privacy Commissioner the discretion to support appropriate sharing of information in exceptional circumstances.

Image credit: Monarch butterfly on purple cornflower via Flickr (Public domain).

IPP11 – disclosure, IPP4 – manner of collection

Back