Privacy Law and Policy Reporter
In the PLPR Special Issue on the review of the NZ Privacy Act 1993 (the Act), Paul Roth argued that ‘the increasing number of complaints that seemingly threaten to swamp the Privacy Commissioner’s office ... [appears] to be the major problem in relation to the complaints jurisdiction’ (‘Privacy Act Review: Access and Complaints’ 5 PLPR 115). In this reply, the Manager of Investigations for the New Zealand Privacy Commissioner takes issue with some of the points raised by Paul Roth (Editor).
Paul Roth has noted that the Privacy Commissioner has ‘assorted functions as listed in s 13 of the Act’ but that his complaints jurisdiction ‘is not specifically referred to at all, but falls under the final omnibus function of performing such functions as are conferred under the Act’. This may give a reader the impression that the investigation of complaints is a minor part of the Commissioner’s functions, but such an impression would be misleading. In fact s 13(1)(u) requires the Commissioner:
to exercise and perform such other functions, powers, and duties as are conferred or imposed on the Commissioner by or under the Act or any other enactment.
Part VIII of the Act then sets out the complaints function in some 24 sections, including s 69 which provides in part that the functions of the Commissioner under Pt VIII shall be to investigate any action that is or appears to be an interference with the privacy of an individual.
In my view, the complaints function is one of the most important functions of the Commissioner and increasing experience with individual complaints only reinforces that view.
In his article Mr Roth refers to the ‘overall benefit to the public weal’ and concludes that the ‘most valuable work’ of the Commissioner has been in ‘vetting proposed new legislation and in commenting publicly on the significant privacy issues of the day’.
It is often the complaints function of the office which alerts the Privacy Commissioner to the significant privacy issues of the day, as it is those practices and policies impacting on individuals which generate complaints. As an example — a large government agency introduced a new form which it sent to health professionals treating the agency’s clients, requesting that health professionals forward the entire medical file of the client to assist the agency involved in assessing claims made to it. Soon after the new form was introduced the Commissioner received complaints from health agencies, clients of the government agency and MPs representing those clients, asking for the Commissioner’s view of the form. The office was able to liaise with the government agency concerned who admitted that, for their purpose of assessing claims, an individual’s entire medical file was not required. The form was quickly amended to request that the health professional concerned forward only that information which was relevant to the claim. Given the large number of clients involved, the ability of the Commissioner to react quickly to the complaints and to obtain a resolution was certainly of benefit to the public.
There are many other examples of individual complaints which, on the face of it, are ‘of a relatively minor nature’ but which indicate problems in the policies or practices of the agency concerned. Therefore even one complaint can have a positive outcome for all those dealing with the agency, as the mere fact that a complaint has been made to the Commissioner causes some agencies to amend their ways before the investigation has concluded. For example, five years after the introduction of the Act, complaints are still being received about individual general practitioners refusing their patients access to their files as ‘the information belongs to me’. It is often possible to contact these GPs, and to resolve the matter, not only for that particular patient but for those in the future who may exercise their rights of access under Rule 6 of the Health Information Privacy Code.
Mr Roth also refers to the fact that the privacy issue which is the subject of the complaint is sometimes only a small part of a wider issue and may have its genesis in ‘relationships gone wrong’. This is true; however, the privacy issues raised are often of importance. For example, individuals attempting to obtain current addresses for their former spouses can test the security safeguards of the most privacy sensitive agencies and it is by individual complaints that the weak points can be identified. Disgruntled employees contemplating personal grievance actions have alerted this office to undesirable human resource information practices in large agencies. The list goes on.
Mr Roth suggests the Act should be amended to subject ‘complaints to a more strict winnowing process’. The Act already allows for this. Complaints are assessed as soon as they arrive at the office. Sometimes the complaint does not, on the face of it, raise an issue that is or appears to be an interference with privacy (as required by s 69 of the Act). The complainant is advised of this and the relevant provisions of the Act are explained. Should they not be able to produce further relevant information, the matter goes no further. On other occasions previous opinions of the Commissioner are provided to the complainant in an effort to show that, even if an investigation is commenced, their preferred outcome is unlikely. Many complainants decide to go no further. It is also sometimes possible to contact the respondent, explain the situation and make suggestions to settle the matter without an investigation commencing.
The Commissioner also has the discretion under s 71(2) to discontinue an investigation if it appears to the Commissioner that, having regard to all the circumstances of the case, any further action is unnecessary or inappropriate. It is extremely difficult to ‘write a complaint off’ without at least notifying the respondent and asking for their explanation of the event. Given the limited resources of the office, where it appears that the respondent agency has either done nothing wrong or, if it has breached one of the privacy principles, it has made reasonable attempts to put things right with the complainant, the Commissioner is not slow in using his discretion, especially if he considers that the complainant is attempting to use the Act as a means of punishing the respondent for some other matter. This quickly resolves the ‘relationships gone wrong’ complaints but allows any important privacy issues to be extracted from them.
The vetting of proposed new legislation also benefits from the ‘coal face’ input which an active complaint jurisdiction brings. The growing use by government agencies of information matching programmes and the vexed question of how public registers may be used are often brought into clearer view by complaints outlining real individuals, real situations and real adverse outcomes.
The length of the queue of complaints waiting to be investigated is of concern, as it detracts from the right of individuals to have their complaints investigated in an timely manner, but detracting from the individual’s right to make a complaint by creating barriers of ‘seriousness’ is, in my view, a short sighted solution.
Deborah Marshall is Manager of Investigations at the office of the New Zealand Privacy Commissioner.