Roth, Paul --- "New Zealand's Privacy Act in the courts" [2001] PrivLawPRpr 54; (2001) 8(6) Privacy Law and Policy Reporter 122

---

New Zealand’s Privacy Act in the courts

Paul Roth

Three recent cases decided under New Zealand’s Privacy Act 1993 illustrate the way the jurisdiction is operating, and the types of issues that are being decided within it. The three cases covered information disclosed to police but not to the individual concerned; the meaning of ‘authorisation’ under the Act and problems of proof; and the failed attempts by the Inland Revenue Department to justify inappropriate disclosure.

The cases also illustrate the operation of the appeal mechanisms under the New Zealand Act. Two of the cases below were decided in the Complaints Review Tribunal, which is the first legal forum where cases are decided after they are unable to be resolved by the Privacy Commissioner through his investigative and mediation functions. The third case is one which was taken on appeal to the High Court, and was unsuccessfully sought to be appealed further to the Court of Appeal.

Information disclosed to police but not to individual concerned

In Harris v Selectrix Appliances (Complaints Review Tribunal, Decision No 12/2001, 18 June 2001), the plaintiff alleged that the defendant breached principles 6 (access to personal information) and 11 (limits on disclosure of personal information) of the Privacy Act by failing to grant access to a purchase receipt, and by disclosing the receipt to the Police.

The plaintiff had been interviewed by the Police concerning the purchase price of a television set obtained from the defendant’s shop in 1996. She had difficulty remembering the price and approached the defendant for a copy of the receipt, but the shop was unable to find it because of the great volume of receipts it held. The plaintiff was subsequently charged with an offence. As a result of the discovery process, she obtained the receipt.

The Tribunal found that principle 6 had not been breached. The defendant searched for the information that had been requested, but was unable to locate it because of the volume of receipts that it held. Accordingly, it was not ‘readily retrievable’ in terms of principle 6 when the request was made.

The Tribunal also found that there had been no breach of principle 11 when the defendant disclosed the receipt to the police. The Tribunal held that the situation was covered by the principle 11(e)(i) exception, which provides that personal information may be disclosed when the agency reasonably believes non-compliance is necessary to avoid prejudice to the maintenance of the law by any public sector agency, including the detection, investigation, and prosecution of offences.

In the result, the proceeding was struck out, and in a separate costs decision (Decision No 16/2001), costs of $350 were awarded against the plaintiff.

This case, struck out before the evidence could be tested, raises two points of concern.

First, the conclusion that the information concerned was not ‘readily retrievable’ in terms of principle 6 appeared to be reached too easily when the same information was able to be found and handed over to the police when it was requested by them. A more strict approach to the concept of ready retrievability was taken by the Tribunal in Mitchell v Police Commissioner [1994] NZCRT 3; [1995] NZAR 274; 1 HRNZ 403. The fact that the information was sought by the plaintiff in the context of a criminal investigation into her affairs would seem to reinforce the importance of her request for information. Moreover, that the information could be found in response to a request by the police would seem to raise a serious issue as to how extensive a search was made for the information when the plaintiff requested it in the first instance.

Second, the Tribunal arguably made an assumption in the defendant’s favour by accepting that the principle 11(e)(i) exception would apply in the circumstances. While it might seem reasonable to assume that the defendant believed on reasonable grounds that the information was wanted by the police for their investigations, the Privacy Act provision actually states that the agency must believe on reasonable grounds that ‘non-compliance is necessary’. If the information could be obtained from other sources or through other means (such as a search warrant), or was unlikely to be highly material to the case, then it is questionable whether the defendant could have reasonably believed that non-compliance was necessary. The standard of necessity should be a high one. To take it as given that information can be automatically handed over whenever the police request it is to water down the requirements of the Privacy Act and the protections that citizens were intended to receive under it.

Meaning of ‘authorisation’ and problems of proof

In L v L (Complaints Review Tribunal, Decision No 15/2001, 26 July 2001), the plaintiff alleged that the defendant obstetrician/gynaecologist breached rule 11 (limits on disclosure of health information) of the Health Information Privacy Code 1994 by disclosing health information to the plaintiff’s husband without her authorisation.

The plaintiff had a doctor/patient relationship with the defendant over some eight years, during which time she underwent a number of procedures and operations. In 1993, the plaintiff was considering having a hysterectomy, but the plaintiff’s husband, who desired more children, dissuaded her shortly before the operation. In 1996, the plaintiff again decided to have a hysterectomy, but did not wish to have her husband involved in the decision-making again. About a week before the operation, the plaintiff left a message with the defendant’s nurse confirming her wish to proceed with the operation and requesting that the defendant not discuss the matter with her husband. The plaintiff completed the hospital admission form in the defendant’s rooms, filling out the next of kin details but omitting the part of the form which requested details of the person to be contacted after the operation. The plaintiff maintained that this omission was deliberate. After admission to the hospital, details of the person to be contacted were completed on the hospital admission forms and post-surgery contact list, but the plaintiff maintained that this was not on her instruction. She also claimed that she discussed her wish with the defendant.

In the event, and in accordance with her usual practice, the defendant, who performed the operation on the plaintiff, telephoned the plaintiff’s husband to confirm that the operation had been completed and to advise on the plaintiff’s condition. Later in the day, further emergency surgery was necessary, and the defendant once again telephoned the husband. She advised him of the emergency, and inquired as to whether he wished to visit the plaintiff because she was very ill. He stated that he was unable to visit. Following the emergency procedure, the defendant again contacted the husband and advised him concerning the plaintiff’s condition.

The plaintiff claimed that the defendant’s three phone calls to her husband breached her express request that he not be contacted. The defendant maintained that the plaintiff never made such a request, and that the only requirement was that there was to be no discussion about the operation with the husband beforehand.

The Tribunal was not satisfied, on the balance of probabilities, that there was an express request or direction to the defendant not to disclose any health information at all to the plaintiff’s husband. This was on the basis that the defendant’s usual practice was to contact the plaintiff’s husband after surgery; the plaintiff was aware of this practice; the plaintiff was normally forthright about her instructions; and that if such an instruction had been given, the defendant would have complied with it. Moreover, the documentation completed by hospital staff in respect of the plaintiff on the day in question did not record that no contact was to be made with the plaintiff’s husband. This was taken as corroborating the defendant’s evidence that no instruction as alleged had been given by the plaintiff. The Tribunal therefore preferred the evidence of the defendant to that of the plaintiff on this point.

The Tribunal found that there was likely to have been a miscommunication between the parties. The Tribunal remarked:

Oral communication between individuals subject to recall some time later is a shaky basis for establishing the precise nature of that which was communicated. There is enough known about the psychology of communication and memory to establish that what one person thought they were transmitting is not necessarily what the other participant received. There are all kinds of explanations for this with which we need not now concern ourselves, but suffice it to say that we are wary of accepting, as the basis of an allegation of a breach of the Privacy Act, something that was said and recorded in no other way than by the speaker’s and recipient’s memories. Allegations of breaches of the Privacy Act are serious matters. If they are the subject of proceedings such as these they involve the expenditure of a great deal of time, money and stress for the parties. They are not to be undertaken lightly. If there is dispute about the information (or directions/instructions) at issue and it is not in some recorded form we will continue to experience difficulty accepting allegations of what was said without there being some other corroboration of those statements. (para 15)

The Tribunal went on to cite a passage from its earlier case A and A v G (Decision No 18/99, 13 July 1999), in which it set out its view that ‘personal information’ for the purposes of the Privacy Act ‘carries within it the specific implication that the information the subject of any issue ... is itself known, accepted or understood in very precise terms’, and that it will be generally difficult to prove the precise content of personal information where information has not been recorded (para 16).

In the result, the Tribunal found that the defendant’s telephone calls to the plaintiff’s husband came within two exceptions to rule 11: either rule 11(b)(i), because they were authorised by the plaintiff through the provision of contact details to the defendant by the hospital staff; or rule 11(1)(e), because there was no express prohibition on disclosing general information about the plaintiff’s condition and progress.

The Tribunal went on to hold that if it were wrong about there not having been a breach of rule 11, there would not in any case have been the requisite damage suffered to constitute a interference with the plaintiff’s privacy in terms of s 66 of the Privacy Act. The plaintiff claimed that she left her marriage about four years after the alleged breach in large part because of the failure of her husband to visit her on the night of her operation after he had been informed of her condition by the defendant. She maintained that if he had not received the advice about her condition, he would not have needed to make a choice about whether or not to visit her. The Tribunal found that the defendant was not responsible for the husband’s decision not to visit her. Accordingly, the Tribunal dismissed the proceeding.

This case raises several issues that the Tribunal appeared to skirt around.

The first is in relation to the onus of proof. While the plaintiff, broadly speaking, will bear the onus of proof of making out his or her case, there are occasions where the onus of proof will shift. In the present case, the onus of proof arguably should have shifted to the defendant once a prima facie claim of disclosure was made out, but the Tribunal in effect dismissed the case on the basis that the plaintiff was unable to prove that the exceptions available to the defendant were inapplicable in the circumstances.

This was not the proper approach to take, as the burden of proof of any exception should lie with the party seeking to rely on it, not the party who has made out a prima facie case. This is expressly provided under s 87 of the Privacy Act. The plaintiff claimed that a disclosure of her health information took place. This was not disputed by the defendant. The onus of proof should then have shifted to the defendant to prove that one of the available exceptions in rule 11 applied.

Thus, the onus of proof should have been on the defendant to prove that she reasonably believed that the disclosure had been authorised by the plaintiff. This in turn should have raised the factual issue as to whether authorisation had actually been given, and the legal issue as to whether authorisation of the sort required under rule 11(1)(b)(i) could be implied or taken for granted from previous conduct, or alternatively, whether information of the kind disclosed could be described as ‘information in general terms’ of the patient’s condition and progress in terms of rule 11(1)(e).

While the Tribunal found as a fact that there had been no express instruction to the defendant not to disclose health information to the plaintiff’s husband, that is not the same thing as express authorisation to disclose in terms of rule 11(1)(b)(i).

In relation to the rule 11(1)(e) exception, the Privacy Commissioner’s commentary to the Health Information Privacy Code (second edition, June 2000) suggests that ‘[t]he general information conveyed may amount to confirmation that a named patient has been admitted and that he or she is comfortable, stable, etc without revealing detailed particulars of the patient’s treatment or prognosis’. It was not clear from the Tribunal decision what precisely had been disclosed to the husband, and the Tribunal did not deal with the issue whether what was said constituted ‘information in general terms’.

Moreover, in view of the above comments on onus of proof, the Tribunal’s citation of its earlier decision in A and A v G must be taken to be a two edged sword. Again, it was not in issue that the plaintiff’s health information was disclosed. What was in issue was whether the plaintiff had authorised the disclosure, whether the plaintiff had prohibited any such disclosure, and what precisely was communicated. Therefore, the comments by the Tribunal on the possibilities of miscommunication between the parties, and the difficulties faced by a litigant in proving unrecorded statements, really tends to cast doubt upon the defendant’s case, not the plaintiff’s case.

Inland Revenue Department tries to justify inappropriate disclosure

In Commissioner of Inland Revenue v B [2001] 2 NZLR 566, the Commissioner of Inland Revenue (CIR) unsuccessfully appealed from a Complaints Review Tribunal decision (Decision No 8/2000, 12 May 2000) which he had earlier unsuccessfully attempted to have struck out (Decision No 6/2000, 5 April 2000).

The respondent B complained that the Inland Revenue Department disclosed her income to her partner’s former partner, who had applied for a departure from a child maintenance assessment under the Child Support Act 1991 (NZ). After being informed in precise terms of B’s high level of income, the former partner began telephoning B and abusing her. B, who was pregnant at the time, was upset by this. The Complaints Review Tribunal found that Inland Revenue’s disclosure of B’s income breached principle 11 (limits on disclosure of personal information) of the Privacy Act, and ordered it to pay $5000 damages to B for humiliation, loss of dignity and injury to feelings.

The CIR appealed the Tribunal’s decision on two points. Firstly, the CIR submitted that he was acting as a ‘tribunal’ in the circumstances, and therefore he was an agency that was exempt from the requirements of the Privacy Act in terms of the s 2(1)(b)(viii) definition of ‘agency’. Secondly, he argued that the Child Support Act required the CIR to provide the reasons for his decisions, and so this overrode the requirements of the Privacy Act in accordance with s 7(1), which provides that the Privacy Act is subject to other legislation ‘that authorises or requires personal information to be made available.’

In relation to the first ground of appeal, the Complaints Review Tribunal had found that the CIR was not acting as a ‘tribunal’ in terms of s 2 of the Privacy Act. He was found to be acting administratively rather than judicially when determining a departure from a maintenance assessment. On appeal, this finding was confirmed through application of the 10 tests distinguishing a tribunal formulated by Lord Diplock in the House of Lords case Trapp v Mackie [1997] 1 All ER 489 at 495. While the Court here accepted that it should not take a ‘purely arithmetical’ approach to the results of applying the tests, it went on to comment that ‘[n]evertheless, the Trapp tests are all useful “touchstones”’.

In relation to the second ground of appeal, the Court did not find that the Child Support Act overrode principle 11 of the Privacy Act. The appellant had argued that s 96D(2) of the Child Support Act requires the CIR to give written reasons for his determination to both parties, and that the disclosure of B’s income occurred in the course of providing those reasons. The salary level of B was one of the reasons for the determination.

The Court gave two reasons for not accepting the appellant’s argument. First, an analysis of the Inland Revenue review officer’s decision showed that disclosure of B’s income ‘was not a necessary part of the reasons for his decision’ (para 43). The reason was that B was financially independent of her partner. There was no need to go into the precise level of her income. The Court remarked:

To add, in giving reasons for a decision, unnecessary but inoffensive detail is one thing, but to include it where it unnecessarily invades personal privacy is quite another. The review officer did not ask himself: is this personal information necessary to my reasoning and decision? (para 44)

The second reason given by the Court for not accepting the appellant’s argument was an internal memorandum circulated by the appellant, which amounted to an admission that ‘the CIR did not consider the precise details of the financial position of the partner of a liable parent to be a necessary part of a review officer’s decision’ (para 45).

Accordingly, the appellant’s second ground of appeal also failed.

The CIR subsequently sought to appeal this decision. Appeals from such High Court decisions to the Court of Appeal require the granting of leave to appeal by the High Court: s 124(2) of the Human Rights Act 1993 (NZ), which applies to privacy matters by virtue of s 89 of the Privacy Act. Leave to appeal must be granted on the ground that ‘the question of law involved in the appeal is one which, by reason of its general or public importance or for any other reason, ought to be submitted to the Court of Appeal for decision.’ The High Court declined the CIR’s application for leave to appeal in Commissioner of Inland Revenue v B (High Court, Wellington, AP 112/00, 21 August 2001). The Court held that the issue, already canvassed thoroughly in the Complaints Review Tribunal and the High Court, was not ‘capable of bona fide and serious argument’ for bringing a second appeal at the Court of Appeal level (the test in Snee v Snee [1999] NZCA 252; (1999) 13 PRNZ 609 at 612-613 (CA)). Moreover, there was no public interest in granting leave to appeal as the Tribunal’s and the Court’s decision had not caused any difficulties in the operation of the child support legislation, and the public interest would not be served by the expenditure of further public monies in bringing and hearing such an appeal.

The only remaining course at the time of writing is for the CIR to apply directly to the Court of Appeal for special leave to appeal under s 124(3) of the Human Rights Act.

Dr Paul Roth, Associate Professor, University of Otago, Dunedin, New Zealand