Slane, Bruce --- "Freedom of information and privacy" [2002] PrivLawPRpr 19; (2002) 9(1) Privacy Law and Policy Reporter 5

Freedom of information and privacy

Bruce Slane

New Zealand Privacy Commissioner Bruce Slane organised and hosted an International Symposium on Freedom of Information and Privacy in Auckland on 28 March 2002. The Symposium was attended by more than 150 participants from 16 different countries. In this issue, we reproduce a number of the more interesting papers from the Symposium.

First, some extracts from the Commissioner’s Introduction to the Symposium — Associate Editor.

Introduction

On freedom of information

The Symposium deliberately uses the phrase ‘freedom of information’ even though the phrase, and the contraction ‘FOI’, are not used much in New Zealand. It has been adopted to encapsulate an expansive concept, and collection of laws, relating to access to information, transparency and ‘open government’. The Official Information Act 1982 (OIA), notwithstanding its misleadingly broad title, is simply the most important of the access to information laws. Two other premier access laws are the Privacy Act 1993, governing access by individuals to information held about themselves, and the Local Government Official Information and Meetings Act 1987 (LGOIMA). LGOIMA is also an example of another species of FOI law: the open meetings law. Discussion of FOI can properly cover such things as public register laws and information disclosure requirements, such as those in public accounts and companies law.

Complete and unfettered freedom of information is unattainable. It is also, in a free and democratic society, undesirable. There can be ‘too much of a good thing’ in terms of enforced transparency. Would anyone wish to live in a glass house without curtains? Every FOI law in the world sets limits on what is to be made freely available. Such limits include the coverage of the law itself, the range of rights and duties, and the reasons for limiting disclosure where other important public interests need to be protected. A typical access law will recognise many reasons for withholding information such as the needs of law enforcement authorities to protect their informants and to complete investigations without tipping people off. This Symposium focuses upon one of the most important of the limits on FOI rights: the fundamental human right to privacy.

The interface between freedom of information legislation and privacy protection reveals a tension. The issue should not be overstated — the appetite of Open Government can usually be satisfied while reconciling the competing interests. Indeed, I might go so far as to say that the difficult cases reflect a ‘healthy conflict’. After all, one might well suspect that if contests did not occasionally arise, that either the reach of the access law was unduly limited or that arbitrary rules required the surrendering of privacy too readily. (On the other hand, one wishes to avoid unnecessary conflict on routine matters by training of officials, clear administrative guidelines and dissemination of instructive casenotes.)

On dispute resolution

If privacy is not simply to be a casualty of an unthinking desire for openness — a tyranny of transparency — it is necessary to articulate the important public interest in upholding privacy and apply an approach to protect that interest. It is essential to provide mechanisms to enable disputes to be resolved. As the President of the French Data Protection Commission put it:

States must ensure respect for private life for everyone and also transparency of public action, which is essential for the good functioning of a democratic society.

The tension that may, however, exist between access to administrative information, or, more generally, information that is made public, and the protection of personal data can be resolved. [E]xamples ... taken from experience, show that reconciliation is possible. This, however, requires a solid legal basis, and a case by case examination that is both prospective and technological.

This attempt at reconciliation also requires that States agree — as they cannot be both a party and a judge — to leave the task of arbitration between the often conflicting interests of the administration of the citizen, in the hands of independent institutions.

On the media’s use of FOI

I suspect that too few journalists take the time to study the OIA (New Zealand’s freedom of information legislation), or are trained by their employers to make effective use of it. For one thing, there is no need for an OIA request to be in writing — and journalists may not realise that requests may on occasion be successful over the phone. Such matters come to my attention where a journalist has been fobbed off by a bureaucrat and the journalist has been misled into taking the well trodden path of writing a Privacy Act ‘explanation’. Frequently the journalist is in total ignorance of the legal duty under the OIA to give reasons for refusing the request. Reasons given must be precise and in the terms allowed for in the OIA itself. For example, it is not permissible, and legally quite wrong, for an OIA request to be refused with an explanation that ‘the Privacy Act doesn’t allow me to tell you that’. An essential skill for a journalist in 2002 is a good working knowledge of the OIA. The journalist should challenge the bureaucrat to specify the reason and give the grounds in support. It is perfectly true that the OIA reason for refusal may be that it is necessary for the information to be withheld to protect the privacy of a natural person and that there is no countervailing public interest requiring disclosure. However, that is a long way from being ‘fobbed off with the Privacy Act’ as newspapers are quick to allege. In such reasons for a refusal the Privacy Act plays no part.

The rest of this article is a reproduction of the opening paper of the Symposium, also given by Bruce Slane.

Freedom of information and privacy: competing interests with complementary aims

Public sector agencies must attempt to balance the competing interests of the desirability of freedom of official information with the need to provide sufficient protection to personal privacy.

Privacy policies

As far as personal information about identifiable individuals is concerned, public sector agencies’ information policies are governed by the information privacy principles set out in the Privacy Act 1993. A good deal of discretion is left with agencies to develop the scope and characteristics of their own policies.

However, the policies should be open and transparent and those whose personal information is being held by the agency should be made aware of the purposes for which it has been obtained and for which it may be used or disclosed. This openness introduces accountability and a quite proper democratic pressure to be fair and reasonable in those information handling practices.

Openness and accountability are essential ingredients of the privacy principles. But nothing in the principles derogates from any statute or regulation which authorises or requires information to be collected or disclosed. The OIA[1] is such a statute. Although dealing in different areas, the Privacy Act and the OIA have similarities. The two statutes work together, for the most part, in harmonious accord.

Information requests: three routes

In broad terms, requests are dealt with according to the type of information the requester seeks.

1. Requests made by individuals for information about themselves must be dealt with in accordance with Principle 6 of the Privacy Act. The Privacy Act also contains the only grounds for withholding that personal information if the agency wishes to do so.

2. Where a request is made by a non-natural person, such as a company, for information about itself, similar provisions in Pt IV of the OIA apply.[2]

3. When a request is made for official information (that is, not personal information about the requester) and the information is not normally routinely given out, the agency must consider the request under the OIA. If the information requested contains personal information about identifiable individuals or may otherwise infringe the privacy of individuals, then the provisions and withholding grounds of the OIA will govern the decision to release that information or not.

Principle of availability

The key underlying principle of the OIA is that information shall be made available unless there is good reason for withholding it.[3] Except where the OIA otherwise expressly requires, questions of availability of official information should be decided in accordance with the purposes of the OIA. The information should be supplied ‘as soon as practicable’, and in any case no later than 20 working days.

It is important to note, however, that under s 4 of the OIA, one of the purposes of the legislation is to ‘protect official information to the extent consistent with the public interest and the preservation of personal privacy’.

Good reasons for withholding: privacy

One good reason for withholding official information is to protect the privacy of natural persons, including that of deceased natural persons (s 9(2)(a)). Relying upon this withholding ground involves a three stage process:

(1) identification of the strength of any privacy interest;

(2) identification of the strength of any public interest supporting disclosure (or, on occasion, supporting withholding the information); and

(3) weighing the competing interests.

Necessary to withhold?

In considering whether it is necessary to protect the privacy of a natural person, agencies may well look to Principle 11 of the Privacy Act for assistance. For instance, an agency may see an exception in Principle 11 which could apply. However, using the exception to disclose information may imperil the relationship the organisation has with those who supplied the information, or may be contrary to longstanding, well understood policies. The agency may decide, for instance, that instituting debt collection proceedings is not sufficient justification for supplying name and address information to plaintiffs. It may also be useful to examine the purposes for which the information was obtained and to see whether acceding to the request would be consistent with those purposes. However, Principle 11 does not determine the issue.

If the agency decides that it is necessary to protect privacy interests, then the agency must consider whether, in the circumstances of a particular case, withholding the information is outweighed by other considerations which render it desirable, in the public interest, to make that information available.[4] This is a balancing exercise which must be sincerely entered into if the disclosure is to obtain protection against any subsequent complaint to the Privacy Commissioner. If information is released under the OIA in good faith, a complaint about the disclosure cannot be upheld under the Privacy Act.

Review of decision

If an agency decides to withhold the information, the requester may take the matter to the Ombudsman for review. Where information is being withheld on the basis of a privacy interest, the Ombudsman must consult the Privacy Commissioner before forming a final opinion.[5]

That consultative process often includes considering: the purposes for which the information is held; whether it has been acquired under some coercive statute or voluntarily supplied; whether the individuals concerned have been approached or can be approached for their reaction to the request; the public interest reasons put forward by the requester; any other public interest reasons (such as accountability) which favour release; any public interest factors which favour withholding the information; and any conditions that can effectively be imposed on the requester to limit any further infringement of privacy.

In the last four years there have been between 50 and 77 consultations annually between the Ombudsmen and Privacy Commissioner.

Joint investigations

Sometimes a request is made for both personal information about the requester and for official information. In those cases, investigating officers of the Privacy Commissioner and the Ombudsman work together to separate the two types of information and apply the appropriate provisions of the respective Acts to it. Usually one office will be used as a conduit for the correspondence on both the personal and official information.

The Ombudsman’s Practice Guideline No 6 sets out how the Ombudsmen approach requests for official information and deal with the privacy withholding ground.

Bruce Slane has been New Zealand Privacy Commissioner since 1992.

---

[1] References to the OIA include references to the corresponding sections in the Local Government Official Information and Meetings Act 1987.

[2] Historically, requests for personal information by natural persons were also dealt with under the OIA, s 24(2). This access regime did not extend to the private sector. The personal access right for natural persons was removed from the OIA by the Official Information Amendment Act 1993 s 5(2). Expanded personal access rights were provided for in the Privacy Act 1993.

[3] OIA s 5.

[4] OIA s 9(1).

[5] OIA s 29B; Local Government Official Information and Meetings Act 1987 s 29A.