206 Final Privacy Assignment Sem B PDF

Preview

Summary

Download 206 Final Privacy Assignment Sem B PDF

Description

Assignment: Mrs Smith – Privacy concerns Administrative Law Assignment

Name:

Macaela Gillespie

Student ID:

1283781

Paper code:

LAWS206

Paper:

Administrative Law

Stream:

B

Assignment Name:

Mrs Smith – Privacy Concerns.

Lecturer:

Valmaine Toki

Due Date:

7th September 2017

Macaela Gillespie 1283781 [1] Introduction Mrs Smith’s privacy has been breached under principle 11 of the Privacy Act;1 that is personal information should not be disclosed for purposes other than those for which the information was obtained. I have advised Mrs Smith on the avenues of redress available to her, following the advantages and disadvantages of each process. Mrs Smith can: -

take her complaint directly to the New Zealand Human Rights Review Tribunal, 2 (HRRT) which will cost her in legal expenses,3 unless she represents herself. Redress may only be granted at the discretion of the HRRT.4 Due to the seriousness of the breach, it is likely she will be granted redress, including financial damages amongst other possible remedies.

Alternatively, Smith can: -

cost effectively take the complaint to the Privacy Commissioner who can attempt to resolve the issue or refer the matter onto the Director of Human Rights Proceedings, who may then take the complaint to the HRRT.

[2] Advantages and Disadvantages The advantage of the Privacy Commissioner is that they are more accessible and is low in cost.5 The Commissioner will take Smith’s complaint and can either:6 -

act as a mediator to remedy the complaint; or

-

decide not to report to the Director because the claim has no substance; or

-

refer the complaint to the Director, which could then lead to a hearing from the HRRT.

1 Privacy Act 1993, s 6, pt 2, principle 11. 2 Section 83. 3 Mai Chen Public Law Toolbox Solving Problems with Government “The Privacy Commissioner” (LexisNexis, 2012) 777-792 at 790. 4 Section 88(1)(a)-(c). 5 Blair Stewart “Privacy Laws and the Private Sector: A New Zealand Perspective” Speech by Blair Stewart (3 December 2010) as cited in Mai Chen Public Law Toolbox Solving Problems with Government “The Privacy Commissioner” at 784. 6 Privacy Act s 77.

1

Macaela Gillespie 1283781 The Commissioner will decide before referring to the Director whether: 7 “…there is ‘credible and available evidence’ to support the case; the ‘seriousness of the breach of the privacy act and the level of harm that occurred as a result of the act’ and whether ‘a genuine and appropriate offer’ was made by the respondent agency…” to remedy the complaint.

The Director of Human Rights Proceedings: 8 -

may bring civil proceedings before the Tribunal or where entitled to, agrees to Smith bringing proceedings; or

-

decide that the complaint has no substance.

If the Commissioner decides not to take the complaint to the Director, or if the Director decides there is no substance, Smith can still choose to go to the HRRT. Due to the seriousness of the breach and the facts being analogous to the leading tribunal decision of Hammond v Credit Union Baywide (NZCU),9 it is likely the complaint will be referred to the Director and will go forward to the HRRT. Outlined below is the procedure used and the findings of the Hammond case for the benefit of Smith’s knowledge.

[3] Precedent to follow. Similar to Smith’s situation, in Hammond, NZCU acquired the image of the cake containing expletive language and in the shape of the NZCU logo; the image was only viewable to Hammond’s private Facebook friends. NZCU then phoned and emailed local companies and agencies warning not to employ Hammond and pressure was placed on her current employer to terminate her employment. Her reasons for resignation were also disclosed internally to the staff of NZCU. Hammond represented herself in the HRRT proceedings, due to the expenses of legal costs.10 To identify and establish a breach of principle 11,11 the HRRT in Hammond referred to the four-step process.12

7 Office of the Privacy Commissioner Annual Report 2009-2010 as cited in Mai Chen Public Law Toolbox Solving Problems with Government “The Privacy Commissioner” at 789. 8 Privacy Act, s 72. 9 Hammond v Credit Union Baywide [2015] NZHRRT 6. 10 Marty Sharpe “Rude Cake Baker gets record $168K in Damages”, (2 March 2015) . 11 Privacy Act s 6, principle 11. 12 Hammond v Baywide at [138].

2

Macaela Gillespie 1283781 The four-step process is laid out in Geary v Accident Compensation Corporation and has been referred to in context of Smith’s situation for her benefit: 13 1. Has there been a disclosure of [Smith’s] personal information? 2. If the tribunal is satisfied there is a disclosure of personal information, the defendant [‘Home Sell’] then needs to establish that the disclosure fell within one of the exceptions provided by principle 11.14 3. If [‘Home Sell’] does not establish an exception and the tribunal is satisfied there is the disclosure of personal information, [Smith] must then prove it constituted interference under section 66(1)(b) of the Act. 4. If the tribunal is satisfied at this stage, then they determine whether in its discretion, to grant any statutory remedies under s 85 of the act. The result of Hammond, was that there was a breach of Hammond’s privacy under principle 11 by; emailing agencies attaching an image of the cake to warn them against employing her, mailing NZCU staff disclosing her reasons for resigning from NZCU and putting pressure on her current employer to terminate her employment.15 Therefore, the actions of ‘Home Sell’ emailing real estate companies within the area, with the image of the cake attached warning them against employing Smith, putting pressure on her current employer ‘Buy Now Real Estate’, and disclosing her reasons for resigning to ‘Home Sell’ staff would also be a breach of principle 11. This satisfies the first three steps of the procedure. In Hammond, redress was granted. Due to the analogy in facts, Smith would likely be granted similar redress which is detailed further in [4].

[4] Redress If Smith’s claim is considered a breach of privacy under principle 11 by the HRRT, the Tribunal has the discretion to grant redress; whether that is financial or otherwise. The tribunal can grant:16 13 Geary v Accident Compensation Corporation [2013] NZHRRT 34 at [190]. 14 Privacy Act s 6, principle 11(a)-(i). 15 Hammond v Baywide at [139.1]-[139.2]. 16 Privacy Act s 85.

3

Macaela Gillespie 1283781 -

a Declaration that the action by ‘Home Sell’ is an interference (‘Home Sell’ interfered with Smith’s privacy by disclosing her personal information when they did not believe on reasonable grounds that any exceptions listed in principle 11 had application);17

-

an order restraining ‘Home Sell’ to continue or repeat that interference, and to prevent then engaging in, allowing or causing anyone else to engage in similar conduct that constituted this interference; 18

-

Damages such as a pecuniary loss suffered as a result of the expenses reasonably incurred by the interference; for example, legal costs incurred by Smith.19 Additionally, loss of any benefit that Smith may have reasonably expected to obtain but for the interference,20 or humiliation, loss of dignity and injury to the feelings of Smith. 21

Other redress could include an order that ‘Home Sell’ perform action(s) specified by the tribunal, to either or both remedy the breach and redress any loss or damage suffered by Smith as a result of the interference. For example, a deletion of records of the emailed image by all companies it was sent to, written confirmation of this, a retraction of the email sent to ‘Home Sell’ staff along with an apology to Smith. 22 The tribunal can deem anything else that they see fit as a remedy for the breach.23

[5] Commissioner Powers and Ramifications Binding decisions of the Privacy Commissioner could be extremely beneficial for Smith’s case and potential complainants. Powers could include the ability to carry out an official investigation on agency practices and systems for handling personal information and reporting on it, following the power to issue a notice of compliance where a breach is found.24 However, there would need to be good reasons for investigating any agency, such as the belief of the inadequate

17 Hammond v Credit Union Baywide at [189.1]. 18 At [189.6]. 19 At [189.3]. 20 At [189.4]. 21 At [189.5]. 22 At [189.7]. 23 Privacy Act s 85(1)(e). 24 Privacy Commissioner Report to the Minister of Justice Under Section 26 of the Privacy Act; Six Recommendations for Privacy Act Reform (3 February 2017) at 8.3.

4

Macaela Gillespie 1283781 ability to protect privacy.25 This would be a beneficial check in the way that it prevents breaches arising in the first place, making the role of the Privacy commissioner to maintain privacy standards before it results in a breach. What needs to be determined for this power to be effective, is establishing the threshold of what a “good reason” is and how the Commissioner has come to the belief that practices or systems of an agency are believably inadequate. In the case of serious or repeated breaches, the Privacy Commissioner could issue a civil penalty which would align the New Zealand Privacy Commissioner with those in other Commonwealth jurisdictions.26 Smith’s case would be a serious breach considering the similarities to the highest paid privacy breach case in New Zealand; that being Hammond. It would be beneficial if the Commissioner could initiate proceedings for the HRRT rather than having to go via the Director of Human Rights Proceedings,27 especially if they do not find that their civil penalty is fit for the complaint, but the complaint is a serious breach. This way, there are still separate binding powers of the Commissioner and the HRRT. This allows a larger check on privacy breaches by the Commissioner, with a narrower stream of complaints going in to the HRRT. It would then be determined on the facts of each situation, whether it falls into line with a situation like Smith or Hammond, or whether it may fall under the civil penalty of the Commissioner. Streamlining the process would inevitably make it faster for hearings to proceed. This would be extremely beneficial for cases like Smith’s, or any others in the future.

Bibliography Cases 25 New Zealand Law Society “Extension of Privacy Commissioner Powers Recommended” . 26 Above, n 24 at 8.4. 27 Chen, above n 9 at 778.

5

Macaela Gillespie 1283781 Geary v Accident Compensation Corporation [2013] NZHRRT 34. Hammond v Credit Union Baywide [2015] NZHRRT 6.

Legislation Privacy Act 1993.

Books and Chapters Mai Chen Public Law Toolbox Solving Problems with Government “The Privacy Commissioner” (LexisNexis, 2012) 777-792.

Reports Office of the Privacy Commissioner Annual Report 2009-2010. Privacy Commissioner Report to the Minister of Justice Under Section 26 of the Privacy Act; Six Recommendations for Privacy Act Reform (3 February 2017).

Internet Resources Marty Sharpe “Rude Cake Baker gets record $168K in Damages”, (2 March 2015) . New Zealand Law Society “Extension of Privacy Commissioner Powers Recommended” .

Other Sources Blair Stewart “Privacy Laws and the Private Sector: A New Zealand Perspective” Speech by Blair Stewart (3 December 2010).

6...