Source: New Zealand Privacy Commissioner – Blog
Under the Privacy Act, the Human Rights Review Tribunal (“the Tribunal”) can award damages for emotional harm caused by a privacy breach. Damages are compensatory rather than punitive; the goal is to compensate individuals for specific harm rather than punish a defendant’s bad behaviour.
Calculating damages for emotional harm is not an exact science, especially when there has been no quantifiable financial loss. We have identified some factors contributing to the different amounts awarded for emotional harm in recent cases, which are helpful to consider when balancing the risks and benefits of taking your complaint to the Tribunal.
What damages can the Tribunal award?
The Tribunal can award damages if, as a result of a privacy breach, the complainant has:
- suffered a pecuniary loss
- reasonably incurred expenses
- lost a benefit that they might reasonably have expected, or
- suffered humiliation, loss of dignity, and injury to feelings.
The Tribunal has provided some useful guidance on quantifying emotional harm caused by a privacy breach. There are three broad bands of emotional harm: less serious breaches can see up to $10,000, more serious awards have ranged from $10,000 to $50,000, and the most serious awards have been more than $50,000[1].
The Tribunal occasionally awards high amounts for emotional harm – $98,000 in Hammond v Credit Union Baywide and $70,000 in Director of Human Rights Proceedings v Slater – but the majority of successful claims are in the $5,000 to $25,000 range. (See the table of damages awarded on the Tribunal’s website.)
Linking harm to the breach
Because damages are compensatory, you are less likely to be awarded damages if you cannot show that your harm was a direct result of the privacy breach.
This was seen in Wise v Commissioner of Police. The Tribunal found an interference with Ms Wise’s privacy, but she was unable to link her stress to the breach and there was no basis to justify damages for emotional harm.
While the breach does not need to be the sole cause of harm, the Tribunal takes care not to conflate emotional harm arising from a privacy breach with emotional harm caused by other issues. This is particularly important when there is a break down in the relationship between the parties, or where there are wider issues.
For example, in Cook v Manawatu Community Law Centre, the Tribunal found the Centre had breached Ms Cook’s privacy when collecting sensitive financial information about her from WINZ. The Centre argued that any stress and anxiety suffered was caused by an ongoing employment dispute, rather than the breach of privacy. The Tribunal acknowledged there were other factors involved, but Ms Cook was able to prove the privacy breach was a material cause of her stress. The Tribunal awarded Ms Cook $6,000, taking care to separate the emotional harm caused by the privacy breach from the harm caused by the employment dispute.
Severity of the harm
An award will likely be higher depending on the severity of the breach and the amount of harm caused.
In Holmes v Housing New Zealand Corporation, the Tribunal awarded Mr Holmes only $400 when, having taken a “possibly over generous view of the facts,” it found he experienced a limited degree of injury to feelings.
This can be contrasted with Green v EIT [2020] NZHRRT 24, in which Mrs Green and her son were awarded $25,000 each after a staff member at the son’s school disclosed a significant amount of personal information about them to the courts. The Tribunal noted this was a “betrayal of trust and extreme embarrassment.” The son was particularly vulnerable because of his disabilities, and the Greens had been encouraged to trust the staff and share intimate details about the son’s health and relationships.
The specific circumstances of each case will be considered when looking at the severity of harm. This is one of the reasons it is difficult to quantify emotional harm.
Conduct of the agency
In Hammond, the Tribunal noted the conduct of the defendant can exacerbate or mitigate the emotional harm caused, and therefore is a relevant factor in the assessment of damages[2].
One mitigating factor the Tribunal considers is the presence of an apology.
In Williams v ACC, ACC accepted they had interfered with Mr Williams’ privacy, by relying on inaccurate information when stopping his weekly compensation payments. Soon after receiving a complaint from Mr Williams, ACC acknowledged the breach, reinstated his payments and provided a written apology. At the Tribunal, Mr Williams made a claim for $10,000 for the emotional harm caused.
The Tribunal considered the timely apology to have lessened the harm and awarded Mr Williams $7,500, noting the speed with which the interference was recognised and remedied by ACC.
However, an apology will not always be enough. In Vivash v ACC, Mr Vivash was awarded $40,000 for injury to feelings, plus an additional $10,000 for other harm, for the destruction of his file. While ACC apologised to Mr Vivash, it had been 12 years since the breach and the Tribunal noted a “belated eleventh-hour acceptance by ACC of the breach can be given little weight.”
It is worth noting it is not only an apology the Tribunal will consider. The conduct of an agency throughout the breach and complaint process may be relevant when calculating damages.
Conduct of the individual
The Tribunal will also consider the conduct of the complainant when assessing the harm caused by a breach.
In Deeming v Whangarei District Council, Mr Deeming made a complaint to the Council’s Mayor about his local rugby club. A Councillor then disclosed the fact he made this complaint to the club president. Mr Deeming was banned from the club and experienced significant loss of dignity and injury to feelings.
However, Mr Deeming delayed bringing the case to the Tribunal for nearly five years after our Office’s investigation. The Tribunals’ decision also acknowledges that Mr Deeming disclosed similar information to the club himself. Consequently, he was awarded $2,000 in damages, significantly less than the $40,000 he claimed.
Although the Privacy Act 2020 has put a time limit of six months on making a complaint to the Tribunal following an OPC investigation, complainants should also consider their conduct when making claims for damages under the Privacy Act.
Risks of going to the Tribunal
There are some risks associated with going to the Tribunal, including the length of time involved, the fact the decisions are public, and the possibility that the Tribunal can award costs against either party. These are all factors to consider when deciding whether to pursue your complaint through the Tribunal process.
[1] Hammond v Credit Union Baywide at [176]
[2] See paragraph [170.3]
