Source: New Zealand Privacy Commissioner – Blog
When investigating complaints, we occasionally run across responding agencies who do not want to engage with our process. Given the nature of a ‘complaint’, there is often a complicated relationship between our complainants and respondents. Our goal is to act as a neutral third party to try to resolve complaints and assist agencies to meet their obligations under the Privacy Act.
Often, we do this by talking with the respondent over the phone, but sometimes it takes a little more. We recently investigated a complaint with a recalcitrant respondent, when a well-timed regional visit by the Commissioner helped the respondent to understand its obligations under the Privacy Act.
Investigation process
When we investigate a complaint, we notify the respondent early in the process. In our notifications we set out the facts of the complaint as we understand them and ask the respondent to provide us with information to aid our investigation. In the case of a principle 6 access complaint, we ask for a copy of the personal information the respondent organisation wants to withhold from the individual and the withholding grounds it is relying on.
When we ask for information, we issue a statutory demand under section 91 of the Act requiring the respondent to provide it to us. We cannot investigate a complaint without a responding organisation providing us the required information.
For us to form an independent view on whether an organisation has a proper basis for its decision to withhold information, we need to be able to see the unredacted information and the organisation’s reasoning. It is only then we can apply the legal tests.
We do not provide the complainant a copy of the information the organisation has provided to us, even if we form a view that there is no proper basis for withholding the information. Section 116 of the Privacy Act requires us to keep all information we receive confidential. Instead, we write to the organisation with our view and suggest it provides the information to the complainant directly.
What we did
In the recent investigation, an individual had requested access to his personal information held by an organisation and had not received a response. We notified the complaint, issuing our statutory demand for the organisation to provide us with a copy of the information it wished to withhold.
The organisation refused to provide both us and the complainant with the requested information, stalling our investigation.
We wrote back to the organisation, explaining the statutory demand and the resulting legal obligations. We took them through our investigation process as I set out above. We invited them to call us to discuss any concerns they may have.
Following another negative response from the organisation, we issued our preliminary view on the complaint. Under section 66 of the Act, a failure to respond to a request for information within the relevant time period is a ‘deemed interference’ with someone’s privacy. As the organisation had not responded to the request, there was an interference with the complainant’s privacy.
It is also an offence to fail to comply with a lawful requirement under the Act (such as our statutory demands), or to obstruct or hinder the Commissioner when exercising his powers (such as our investigations).
Regional visit
Throughout the year, the Privacy Commissioner undertakes regional visits to parts of New Zealand. This is an opportunity to educate individuals and organisations on privacy.
While we were waiting for a response to our preliminary view, an opportunity arose for a member of the investigation team to accompany the Commissioner on one of these regional visits, to the very town our recalcitrant respondent was located.
We leapt on the opportunity and the organisation agreed to meet with the investigator and the Commissioner to discuss the complaint.
During the visit, we were able to listen to the organisation’s concerns about the complaint and understand more about the surrounding circumstances.
In this case, the complainant had committed crimes against the organisation, creating a tumultuous relationship involving Police and legal proceedings. Notification of a Privacy Act complaint was the cherry on top of an already complicated situation.
We explained their obligations under the Privacy Act and how they applied regardless of the history with the complainant. Even if the person requesting information has committed criminal actions, they still have the right to access their information. Their previous actions are not relevant to our investigation.
The organisation showed us what information they held on the complainant and agreed to release it to him. They did this via email the same day.
Let us help you to help yourself
We understand there is often a tumultuous history behind a privacy complaint that goes beyond the Privacy Act. This can sometimes make it difficult for a respondent to want to engage with our complaint process.
If you’re ever unsure about what information we need, why we need it, or what is going to happen to it, please call us! We are more than happy to answer any questions you have and address any of your concerns.
We want to make the complaint process as smooth and easy for everyone involved, we just need the parties to be willing to engage with our process.
