Case Note 329928 [2026] NZ Priv CMR 1: Personal emails sent from work email address “held” by Employer

Source: Privacy Commissioner

21 Aug 2026, 09:00

Background

A woman made an information request to her employer under principle 6 of the Privacy Act. The request was for personal information about the woman including her interactions with other employees.  

The employer released some information to the woman, but withheld some information under sections 49(1)(a)(iii), 53(b)(i) and 53(d) of the Privacy Act.

The woman complained to our Office, and asked us to review the employer’s decision to withhold information from her.

Principle 6

This complaint raised issues under principle 6 of the Privacy Act. 

Principle 6 allows an individual to request their personal information from an agency, subject to any applicable withholding grounds set out in sections 49-53 of the Privacy Act.  

Section 44(2) of the Privacy Act notes that an agency should respond to an information request by explaining that:

a. they do not hold the requested information; or
b. they do hold the requested information, and access to the information is either granted or refused; or
c. they do not confirm or deny that information exists in line with the requirements under section 47 of the Privacy Act. 

When an agency responds under section 44(2)(b), it can only withhold information from the requester if the information is held by the agency itself.

Our investigation 

Our investigation looked at the agency’s response to the woman’s request for information about herself. 

We noted that some of the information the agency withheld from the woman included emails from another employee’s work email address. The emails in question concerned a personal dispute between the woman and the other employee. 

The other employee had used a work email for their personal use, including seeking advice from a lawyer about the personal dispute between them. This information fell within scope of the woman’s access request to the employer because it was in their email system. 

We considered whether the employer actually “held” this information for the purpose of the Privacy Act. An agency holds personal information when that information is in its possession, custody, or control. Whether an agency ‘holds’ personal information can usually be figured out by looking at the facts of the case. Some examples include:

• A letter held in a physical filing cabinet in the agency’s office.
• A client’s photograph in an agency’s online database.
• Employee information within an HR system.

We looked at relevant case law, including Clarke v Attorney-General [1997] NZEmpC 119. In that case an employer dismissed three employees for sending offensive emails using their employer’s system. The employees’ advocate tried to argue that the Privacy Act prevented the employer from using these private communications for disciplinary purposes. This argument was unsuccessful and the Employment Court considered that the employer had acted appropriately and in line with email policies that had been communicated to the former employees. 

Section 10 of the Privacy Act says:

1.    For the purposes of this Act, personal information held by a person in the person’s capacity as an officer, an employee, or a member of an agency is to be treated as being held by the agency.

2.    However, subsection (1) does not apply to—

a.    personal information held by an officer, an employee, or a member of a public sector agency (A) if—

i.    the information is held only because of the person’s connection with a private sector agency; and
ii.    that connection is not in the person’s capacity as an officer, an employee, or a member of A; or

Section 10 sets out when information held by an employee is (or is not) deemed to be held by that person’s employer. It does not set out when information held by the employer agency is deemed to be held by the employee instead. 

Section 10 provides that information held by an employee is deemed to be held by their employer agency, where the employee is acting in their capacity as an employee. Section 10(2)(a) of the Act provides that personal information held by an employee is not treated as being held by their employer agency, if the information is only held because of the employee’s connection with a private sector agency (which includes a person, under sections 4 and 7 of the Act) and that connection is not in the person’s capacity as an employee. There is no corresponding provision that information held by an employer, that is solely personal and not related to work, is deemed to be held by the employee that it belongs to.

Our findings

In this case, the employer held the information as it was within its possession and control. The emails were stored in the employer’s system and it was able to access and retrieve copies of the other employee’s emails, even though they were personal and legally privileged.

We considered that the employer had a proper basis for the decision to withhold the information from the woman. However, we found they had applied incorrect withholding grounds. In the circumstances sections 49(1)(a)(iii) and 53(b)(i) were operating because:

• it would be an unwarranted disclosure of another employee’s affairs if the information was released to the woman
• releasing this information would include the disclosure of information about another person who is the victim of an offence or alleged offence and would cause significant distress to the victim if released.

We did not consider the employer could rely on section 53(d) to refuse the request, as although the other employee’s communications with their lawyer were privileged, it was the other employee’s privilege, and not the employers. 

Caution for employees

We strongly caution employees to check their employer’s internal policies on email use, especially before using a work email address for personal communications. 

The employer’s internal policies are relevant as to how email information is classified, and what access and responsibility the agency has to non-work-related personal information stored in its devices and systems.

Putting sensitive and privileged personal information into an agency’s system creates a risk for the security of that information, including that it might be captured by an access request, either under the Privacy Act or the Official Information Act.

Original source: https://nz.mil-osi.com/2026/09/01/case-note-329928-2026-nz-priv-cmr-1-personal-emails-sent-from-work-email-address-held-by-employer/