Kia ora koutou,
Privacy rarely reaches the courts in New Zealand. While, naturally, courts are often called to decide on the application of common law privacy rights, otherwise known as the tort of privacy — such as in the context of media activities — matters relating to interpretation of the Privacy Act are not often considered at this level.
This is primarily because of the Privacy Act's focus on dispute resolution. Because the privacy commissioner has a gatekeeper role in relation to Privacy Act complaints, difficult questions of legal interpretation are generally bypassed in favor of resolution. This means we have a relative lack of court precedent to draw on when advising clients on the application of the Privacy Act.
This makes the recent decision of the High Court of New Zealand in H v Attorney-General — [2024] NZHC 2317 particularly useful and interesting for privacy practitioners. The plaintiffs in the case were survivors of adult abuse, which they say they suffered while in state care. They requested access to their state care records from the Ministry of Social Development, which withheld or redacted parts of their records under the Privacy Act 1993 and the Privacy Act 2020.
The ministry stated reports and plans ordered by and furnished to courts needed to be requested from the courts. The plaintiffs sought declarations that the privacy acts did not provide a basis for the relevant government agency to withhold from them their own personal information.
The issue for the court was whether the rights of claimants to access their personal information under the privacy acts were limited by specific provisions in welfare legislation and court rules. The court concluded they were not and that, accordingly, the government agencies were bound by the privacy acts to respond to those requests.
It is crucial to note that this decision was limited to circumstances where the child or young person themselves, as an adult, was requesting the personal information. The court found that, in those circumstances, unless a court had ordered specific personal information not be provided to the person concerned, or another exception in the privacy acts applied, the agency must provide the information to the individual.
The court noted that the Crown had changed its position in relation to this legal issue several times, and that survivors of abuse in state care could not reasonably be expected to have confidence in the Crown's word that it would abide by the decision of the court without a formal order being made.
For this reason, the court declared the plaintiffs' rights as adults, to access their own personal information under the privacy acts, in documents that were held by the defendant agencies which were ordered to be created by courts, were not limited, under Section 7 of the Privacy Act 1993 or Section 24 of the Privacy Act 2020, by the provisions of the Oranga Tamariki Act 1989, the Care of Children Act 2004, the Children and Young Persons Act 1974, the Child Welfare Act 1925, the Guardianship Act 1968, and the District Court (Access to Court Documents) Rules 2017 or Family Court Rules 2002.
This decision is critically important for adult survivors of abuse in state care. It also provides helpful precedent for privacy practitioners looking to understand the interaction between the Privacy Act and other statutes that impose restrictions on the availability of personal information, which the Court considered should be read relatively strictly.
The decision is also worth a read for its overview of the purposes of the Privacy Act, including the balancing of privacy against other rights and interests, and the fundamental nature of the access right provided by Information Privacy Principle 6.
Daimhin Warner, CIPP/E, is the country leader, New Zealand, for the IAPP.
