Posted on: Jun 14, 2016
The woman was investigated by her employer about her job performance. The performance concerns included the woman having failed a certified training programme several times.
After the investigation, the woman was demoted in her job. She said the employer had also threatened her with a misconduct finding.
The employee said her subsequent fight to ‘clear her name’ had resulted in her suffering from depression and anxiety. Her situation put emotional stress on her marriage and there was financial stress from the cost of engaging a lawyer. She also felt humiliated in the workplace as she continued to work for the same employer.
Principle 6 – Access request
The woman’s lawyer asked for the report on the woman’s job performance issues, as well as notes and recordings of interviews relevant to the case. Principle 6 of the Privacy Act gives people the right to access information about themselves.
During the interviews, the investigator had asked other staff direct questions about what they had seen, heard or thought about the woman. The investigator took handwritten notes and made recordings of the interviews.
The lawyer explained that the employee was concerned about the content of the investigator’s report into her job performance. The employee said it contained significant errors which she had not been given an opportunity to address and correct.
The employer provided some of the information in response to the request, but withheld other parts, citing two sections of the Privacy Act – section 29(1)a and section 29(1)b. The employer interpreted those sections to mean that personal information could be held in confidence to prevent the disclosure of affairs of other people, and also to maintain a promise of confidentiality made to the people who provided information about the woman.
Complaint to Privacy Commissioner
The woman’s lawyer complained to the Privacy Commissioner about the employer’s refusal to provide all the information.
The Privacy Commissioner contacted the employer, who provided more of the requested information, but did not provide the interview recordings or transcripts of the interviews. The employer said no such recordings existed, but the woman said her colleagues had told her that they were recorded when they were interviewed.
The Privacy Commissioner then advised the employer to provide the recordings or transcripts to the lawyer but also advised the lawyer that if the employer continued to deny the recordings existed, it would be difficult for the Privacy Commissioner to prove otherwise.
The employer came back and admitted that the investigator did make recordings. These had since been deleted because of ‘technical complications with the audio recorder’. This was due to a malfunction with the memory card.
Principle 5 – Security clarification
This development raised issues under principle 5 of the Privacy Act, which requires an agency to take steps to prevent against the loss and misuse of information.
The Privacy Commissioner asked the employer for a copy of their information retention and destruction policies, and for transcripts or summaries of the interviews, as well as a list of questions asked of the woman’s colleagues.
The employer supplied the information handling policies, a list of questions asked of the woman’s colleagues and, later, notes taken by the investigator of his interviews. After initially agreeing that the investigator, who was a contractor, was their agent and that they had breached principle 5, the employer changed its position and insisted there was no breach of this principle.
The Privacy Commissioner formed the view that the employer had breached principle 5 by failing to take reasonable steps to ensure the audio recordings were protected from loss or destruction. This was also contrary to the employer’s own information management policies.
The Privacy Commissioner also decided the employer had breached principle 6 by not providing the woman and her lawyer with transcripts of the interview recordings or minutes.
Employee suffered harm
The Privacy Commissioner concluded that given the circumstances and nature of the investigation, the employee had suffered harm as a result of the loss of her personal information. The Privacy Commissioner therefore advised the employer that it would be appropriate to consider offering her some compensation.
At the time, the employee was in mediation with the employer about the employment issues. The Privacy Commissioner advised the woman’s lawyer to include the Privacy Act breaches as part of the mediation. In the end, the mediation was unsuccessful. The Privacy Commissioner then advised the woman that while the Commissioner would not be referring her case to the Director of Human Rights Proceedings, she had the right to take her case to the Human Rights Review Tribunal independently.
May 2016 Case note 266292 [2016] NZ PrivCmr 6.
Source: The Office of the Privacy Commissioner
Disclaimer
This article, and any information contained on our website is necessarily brief and general in nature, and should not be substituted for professional advice. You should always seek professional advice before taking any action in relation to the matters addressed.
