Home | Databases | WorldLII | Search | Feedback High Court of New Zealand Decisions

Taylor v Chief Executive of the Department of Corrections [2020] NZHC 383 (4 March 2020)

Last Updated: 4 March 2020

JUDGMENT OF GWYN J,

AND MEMBERS DEBORAH HART AND WENDY GILCHRIST

This judgment was delivered by me on 04 March 2019 at 3.00pm Pursuant to Rule 11.5 of the High Court Rules

..............................

Registrar/Deputy Registrar

TAYLOR v CHIEF EXECUTIVE OF THE DEPARTMENT OF CORRECTIONS [2019] NZHC 383 [4 March 2020]

Introduction

[1] This appeal relates to a claim pursued originally before the Human Rights Review Tribunal (the Tribunal). The appellant, Mr Taylor, was at the relevant time a prisoner at Auckland Regional Prison, Albany, Auckland. On 5 September 2014 he made an “everything request”¹ of the respondent (Corrections) under information privacy principle 6 (principle 6) of the Privacy Act 1993 (the Act) for the period 1 August 2014 to 5 September 2014.²

[2] Mr Taylor’s complaint in the Tribunal was that Corrections interfered with his privacy when it responded to the request because it:

(a) redacted the names, positions and contact details of Corrections staff members appearing in the material provided; and

(b) obscured the content of some documents by the application of a watermark “released under the Privacy Act”.

[3] The Tribunal’s first principal conclusion was that the information withheld from Mr Taylor was not personal information about him and was therefore not disclosable under principle 6.³ Its second was that any interference with Mr Taylor’s privacy by the watermark was trivial in nature, such that it declined to make a declaration of interference with privacy.⁴

[4] Mr Taylor now appeals the Tribunal’s decision. He began with four grounds of appeal but formally withdrew all but one before the matter came to a hearing.

[5] That ground is set out in the notice of appeal:

The Human Rights Review Tribunal (the Tribunal) erred in determining (at paragraphs [126], [128] and [148.1]) that the information redacted from that supplied in response to his [the Appellant’s] request for information, made pursuant to s 6, Principle 6, of the Privacy Act 1993 (the Act), via a PCO1 form on 5 September 2014 (information Request), was not “personal

¹ Mr Taylor’s request is set out at [10] below.

² Privacy Act 1993, s 6.

³ Taylor v Chief Executive of the Department of Corrections [2018] NZHRRT 35 at [148.1].

⁴ At [148.2].

information” about the Appellant and consequently there was no interference with his privacy as defined in ss 66 (1) and 66 (2) of the Act.

[6] Corrections opposes the appeal and has filed a notice to support the decision on other grounds, being that even if the names and details of Corrections’ staff members were Mr Taylor’s personal information (which it denies) it was nevertheless entitled to refuse disclosure of that information on the basis of it being unwarranted disclosure of the affairs of another,⁵ and/or because the information is trivial.⁶

[7] The Privacy Commissioner appeared in the proceedings before the Tribunal and appeared in this appeal as the second intervener. The first intervener, the Director of Human Rights Proceedings (the Director), appeared in accordance with s 86(1)(b) of the Act. The Privacy Commissioner initially gave notice of his intention to appear and be heard pursuant to s 86(5) of the Act.⁷ Following the Director giving notice that he would appear, the Privacy Commissioner applied for and was granted leave to intervene on the basis that the issues raised (particularly the definition of personal information) are of importance to the operation of the Act.

Approach of this Court on appeal

[8] The appellate approach settled by the Supreme Court in Austin, Nichols & Co Inc v Stitching Lodestar applies in this case.⁸ This requires the Court to form its own view on the relevant issues, having appropriate regard to the conclusions reached by the Tribunal. The persuasive burden lies on Mr Taylor to persuade the Court that the Tribunal decision is wrong.

Evidence

[9] The Tribunal heard extensive evidence from the sole Corrections witness, Mr Vincent Arbuckle. Mr Arbuckle’s evidence was principally directed to the reasons why the names and contact details of staff were properly withheld under s 29(1)(a) of

⁵ Privacy Act 1993, s 29(1)(a).

⁶ Section 29(1)(j).

7. That section allows the Privacy Commissioner to appear and be heard where the Director would be entitled to appear and be heard but declines to do so. Where the Director does appear, as in this case, the Privacy Commissioner requires leave to intervene.

⁸ Austin, Nichols & Co Inc v Stichting Lodestar [2007] NZSC 103, [2008] 2 NZLR 141.

the Act. Mr Taylor, in oral submissions before us, suggested that the Tribunal’s finding that Mr Arbuckle was a “careful, conscientious and credible witness” whose evidence was “accepted without qualification” was open to review by this Court.⁹ For reasons explained later in this judgment we did not find it necessary to consider that issue.

Background

[10] On 5 September 2014 Mr Taylor made a request of the Department of Corrections (the request):¹⁰

Pursuant to section 6 Principle 6 of the Privacy Act I request copies of all file notes, incident reports, email traffic other information of any kind in any form, that relates to me, is about myself or mentions refers to me in any way shape or form, dated since 1 August 2014 – and was created or generated by any Corrections employee at Auckland Prison (including PM Sherlock) – to the date this request is completed with warning any extension of the 20 statutory working day maximum will be challenged before the Privacy Commissioner

– as experience shows this provision is being regularly abused by Corrections.

Claim against the Department of Corrections

[11] On 8 September 2014 Mr Taylor was told the request would be granted and that it would be referred to the Ministerial Service Team (MST) at Corrections’ National Office in Wellington to action the response.

[12] The evidence before the Tribunal was that, from July 2014 until new guidelines were issued in November 2015, Corrections had a particular practice in responding to some Act requests.¹¹ For a few offenders who made large numbers of requests and/or who routinely engaged in time-consuming disputes on the issues involved, MST provided active support to the prison or Community Corrections site where the prisoner was based.¹² However, MST staff tended to have limited knowledge of individual offenders and found it difficult to know whether the disclosure of staff names should be made (on the basis that the names would be known to the offender) or withheld (on the basis that the disclosure was unwarranted in terms of the staff

⁹ Taylor v Chief Executive of the Department of Corrections, above n 3, at [73].

¹⁰ The request covered the period from 1 August 2014 to 5 September 2014.

¹¹ At [65].

¹² At [65.2].

member’s privacy).¹³ Nor were MST staff in a position to know whether there might be a situation of imminent risk of harm to a staff member.¹⁴

[13] In July 2014, after consultation with the Office of the Privacy Commissioner, Corrections issued a “practice update” to MST staff which provided that, from that point, “all staff names will now be withheld from information released, unless there is a specific request for identifying information, which will be considered on a case by case basis.”¹⁵

[14] That practice remained in place until new guidelines were issued in November 2015, which effectively required case by case consideration for all requests.¹⁶ Mr Taylor’s request was dealt with under the July 2014 practice update.

[15] By letter dated 17 November 2014 Corrections provided to Mr Taylor the information requested, explaining that some information had been withheld:

You will note that some information has been withheld in accordance with the following sections of the Privacy Act:

section 29(1)(a) as disclosure of the information would involve the

unwarranted disclosure of the affairs of another individual, or of a deceased individual.

section 29(1)(f) as disclosure of the information would breach legal

professional privilege.

section 55(e) as information contained in any correspondence or

communication that has taken place between the office of the Commissioner and any agency and that relates to any investigation conducted by the Commissioner under this Act, other than information that came into existence before the commencement of that investigation.

[16] The Corrections letter of 17 November 2014 also stated:

I trust the information provided is of assistance. Should you have any concerns with this response, I would encourage you to raise these concerns

¹³ At [65.5].

¹⁴ At [65.5].

¹⁵ At [65.10]. The evidence before the Tribunal was that Corrections discussed its proposed approach with the Office of the Privacy Commissioner (OPC) and was of the view that the OPC supported that approach. Subsequently it became clear that the OPC did not.

¹⁶ At [65.14].

with the Department. Alternatively, you are advised of your right to also raise any concerns to the Privacy Commissioner under section 67 of the Privacy Act ...

[17] The documents provided by Corrections to Mr Taylor were principally email communications between Corrections staff. The Tribunal concluded that “In the main, the documents record routine transactions in the administration of Mr Taylor’s sentence.”¹⁷ The redacted information comprised the names, positions, titles, telephone numbers and email addresses of the sending and receiving parties (the redacted information).

Complaint to Privacy Commissioner

[18] Following receipt of Corrections’ response Mr Taylor filed a complaint with the Privacy Commissioner. The Commissioner made a ruling on the complaint, contained in a letter of 5 May 2015 to Corrections. The Commissioner reached the view that the redacted information had been properly withheld under ss 29(1)(f) and 55(e) of the Act, but said he had not been satisfied that the redacted information could necessarily be withheld under s 29(1)(a) of the Act “in the absence of any specific argument why releasing this particular information would be unwarranted.”

Tribunal Hearing

[19] Mr Taylor then brought a claim to the Tribunal which was heard by the Tribunal on 14–17 March 2018. The Tribunal’s decision was released on 31 July 2018.¹⁸

[20] The Tribunal held that:

[148.1] The information withheld from Mr Taylor was not personal information about Mr Taylor and was therefore not disclosable under IPP 6; and

[148.2] In relation to the documents which were watermarked “Released Under the Privacy Act 1993”, such interference with Mr Taylor’s privacy as did occur was trivial in nature and no declaration of interference with privacy is to be made. Furthermore, as a consequence of subpart 1 of Part 2 of the Prisoners’ and Victims” Claims Act 2005, no monetary compensation can be awarded to Mr Taylor.

¹⁷ At [126].

¹⁸ Taylor v Chief Executive of the Department of Corrections, above n 3.

[21] Because of its conclusion that no personal information had been withheld from Mr Taylor, the Tribunal did not need to address the application of s 29(1)(a) of the Act, including Mr Taylor’s argument that Corrections could not apply a “blanket” approach to redactions (under the July 2014 practice update) and was obliged to consider whether each individual redaction could be justified under the withholding grounds.¹⁹

Issues on appeal

[22] The principal issue on appeal is whether the redacted information was Mr Taylor’s personal information.

[23] Principle 6 of the Act provides:

Principle 6

Access to personal information

(1) Where an agency holds personal information in such a way that it can readily be retrieved, the individual concerned shall be entitled

–

(a) to obtain from the agency confirmation of whether or not the agency holds such information; and

(b) to have access to that information.

(2) Where, in accordance with subclause (1)(b), an individual is given access to personal information, the individual shall be advised that, under principle 7, the individual may request the correction of that information.

(3) The application of this principle is subject to the provisions of Parts 4 and 5.

[24] The Act defines “personal information”:²⁰

personal information means information about an identifiable individual; and includes information relating to a death that is maintained by the Registrar-General pursuant to the Births, Deaths, Marriages, and Relationships Registration Act 1995, or any former Act (as defined by the Births, Deaths, Marriages, and Relationships Act 1995)

19. At [130]; with Mr Taylor relying on Kelsey v Minister of Trade [2015] NZHC 2497, [2016] 2 NZLR 218.

²⁰ Privacy Act 1993, s 2.

Submissions

[25] It was common ground between the parties and the interveners that personal information is not limited to “private” or “sensitive” information. Rather, the definition is used in the Act in the sense of ‘information about a person’. What is personal information must be determined in context, on a case by case basis. There is no “bright-line” test as to what is personal information.

[26] Beyond that, there was disagreement between Mr Taylor, the Privacy Commissioner and the Director on the one hand and Corrections on the other as to the breadth of the definition of personal information and the significance of the access right provided by Principle 6.

[27] We will begin by summarising the relevant submissions of the Privacy Commissioner, followed by those of Mr Taylor and the Director.²¹

Privacy Commissioner’s submissions

[28] As mentioned above, the Privacy Commissioner’s grounds for seeking leave to intervene included that the meaning to be given to “personal information” is an important issue for the operation of the Act.

[29] The Privacy Commissioner’s written submissions were pitched at a relatively high level. The oral submissions given on his behalf went somewhat further with the (implicit) criticism that, in applying the decision of the majority in Harder v Proceedings Commissioner, the Tribunal was adopting a “narrow” interpretation of personal information.²²

[30] The Privacy Commissioner submitted that the right of an individual to seek access to their personal information is “the most significant entitlement” under the Act. He advocated a broad definition of personal information, submitting that would

²¹ Mr Taylor stated he adopted and endorsed the submissions of the Privacy Commissioner in a memorandum dated 19 September 2019, before also filing his own written submissions on 25 September and making oral submissions at the hearing.

²² Taylor v Chief Executive of the Department of Corrections, above n 3, at [114]–[115]; citing

Harder v Proceedings Commissioner [2000] NZCA 129; [2000] 3 NZLR 80 (CA).

align with the text and purpose of the Act, which is a human rights statute.²³ The Commissioner also pointed to the Act being part of New Zealand’s freedom of information legislation and open government regime and to the right in s 14 of the New Zealand Bill of Rights Act 1990 to “freedom of expression, including the freedom to seek, receive and impart information” as supporting a broader approach.

[31] There were two broad strands to the Commissioner’s approach to the definition of personal information. First, whether information is about an individual depends on whether it relates to that individual, in conveying something about them or their rights, obligations and interests, such that there is a sufficient connection in the circumstances between the individual and the information concerned. Whether there is a sufficient connection turns on the character of the information and the degree and amount of insight standing to be conveyed.

[32] The second strand makes reference to the reasons why a requester might seek access to the information and the uses to which they might put it, both in ensuring compliance with the Act and in exercising other rights. The Privacy Commissioner explained that “Providing access to an individual to their personal information might explain why a particular action was taken in respect of the individual and acts as an essential precondition to the exercise of complaint rights under the other privacy principles, including the right to correction of personal information, the right to challenge the accuracy of the information, the ongoing retention of the information, the fairness or lawfulness of its collection, and to ensure its lawful use and disclosure within the agency that holds it (i.e. as a check on unauthorised disclosures amongst employees).”²⁴

[33] The Commissioner also noted other important uses for access rights beyond the Act itself, including allowing an initial scoping exercise before initiating litigation and generally supporting individuals’ rights to request reasons for decisions affecting them and make complaints to other bodies including the Human Rights Commission, the Health and Disability Commissioner and the Ombudsman.

²³ Pointing to Coburn v Human Rights Commission [1994] 3 NZLR 323 (HC) at 333–335.

²⁴ Citing Case Note 289320 [2019] NZ PrivCmr 3.

[34] The Privacy Commissioner acknowledged that there needs to be a “genuine link” between the information and the individual and accepted that it is not enough that the information in question references the requester. “Personal information” must be assessed in the particular context of the request. This includes the circumstances of the requester, their relationship with the agency concerned (including any vulnerability or power imbalance), the manner in which the information was collected or generated and the information’s significance to the requester.

[35] The Privacy Commissioner submitted that the requirement that information be “about” the requester “is better conceived of as the wide gateway to the Privacy Act, which then provides a variety of mechanisms to ensure that competing interests are appropriately taken into account and liability is limited to meritorious complaints.”²⁵ In essence, the Commissioner says that, rather than rigorously identify which information is personal information about the requester at the outset, if the information is considered to be about a person “in a broader sense” agencies should proceed to determine whether withholding grounds apply rather than “getting stuck at the first hurdle”. The breadth of the definition argued for can, the Commissioner says, be managed by the application of the various withholding grounds under ss 27–29 of the Act.

[36] Regarding “mixed information” (potentially personal information about more than one individual) the Commissioner submits that the Tribunal has generally used the grounds under s 29(1), rather than definitional issues, to regulate access.²⁶ We note that Ms Casey, for Corrections, argued that leaving all “filtering” to be done under s 29 may risk depriving agencies of their rights, such as when no withholding grounds apply.

Mr Taylor’s submissions

[37] Mr Taylor adopted the submissions of the Privacy Commissioner and the Director in respect of the definition of “personal information”. He framed the issue in

25. Pointing to Katrine Evans “The Expanding Definition of Personal Information” (2017) 77 Privacy Unbound 11 at 12.
26. Making reference to Adams v New Zealand Police [1997] NZCRT 16 at 7; and Director of Human Rights Proceedings v Commissioner of Police, [2007] NZHRRT 34.

the following terms: “If there is information on a document sent to me, which relates to me, that makes it ‘about’ me. If it’s generated because of me, it’s my personal information.”

[38] Mr Taylor emphasised that holding public servants (such as Corrections officers) accountable is important and the Act may be the only accountability mechanism available in some cases. His submission is that allowing officials to operate anonymously makes establishing whether they are acting within their statutory authority (and challenging their decisions) difficult. In his brief of evidence before the Tribunal he also noted that redacting staff names and positions makes it difficult to identify how information about him is being spread or communicated.

[39] Mr Taylor said that the redacted information related to the Corrections officers’ work-related tasks, not their personal capacity. In his submission, knowing the identity of the authors and recipients of the emails is crucial to contextualising and assessing their decisions or conduct. For example, without identifiers he would be unable to tell if a lot of reports about him came from one particular officer. He conceded that the officers’ email addresses and phone numbers were less important than their names but argued that withholding even those details risks whittling away the concept of personal information.

[40] If, as Mr Taylor submitted, the redacted information was his personal information, Corrections was obliged to individually assess whether each piece of information could properly be redacted under any of the withholding grounds under the Act. Mr Taylor says Corrections did not do that. Rather it applied a blanket policy, contrary to law.²⁷ Further, he submits the withholding grounds could not in any event be made out.²⁸ There was therefore no proper basis for Corrections’ decision to withhold the information and, it follows, an interference with his privacy under s 66 of the Act.

²⁷ Kelsey v Minister of Trade, above n 19.

²⁸ Regarding s 29(1)(a) of the Act Mr Taylor submits that the withheld information did not constitute “affairs” because “affairs” require a course of conduct, event or action, which were not present. This view appears unsupported by recent authorities – see Director of Human Rights Proceedings v Commissioner of Police, above n 26, at [35]. Mr Taylor further submits disclosure would not be “unwarranted” in terms of lacking a good or sufficient reason, given no reason to oppose disclosure was offered by Corrections at the time.

Director of Human Rights Proceedings’ submissions

[41] On 17 September 2019 the Director filed a memorandum confirming that he supported the submissions filed by the Privacy Commissioner. Counsel for the Director also appeared and made oral submissions. As with the Commissioner, Counsel’s oral submissions went further than indicated by the written submissions. Counsel did not say that the end result reached by the Tribunal was necessarily wrong but criticised the “route taken” to that result and concluded that the Tribunal had misdirected itself.

[42] Like the Privacy Commissioner, the Director proceeded on the basis that the information was mixed information and favoured an approach emphasising the balancing mechanisms within the Act. The definition of personal information should screen out information that is clearly out of scope, but the substantive inquiry should occur at the second stage – whether there are appropriate withholding grounds. The Director’s submission was that “narrowing” the definition of personal information would allow an agency to effectively have two bites of the cherry: it could raise the same arguments as to definition as in considering the application of s 29(1)(a).

[43] At its baldest, the Director’s approach was that a communication between A and B about C is personal information about C. By implication that includes not just the substance of the communications, but also the identifying details of the sender and recipient. As the Privacy Commissioner argued in CBN v McKenzie Associates,²⁹ the Director said that whatever is in a file with the requester’s name on it is the requester’s personal information.

Analysis

[44] The central question is whether the redacted information was Mr Taylor’s personal information as that term is used in the Act. If it is not Mr Taylor’s personal information then it is not necessary for us to go on to consider whether any of the withholding grounds apply (including whether the alleged “blanket” policy of redacting all staff details was unlawful)³⁰ and whether, pursuant to s 66(2)(b) of the

²⁹ CBN v McKenzie Associates [2004] NZHRRT 48; (2004) 8 HRNZ 314 at [33].

³⁰ Kelsey v Minister of Trade, above n 19.

Act, there was “no proper basis” for Corrections’ decision to withhold the redacted information.

[45] “Personal information” is defined in the Act to mean “information about an identifiable individual”.³¹ It captures a very wide range of information and is not limited to information that is particularly sensitive, intimate or private.³² As the Supreme Court observed in R v Alsford, the concept of privacy is contextual and “information which may not appear to be personal or intrusive in the context in which it is supplied or obtained may well be so in another context.”³³

[46] The interpretation of “personal information” must be guided by the statutory objective of the right to access personal information and the purposes of the Act itself.³⁴ The long title to the Act is:

An Act to promote and protect individual privacy in general accordance with the Recommendation of the Council of the Organisation for Economic Cooperation and Development Concerning Guidelines Governing the Protection of Privacy and Transborder Flows of Personal Data, and, in particular, -

(a) to establish certain principles with respect to –

(i) the collection, use, and disclosure, by public and private sector agencies, of information relating to individuals; and

(ii) access by each individual to information relating to that individual and held by public and private sector agencies; and...

Is principle 6 the “most significant” entitlement under the Privacy Act?

[47] Access to personal information is a key accountability mechanism, reflected in its specific inclusion in the long title as one the particular purposes of the Act. Chief Justice Elias in Alsford described principles 1, 2 and 6 as “central to the scheme of protection under the Privacy Act” and said principle 6 “confers on the individual

³¹ Privacy Act 1993, s 2.

32. R v Alsford [2017] NZSC 42, [2017] 1 NZLR 710 at [30]; and Watson v Capital & Coast District Health Board [2015] NZHRRT 27 at [69].

³³ R v Alsford, above n 32, at [134].

³⁴ See Interpretation Act 1999, s 5; and Commerce Commission v Fonterra Cooperative Group Ltd

[2007] NZSC 36, [2007] 3 NZLR 767 at [22].

concerned an entitlement to confirmation of the information held about him by the agency and to have access to the information and to require correction of errors in it.”³⁵ The right to access is the only principle directly enforceable against public sector agencies in the courts.³⁶

[48] However, the importance of principle 6 is as part, albeit a significant part, of the overall regime of rights, entitlements and obligations under the Act, rather than constituting “the most significant entitlement provided under the Privacy Act.”

[49] That point is important because the definition of personal information is central to the operation of all but one of the principles in s 6 of the Act. “Personal information” must have the same meaning when an individual seeks to enforce his or her rights under any of the other principles and when an agency (which may include small businesses and even individuals, as well as very large government bodies) is called on to comply with any other of the principles. As Corrections put it, “If information is classified as personal information then it is subject to all these obligations in full.” In the context of this case, if the redacted information was Mr Taylor’s personal information as contended, would Corrections require his permission to disclose the names and identifying details of the prison officers on the emails? Counsel for the Director suggested that a staff roster that was relevant to Mr Taylor as a prisoner, whom staff would supervise pursuant to the roster, might possibly amount to Mr Taylor’s personal information. If that were the case, would Corrections need to seek authorisation from Mr Taylor (and other prisoners) before using that information?

The meaning of “personal information”

[50] The appellant, the Privacy Commissioner and the Director all advocate for a broad definition of “personal information”. The definition of personal information was characterised by the Commissioner as a “jurisdictional filter”. That suggests a discretionary tool. But “personal information” is a legal definition that sets the boundaries within which the privacy principles operate.

³⁵ R v Alsford, above n 32, at [138].

³⁶ Privacy Act 1993, s 11(1).

[51] The appellant and the interveners all submitted that complex issues of interpretation can be avoided by moving quickly to the second stage of analysis under the withholding grounds in s 29 of the Act, which provide an adequate balancing mechanism. However, the s 29 withholding grounds apply only to principle 6. There is no equivalent mechanism which would allow tempering or narrowing of a broad definition when it comes to be specifically applied in the context of other of the information privacy principles. This is an important factor which tells against the breadth of the definition advocated for.

[52] Implicitly linked to the submission that the right of access under principle 6 is the most significant entitlement provided under the Act is the reference by the appellant, the Privacy Commissioner and the Director to the importance of other uses to which personal information obtained under principle 6 might be put.³⁷

[53] It is no doubt correct that a very broad interpretation of personal information, enabling access to as much information as possible, may facilitate other valid interests, but the usefulness of the information that may be obtained under a principle 6 access request and the requester’s genuine and proper interest in it does not, of itself, render it personal information. There are separate regimes which address the public interest in ensuring appropriate access to personal information for those purposes. As counsel for the respondent put it, there is no need to put the whole “individual vs state jurisprudence” into the Act. The requester’s motivations and the potential uses of the information do not supplant the statutory objectives of the right and the purposes of the Act itself.³⁸

Freedom of information regime

[54] The Privacy Commissioner submitted that the definition of “personal information” should be given a broad reading in part because the Act is part of New Zealand’s freedom of information legislation. The entitlement of an individual to

³⁷ Some of these are set out above at [33].

³⁸ The United Kingdom Court of Appeal observed that the right to access personal data enables an individual to assess whether their privacy is being unlawfully infringed upon, rather than being an “automatic key to information” for any purpose, such as discovery to support complaints against third parties, and that whether information is personal information must be assessed on a “continuum of relevance” in Durant v Financial Services Authority [2003] EWCA Civ 1746, [2004] FSR 28 (UKCA) at [27]–[28].

request access to their personal information was previously contained in the Official Information Act 1982 and continues to be for legal persons.³⁹ However, as the respondent noted, the right to access the freedom of information regime is not affected by the breadth or narrowness of the definition of personal information. The definition affects only which statute the requester proceeds under. We agree that there is no reason to expand the meaning of personal information to enhance or protect the rights of access to information held by state agencies.

Section 14 Bill of Rights Act

[55] A further basis for the Commissioner’s support for a broad interpretation of personal information was that it supports the right to freedom to seek and receive information under the New Zealand Bill of Rights Act.⁴⁰ We agree with the respondent on this point too: s 14 of the Bill of Rights Act has no role in supporting an expanded definition of personal information. The respondent relied on The New Zealand Bill of Rights Act, A Commentary:⁴¹

The right to receive information prevents the state from restricting a person from receiving information that others may wish or be willing to impart to her or him. So, for example, the state is prohibited from standing between a speaker and his or her audience since each has the right of access to each other.

...

In summary, the ECtHR position is that art 10 [the equivalent to s 14] embodies a right not to be impeded in one’s efforts to access public information. There may also be an obligation on states to facilitate access to information that is not readily available. However, freedom of expression does not entitle the individual to have access to information held specifically about him or her. Those cases in the ECHR context generally trigger art 8 of the ECHR (the right to family life and privacy).

[56] Further, s 14 of the Bill of Rights Act applies only to acts done by the state or the agencies that fall within s 3 of the Bill of Rights Act. The private sector agencies and individuals subject to disclosure obligations under the Privacy Act will not generally be covered by s 3.

³⁹ Official Information Act 1982, s 24.

⁴⁰ New Zealand Bill of Rights Act 1990, s 14.

41. Andrew Butler and Petra Butler, The New Zealand Bill of Rights Act: A Commentary (2^nd ed, LexisNexis, Wellington, 2015) at [13.7.45] and [13.7.51] (emphasis added).

Section 14 Privacy Act

[57] The Privacy Commissioner was critical of the Tribunal’s references to s 14 of the Privacy Act, arguing that recourse to s 14 is unnecessary to discern whether information is “about” an individual.⁴² We do not read the Tribunal’s references as purporting to do that. Rather, the Tribunal refers to s 14 simply as a recognition in the Act of other rights and interests that must be taken into account.

[58] It is clear that the Act does not place any onus on a requester to explain the motive or reasons for an access request and we do not take the Tribunal to be saying otherwise. However, as the parties and the interveners agreed, what is personal information must be interpreted in the context of the particular access request. We agree with the Tribunal that there will be cases where the agency dealing with the request may have little contextual information to assist it in identifying all of the requester’s personal information.⁴³ While there is no onus on a requester to provide that context, nor is it for the responding agency to speculate as to the context. Where, without further context, it is not plain that the information requested is the requester’s personal information, he or she risks the request being declined.

“Mixed information”

[59] All of Mr Taylor, the Privacy Commissioner and the Director approached the issues on the basis that the information sought (being the unredacted communications, including the names and identifying details of Corrections officers) was mixed information, combining information about Mr Taylor with information about other individuals (Corrections staff). They relied on cases in which the personal information of two or more people was inextricably intertwined, such that the agency in question could not deal with a request for the personal information of one without dealing with the other(s).⁴⁴ They contended that in such cases s 29(1)(a) is the “primary regulator”,

⁴² Taylor v Chief Executive, Dept of Corrections, above n 3, at [90] and [107].

⁴³ At [81.4] and [99]–[101].

⁴⁴ Case Note 232613 [2012] NZPrivCmr 7 (September 2012); Case Note 229963 [2011] NZPrivCmr 9; Case Note 208123 [2010] NZPrivCmr 12l; Case Note 80156 [2005] NZPrivCmr 2; Case Note 17375 [1997] NZPrivCmr 6; Adams v New Zealand Police, above n 26; and Director of Human Rights Proceedings v Commissioner of Police, above n 26.

and a more appropriate point to address whether to provide access than the initial stage of determining what is personal information.⁴⁵

[60] We agree with the respondent that this case does not involve intermingling of information in that substantive sense. Rather, the information that is plainly Mr Taylor’s personal information merely appears on the same page as the redacted information (the personal information of the Corrections officers). The two are not intertwined and the material provided to Mr Taylor is not rendered unintelligible by reason of the redactions. On that point the Tribunal said that “Having ourselves examined the open and closed versions of the disclosed documents we are of the further view the redactions did not have the effect of making the substantive content of the documents unintelligible.”⁴⁶ The members of this Court also had the benefit of examining both the open and closed versions of the disclosed documents and we agree with the Tribunal’s conclusion on this point.

[61] The authorities on “mixed information” relied on by the appellant and the interveners do not assist in this case. Most of the cases cited to us involved situations where information was clearly about more than one person, such as comparisons between the complainant and other individuals in an assessment process, or the name of an informant who had provided information about the complainant to a law enforcement or decision-making body.⁴⁷

⁴⁵ O v N (No 2) [1996] NZCRT 4 at 15.

⁴⁶ Taylor v Chief Executive of the Department of Corrections, above n 3, at [126].

⁴⁷ Director of Human Rights Proceedings v Commissioner of Police, above n 26, and O v N (No 2), above n 45, both dealt with complainants who sought to learn the identities of specific ‘informants’ who had provided evidence or information adverse to them. While in both cases the identity of the informant was treated as personal information, we consider that necessarily limited to the particular facts of the case, because the identity-information existed in relation to the specific allegations made against the complainants.

Naidu v Royal Australasian College of Surgeons [2018] NZHRRT 23 involved a complainant who unsuccessfully applied for entry into orthopaedic surgery training. The respondent refused to disclose the mechanism by which his score had been calculated for assessing his application. The Tribunal held that, while it was not personal information, the mechanism’s provision was a condition precedent to being able to access the complainant’s personal information. That is not analogous to this case – Mr Taylor does not require the redacted details to understand what he has already been provided.

CBN v McKenzie Associates, above n 29, involved a complainant’s access to his former lawyer’s file, which included a number of kinds of information, including information about the complainant’s former wife and particulars of her life, alongside information about the complainant. The Tribunal expressed reservations about whether the potential for information to become relevant to a person converted it into personal information about that person. Those reservations were confirmed when Mr Taylor made a similar argument at the Tribunal, which was

[62] Having reached the view that the unredacted information in this case is not “mixed information”, an important part of the logic of Mr Taylor’s, the Privacy Commissioner’s and the Director’s argument that the Court should go straight to s 29, rather than labouring over what is encompassed within the definition of personal information, falls away.

Conclusions

[63] We agree with the Tribunal that the question of whether information is about an identifiable individual requires that the word “about” be given appropriate content.⁴⁸ We do not see the Tribunal’s decision as reading down or narrowing the definition of personal information, but rather giving a meaning to what is a legal definition.⁴⁹

[64] The meaning given to the words “about an individual” must make sense in the context of all the privacy principles, not just principle 6. It is no answer to the difficulty in fixing on a definition to say that recourse can be had to other mechanisms in the Act to calibrate privacy and other interests, particularly when those other mechanisms – specifically the withholding grounds in s 29 of the Act – apply only to principle 6.

[65] Ultimately in this case, as in the other cases cited to us, what is Mr Taylor’s personal information comes down to an examination of the particular information in the particular context. The substance of the information sought by Mr Taylor was provided to him: “all file notes, incident reports, email traffic other information of any kind in any form, that relates to me, is about myself or mentions refers to me in any way shape or form”. The information which was redacted, while appearing on the same pages as Mr Taylor’s personal information, was not “about” him. It was essentially administrative information. Nor did its omission render the communications unintelligible.

discussed and dismissed: Taylor v Chief Executive of the Department of Corrections, above n 3, at [120]–[122]. We also share those reservations.

⁴⁸ Taylor v Chief Executive of the Department of Corrections, above n 3, at [83].

49. Consistent with the Court of Appeal’s caution against an “unqualified approach” in Harder v Proceedings Commissioner, above n 22, at [23].

[66] We have reached the following conclusions.

(a) First, we are satisfied that the redacted information was not Mr Taylor’s personal information and was therefore not disclosable by Corrections.

(b) Second, because of the view we have reached on the first question, it has not been necessary for us to go on to consider whether any of the withholding grounds applied. We find there was no interference with Mr Taylor’s privacy under s 66 of the Act.

[67] Accordingly, the appeal is dismissed.

Costs

[68] Generally, the successful party in a proceeding is entitled to reclaim costs. Here that party is Corrections. This position is not changed by the fact that Mr Taylor is a litigant in person, nor by arguments around his ability to pay. However, we note that Hinton J, in the context of an application to waive security for costs, observed that the ground of appeal which this judgment determines appeared to involve a question of public interest, in respect of which costs were unlikely to be awarded regardless of the outcome.⁵⁰ Rule 14.7(e) of the High Court Rules 2016 allows for a refusal of or reduction in costs where “the proceeding concerned a matter of public interest, and the party opposing costs acted reasonably in the conduct of the proceeding”.

[69] While Mr Taylor has not succeeded in changing the law, we consider the issues his case touches have relatively broad relevance. Our preliminary view is that costs may appropriately therefore lie where they fall, including in respect of the Privacy Commissioner and the Director.⁵¹ If the parties do not agree, Corrections may file a memorandum within 10 days, following which the other parties will have a further 10 days in which to file their memoranda in response.

⁵⁰ Taylor v Chief Executive of the Department of Corrections [2019] NZHC 644 at [41].

⁵¹ Subject to s 86(4) of the Privacy Act 1993.

Gwyn J/Ms Gilchrist/Ms Hart

Counsel/Solicitors:

V E Casey QC, Wellington Crown Law, Wellington

Director of Human Rights Proceedings, Auckland Office of the Privacy Commissioner, Wellington Copy to:

A W Taylor