Home | Databases | WorldLII | Search | Feedback Human Rights Review Tribunal of New Zealand

Taylor v Corrections [2018] NZHRRT 35 (31 July 2018)

Last Updated: 31 July 2018

IN THE HUMAN RIGHTS REVIEW TRIBUNAL [2018] NZHRRT 35

Reference No. HRRT 025/2015

UNDER THE PRIVACY ACT 1993

BETWEEN ARTHUR WILLIAM TAYLOR PLAINTIFF

AND CHIEF EXECUTIVE, DEPARTMENT OF CORRECTIONS

DEFENDANT

AT AUCKLAND BEFORE:

Mr RPG Haines ONZM QC, Chairperson

Mr RK Musuku, Member Mr BK Neeson JP, Member

REPRESENTATION:

Mr AW Taylor in person

Ms V Casey QC and Ms E Devine for defendant Ms I Zadorozhnaya for Privacy Commissioner

DATE OF HEARING: 14, 15, 16 and 17 March 2016

DATE OF DECISION: 31 July 2018

DECISION OF TRIBUNAL¹

INDEX

INTRODUCTION [1]

The role of the Privacy Commissioner [4]

Delay [6]

¹ [This decision is to be cited as Taylor v Corrections [2018] NZHRRT 35.]

Open and closed documents [7]

Order in which issues to be addressed [10]

THE CASE FOR MR TAYLOR [11]

THE VIEW TAKEN BY THE PRIVACY COMMISSIONER [22]

THE CASE FOR CORRECTIONS [27]

The watermark issue [29]

The redaction issue [33]

The Corrections environment and the safety of staff [35]

Corrections’ approach to responding to Privacy Act requests [64]

The response to Mr Taylor’s request in the present case [69]

Mr Arbuckle – credibility assessment and findings [71]

THE REDACTION COMPLAINT – DISCUSSION [75]

PERSONAL INFORMATION [78]

Interpretation – text, purpose and context [78]

About [83]

Other interests to be balanced [86]

Open texture [91]

Context [92]

Judicial interpretation of personal information – senior courts [106] Judicial interpretation of personal information – the Tribunal [116]

Conclusion [124]

SECTION 29(1)(a) – UNWARRANTED DISCLOSURE OF THE AFFAIRS

OF ANOTHER [129]

THE WATERMARK COMPLAINT – DISCUSSION [133]

The principle [133]

The facts of the present case [136]

Conclusion [141]

REMEDIES [143]

Declaration [143]

Damages [144]

OVERALL CONCLUSION [148]

COSTS [149]

INTRODUCTION

[1] Mr Taylor’s case under the Privacy Act 1993 (PA) is that on 5 September 2014 he made a request that Corrections provide access to certain personal information about him held by Corrections. He alleges that when the information was so provided it was deficient in two broad respects:

[1.1] Email correspondence to and from Corrections staff about Mr Taylor had been redacted by the removal of the name, position description and contact details of those staff members.

[1.2] The content of some documents had been obscured by the addition of a watermark which read “Released Under the Privacy Act 1993”.

[2] To these allegations Corrections has responded:

[2.1] The withheld information was not personal information about Mr Taylor and was therefore not disclosable under information privacy principle 6 (IPP 6).

[2.2] In the alternative, the information was properly withheld under s 29(1)(a) of the Act (unwarranted disclosure of the affairs of another) and under s 29(1)(j) (request frivolous or vexatious or the information requested trivial).

[2.3] The obscuring of information by the watermark was inadvertent. The information was re-provided to Mr Taylor on 9 March 2015 with an apology.

[3] In this decision we give our reasons for finding:

[3.1] The redacted information was not personal information about Mr Taylor in terms of IPP 6. It is therefore not necessary to consider the alternative defence that the information was properly withheld from Mr Taylor under PA, s 29(1)(a).

[3.2] While the watermark did obscure parts of a limited number of documents, there was no consequential interference (as defined in PA, s 66) with Mr Taylor’s privacy.

The role of the Privacy Commissioner

[4] Subsequent to the filing of these proceedings on 21 May 2015 the Privacy Commissioner by letter dated 19 June 2015 gave notice under PA, s 86(5) of his intention to appear and be heard in these proceedings, noting that the complaint made about the redactions raised issues of wider application than just in relation to Mr Taylor’s case.

[5] In his written submissions presented at the hearing the Commissioner emphasised that his appearance was to assist the Tribunal on matters of law and in particular, in relation to PA, s 29(1)(a). The Commissioner did not make submissions on the merits of the case.

Delay

[6] The long delay in the delivery of this decision has already been acknowledged and explained by the Chairperson in Minutes issued on 21 July 2017, 19 April 2018 and 20 June 2018.

Open and closed documents

[7] In addition to the common bundle of documents, the Tribunal received by way of a closed bundle an unredacted copy of the Privacy Act disclosure made to Mr Taylor on 17 November 2014. The Tribunal has also received in open format the same documents but in the form they were in when provided to Mr Taylor. The Tribunal was thereby able to see for itself the information which Corrections withheld from Mr Taylor.

[8] The documents obsured in part by the watermark were filed as a separate bundle to facilitate the Tribunal assessing for itself the nature and effect of the watermark on the documents to which it had been applied.

[9] The open and closed formats of evidence and their procedural necessity were explained by the Chairperson in the Minute issued on 19 August 2015 following a case management teleconference held on that date.

Order in which issues to be addressed

[10] Once the evidence for the parties has been outlined it is intended to first address the redaction complaint and thereafter the watermark complaint. It is not practical to recite at length the evidence and submissions received in the course of the four day hearing. A brief outline of the salient points only will be given.

THE CASE FOR MR TAYLOR

[11] The case for Mr Taylor is straightforward. At the relevant time he was a prisoner at Auckland Regional Prison, Albany, Auckland. Using the required PC.01 form he on 5 September 2014 made an IPP 6 request framed in the widest of terms, a point to which we return later. He sought all file notes, incident reports, email traffic and other information for the period 1 August 2014 to 5 September 2014:

Pursuant to section 6 Principle 6 of the Privacy Act I request copies of all file notes, incident reports, email traffic other information of any kind in any form, that relates to me, is about myself or mentions refers to me in any way shape or form, dated since 1 August 2014 – and was created or generated by any Corrections employee at Auckland Prison (including PM Sherlock) – to the date this request is completed with warning any extension of the 20 statutory working day maximum will be challenged before the Privacy Commissioner – as experience shows this provision is being regularly abused by Corrections.

[12] The PC.01 form records that on 8 September 2014 Mr Taylor was told the request would be granted. It further records that the request would be referred to the Ministerial Service Team (MST) at the National Office, Wellington.

[13] By letter dated 17 November 2014, in providing Mr Taylor with the requested information, Corrections explained that some information had been withheld:

You will note that some information has been withheld in accordance with the following sections of the Privacy Act:

section 29(1)(a) as disclosure of the information would involve the unwarranted disclosure of the affairs of another individual, or of a deceased individual.

section 29(1)(f) as disclosure of the information would breach legal professional privilege. section 55(e) as information contained in any correspondence or communication that has

taken place between the office of the Commissioner and any agency and that

relates to any investigation conducted by the Commissioner under this Act,

other than information that came into existence before the commencement of that investigation.

The letter included a statement that Mr Taylor was encouraged to raise any concerns with the Department:

I trust the information provided is of assistasnce. Should you have any concerns with this response, I would encourage you to raise these concerns with the Department. Alternatively, you are advised of your right to also raise any concerns to the Privacy Commissioner under section 67 of the Privacy Act...

[14] Speaking in general terms, the documents provided to Mr Taylor comprised email traffic between Corrections staff. The content of the documents was about Mr Taylor. The redacted information comprised names, positions, titles, telephone numbers and email addresses of the sending and receiving parties.

[15] As mentioned, the complaint now made by Mr Taylor is twofold. First, it was impermissible for the name, position, title, telephone number and email address of the sender and of the recipient to be redacted. Second, that some information was obscured by the watermark.

[16] As to the redaction complaint, Mr Taylor said in evidence the removal of identifying names and positions of Corrections staff made much of the information unintelligible and also made it difficult, if not impossible, to sheet home responsibility for actions or decisions made by staff about Mr Taylor or to identify those who contributed information on which those decisions were based. Where officials operate anonymously, it becomes more difficult to establish whether they are acting within their statutory authority and to challenge their decisions.

[17] Mr Taylor told the Tribunal it is also his belief that the redactions were made pursuant to a policy adopted by Corrections in August 2014 which made provision for all staff names to be removed from information released to prison inmates under IPP 6 without giving consideration to whether each individual redaction could be justified under the withholding grounds permitted by the Privacy Act. Mr Taylor submits such policy was unlawful and relies on Kelsey v Minister of Trade [2015] NZHC 2497, [2016] 2 NZLR 218.

[18] As to the watermark complaint, Mr Taylor said in evidence that the heavy overprinting was deliberate and intended to cause him inconvenience.

[19] In support of his claims regarding the excessive watermarking Mr Taylor called as a witness Mr Brian Hunter who described himself as an information technology consultant who for the past 15 years has been involved with support and advocacy for inmates, mental health patients and WINZ clients. Much of the evidence intended to be given by Mr Hunter was excluded for the reasons set out by the Tribunal in Taylor v Corrections (Admissibility of Evidence) [2016] NZHRRT 10 (11 March 2016). Mr Hunter was, however, permitted to state in evidence that “going back to the time when Corrections used a rubber stamp” he recalled examples where, he claimed, it was “obvious that whoever has applied that stamp had moved it around the page thus causing smudging and making it difficult to read the content”. Mr Hunter offered his opinion that this occurred so frequently it could not be put down to human error and could only have been deliberate.

[20] We did not find the evidence of Mr Hunter of assistance. He did not qualify himself as an expert on the subject of watermarking or the use of software for digital marking. In addition, neither in his written statement nor in his oral evidence did Mr Hunter disguise
the fact that he sees Corrections as a corrupt organisation, guilty of allegedly serious breaches of the law, if not criminality. The admissibility decision at [42.2] records that few, if any, of the opinions offered by Mr Hunter were expressed in objective terms. In these circumstances we put his admissible evidence entirely to one side because it will not assist us to deal effectively with the issues. The Tribunal has the documents in question and can make its own assessment of the degree to which the documents are rendered illegible by the watermark. Nor does the Tribunal need assistance in determining whether the sole witness for Corrections, Mr V Arbuckle, is to be believed when he asserted that the poor quality watermarking in the present case was inadvertent, not deliberate.

[21] Mr Taylor seeks the following relief:

[21.1] A declaration that the obscuring of information by use of the watermark was an interference with Mr Taylor’s privacy.

[21.2] A declaration that the withholding of the requested IPP 6 information was an interference with Mr Taylor’s privacy.

[21.3] An order restraining Corrections from withholding personal information “without subjective consideration as to whether it is warranted”.

[21.4] An order restraining Corrections from acting in the same manner in relation to any future requests.

[21.5] A “reconsideration” order:

... the Defendant must reconsider all Privacy Act requests the Plaintiff has made where the blanket policy has been applied of withholding staff names, contact details (such as email addresses) and other information without subjective consideration as to whether that was justified. The Defendant must determine those requests in the light of findings made by the HRRT in this proceeding.

[21.6] Damages.

THE VIEW TAKEN BY THE PRIVACY COMMISSIONER

[22] As was his right, Mr Taylor filed a complaint with the Privacy Commissioner.

[23] Ordinarily the Tribunal does not in its decisions make reference to the views reached by the Commissioner in respect of any particular complaint. That is because a hearing before the Tribunal proceeds on a de novo basis, not as an appeal. The fundamental principle is that the Tribunal must decide the case on the evidence and submissions received during the course of the Tribunal hearing, not in the course of the prior papers hearing held by the Commissioner. The Tribunal conducts a face to face oral hearing and inevitably receives more detailed evidence and submissions than that made available to the Privacy Commissioner.

[24] However, in the present case the Commissioner’s ruling is relevant for the purpose of contextualising his appearance in these proceedings under PA, s 86(5) and because it records Mr Taylor’s decline of an invitation by the Commissioner to provide submissions as to why it was necessary for him (Mr Taylor) to have the names and contact information of the Corrections employees who had sent or received correspondence about him.

[25] The ruling is contained in a letter dated 5 May 2015 from the Commissioner to Corrections. The document was included in the common bundle of documents. As can
be seen from the passage quoted below, the Commissioner was of the view the information had been properly withheld under PA, ss 29(1)(f) and 55(e). However, as to the withholding of the names and contact information of Corrections employees, the Commissioner stated he had not been satisfied this information could necessarily be withheld from Mr Taylor under PA, s 29(1)(a) “in the absence of any specific argument why releasing this particular information would be unwarranted”. However, because Mr Taylor had declined to make submissions on why it was necessary for him to have the names and contact information, the information had been properly withheld under PA, s 29(1)(j) on the basis the information was trivial:

Our view

On 23 April 2015, we wrote to Mr Taylor to advise him we did not consider further action by our Office was warranted. We took this view on the basis we were satisfied that the first issue he had raised, with respect to obscured information, had been resolved as Corrections had subsequently re-released this information.

We also took the view that, having reviewed the withheld information, along with Corrections’ submissions we were satisfied this information could be withheld from Mr Taylor.

More specifically, we were satisfied that Corrections could rely on sections 29(1)(f) and 55(e) to withhold information. Please note however, we were not satisfied that the remaining information, namely names and contact information of Corrections employees who had sent or received correspondence about Mr Taylor, could necessarily be withhold from Mr Taylor under section 29(1)(a) in the absence of any specific argument why releasing this particular information would be unwarranted.

However, in the circumstances, namely that Corrections had already provided Mr Taylor with the substantive content (including time and date details) and in the absence of any specific submissions from Mr Taylor on why it was necessary for him to have this information, we took the view that the name and contact information could be withheld from Mr Taylor under section 29(1)(j) on the basis this information was trivial.

We invited Mr Taylor to comment on our view before making any final decision. Mr Taylor has responded to indicate that he does not agree with our view, but has advised he does not wish to provide us with any further comments.

[26] As to the information obsured by the watermark, the Commissioner stated he had reached the view the issue had been resolved by the re-release of the information by Corrections to Mr Taylor.

THE CASE FOR CORRECTIONS

[27] The case for Corrections is that:

[27.1] The redacted information was not personal information to which Mr Taylor was entitled.

[27.2] Alternatively, if the Tribunal found that it was personal information, Corrections was entitled under PA, s 29 to decline to provide that information.

[27.3] The text of the information inadvertently obscured by the watermark was, with a few exceptions, also not personal information. In any event, Corrections promptly supplied unobscured copies as soon as it became aware of the issue, apologised for the inadvertent technical error and took steps to prevent its recurrence.
[27.4] In relation to both complaints, Mr Taylor had not established an interference with his privacy in terms of PA, s 66.

[27.5] Mr Taylor had not established he had suffered any damage in terms of PA, s 88 and had not met the requirements of the Prisoners and Victims Claims Act 2005, ss 13 and 14. Further, in terms of PA, s 85(4) Corrections had acted in good faith for the protection of the privacy and safety of its staff.

[28] Reference will now be made to the evidence given by the only witness called by Corrections, being Mr VP Arbuckle, Deputy Chief Executive, Corporate Services, Department of Corrections.

The watermark issue

[29] Mr Arbuckle made the general point that when by letter dated 17 November 2017 Corrections had provided the requested information to Mr Taylor he (Mr Taylor) had been asked to raise any concerns with Corrections.

[30] Mr Taylor had not raised any such concerns. The first notice of any complaint by him (Mr Taylor) was when the Privacy Commissioner advised Corrections by letter dated 4 February 2015 that Mr Taylor had lodged a complaint.

[31] Only then had Corrections been alerted to the watermark problem which had affected some, but not all of the documents sent to Mr Taylor. This had been entirely inadvertent and the source of the fault had been investigated. It had been found to be an intermittent problem caused by the way staff sometimes used the Adobe redaction tool in conjunction with the scanning function. The problem had been addressed.

[32] Only a small portion of the documents had been affected by the watermark problem, a problem which tended to affect only the first and sometimes the last page of multi-paged documents. Corrections had taken steps to identify the affected documents and they had been re-released to Mr Taylor under cover of a letter dated 9 March 2015. That letter also included the Department’s explanation and an apology for the error:

I refer to the complaint you have raised with the Office of the Privacy Commissioner regarding the Department’s decision to withhold some information from the documents included in a response to you dated 17 November 2014.

I can advise that the Department has responded directly to the Privacy Commissioner regarding the decision to withhold information from you under sections 29(1)(a), 29(1)(f) and 55(e) of the Privacy Act 1993. However, you also included an example document in which information had been obscured by a watermark “Released under the Privacy Act 1993”. I apologise for this oversight which was caused by a problem with the redaction tool we use. I have gone through the documents to identify any that were obscured and reprinted them so that the watermark no longer conceals the information. This information is enclosed.

I trust this information is useful to you.

The redaction issue

[33] Mr Arbuckle confirmed it was Corrections’ view that the names and contact details of staff and others involved in sending or receiving the emails in question were not personal information about Mr Taylor. Quite properly his evidence did not address that issue, it being largely a question of law. Rather, his evidence focused on the reasons why Corrections submit the name and contact details were properly withheld under PA, s
29(1)(a). It is impractical to recite that evidence at length. A possibly incomplete summary follows.

[34] The evidence of Mr Arbuckle addressed three broad topics:

[34.1] The Department’s concerns relating to staff safety and its view of the importance of staff privacy in protecting both staff safety and the safe management of custodial and community based sentences.

[34.2] The Department’s processes for responding to Privacy Act requests and its approach to protecting staff privacy under the Privacy Act.

[34.3] The Department’s response to Mr Taylor’s request under the Privacy Act that is the subject of this claim.

The Corrections environment and the safety of staff

[35] Mr Arbuckle explained Corrections is responsible for the management of New Zealand’s corrections system. It must ensure that prisoners and community based offenders comply with the sentences and orders imposed by the courts and the Parole Board. The Department and its staff are tasked with ensuring those sentences and orders are administered in a safe, secure, humane and effective manner, with the paramount consideration being public safety. The Department is also tasked with providing information to the courts and the Parole Board to assist them in decision-making.

[36] At the time of the hearing Corrections:

[36.1] Employed nearly 8,000 staff and engaged with over 2,000 registered volunteers;

[36.2] Operated 16 prisons and 167 community sites;

[36.3] Managed, on average, around 9,000 people in prisons and 29,000 community based offenders on any given day.

[37] The Corrections’ working environment is unique. With the exception of remand prisoners (those facing charges who have been remanded in custody, many of whom have existing criminal records) or those on electronically monitored bail, all the work of Corrections is with those who have been convicted of criminal offending. Staff working in prisons deal consistently with serious offenders. Staff working in community sites deal with a range of offenders, including those sentenced to community based sentences, those on home detention and serious offenders on parole or subject to extended supervision orders.

[38] Those convicted of criminal offending have demonstrated a willingness to act without regard to the law and those convicted of violent offending have demonstrated a willingness to act with violence. Most offenders also demonstrate poor impulse control and a disregard of the rights and interests of others. Many offenders use violent behaviour to “resolve” issues or to express themselves.

[39] Those offenders managed in prisons include New Zealand’s most violent offenders and those with the most serious record of re-offending.
[40] Data held by Corrections shows that those on remand are over-represented in violent incidents in prison. These prisoners present a particular challenge as they are outside the scope of most rehabilitation programmes and have security and segregation requirements above those of average sentenced prisoners. Remand prisoners can also be suffering from recent abuse of alcohol or drugs and can be volatile as a result of uncertainty while awaiting trial or sentencing.

[41] Gangs also make up a significant part of New Zealand’s offender population. Gang members re-offend at more than twice the rate of non-gang members and are involved in a wide range of criminal offending. Gang members give priority to conforming to the rules and expectations of their organisation and both this and the potential for conflict between different gangs increases the risks to Corrections staff, particularly in prisons. In addition, individual members in prisons have access to the gang network to facilitate intimidation and offending outside the prison and this is exacerbated by the network of patched and associate and affiliate members, which means that not all gang members are readily identifiable.

[42] Another significant feature of Corrections work is that staff deal with high levels of people with mental illness. Research has shown that mental illness is five times more common among prisoners than in the general population. The high proportion of offenders in this category creates additional and often unpredictable risks and challenges for staff.

[43] In emphasising that Corrections staff face risks of a nature and level that is unique, Mr Arbuckle said that this is not just to do with the fact that staff deal with offenders. It is also the nature of the work they do. Frontline staff are the face of the offender’s sentence, with all the restrictions and loss of freedom that this involves. Staff are responsible for implementing restrictions that affect every aspect of the prisoner’s day to day life: unlock times, when they can associate with other prisoners and who they can associate with; what they are allowed to do and when; where and what they eat; when, how and how often they can see their families; when they can use the phone; what items are allowed in their cells; what can be sent to them from outside and so on.

[44] Prison staff are custodial officers, undertaking the day to day implementation of the sentence imposed by the sentencing court. Their work is not welcomed by offenders and they are often involved in acting against what the offender wants.

[45] Prison environments can be violent and abusive for staff. Aggressive and abusive language can be commonplace. Physical assaults are not uncommon and the rate of serious assaults resulting in injury to staff was one of the key concerns that led to the establishment of the Expert Advisory Panel on staff safety and the on-going staff safety initiatives later described by Mr Arbuckle in his evidence.

[46] While direct violence against staff in prisons is a serious concern, it is also a particular feature of working in a prison that threats to staff are often indirect. The prison environment is very controlled and physical assaults on staff will always be responded to very seriously. However, as prisoners often cannot threaten staff directly in their workplace, staff can face serious threats outside the work environment, and particularly in their home and to their families. Prisoners use information about staff members to threaten them: a staff member who is told “I know where you live” or “I know where your kids go to school” by a prisoner with known gang associations is usually being threatened with harm to his or her family.
[47] There are many examples of this type of behaviour by prisoners. It may be motivated by a desire to obtain special treatment or a favour from the staff member, to make life easier for the prisoner. It may be motivated by a desire for retribution for something the staff member has done which has had an adverse impact on the prisoner, such as preventing contraband coming in to the prison, an unfavourable report or reporting on a disciplinary matter. It may be simply that the staff member works for Corrections and is “unpopular” (for example, because of the role that they work in).

[48] One of the particularly difficult aspects of this for staff is that while they know the names and the faces of the prisoners they are dealing with each day, they do not know who a prisoner might be using to harm them in the community. The threat could come from anyone at any time.

[49] Community staff face both similar and different challenges, reflecting the nature of their work. Again, their day to day work usually involves an unwelcome interference in the lives of offenders. Staff involved in administering community sentences, parole and extended supervision orders exercise restrictive powers over offenders and can also be involved in making decisions or providing reports that can have significant adverse effects. There is a similar potential for threats and harm to influence staff in how they do their work, or by way of retribution, although more often the violence against community staff takes the form of verbal threats and intimidation rather than direct physical assault. These staff are equally exposed to general abuse and harassment just because they work in Corrections.

[50] The risks and threats to staff working in prisons and in the community can be very serious. On occasion the harassment and threats have led to staff needing to relocate themselves and their families to a different town. Other threats have required Police involvement and many staff are in positions where they routinely take quite high levels of precautions day to day to keep themselves and their families safe. Pets are also a particular target.

[51] In addition to physical safety, staff can be subject to aggressive harassment by current and ex-prisoners and community based offenders. The expansion of social media has made this a significant issue, as it is now easy for offenders to publish material (either directly or through associates) and to engage in public harassment of staff. Staff members have been targeted by the public release of their personal information or by harassment such as abusive name calling and caricatures on social media sites. Female staff can be particularly targeted by sexist or sexual slurs. While this is a less extreme threat than physical violence, it can be very distressing. No staff in any organisation should be unnecessarily exposed to this type of harassment simply as a result of doing their job. Further, in the Corrections context, the fear of the harassment escalating to physical violence is also very real.

[52] The additional challenges posed by offenders with mental illnesses creates a further layer of unpredictable and at times very serious threats to staff safety. Fixation on particular staff members can be a real issue and this can develop without warning and go in unpredictable directions.

[53] Mr Arbuckle explained that staff were the backbone of Corrections. Without staff working at sites across the country Corrections could not do what it does. Keeping staff safe is therefore a top priority for Corrections.
[54] As a result of the work of the Advisory Panel Corrections has embarked on a safety plan “Keeping Each Other Safe”. This plan outlines 40 work streams and initiatives focused on the importance of staff safety and also creating momentum for the development and implementation of new safety initiatives outside the initial plan. Among the initiatives is the training and guidelines for staff on ensuring personal safety, covering how to protect personal information and how to maintain safety at home, at work and on- line.

[55] In his evidence Mr Arbuckle added that the concern with staff being threatened, harassed and intimidated related not only to their own safety (and that of their families) but also to public safety and the safe and effective administration of sentences. One of the key concerns in the prison environment was keeping staff safe from manipulation and coercion by prisoners, which can lead to corruption.

[56] Mr Arbuckle told the Tribunal that were staff to be vulnerable to corruption and manipulation the adverse consequences for public safety and the safe and effective administration of prisons could not be overstated. Obvious risks are uncontrolled contraband, improper and unfair administration of entitlements, privileges and disciplinary processes; inappropriately weighted reports to the judiciary and the Parole Board, compromising the sentences and orders being made. Staff vulnerable to corruption and manipulation cede authority in the prison to particular prisoners, undermining and potentially collapsing the integrity of the entire system.

[57] Protecting staff from coercion and harassment is therefore important not only for their health and safety at work, and their and their families’ safety in the community, but also for controlling manipulation and potential corruption in the prisons.

[58] Keeping personal information private is a key aspect of the response to these factors.

[59] It is known that prisoners observe staff closely and use a variety of means to build up small bits of information about staff over time, which might then be used quite subtly. For example, a prisoner may notice that a staff member is distracted or withdrawn, or wearing a less tidy uniform, or is working a lot of overtime. The prisoner may express concern to another staff member about this who may let drop a piece of private information. This all goes into the sort of “profile” prisoners collect to identify which staff might be vulnerable to coercion, corruption or manipulation and how they might go about doing that.

[60] Corrections staff are trained that it is critically important to protect their privacy and the privacy of those they work with, as any personal information can be used against them. In the work environment staff are advised not to discuss anything private about themselves or others if an offender could be listening; not to have written information where an offender may see it (eg an open bag, a visible computer screen or left in a rubbish bin); not to give out private information without verification of the identity of the person requesting it.

[61] Staff are also advised about:

[61.1] Shifting to the unpublished electoral roll.

[61.2] Shifting to the confidential motor vehicle registration register.
[61.3] Having a restricted access or unlisted phone number.

[61.4] Being aware of information disclosed to the Companies Office if the staff member or their family members have registered a company or a trust and if possible to arrange for others to provide the published information instead (such as lawyers or accountants).

[61.5] Protecting property ownership details.

[61.6] Protecting identity documents.

[61.7] Being careful about having items visible in their car that may identify them as working for Corrections.

[62] Corrections also provides comprehensive guidance for staff on online safety as Facebook and other social media sites can be a significant problem for staff and their families. Such social media sites allow offenders to find out where staff live, where they go on holiday, where their children go to school and other personal information that can be used against them. The problem, however, is not easily addressed as it is not realistic to expect employees’ families to have no engagement with social media.

[63] However, there is a developing expectation, particularly in high risk areas, that privacy protection measures are not merely recommendations that staff should follow but are also requirements of the job and failure to comply with them will be an employment issue for the staff member. This is part of Corrections meeting its obligations as an employer under the Health and Safety legislation which provides it is up to the employer to take steps to ensure that staff take appropriate steps to keep themselves safe.

Corrections’ approach to responding to Privacy Act requests

[64] As earlier mentioned, the essence of Mr Taylor’s complaint in relation to the redacted documents is that the identifying names and positions of Corrections staff were removed and no separate decision was made in relation to each redaction as to whether the redaction was justified under PA, s 29(1)(a). He alleges a blanket determination was made that the identifying names and positions of all Corrections staff were to be removed.

[65] Addressing that complaint Mr Arbuckle said that, leaving aside the question whether the information was personal information, the so-called blanket redaction of staff names under PA, s 29(1)(a) related to a particular practice that developed for a period in the Ministerial Services Team (MST) at National Office in response to a particular situation:

[65.1] Corrections receives a very large number of Privacy Act requests from or on behalf of prisoners or community based offenders. These requests are not managed centrally. Most are handled directly by the prison or Community Corrections site concerned and not referred to National Office at all. This is encouraged. Privacy Act requests must be responded to within 20 working days and staff on site are usually in the best position to locate the relevant material and respond to the request promptly.

[65.2] However, there are a few offenders (usually somewhere between five and ten) where the MST at National Office provides active support to the site in responding to Privacy Act requests. These are typically prisoners who make a
large number of requests and/or who routinely engage in time-consuming disputes on these issues.

[65.3] Mr Taylor is in this category. Since 2007 he has made approximately 260 requests under the Privacy Act and Official Information Act. His Privacy Act requests are usually referred to the MST for response.

[65.4] Many of the requests handled by the MST are large and complex and many involve documents and information dating back over a number of years.

[65.5] Staff in the MST tend to have limited knowledge of the offender and have found it difficult to assess whether the disclosure of staff names should be made (on the basis that the names would be known to the offender) or withheld (on the basis that the disclosure was unwarranted in terms of the staff member’s privacy). More critically, MST staff are not in a position to be aware of situations where there might be an iminent risk of harm to a staff member.

[65.6] MST staff attempted to address this by contacting individual staff members to check whether there were particular safety concerns. However, in the context of often large and complex requests that could involve very large numbers of staff this was causing significant delays in response times. Even with the extensions allowed under the Act, MST responses were often not meeting expectations of appropriate response times and the process was becoming unwieldy.

[65.7] Discussions with the Office of the Privacy Commissioner (OPC) also made it clear Corrections was at risk of breaching its obligations under the Act in relation to some of these requests. There was also a concern that sometimes staff could not be contacted in that with the passage of time they may have left Corrections or just be on leave at the time.

[65.8] In mid-2014 a particular incident brought this issue to a head.

[65.9] On 25 June 2014 MST staff raised these issues with the OPC at one of the regular meetings between the agencies. MST staff proposed that a more straightforward approach be adopted to address the two concerns of delay and staff safety. The approach proposed was that for responses processed by MST, all staff names would be redacted under PA, s 29(1)(a) unless there was a specific request for identifying information to be disclosed. MST staff understood at the time the OPC was supportive of this approach.

[65.10] In July 2014 a “practice update” was issued by Corrections to MST staff as follows:

Change to practice – withholding of staff names

Until now, Corrections has largely considered that offenders and prisoners have the right to staff names in information request responses. Generally, if the staff member has had regular dealings with the individual, or would be known to the individual, then the staff member’s name has not been withheld from documents provided.

Following consultation with the Office of the Privacy Commissioner, it has been recognised that anticipating the interference of privacy to our staff, or the risk to their safety should their name/s be disclosed, is very difficult. The volume of information prepared for release by Corrections also means that consistency is difficult to achieve, and it is not usually practical to consult with all staff named in documents.

The safety of Corrections staff is of paramount importance. Therefore:

all staff names will now be withheld from information released, unless there is a specific request for identifying information, which will be considered on a case by case basis.

[65.11] This approach adopted by the MST in July 2014 was not rolled out across the Department.

[65.12] It is not clear whether there was a change in view in the OPC or whether the OPC position was misunderstood by MST staff at the June 2014 meeting, but it subsequently became clear the OPC was not supportive of this approach by the MST.

[65.13] The MST accordingly revised its approach and MST staff were informed that the release of staff names (at least to the extent that they appeared to be part of the personal information of the requester) had to be considered on a case by case basis before any redactions were made.

[65.14] In November 2015 new guidelines were issued to the MST. In relation to PA, s 29(1)(a) they stated that a decision under this provision “is a subjective process”:

Withholding of information about other individuals

References in the requested information to other individuals are a particular area to consider when assessing a Privacy Act request. These individuals can include friends, family or whanau, associates, neighbours, other offenders, or Corrections staff member and/or contractors.

The Privacy Act states that information about other individuals should be withheld where the release would, “... involve the unwarranted disclosure of the affairs ...” of that other individual. This determination is a subjective process.

The following are some key decisions that need to be considered, which will inform a decision about whether other individuals’ names, or personal information, should be withheld:

...

Issuing a decision

In most cases the requestor does not disclose the reason for their information request. There may be occasions, however, when it subsequently becomes apparent that some redacted names are necessary for the requestor’s original purpose. On that basis, it would be prudent for the Corrections decision letter to advise the requestor that they can ask Corrections to revisit any specific redactions with a rationale of the need to access the identity.

[65.15] Because Mr Taylor’s information request was made on 5 September 2014 with the information being provided by Corrections under cover of a letter dated 17 November 2014, the November 2015 practice guidelines were not used by Corrections in Mr Taylor’s case.

[66] While it is only the interpretation applied by the MST in 2014 which is of direct relevance to the application of PA, s 29(1)(a) to the present case, for completeness mention is made of the interpretation of the Privacy Act as applied by Corrections outside the MST context. The relevant policy and guidelines, prepared in 2013 and updated from time to time, have consistently addressed PA, s 29(1)(a) in the following terms:

Corrections needs to ensure that it does not provide details of other people that would be an unwarranted release of their information. Each case is considered on its own merits.

Corrections would normally withhold all names and identifying aspects relating to other individuals, including staff members, as the release of this information could interfere with the other individuals’ privacy under section 29(1)(a). Besides withholding the other people’s names, Corrections can also withhold any words that would allow the requester to identify the individual including phrases such as “neighbour”, “cell-mate”, and “community work party member”. It also means we can withhold addresses, phone numbers, and any identifying information.

However, if the offender is aware of the other individual, especially in the above examples where he/she was fighting with that other prisoner, it might not be necessary to remove that name. Where the name is well known to the requester, the further release will not meet the definition described in the Privacy Act of being an unwarranted disclosure.

[67] Mr Arbuckle said that Corrections’ approach to the release of staff information is being increasingly informed by the growing awareness of the importance of keeping staff information private, for both their safety and the safety of their families, and to counter the risks to public safety of staff being threatened, coerced or manipulated by offenders. In relation to the published policy and guidelines issued in 2013 he told the Tribunal that they have been, and continue to be, updated from time to time. Echoing the terms of the policy he said that while the usual position would be that staff names would be redacted, this has to be assessed on a case by case basis by the person preparing the response.

[68] Mr Arbuckle acknowledged, however, that the guidelines are just that, guidelines and there may be other reasons that require the names of Corrections staff to be released or other reasons why they should be withheld. The development of more detailed guidance required the consideration of complex matters relevant to the obligations of Corrections:

[68.1] As a good employer and under the Health and Safety legislation, to protect staff and their families from harm and harassment.

[68.2] Under the Corrections Act, to ensure that sentences and orders are administered in a safe, secure and effective manner, with the maintenance of public safety as the paramount consideration.

[68.3] Under the Privacy Act, to ensure appropriate access by individuals to their personal information held by the Department.

The response to Mr Taylor’s request in the present case

[69] After making reference to the PC.01 form completed by Mr Taylor on 5 September 2014 and the provision of the information by Corrections by letter dated 17 November 2014 Mr Arbuckle drew attention to the fact that the final paragraph of the Corrections letter had contained the following statement:

Should you have any concerns with this response, I would encourage you to raise these concerns with the Department.

Mr Arbuckle told the Tribunal that Mr Taylor had not in fact raised any concerns. He (Mr Arbuckle) added that the first notice of any dissatisfaction on the part of Mr Taylor was when the Privacy Commissioner advised the Chief Executive that he (Mr Taylor) had lodged a complaint. It was also the first time the Department had been alerted to the watermark problem. Mr Arbuckle said the inappropriate watermarking of some of the documents was entirely inadvertent. It was found this was an occasional problem caused
by the way staff sometimes used the Adobe redaction tool in conjunction with the scanning function. That problem had since been addressed and in addition, by letter dated 9 March 2015 an apology had been offered to Mr Taylor together with reprints of the relevant documents so that the watermark no longer concealed the information.

[70] With reference to the letter dated 5 May 2015 from the Privacy Commissioner to Corrections Mr Arbuckle noted the Commissioner had reported Mr Taylor had been asked by the Commissioner why it had been necessary for him (Mr Taylor) to have the names and contact information of Corrections employees but that Mr Taylor had declined to make submissions.

Mr Arbuckle – credibility assessment and findings

[71] In cross-examination Mr Taylor raised a number of issues with Mr Arbuckle but on no issue of substance was Mr Arbuckle’s evidence in chief qualified or altered. There was no inconsistency between his evidence regarding the problems and potential dangers in Corrections staff using social media and the evidence tendered by Mr Taylor that it is possible to locate on Facebook pages operated by some Corrections staff. Mr Arbuckle made it clear it was not realistic to expect employees’ families to have no engagement with social media though it was a “developing expectation”, particularly in higher risk areas, that privacy protection measures are not merely recommendations that staff should follow but are also requirements of the job.

[72] Nor was there any inconsistency between the safety precautions spoken of by Mr Arbuckle and the fact that senior Corrections staff (including Mr Arbuckle) have a LinkedIn page. He correctly distinguished the outward facing roles of senior executives from that of “offender facing staff”.

[73] Our conclusion was that Mr Arbuckle was a careful, conscientious and credible witness. His evidence is accepted without qualification.

[74] It is now intended to address the legal issues.

THE REDACTION COMPLAINT – DISCUSSION

[75] The foundation of Mr Taylor’s case is IPP 6 which provides:

[76] The issue is whether, in the particular context, Corrections is correct in arguing that the names, positions, titles, phone numbers and email addresses withheld from Mr Taylor were not, in the particular context, personal information about Mr Taylor.
[77] The answer to this question will be determined by the meaning to be given to “personal information”. Only if information is personal information will the withholding provisions in PA, s 29(1)(a) become relevant to the case.

PERSONAL INFORMATION

Interpretation – text, purpose and context

[78] The definition of “personal information” is central to the scope of IPP 6 and to the Act as a whole since all of the privacy principles and all of the withholding provisions apply only to information that is “personal information”. “Personal information” is defined in PA, s 2(1):

personal information means information about an identifiable individual; and includes information relating to a death that is maintained by the Registrar-General pursuant to the Births, Deaths, Marriages, and Relationships Registration Act 1995, or any former Act (as defined by the Births, Deaths, Marriages, and Relationships Registration Act 1995)

[79] “Information” is not defined in the Act, which appears to be deliberate. Speaking of the forerunner to the present provisions McMullin J in Commissioner of Police v Ombudsman [1988] NZCA 211; [1988] 1 NZLR 385 (CA) at 402 held that the word denotes “that which informs, instructs, tells or makes aware”:

"Information" is not defined in the [Official Information] Act. From this it may be inferred that the draftsman was prepared to adopt the ordinary dictionary meaning of that word. Information in its ordinary dictionary meaning is that which informs, instructs, tells or makes aware.

[80] The definition of “personal information” is very broad, and is not limited to information that is particularly sensitive, intimate or private.

[81] Broad as the definition may be, it is nevertheless not without limitation. Applying the interpretive principles of text, purpose and context the following points must be made:

[81.1] About. The Act does not apply to all information. It applies only to personal information. The definition requires that that information must be “about” an identifiable individual. This explicit requirement must be given proper recognition and weight.

[81.2] Other interests to be balanced. The Act does not promote the interests of the individual making the IPP 6 request above all other interests. While the Act provides a framework for protecting an individual’s right to privacy and of access to personal information, it also recognises that other rights and interests must at times be taken into account.

[81.3] Open texture. A key feature of the Act is that it is not rules-based. It is principles-based and open textured. Application of the Act is in significant respects context specific. For good reason there is no “bright line” interpretation of personal information. The definition as well as the privacy principles must be applied and assessed in relation to each individual set of facts as they arise. That is, whether information is “about” an identifiable individual will often depend on the context of the particular facts.

[81.4] Context. The agency holding the information requested under IPP 6 may not be in a position to identify all of that which is personal information about the requester unless the requester provides the relevant context. While the requester
is not required to give explanation or context for an IPP 6 request, in some cases failure to do so will create a risk the agency will have insufficient knowledge with which to identify all the information which, in the context known only to the requester, is in truth personal information about the requester.

[82] Each of these points is now expanded upon.

About

[83] Broad as the definition of personal information may be it is not without limit. The definition requires that the information be “about” an identifiable individual. This is a significant qualification and must be given appropriate content.

[84] As in the case of “information”, there is no statutory definition of “about” and it may be inferred the ordinary dictionary meaning is intended. The Oxford English Dictionary (Online 3^rd ed, 2017) offers the following meaning in the context of expressing relation or connection:

c. to be (all) about: (a) to have as subject matter, to be concerned with; (b) to consist of essentially, to have as point or purpose; that is what it is all about: that is the reality of a particular situation or of life in general; (c) to be principally concerned with; to be in favour of or fond of. [Emphasis in original]

All of these expressions convey a relationship or connection that is more than tenuous.

[85] The point at which information ceases to be “about” a named individual may in some circumstances be difficult to identify with precision. This is inherent in the open- textured language of the Act. But the idea of a “continuum of relevance or proximity” is not new in the information privacy context and indeed may be of assistance. See Durant v Financial Services Authority [2003] EWCA Civ 1746, [2004] FSR 28 at [28]. At some point the connection will be so tenuous that the information will not be “about” the individual.

Other interests to be balanced

[86] It is plain from the text of the Act that information privacy is not an absolute right or value. It can be overridden in particular circumstances by other rights and interests.

[87] The Privacy Act recognises this in a number of ways. For example, it includes a range of exceptions within the information privacy principles themselves. See IPPs 2, 3, 6, 10 and 11. Those exceptions modify the application of the principles in important ways by allowing agencies not to comply with a principle for such reasons as that non- compliance is necessary to protect interests such as health, safety and maintenance of the law; that compliance would not be reasonably practicable in the circumstances; or that the individual to whom the information relates has authorised non-compliance.

[88] Specific exceptions to IPP 6 are set out in ss 27 to 29 of the Act. The good reasons listed in s 27 for refusing access to personal information include prejudicing security or defence or the maintenance of the law, including the prevention, investigation and detection of offences and the right to a fair trial or endangering the safety of any individual. Section 28 protects trade secrets and commercial positions. Section 29 lists no fewer than eleven other reasons justifying the refusal of an information request including circumstances where the disclosure of the information would involve the unwarranted disclosure of the affairs of another individual; the disclosure of evaluative material; the
disclosure of information likely to prejudice the physical or mental health of an individual; disclosure contrary to the interests of an individual under the age of 16; prejudicing the safe custody or the rehabilitation of an individual convicted of an offence or detained in custody; breach of legal professional privilege; revealing the source of information of a bona fide news media journalist where the information is subject to an obligation of confidence and finally where the request is frivolous or vexatious, or the informaton requested is trivial. Section 29(2) provides further exceptions to IPP 6 where the information requested is not readily retrievable or does not exist or cannot be found.

[89] Even those principles that do not include exceptions are generally qualified in some way, particularly by providing that an agency must take only such steps as are reasonable in the circumstances. There are other exemptions and exclusions. Exclusions refer to entities or types of information that are not covered by the privacy principles at all, notably the news media in the course of their news activities. Exemptions provide that particular types of agency or information, although not excluded altogether from the scheme of the Act, do not have to comply with certain privacy principles. For example, intelligence organisations are required to comply only with IPPs 6, 7 and 12.

[90] So while the Act provides a framework for protecting an individual’s right to privacy of personal information it also recognises that other rights and interests may at times have to be taken into account. Section 14 makes this explicit in the context of the performance by the Privacy Commissioner of his or her powers. As it is a section referred to by the Court of Appeal in a 2000 decision shortly to be discussed the text of s 14 follows:

14 Commissioner to have regard to certain matters

In the performance of his or her functions, and the exercise of his or her powers, under this Act, the Commissioner shall—

(a) have due regard for the protection of important human rights and social interests that compete with privacy, including the general desirability of a free flow of information and the recognition of the right of government and business to achieve their objectives in an efficient way; and
(b) take account of international obligations accepted by New Zealand, including those concerning the international technology of communications; and
(c) consider any developing general international guidelines relevant to the better protection of individual privacy; and
(d) have due regard to the information privacy principles and the public register privacy principles.

Open texture

[91] While the Long Title of the Privacy Act speaks of promoting and protecting individual privacy, it also speaks of achieving this end through “certain principles”. As noted by the Law Commission in its Review of the Privacy Act 1993: Review of the Law of Privacy Stage 4 (NZLC IP17, 2010) at [2.6] a key feature of the Privacy Act is that it is not rules-based. It is principles-based and open-textured, and regulates in a rather light- handed way. The open-textured nature of the Act means that judgment is required in its application since it does not set out detailed steps for agencies to follow or provide a checklist for compliance. The privacy principles must be applied and assessed in relation to each individual set of facts as they arise. See similarly the subsequent Law Commission Report Review of the Privacy Act 1993: Review of the Law of Privacy Stage 4 (NZLC R123, 2011) at [2.9] to [2.13] which emphasises that the principles do not provide the certainty of “bright line” rules:

2.9 The Act deliberately takes a flexible, open-textured approach to regulating the collection, storage, use and disclosure of personal information. Rather than setting out strict rules

Context

about how personal information may be handled, the Act is based on a set of 12 privacy principles. These principles provide agencies with a high degree of flexibility in terms of how they comply with them.

[92] Access under IPP 6 to personal information held by a public sector agency is a right enforceable in a court of law. See PA, s 11. Exercise of that right does not require justification or explanation. An individual is entitled to make an “everything” request of the kind made by Mr Taylor in the present case.

[93] The agency then has an obligation under PA, s 40 to determine, as soon as reasonably practicable and in any case not later than 20 working days after receipt of the request whether the request is to be granted, and if it is to be granted, the manner and for what charge (if any) and also to give notice of the decision to the individual.

[94] The agency may refuse to disclose information requested pursuant to IPP 6, but only on one or more of the grounds set out in PA, ss 27, 28 and 29. See PA, s 30. Where information is withheld, that information may be deleted from any document made available to the requester. See PA, s 43.

[95] Of necessity there is no participation by the individual in the decisions made by the agency under PA, ss 27, 28, 29, 40 and 43.

[96] An individual dissatisfied with any of these decisions has as a remedy the ability to make a complaint to the Privacy Commissioner under Part 8 of the Act and thereafter to bring proceedings before the Tribunal.

[97] In summary, the Act leaves to the agency the task of deciding (inter alia): [97.1] Whether the request is to be granted and if so, in what manner. [97.2] Whether the information held by the agency is personal information. [97.3] Whether information is to be withheld under ss 27 to 29.
[97.4] Whether redactions are to be made from any document.

[98] All of these decisions are made without the agency necessarily knowing why the access request has been made, what (if anything) the requester is looking for or the use to which the information is to be put. That context, while known to the individual is, in the Tribunal’s experience, almost invariably not disclosed to the agency.

[99] Because agencies will not ordinarily have the benefit of the full context of an access request they must necessarily make important decisions based only on the content of the particular request. Consequently a decision that certain information is not personal information may be entirely correct if that decision is based on the wording of the access request but it may equally be wrong if assessed against the (undisclosed) full context of the individual’s reasons for the request and the purpose to which the information is to be put.

[100] In addition the decisions in Harder and Geary (about to be discussed) illustrate that opinons on what is personal information may well differ. The open-textured definition (“about an individual”) in an Act which itself is open-textured inevitably means there is no
hard edge or bright line test for when information is “personal information”. While in many cases this may not present challenge or difficulty, there will be cases in which context will be everything and that the ambit of disclosure will be controlled by the degree to which the context of the request is disclosed by the person making the request.

[101] An agency (as here) faced with an “everything” request couched in general terms and which discloses nothing as to the purpose or context of the request is not required to speculate as to what the actual context might be. It is the requester alone who holds that information but if it is withheld (as the requester has a right to do), the requester must accept as a consequence that the agency will process the request according to the terms in which the request is framed.

[102] A dissatisfied individual can then complain to the Privacy Commissioner and thereby enter the meaningful (and largely successful) mediation process facilitated by him (or her) and most recently described in Gray v Ministry for Children [2018] NZHRRT 13 (11 April 2018) at [17] to [22]. As the facts of the present case again demonstrate, the individual will then have opportunity to provide the context relevant to determining whether, in the light of that context, disclosure by the agency ought to be broadened.

[103] In the present case Mr Taylor did not in the complaint process make specific submissions on why it was necessary for him to have the names, positions, titles, phone numbers and email addresses of the sending and receiving parties. He was invited by the Privacy Commissioner to make submissions on the point but declined to do so.

[104] In proceedings before the Tribunal a complaint that an agency has wrongfully withheld personal information must be assessed against the wording of the IPP 6 request and the context of that request as disclosed by the individual at the time of the request or which was necessarily known by the agency at that time. Whether an agency was right or wrong in classifying information as either “personal” or “not personal” is a question which must be determined on facts and circumstances as so disclosed or known, not with hindsight.

[105] It is now possible to address the relevant court and tribunal decisions on the meaning and application of personal information.

Judicial interpretation of personal information – senior courts

[106] The first senior court decision is that of Harder v Proceedings Commissioner [2000] NZCA 129; [2000] 3 NZLR 80 (CA). In that case one of the issues was whether, in recording two telephone conversations, a lawyer (Mr Harder) had collected personal information about the caller, Ms C. Mr Harder was acting for a man who had been charged with breaching a non- violence order made in favour of the caller. She contacted Mr Harder by telephone before the charge was due to be heard and made an offer to resolve the matter which would have involved her asking the police to withdraw the charge. Her offer also involved Mr Harder’s client paying to her reparation moneys which she had earlier been awarded. For reasons given in the judgment, it became unnecessary for the Court to determine the “personal information” issue but the majority (Elias CJ, Thomas and Tipping JJ) nevertheless addressed the issue. They observed sight appeared to have been lost that in determining the reach of “personal information” other provisions of the Act had to be taken into account. They cautioned that an unqualified approach (ie one not qualified by the context of the Act) to what constitutes “information about an identifiable individual” would lead readily to breaches of one or more of the information privacy principles:

[23] It is, in the circumstances, unnecessary to address the personal information issue. The case does not turn on this point which must remain open for determination when it directly arises. Nevertheless we consider it appropriate to make the following observations. The information privacy principles are all concerned with personal information. That concept is a central feature of the Act. An unqualified approach to what constitutes “information about an identifiable individual” will lead readily to breaches of one or more of the information privacy principles. It is a feature of the Act that there can be a breach of an information privacy principle, yet whether that breach becomes an interference with privacy in terms of s 66 is dependent on the opinion of the Commissioner or the tribunal as to whether the action of the alleged contravener has had one or more of the results referred to in s 66(1)(b). The approach of the Commissioner and the tribunal in the present case does not suggest that this provision has been viewed alongside the balancing provisions of s 14(a). They require the Commissioner, and implicitly others involved in the interpretation and administration of the Act, to have due regard for the protection of important human rights and social interests that compete with privacy, including the general desirability of a free flow of information and the recognition of the right of government and business to achieve their objectives in an efficient way. Those concepts are thus relevant to the scope of the definition of personal information.

[107] We see nothing controversial in the obiter statement by the majority that in the interpretation and administration of the Act (and in determining the reach and application of the definition of personal information), due regard must be had for the protection of important human rights and social interests that compete with privacy, including the general desirability of a free flow of information and the recognition of the right of government and business to achieve their objectives in an efficient way. For the reasons we have given earlier, all this is implicit in the terms of the Act. If any criticism is to be made of the majority observations it is that PA, s 14(a) alone is referenced, not the broader features of the Act earlier examined under the headings of About, Other interests, Open texture and Context. The statutory interpretation exercise undertaken by the majority is in this respect incomplete and undeveloped but nevertheless well-founded. The interpretation path dictated by the Interpretation Act, s 5 leads to the same conclusion.

[108] In the circumstances we do not accept Harder mandates a narrow reading of “personal information” as opposed to a reading based on the principles in the Interpretation Act, s 5.

[109] As to the facts, the majority recognised that not all information which can in one way or another be associated with a particular person be described as “personal information” within the meaning of the Act.

[24] In essence Ms C put a settlement proposal to Mr Harder on behalf of his client (the first conversation) and denied she had certain items which Mr Harder's client claimed were his (the second conversation). While it is not necessary to make any final determination whether the information involved in the present case was personal information within the true meaning and intendment of that expression under the Act, it is not at all clear that this was personal information. Was it relevantly information about Ms C? The only way the first conversation could involve information about Ms C would be to say it constituted information about her attitude to the way the differences between herself and her former partner might be resolved. The same can be said of the second conversation. It seems strained to suggest that Ms C's denial of possession of certain unspecified chattels is information about her for privacy purposes. It would be surprising if Parliament intended the Act to have such an unrestrained reach.

[110] In Sievwrights v Apostolakis HC Wellington, CIV-2005-485-527, 17 December 2007 the Court “acknowledged” what was said to be the difference in approach between the majority in Harder and “the preferred approach of the Tribunal” which, it was said, did not read down the broad definition of personal information. The High Court appears to have assumed a difference in approach. None of the asserted differences are identified or explained. Nevertheless the Court explicitly refrained from resolving the perceived difference. Instead, the Court emphasised (correctly) that whether information is
“personal information” will be resolved by a fact-based analysis. Context was said to be “all important”:

[10] ... We prefer to approach this case by a close analysis of the facts. We consider the vast majority of cases where an issue involves consideration of whether the information is “personal information” will be resolved by a fact-based analysis....

[15] ... Context is all important. Here, as we have stressed, the context illustrates the information was personal.

[111] In Geary v New Zealand Psychologists Board [2012] NZHC 384, [2012] 2 NZLR 414 the issue was whether Mr Geary’s list of his ACC clients was personal information about him. In finding the list was not personal information about Mr Geary the Court at
[47] referred to the “continuing debate” about the scope of the definition of personal information, citing both Harder and Sievwrights but without identifying the differences or resolving the debate. The Court concluded at [52] that even had the list contained Mr Geary’s name, the same conclusion would have been reached, namely that it was not personal information “about” Mr Geary.

[112] On one view this is a surprising conclusion as the list was information as to who Mr Geary had seen as clients. It seemed a relatively straightforward case of information being “about” Mr Geary. Nevertheless, the case underlines the point that whether information is “personal information” will be resolved by a fact-based analysis. Context will be all important to that analysis. But even then there may not be one obviously “correct” answer.

[113] The importance of the factual inquiry was again emphasised in Grupen v Director of Human Rights Proceedings [2012] NZHC 580, (2012) 9 HRNZ 635 at [32]. In Siemer v Privacy Commissioner [2013] NZHC 1483 at [35] the supposed narrow approach to the meaning of the expression “about” said to have been adopted by the majority in Harder is referred to as is the fact that High Court decisions have tendered to focus on a factual analysis. However, beyond referring to the “debate”, the decision in Siemer contains no analysis and is not of assistance.

[114] Because the majority in Harder suggested the term “personal information” must be read in context and that it is a term not of unlimited meaning, it seems to have been assumed that a “narrow” interpretation of personal information should be adopted as opposed to a “broader approach”, whatever that may mean. The supposed differences between Harder and decisions of the Tribunal do not appear to have ever been articulated. For the reasons we have given we are of the view Harder has been misread and somehow that misreading has gained currency with a supposed binary opposition of a narrow approach versus a broader approach. In our view the majority decision in Harder does no more than point out that the Act, read in context, necessarily limits the breadth of “personal information”. Not least is the requirement that the information be “about” an identifiable individual.

[115] While opinions may differ as to the factual findings made in any specific case, the interpretive approach adopted by the majority in Harder is nevertheless sound. At the very least all senior court decisions agree that whether information is “information about an individual” is a question of fact. In this sense, context is everything.

Judicial interpretation of personal information – the Tribunal

[116] The Tribunal has not hitherto attempted an exhausive analysis of when information is “about” an individual. It has operated on the consensus view that in the vast majority of

cases the issue whether information is personal information will be resolved by a fact- based analysis. See for example Director of Human Rights Proceedings v Hamilton [2012] NZHRRT 24 at [55].

[117] However, mention must be made of CBN v McKenzie Associates [2004] NZHRRT 48; (2004) 8 HRNZ 314 where in Family Court care and protection proceedings a lawyer had declined to release a client’s file until an outstanding account had been paid. The client alleged a breach of IPP 6. In finding there had been such breach the Tribunal stated that it was no answer to a request by a client for access to personal information held about him or her for the lawyer to say that the file at issue was protected by a lien for unpaid costs.

[118] Nevertheless, the Tribunal at [30] expressed reservations about the extent of the lawyer’s default because it was accepted that the file contained a number of different kinds of information. The default could only apply in relation to personal information about the client. It was accepted the file had also contained information about the former wife (the mother of the client’s son) and in particular information about her living arrangements and the circumstances in which the son was placed whenever he was in her custody. Other information was about the mother’s new partner. The Tribunal concluded at [31] that the file was made up of different kinds of information, not all of which would in or of itself be information “about” the client.

[119] For the Director of Human Rights Proceedings it was submitted at [33] that even if information is not in or of itself information about an individual, it can and does become personal information to which the individual concerned is entitled to have access if it is referenced to that individual. If the lawyer’s file was kept in the name of the plaintiff, then everything on it related to him and thus became personal information about him. In the present case Mr Taylor makes much the same argument.

[120] The Tribunal expressed reservations about this wide approach and at [39] responded that the fact that information may become relevant to someone does not necessarily convert it into personal information “about” that person:

[39] With respect, we have reservations about the very wide approach suggested by Dr Roth in this part of the argument. The fact that information may become relevant to someone does not necessarily convert it into personal information “about” that person. In the present case, for example, we think it safe to assume that the defendants' file for the plaintiff contained information about his former wife. That information may have been relevant to the plaintiff in the sense that it might have either limited or enhanced his chances of obtaining the custody arrangements that he wanted, but for all that we struggle to see that the information about his former wife thereby became personal information about the plaintiff.

[121] The Tribunal accepted, however, that much will depend on the context in which the information is found:

[41] On the other hand, we accept that there is no “bright line” test which separates that which is obviously personal information about an identifiable individual from that which is not. Much will depend in any given case on the context in which the information is found. There may be particular factors in different settings that compel a conclusion that, although the requesting individual is not named in the information, nonetheless there is a sufficient connection between the information and the requester to justify a conclusion that the information is personal information “about” the requester.

[122] We are in agreement with these statements.

[123] We do not intend referring to earlier Tribunal (or Complaints Review Tribunal) cases decided at a time when criminal discovery was obtained through the Official Information
Act 1982 and the Privacy Act 1993. The High Court took a necessarily broad view of what fell within the ambit of “personal information” where criminal charges were concerned. See for example Cornelius v Commissioner of Police [1998] 3 NZLR 373 at 379 to 380. If the information on the Police file could not be described as “personal” to the suspect or accused, it would be disclosable if it met the definition of official information. Either way an expansive view was taken to ensure full disclosure and a fair trial. The situation has since been addressed by the Criminal Disclosure Act 2008.

Conclusion

[124] It was for Mr Taylor to establish that the redacted information comprising names, positions, titles, phone numbers and email addresses was, in the context of his 5 September 2014 IPP 6 “everything” request, “personal information” ie information “about” him. This he failed to do not only when invited by Corrections and then by the Privacy Commissioner to provide more context, but also when giving evidence to the Tribunal. Instead he claimed before the Tribunal the removal of the identifying information made it difficult to sheet home responsibility for actions or decisions made by Corrections staff about him (Mr Taylor) or to identify staff who contributed information on which those actions or decisions had been based.

[125] The short answer is that IPP 6 confers a right to personal information only. It is not a key to other, non-personal information. Nor is an IPP 6 request a means of obtaining pre-trial discovery of non-personal information for use in litigation or complaints against third parties. As submitted by Corrections, IPP 6 does not provide for a de facto “discovery” or disclosure regime entitling an individual to seek all the records of the agency that may have any reference to him or her. Rather, it is directed at ensuring that individuals are given access to those parts of records that contain personal information about him or her.

[126] Having examined the documents ourselves we are satisfied Corrections is correct in submitting that taking the 5 September 2014 access request on its own terms and without further context from Mr Taylor, the redacted information is not personal information about Mr Taylor. In the main, the documents record routine transactions in the administration of Mr Taylor’s sentence. To the extent the substantive content of those documents includes personal information about Mr Taylor, that context has been disclosed. But the specific identity of the persons sending or receiving the emails, or referred to in the context of routine inquiries and day to day operational decisions, are not in the context of a general and unparticularised “everything” request “about” Mr Taylor. Having ourselves examined the open and closed versions of the disclosed documents we are of the further view the redactions did not have the effect of making the substantive content of the documents unintelligible. The personal information has been disclosed in full and without redaction.

[127] As conceded by Corrections, one error has been identified. The name of the deponent of the affidavit at p 49 of Volume 1: Redacted Documents (open) is part of the personal information described in that email and ought not to have been redacted. However, as Corrections submitted the redaction is trivial and of no effect. Mr Taylor knew the name of the deponent and even with the name redacted had been given effective access to the personal information. In other words he was fully capable of filling the gap and therefore has in fact received the information that Corrections held about him.
[128] For the reasons given there has been no breach of IPP 6, no withholding of personal information about Mr Taylor and no interference with his privacy as defined in either PA, s 66(1) or s 66(2).

SECTION 29(1)(a) – UNWARRANTED DISCLOSURE OF THE AFFAIRS OF ANOTHER

[129] Section 29(1)(a) of the Act allows an agency to refuse to disclose any personal information requested pursuant to IPP 6 if the disclosure of the information would involve the unwarranted disclosure of the affairs of another individual.

[130] In view of our conclusion that no personal information has been withheld from Mr Taylor it is unnecessary for us to address the issues which would have arisen under s 29(1)(a) had we found to the contrary. This is because s 29 applies only to information which is “personal information”.

[131] Consideration has been given to whether we should nevertheless determine the s 29(1)(a) issues. Our reasons for declining to do so follow:

[131.1] The determination would have narrow application to a specific period of time and to the MST only, not to the wider Corrections system for processing IPP 6 requests which was in place at that time. The evidence of Mr Arbuckle was that new guidelines had been issued to the MST in November 2015. We see little utility in making findings which are not only unnecessary but also of little or no future value.

[131.2] In his submissions Mr Taylor made it clear that his broader purpose in bringing these proceedings was to challenge Corrections’ general approach to responding to requests made by prisoners under the Privacy Act. However, the Tribunal does not accept it has jurisdiction to determine such challenge. Specifically, the Tribunal does not have jurisdiction to initiate a review of the overall lawfulness of Corrections’ operational policies for responding to Privacy Act requests.

[131.3] Furthermore, not only does the Tribunal not have sufficient evidence before it to undertake an inquiry of that scope in relation to an existing policy, Corrections is itself engaged in a complex policy development programme to integrate its Privacy Act and Official Information Act obligations into the wider safety and security initiatives spoken of by Mr Arbuckle in recognition of the growing importance of keeping staff safe. As submitted by Corrections, Mr Taylor appears to be asking the Tribunal to make a ruling on the appropriate outcome of that policy work before Corrections has reached its own view on how best to balance its obligations and operational requirements.

[132] We accordingly now address the watermark complaint.

THE WATERMARK COMPLAINT – DISCUSSION

The principle

[133] Where a watermark is used by an agency to identify a document as having been provided under the Privacy Act, care is required to ensure the information contained in the document is not thereby rendered less legible than the unmarked version held by the agency.

[134] Where personal information is obscured or rendered illegible (to a greater or lesser degree) by a watermark the agency is at risk of a finding being made that it has in effect refused to make available the obscured or illegible information. It would not matter that the situation arose by deliberate action, carelessness or inadvertence. It is implicit that personal information provided in response to an IPP 6 request will, if contained in a document, be legible unless the document held by the agency is itself illegible to one degree or another.

[135] Where a finding is made by the Tribunal that an agency has in such circumstances “refused” to make personal information available and the Tribunal further concludes there was no proper basis for that decision, an interference with the privacy of the individual has been established in terms of the definition contained in PA, s 66(2)(a)(i) and s 66(2)(b). Such finding would enliven the Tribunal’s jurisdiction to grant one or more of the remedies listed in PA, s 85(1).

The facts of the present case

[136] In the present case the Tribunal has had opportunity to inspect Volume 2 of the common bundle of documents and to examine all the information affected by the watermark issue. We accept the analysis set out in the closing submissions by Corrections accurately summarises the conclusions to be drawn.

[137] Of the 42 pages in Volume 2:

[137.1] Only 28 have any content obscured. The remaining pages either have no text obscured, or the obscuring affects only proforma details on emails or document scan numbers or similar features.

[137.2] Of the 28 pages with any content obscured only 14 are not copies of correspondence to or from Mr Taylor or his legal advisors.

[137.3] Of these 14 pages, only six pages have obscuring of anything that could be classed as “information”. The remaining pages deal with only routine communications between staff in the nature of directions to deliver something, reporting that administrative tasks have been completed or asking questions.

[137.4] Of these 6 pages:

[137.4.1] Page 7 contains personal information about Mr Taylor as it refers to him calling the 0800 line.

[137.4.2] Pages 12 to 14 and 16 contain personal information about Mr Taylor as they refer to court proceedings in which he was engaged.
[137.4.3] Page 24 is not personal information about Mr Taylor: it is a request for information from a barrister on how to arrange to sit in at a hearing being held at the prison.

[137.5] The obscured information on these pages is not significant and can largely be inferred from the surrounding text, a point largely conceded by Mr Taylor in cross-examination. Given Mr Taylor’s personal knowledge of the matters referred to he had no difficulty in understanding what the content of this information was.

[138] Mr Taylor did not advise Corrections of the problem regarding the obscured text notwithstanding the Corrections letter dated 17 November 2014 concluded with a statement that should Mr Taylor have any concerns with the Corrections response, he was encouraged to raise those concerns with Corrections. The first notice Corrections had that there had been a technical problem was when it received notice of Mr Taylor’s complaint to the Privacy Commissioner.

[139] At that point Corrections responded promptly and provided Mr Taylor with a further set of the documents. The error was explained and corrected. In addition an apology was given.

[140] Corrections has remedied the source of the problem that caused the error.

Conclusion

[141] Overall, our conclusion is that in relation to a very small number of pages personal information of little significance was obscured by the watermarks.

[142] On analysis the watermark complaint is properly characterised as trivial given the handful of pages involved and the relative insignficance of the obscured information. Also relevant is the fact that Corrections immediately provided a second copy of the documents and apologised. That apology which was both appropriate and timely, is to be taken into account under PA, s 85(4). See for example Williams v Accident Compensation Corporation [2017] NZHRRT 26 at [38].

REMEDIES

Declaration

[143] For good reason all the remedies listed in PA, s 85 are discretionary remedies, including that of a declaration of interference with privacy, a point recognised in Geary v New Zealand Psychologists Board [2012] NZHC 384, [2012] 2 NZLR 414 at [107]. While there has been a technical, inadvertent and trivial interference with Mr Taylor’s privacy, it is not an interference which justifies the granting of a remedy by way of a declaration of interference.

Damages

[144] For similar reasons we would not be prepared to award damages under PA, s 88(1)(c) for humiliation, loss of dignity or injury to feelings. Mr Taylor endeavoured to “talk up” this aspect of the case but without success given the trivial circumstances.

[145] It is also to be noted that PA, s 88(1) is subject to subpart 1 of Part 2 of the Prisoners’ and Victims’ Claims Act 2005 (PVCA). There is no doubt the present
proceedings are a specified claim as that term is defined in PVCA, s 6. Sections 13 and 14 of the PVCA provide in relation to such claims:

13. Restriction on awarding of compensation

(1) No court or tribunal may, in proceedings to which this subpart applies, award any compensation sought by a specified claim unless satisfied that—

• (a) the plaintiff has made reasonable use of all of the specified internal and external complaints mechanisms reasonably available to him or her to complain about the act or omission on which the claim is based, but has not obtained in relation to that act or omission redress that the court or Tribunal considers effective; and
• (b) another remedy, or a combination of other remedies, cannot provide, in relation to the act or omission on which the claim is based, redress that the court or Tribunal considers effective.

(2) In this section, reasonable use of a complaints mechanism means the use that the court or Tribunal considers it reasonable for the plaintiff to have made in the circumstances.

14. Guiding considerations for awarding of compensation

(1) A court or tribunal must take into account the matters specified in subsection (2) in determining, in proceedings to which this subpart applies,—

• (a) whether compensation is required to provide effective redress; and (if it is)
• (b) the quantum of an award of compensation required to provide effective redress.

(2) The matters referred to in subsection (1) are—

• (a) the extent (if any) to which the plaintiff, the defendant, or both took, within a reasonable time, all reasonably practicable steps to mitigate loss or damage arising from the act or omission on which the claim is based; and
• (b) whether the defendant’s breach of, or interference with, the right concerned was deliberate or in bad faith; and
• (c) the relevant conduct of the plaintiff; and
• (d) the consequences for the plaintiff of the breach of, or interference with, the right concerned; and
• (e) the freedoms, interests, liberties, principles, or values recognised and protected by the right concerned; and
• (f) any need to emphasise the importance of, or deter other breaches of or other interferences with, the right concerned; and
• (g) the extent (if any) to which effective redress in relation to that act or omission has been, or could be, provided otherwise than by compensation; and
• (h) any other matters the court or Tribunal considers relevant.

(3) In this section, the right concerned has the meaning given to it by the definition of specified claim in section 6.

[146] Section 13 applies because:

[146.1] Reasonably available to Mr Taylor was the express invitation dated 17 November 2014 by Corrections to raise any concerns with the Department.

[146.2] By complaining to the Privacy Commissioner Mr Taylor obtained effective redress in that once his complaint to the Commissioner had been conveyed to Corrections, the department by letter dated 9 March 2015 provided Mr Taylor with a further set of the documents and tendered a sincere apology. In addition, as confirmed by Mr Arbuckle, the problem has been addressed for the future.

[147] As stated in PVCA, s 3(1), one of the purposes of the Act is to ensure that the remedy of compensation is reserved for exceptional cases and used only if, and only to the extent that, it is necessary to provide effective redress. For the reasons given the present is not an exceptional case and neither a declaration of interference with privacy nor an award of damages under the Privacy Act is necessary to provide effective redress to Mr Taylor.

OVERALL CONCLUSION

[148] Our primary conclusions are:

[148.1] The information withheld from Mr Taylor was not personal information about Mr Taylor and was therefore not disclosable under IPP 6.

[148.2] In relation to the documents which were watermarked “Released Under the Privacy Act 1993”, such interference with Mr Taylor’s privacy as did occur was trivial in nature and no declaration of interference with privacy is to be made. Furthermore, as a consequence of subpart 1 of Part 2 of the Prisoners’ and Victims’ Claims Act 2005, no monetary compensation can be awarded to Mr Taylor.

COSTS

[149] Costs are reserved. Unless the parties come to an arrangement on costs the following timetable is to apply:

[149.1] Corrections are to file their submissions within 14 days after the date of this decision. The submissions for Mr Taylor are to be filed within the 14 days which follow. Corrections is to have a right of reply within seven days after that.

[149.2] The Tribunal will then determine the issue of costs on the basis of the written submissions without further oral hearing.

[149.3] In case it should prove necessary, we leave it to the Chairperson of the Tribunal to vary the foregoing timetable.