Home | Databases | WorldLII | Search | Feedback Human Rights Review Tribunal of New Zealand

Mills v Capital and Coast District Health Board [2019] NZHRRT 47 (30 October 2019)

Last Updated: 31 October 2019

(1) ORDER PROHIBITING PUBLICATION OF NAME OF WITNESS

(2) ORDER PREVENTING SEARCH OF THE TRIBUNAL FILE WITHOUT LEAVE OF THE TRIBUNAL OR OF THE CHAIRPERSON

IN THE HUMAN RIGHTS REVIEW TRIBUNAL [2019] NZHRRT 47

Reference No. HRRT 012/2019

UNDER THE PRIVACY ACT 1993

BETWEEN RICHARD EDWARD MILLS PLAINTIFF

AND CAPITAL AND COAST DISTRICT HEALTH BOARD

FIRST DEFENDANT

AND HUTT DISTRICT HEALTH BOARD SECOND DEFENDANT

AT WELLINGTON BEFORE:

Mr RPG Haines ONZM QC, Chairperson Ms GJ Goodwin, Deputy Chairperson Mr MJM Keefe QSM JP, Member

Ms DL Hart, Member

REPRESENTATION:

Mr RE Mills in person

Mr H Kynaston and Ms E von Veh for first and second defendants

DATE OF HEARING: 4, 5 and 6 September 2019

DATE OF DECISION: 30 October 2019

DECISION OF TRIBUNAL¹

¹ [This decision is to be cited as Mills v Capital and Coast District Health Board [2019] NZHRRT 47.]

INDEX

INTRODUCTION [1]

Chronology [2]

The Facebook information [11]

The telephone call of 15 November 2017 [19]

Disclosures in the ERA statement of reply [25]

PRELIMINARY MATTERS [33]

The Hearing [33]

Application of the Health Information Privacy Code [35]

Application for permanent name suppression [36]

The witnesses [37]

SUMMARY OF ALLEGATIONS AND RESPONSES [39]

Allegations against the CCDHB and responses [40]

Allegations against the HVDHB and responses [42]

LEGAL ANALYSIS: ALLEGATIONS AGAINST THE CCDHB [50]

Whether there was an actual belief on reasonable grounds [60]

LEGAL ANALYSIS: ALLEGATIONS AGAINST THE HVDHB [64]

The “collection” IPPs [64]

Whether the HVDHB breached IPP 1 [65]

Whether the HVDHB breached IPP 2 [71]

Collection – Facebook [72]

Collection - the telephone call of 15 November 2017 [79]

Whether the HVDHB breached IPP 4 [90]

Collection – Facebook [91]

Collection – the telephone call [95]

The “use” IPPs [101]

Whether the HVDHB breached IPP 8 [102]

Summary of breaches [114]

WHETHER AN INTERFERENCE WITH THE PRIVACY OF MR MILLS

HAS BEEN ESTABLISHED [116]

Whether the CCDHB interfered with Mr Mills’ privacy [119]

Whether the HVDHB interfered with Mr Mills’ privacy [130]

Collection of information during the telephone call [132]

Use of Facebook information without verification [135]

REMEDY [139]

Section 85(4) – conduct of the defendants [142]

Declaration [150]

Damages for injury to feelings [152]

Training [161]

Training – recommendation by Tribunal [164]

FORMAL ORDERS [167]

COSTS [168]

INTRODUCTION

[1] Mr Mills has terminal cancer of the brain. In medical terms he has a Grade 4 glioblastoma tumour. His life expectancy is measured in months. He believes the two defendant District Health Boards (DHBs) have interfered with his privacy in breach of the information privacy principles (IPPs) or alternatively, in breach of the Health Information Privacy Code 1994 (HIPC). He relies also on the well-established principle that information about a person’s health and medical treatment is inherently private and confidential.

Chronology

[2] The legal aspects of the claim will be addressed shortly. First it is necessary to provide a brief overview of the background circumstances. This overview draws on the evidence given by Mr Mills and by the two DHBs. There are few, if any, material conflicts of evidence. The credibility of Mr Mills and of the witnesses for the DHBs is not in issue.

[3] Mr Mills’ wife is a skilled medical typist who began working in a full-time role for the Hutt District Health Board (HVDHB) on 26 September 2016. During 2017 Mrs Mills had health issues which gave rise to her seeking reduced working hours. By late September 2017 differences had arisen between the HVDHB and Mrs Mills over her working hours, to the extent that the HVDHB advised Mrs Mills it could no longer support her inability to work full time. The HVDHB proposed a meeting to discuss the issues.

[4] Those discussions were disrupted by a supervening crisis in Mrs Mills’ domestic life. On 8 October 2017 her husband, Mr Mills, suffered a seizure and within four days underwent a craniotomy following the diagnosis of a Grade 4 malignant brain tumour. Median life expectancy of a person with the Grade 4 malignant brain tumour is
14.6 months, from diagnosis.

[5] Whereas Mrs Mills had previously sought reduced working hours on account of her own health she was now in the position of having to seek leave to care also for her husband.

[6] It is necessary at this point of the narrative to provide further details about Mr Mills. Mr Mills is a self-employed disc jockey and MC. He is also a marriage celebrant. Mr Mills has an active public Facebook page on which he posts substantial information about his work activities and (more recently) how he is dealing with his health diagnosis. Following his operation Mr Mills posted on Facebook several accounts of his experiences with the health system, all written from a positive standpoint. He was complimentary about the health services he received. Tellingly, however, along with the positive statements Mr Mills said:

There have been challenges. I’m forbidden to drive, possibly for ever, but at least for a year. That affects my work prospects vastly, as I have been driving 20,000 miles (35,000km) per year until now, mostly for my own business. My right leg has limited movement in the hip and knee, and no control at all below the knee, so walking (although now possible) is very slow deliberate and clumsy. My right arm has massively reduced sensation, so control is very sketchy and erratic. This seems to be slowly improving, but as I’m right handed, everything is challenging.

[7] Principally for financial reasons but also to fulfil commitments previously made to clients Mr Mills needed to return to work as soon as possible after his operation. This could only be achieved with the assistance of his wife and friends:

...events that I booked some months ago are all happening in the next week, so I’m very grateful [for] help that I’m getting from some of my very close friends and colleagues. This morning I jump on a plane here in Wellington and fly to Queenstown.....My good friend Nick Logan will also be jumping on a plane in Auckland and landing in Queenstown around the same time.

Tomorrow he is helping me with a wedding where I am MC but not DJ or celebrant ....

Later on Thursday another good friend of mine, David Steel will stay with us here in Wellington and then he and I will drive up to the Mission Estate ... there we will be providing ceremony sound MC services and DJ entertainment for that night. Nick then flies back down from Auckland and helps me out with providing sound at a busy food, wine and music festival...

[8] It can be seen Mr Mills was relying on his friends’ assistance to continue to work.

[9] Returning to Mrs Mills, the day after Mr Mills’ craniotomy, she contacted her “two up” manager at the HVDHB, Ms Ririnui, asking for leave without pay to care for Mr Mills. Ms Ririnui asked for an explanation as to the relationship between Mrs Mills and Mr Mills (doubtless because Mrs Mills worked as Tracey Lee Jacobs).

[10] Mrs Mills advised the HVDHB of Mr Mills’ condition and provided a letter from an employment specialist advising that Mr Mills’ health was at a critical stage and he needed Mrs Mills’ full-time care. The letter had an accompanying medical certificate.

The Facebook information

[11] Around this time an employee of the HVDHB, Ms Williams, noted a post on her Facebook newsfeed which contained a link to a “Give-a-Little” page. That had a photograph of Mr and Mrs Mills. Ms Williams recognised Mrs Mills’ photograph. The Give- a-Little page had not been set up by Mr or Mrs Mills or with their authority, but by a friend of Mr Mills. The name of that friend was prominently displayed on the Give-a-Little page. It was that friend who was reported as stating that the purpose of the appeal was to raise funds to help Mr and Mrs Mills stay in their own home as he was terminally ill and Mrs Mills had been made redundant. Ms Williams reported what she had seen to Ms Ririnui as they both knew it was incorrect that Mrs Mills had been made redundant. In their evidence neither Ms WiIliams nor Ms Ririnui mentioned that they had noticed the assertion of redundancy had not been made by Mrs Mills herself.

[12] Ms Williams and another HVDHB employee, Ms Paku, then looked at both Mr and Mrs Mills’ Facebook pages. Mrs Mills’ Facebook settings were private, and they could see only her name and profile picture. Mr Mills’ Facebook settings, however, were public. The contents included details of the work Mr Mills was then engaged in. Ms Ririnui instructed Ms Williams to take a screen shot of Mr Mills’ Facebook entries and to print it out for her and members of the human resources department. This was done.

[13] At this stage mistrust of Mrs Mills arose on the part of the HVDHB. On the one hand it had advice and medical certificates from Mrs Mills stating that she needed full time leave to care for her terminally ill husband. On the other hand, the HVDHB had seen Mr Mills’ own Facebook posts showing he was working around the country. The HVDHB
had also seen the Give-a-Little page on which the page creator had incorrectly asserted that Mrs Mills had been made redundant.

[14] All of these concerns were capable of ready answers, but neither Mrs Mills nor Mr Mills were approached directly and asked for their response.

[15] After his operation, Mr Mills continued to be treated by Capital and Coast District Health Board (CCDHB). Following a referral from a cancer nurse co-ordinator, on 31 October 2017 a social worker employed by the CCDHB had a meeting with Mr and Mrs Mills at their home. For the reasons given at [36] below, this person will be referred to as Employee X. During the home visit Employee X discussed with Mr and Mrs Mills the services the CCDHB was able to provide to support the Mills’ needs.

[16] In the meantime tension between the HVDHB and Mrs Mills escalated to the point where Mrs Mills filed a statement of problem with the Employment Relations Authority (ERA).

[17] On 9 November 2017 Employee X again visited Mr and Mrs Mills at their home. During that visit Mrs Mills asked Employee X to write a letter for her describing what she and Mr Mills were going through in terms of Mr Mills’ treatment. Mrs Mills asked for this in the context of the ERA proceedings. Mr Mills was part of the conversation and supported the request. Employee X prepared a letter and emailed it to Mrs Mills. The letter gives very little detail of Mr Mills’ medical condition. The content of the letter, compared to a subsequent telephone conversation between Employee X and Ms Ririnui, form the basis of one of the claims in these proceedings. For that reason the full text of the letter follows:

To whom it may concern:

This letter confirms that Richard Mills is a current patient of the Wellington Blood & Cancer Centre and is commencing radiation therapy and chemotherapy for cancer on the 20^th of November. This has followed several weeks of recovery from surgery as well and worry about his future health needs.

I understand that Tracey Jacobs, Richard’s partner and primary caregiver, is undertaking a mediation process in relation to her employment which is due to commence at the same time as Richard’s treatment. The loss of work and earnings, alongside the process of mediation have contributed to significant financial and emotional distress for the couple as they work prepare for the challenges ahead.

Richard has given his permission to share this information with you, and we request that a speedy resolution to the matter so that Tracey and Richard can concentrate on treatment and recovery, as well as have some financial security. [emphasis added]

[18] Mediation between the HVDHB and Mrs Mills took place on 13 November 2017. No agreement was reached, but without prejudice discussions continued. On 14 November 2017 the HVDHB again accessed Mr Mills’ Facebook pages, took further screen shots and placed them on Mrs Mills’ file. The screen shots included the information set out earlier in this decision.

The telephone call of 15 November 2017

[19] On 15 November 2017 Mrs Mills sent the Employee X letter to the HVDHB. After consultation with the human resources department, Ms Ririnui was instructed to call Employee X to discuss the letter. This she did the same day.
[20] Ms Ririnui’s evidence was that the call was to clarify Mr Mills’ care needs, so that the HVDHB might understand what that might mean for Mrs Mills’ employment and the discussions they were then having. Ms Ririnui said it was a brief call of approximately five minutes. She recalls Employee X saying he needed to obtain Mr Mills’ permission to talk to Ms Ririnui. Ms Ririnui further recalls pointing out that Mr Mills had given permission to share information around his illness, as documented in Employee X’s letter. As a consequence Employee X agreed to continue with the discussion and to answer some questions. Ms Ririnui took notes while she spoke and subsequently had them typed up in a file note. The file note was not a verbatim record, but included the following information about Mr Mills’ health which Mr Kynaston accepted had not been previously recorded in Employee X’s letter:

[20.1] Mr Mills was receiving support from occupational therapy and physiotherapy.

[20.2] A NASC assessment was not required.

[20.3] He could do things on his own.

[20.4] He could be left alone.

[21] NASC (needs assessment and service co-ordination) relates to the level of practical assistance assessed as being needed, especially where there is little or no whanau or other third-party support.

[22] Employee X’s recollection of the 15 November 2017 call is similar to that of Ms Ririnui. He told her he would need permission from Mr Mills to discuss matters with Ms Ririnui, but Ms Ririnui asserted Mr Mills had already given permission to share this information. Employee X did not have the letter in front of him at the time of the conversation. Employee X answered Ms Ririnui’s questions and tried to respond in line with his recollection of the information provided in his earlier letter in a general way, rather than going into specifics. Employee X believed the call was made for the purpose of mediation only. The Tribunal accepts that in continuing with the call Employee X was well- intentioned and wanted to help Mrs Mills in her employment dispute.

[23] On 19 November 2017 Ms Williams attended a festival in Martinborough called “Toast Martinborough”. She saw Mr Mills acting as DJ/MC at the Tirohana Estate Vineyard as part of the festival. That Ms Williams then reported this to Ms Ririnui exemplified the lack of trust on the part of the HVDHB in relation to Mr Mills’ actual care needs. During the hearing before the Tribunal, when answering questions from Mr Mills, Ms Williams agreed she did not see Mr Mills either walking onto the stage or moving any equipment at Tirohana Estate.

[24] Again neither Mr Mills nor his wife were approached by the HVDHB to comment on the concerns held by it.

Disclosures in the ERA statement of reply

[25] On 20 November 2017 the HVDHB filed its statement of reply to Mrs Mills’ ERA proceedings. That statement attached a copy of the file note made by Ms Ririnui of her conversation on 15 November 2017 with Employee X. It also attached copies of Mr Mills’ Facebook entries that had been screen shot on 14 November 2017. Paragraph 3.4 of the statement of reply said:

While sympathetic to the applicant’s situation and accepting that she has some care responsibilities, the respondent has reasons to believe this assertion to be overstated. The respondent understands that the progress of Mr Mills’ recovery to date has been such that he does not require that level of support. This understanding is based on Mr Mills’ own statements on social media [doc 12] and the information received from [Employee X] supporting Mr Mills. [doc 13].

[26] Service of the statement of reply was the first time Mr and Mrs Mills became aware the health of Mr Mills had been discussed by Employee X with the HVDHB, that Mr Mills’ Facebook page had been examined and that it was alleged Mrs Mills had misrepresented her husband’s care needs.

[27] On 21 November 2017 Employee X met with Mr and Mrs Mills at their request. They showed him the file note made by Ms Ririnui. Employee X said he had never seen it before and would have to talk to his manager about it. On 22 November Mrs Mills sent an email to Employee X advising that she and Mr Mills were shocked to learn their private information had been openly shared as they had not given permission to Employee X to talk to the HVDHB. Mr and Mrs Mills were upset their confidential information had turned up in a legal document against them. A retraction was requested.

[28] Employee X emailed Mr and Mrs Mills on 24 November 2017 attaching a formal response. The brief email contained a one line paragraph which read: “[o]nce again, I offer my sincerest apologies that this occurred and for any hurt that may have happened as a result”. The letter attached to the email set out Employee X’s recollection of the telephone conversation and advised that he (Employee X) had no knowledge that the purpose of the telephone conversation was for other than that of mediation. The letter concluded:

I believe that Mrs Ririnui has misrepresented herself with respect to the purpose of her telephone call, and her actions to use this information against Tracey have caused irreparable damage to the therapeutic relationship I had fostered with Richard and Tracey to support them through an already challenging time, in addition to causing them additional stress.

I have been in contact with Tracey and Richard to apologise to them for any unintended hurt that has been caused through these actions, and they will receive a copy of this letter for their records.

[29] Shortly before Christmas 2017 Mrs Mills reached a confidential settlement with the HVDHB in connection with all matters relating to her employment. That she and Mr Mills sincerely believe she (Mrs Mills) was forced into an unfavourable settlement is not an issue which the Tribunal has jurisdiction to determine.

[30] In March 2018 Mr Mills complained to the Privacy Commissioner alleging breaches of his privacy by both the CCDHB and the HVDHB.

[31] The Certificate of Investigation issued by the Privacy Commissioner on 15 October 2018 in relation to the alleged CCDHB breaches of Rule 11 of HIPC confirmed the Commissioner considered there had been a breach of that Rule, that there had been adverse consequences and that there had been an interference with privacy.

[32] The Certificate of Investigation issued by the Privacy Commissioner on 30 October 2018 in relation to the alleged HVDHB breaches of Rules 1, 2 and 4 of HIPC and IPP 8 confirmed the Commissioner considered there had also been a breach of privacy, there had been adverse consequences and that there had been an interference with privacy.

PRELIMINARY MATTERS

The Hearing

[33] The case proceeded by way of a three-day hearing in Wellington between 4 September 2019 and 6 September 2019. Mr Mills was self-represented. Throughout the hearing Mr Mills advanced his case with restraint, skill, responsibility and above all, dignity.

[34] Following the hearing the Tribunal drew the attention of the parties to a case not cited in argument, namely R (W) v Secretary of State for Health (British Medical Association intervening) [2015] EWCA Civ 1034, [2016] 1 WLR 698. By Minute dated 19 September 2019 the parties were invited to make further submissions in relation to that case. Those further submissions have been taken into account in the preparation of this decision.

Application of the Health Information Privacy Code

[35] At the commencement of the hearing there was discussion as to whether the case should be determined under the HIPC or under the IPPs in the Privacy Act. Counsel for the DHBs submitted that while the information about Mr Mills related to his health status, it was not collected for that purpose. Rather it was collected in the context of the employment relationship between the HVDHB and Mrs Mills. Following discussion the parties agreed to proceed under the IPPs. In any event, we are of the view that nothing turns on the point because on the facts the differences between HIPC and the corresponding IPPs are immaterial.

Application for permanent name suppression

[36] At the hearing the CCDHB requested an order under s 107(3)(b) of the Human Rights Act 1993 and s 89 of the Privacy Act permanently suppressing the name of the CCDHB’s sole witness. In a separate decision we give our reasons for granting that order. In this decision, the CCDHB’s witness is referred to as “Employee X”, “he” or “him”.

The witnesses

[37] As part of his case Mr Mills tendered a statement by his friend Mr Nick Boyce- Bacon. By consent that statement was read into evidence without Mr Boyce-Bacon being required to give evidence in person. His statement supports the contention by Mr Mills that it would have been impossible for him (Mr Mills) to have worked without the support of Mrs Mills and without the assistance of Mr Boyce-Bacon and other friends.

[38] At the hearing, the HVDHB called as witnesses its employees Ms Ririnui, Ms Williams and Ms Paku. As the finding of facts are within a narrow compass and generally agreed, credibility did not play a significant role in this case. Nevertheless, in relation to the way in which matters unfolded we find:

[38.1] First, that because the Give-a-Little page erroneously referred to Mrs Mills as having been made redundant (the assertion had been made by a third person without the knowledge or consent of Mr or Mrs Mills), the attitude of the HVDHB witnesses to Mrs Mills and her husband had been negatively affected.
[38.2] Secondly, that because of the inaccuracies in the Give-a-Little page, there was a pre-disposition to interpret Mr Mills’ Facebook page entries in a manner which was unfavourable to the bona fides of the leave requests made by Mrs Mills.

SUMMARY OF ALLEGATIONS AND RESPONSES

[39] Before the legal issues are addressed in detail an overview of the allegations made by Mr Mills and of the responses by the defendants might assist.

Allegations against the CCDHB and responses

[40] Against the CCDHB, Mr Mills alleges that Employee X, in discussing Mr Mills’ health with Ms Ririnui during a telephone call of 15 November 2017, disclosed Mr Mills’ personal information in breach of IPP 11. IPP 11 provides that an agency holding personal information shall not disclose that information unless, inter alia, the disclosure is authorised by the individual concerned. Mr Mills says he did not authorise Employee X to have a conversation with Ms Ririnui about the content of the letter, let alone provide any additional information about him.

[41] The CCDHB denies there was any breach. It says, first, that the telephone call between Ms Ririnui and Employee X was merely for clarification and did not involve any disclosure. If it is found there was disclosure, the CCDHB says it understood Mr Mills had authorised the disclosure of information.

Allegations against the HVDHB and responses

[42] Mr Mills alleges that the HVDHB has breached four IPPs. The HVDHB denies all of these allegations.

[43] Mr Mills first alleges the HVDHB breached IPP 1 which provides that information must not be collected by an agency unless the information is collected for a lawful purpose connected with a function or activity of the agency and the collection of the information is necessary for that purpose. Mr Mills alleges two instances of breaches of IPP 1. The first relates to the collection of information from Mr Mills’ Facebook page. The second relates to the collection of information relating to Mr Mills’ health during the telephone conversation between Ms Ririnui and Employee X. Both types of information were used in the employment dispute between Mrs Mills and the HVDHB. Mr Mills says neither collection was needed for that purpose.

[44] The HVDHB says each collection was lawful. It was necessary for the HVDHB to have all available and relevant information in connection with the employment issues between it and Mrs Mills. The collection of Mr Mills’ health information from Employee X and from Facebook was necessary to properly assess Mrs Mills’ leave requests, in the context of the then current employment dispute.

[45] The second allegation Mr Mills makes against the HVDHB is that it breached IPP 2. Information privacy principle 2 provides that when an agency collects information it must collect from the individual concerned, unless the agency believes on reasonable grounds that one of the statutory exceptions applies. Mr Mills says the Facebook information could have been obtained directly from him. Mr Mills also says the HVDHB should have collected information directly from him, not indirectly from Employee X.
[46] The HVDHB says Mr Mills’ Facebook information was publicly available and so no breach arose. It says that to the extent health information collected about Mr Mills from Employee X enlarged upon the information already contained in the earlier letter from Employee X, the collection of that information was authorised by Mr Mills. The HVDHB also says that the collection from both Facebook and Employee X was necessary for the conduct of contemplated employment proceedings against Mrs Mills.

[47] Thirdly, Mr Mills alleges the HVDHB breached IPP 4. IPP 4 provides that personal information shall not be collected by an agency by unlawful means or by means that in the circumstances of the case are unfair or intrude to an unreasonable extent upon the personal affairs of the individual concerned. Mr Mills says it was unfair and unreasonably intrusive of Ms Ririnui to seek personal information about his health from Facebook and from Employee X. The HVDHB denies this.

[48] Finally, Mr Mills alleges the HVDHB breached IPP 8, which provides that an agency must not disclose or use information without first taking reasonable steps to ensure that it is accurate, up to date, relevant and not misleading. Mr Mills says that the HVDHB took no steps to check the accuracy of the Facebook information before it was used in the ERA proceedings. In any event, looked at more closely, his Facebook posts should not have been interpreted in the manner that they were by the HVDHB, in the context of the employment dispute between it and Mrs Mills.

[49] In relation to IPP 8, the HVDHB says it had no reason to doubt the accuracy of the Facebook information, as Mr Mills was the person who had posted it. It was reasonable for the HVDHB not to take further steps in connection with that information, in the context of the litigation pending between it and Mrs Mills.

LEGAL ANALYSIS: ALLEGATIONS AGAINST THE CCDHB

[50] Mr Mills claims the CCDHB breached IPP 11 during the telephone conversation of 15 November 2017 between Employee X and Ms Ririnui.

[51] IPP 11 provides:

Principle 11
Limits on disclosure of personal information

An agency that holds personal information shall not disclose the information to a person or body or agency unless the agency believes, on reasonable grounds,—

(a) that the disclosure of the information is one of the purposes in connection with which the information was obtained or is directly related to the purposes in connection with which the information was obtained; or
(b) that the source of the information is a publicly available publication and that, in the circumstances of the case, it would not be unfair or unreasonable to disclose the information; or
(c) that the disclosure is to the individual concerned; or
(d) that the disclosure is authorised by the individual concerned; or

...

[52] The application of IPP 11 was summarised in Geary v Accident Compensation Corporation [2013] NZHRRT 34 at [190]:

[190] Applying this provision to Principle 11, it was established in L v L HC Auckland AP95-SW01, 31 May 2002, Harrison J at [20] (and see the Tribunal decisions collected in Harris v Department of Corrections [2013] NZHRRT 15 (24 April 2013) at [43]) that the sequential steps to be followed are:

[190.1] Has there been a disclosure of personal information. The plaintiff carries the burden of proving this threshold element on the balance of probabilities.

[190.2] If the Tribunal is satisfied that personal information has been disclosed, the burden shifts to the defendant to establish to the same standard that that disclosure fell within one of the exceptions provided by Principle 11.

[190.3] Third, if the Tribunal is satisfied that the personal information was disclosed and that the defendant has not discharged his or her burden of proving one of the exceptions in Principle 11, the Tribunal must then determine whether the disclosure constituted an interference with the individual’s privacy as defined in s 66 of the Privacy Act. That is, has the plaintiff established one of the forms of actual or potential harm contemplated by [s 66(1)]. The burden of proof reverts to the plaintiff at this stage.

[190.4] Fourth, if the Tribunal is satisfied to this stage, then its final task is to determine whether, in its discretion, it should grant any of the statutory remedies identified in s 85 of the Act.

[191] It is not a defence that the interference was unintentional or without negligence on the part of the defendant. See s 85(4) and L v L at [13] and [99].

[53] The CCDHB first maintains there was no disclosure of personal information during the telephone call of 15 November 2017 and submits the ordinary meaning of “disclosure” is the process of making something known that was previously unknown. The CCDHB further submits that as Ms Ririnui and Employee X only discussed, by way of clarification, information contained in Employee X’s letter of 11 November 2017 there was no disclosure of information (for the purposes of IPP 11) during the telephone call.

[54] The Tribunal does not accept these submissions. Ms Ririnui’s file note of the 15 November 2017 telephone call confirms that Employee X provided the following information not already included in his letter:

[54.1] Mr Mills was receiving support from occupational therapy and physiotherapy.

[54.2] A NASC assessment was not required.

[54.3] He could do things on his own.

[54.4] He could be left alone.

[55] This information was additional to the information in Employee X’s letter of 11 November 2017. Accordingly, we find there was disclosure of Mr Mills’ personal information by Employee X to Ms Ririnui.

[56] We now turn to the question whether the CCDHB may rely on any of the exceptions allowed by IPP 11. Before it can do so it must establish that at the time of disclosure it possessed a belief on reasonable grounds that one of the statutory exceptions applied.

[57] In Geary v Accident Compensation Corporation at [202] the Tribunal observed “there is a subjective component (the belief) and an objective component (the reasonable grounds). It must be established that both elements existed as of the date of disclosure”.

[58] The need for reasonable grounds for belief requires that at the time the decision to disclose the information is made the agency must address its mind to the relevant provision in IPP 11 on which it intends to rely. The High Court in Geary v New Zealand Psychologists Board [2012] NZHC 384, [2012] 2 NZLR 414 at [63] said:

We consider that the need for reasonable grounds for belief in the necessity of disclosure requires the agency concerned to first inspect and assess the material being disclosed. The exception is not engaged where there is a failure to check the contents of the disclosure material before transmission.

[59] The CCDHB relies on IPP 11(d) namely, that Mr Mills authorised the disclosure. To succeed the CCDHB must show an actual belief on reasonable grounds that Mr Mills authorised the disclosure.

Whether there was an actual belief on reasonable grounds

[60] Employee X, as the participant in the telephone conversation, is the person whose actual belief on reasonable grounds is relevant. Employee X was a reluctant participant in the telephone call of 15 November 2017. He did not have his letter of 11 November 2017 to hand during the conversation. He initially told Ms Ririnui he would need Mr Mills’ consent before speaking with her but nevertheless continued with the conversation because Ms Ririnui assured him that Mr Mills had given permission to share his medical information as documented in the letter of 11 November 2017.

[61] Employee X was well-meaning and believed he was assisting Mrs Mills. He was, however, also a professional person working in a sensitive health area. He was or should have been well aware of the confidentiality that attaches to health information. The letter of 11 November 2017 (drafted by Employee X himself) was expressly circumscribed as to what Employee X was authorised to disclose. It stated “Richard has given permission to share this information with you ...”, being the information contained in the letter itself. Employee X had written the letter only four days previously. The disclosure permission is clearly expressed in limited terms. In addition, Employee X wrote the letter specifically in the context of Mrs Mills’ employment dispute with the HVDHB. The fact of this dispute should have put him on guard in connection with disclosure of any information.

[62] In these circumstances we find that Employee X did not at the time of the telephone call of 15 November 2017 have an actual belief based on reasonable grounds, that Mr Mills had authorised the disclosures made. We therefore find the CCDHB breached IPP 11.

[63] Whether such breach amounted to an interference with the privacy of Mr Mills is a separate issue to which we later return.

LEGAL ANALYSIS: ALLEGATIONS AGAINST THE HVDHB

The “collection” IPPs

[64] The first four of the IPPs have as their focus the collection of personal information. We deal separately with IPP 8. Mr Mills alleges the HVDHB breached IPP 1, IPP 2 and IPP 4. As they are the focus of this part of the decision they are reproduced in full:

Principle 1
Purpose of collection of personal information

Personal information shall not be collected by any agency unless—

(a) the information is collected for a lawful purpose connected with a function or activity of the agency; and
(b) the collection of the information is necessary for that purpose.

Principle 2
Source of personal information

(1) Where an agency collects personal information, the agency shall collect the information directly from the individual concerned.
(2) It is not necessary for an agency to comply with subclause (1) if the agency believes, on reasonable grounds,—

• (a) that the information is publicly available information; or
• (b) that the individual concerned authorises collection of the information from someone else; or
• (c) that non-compliance would not prejudice the interests of the individual concerned; or
• (d) that non-compliance is necessary—
  • (i) to avoid prejudice to the maintenance of the law by any public sector agency, including the prevention, detection, investigation, prosecution, and punishment of offences; or
  • (ii) for the enforcement of a law imposing a pecuniary penalty; or
  • (iii) for the protection of the public revenue; or
  • (iv) for the conduct of proceedings before any court or tribunal (being proceedings that have been commenced or are reasonably in contemplation); or
• (e) that compliance would prejudice the purposes of the collection; or
• (f) that compliance is not reasonably practicable in the circumstances of the particular case; or
• (g) that the information—

(i) will not be used in a form in which the individual concerned is identified; or

(ii) will be used for statistical or research purposes and will not be published in a form that could reasonably be expected to identify the individual concerned; or
(h) that the collection of the information is in accordance with an authority granted under section 54.

Principle 4
Manner of collection of personal information

Personal information shall not be collected by an agency—

(a) by unlawful means; or
(b) by means that, in the circumstances of the case,—

• (i) are unfair; or
• (ii) intrude to an unreasonable extent upon the personal affairs of the individual concerned.

Whether the HVDHB breached IPP 1

[65] IPP 1 provides that where an agency collects personal information, the purpose of the collection must be lawful and it must be connected with a function or activity of the agency. In addition, it must be necessary for that purpose.

[66] The phrase “necessary for that purpose” means reasonably necessary. See Lehmann v Canwest Radio Works Ltd [2007] NZHRRT 35 at [50]. More recently, in Tan v New Zealand Police [2016] NZHRRT 32 at [77] and [78] the Tribunal concluded that the term “necessary for that purpose” indicates a higher threshold than “reasonableness” and “expedient”:

[77] In the present context the information privacy principles have as their purpose the promotion and protection of individual privacy. Those principles are not absolute and are subject to limits sometimes framed in terms of the agency holding a belief on reasonable grounds and sometimes in terms of the agency concluding non-compliance is “necessary”. From this we conclude the term “necessary” as used in the information privacy principles indicates a higher threshold than “reasonableness” and “expedient”. We therefore intend employing the Canterbury Regional Council v Independent Fisheries Ltd meaning of “needed or required in the circumstances, rather than merely desirable or expedient”.

[78] We believe this approach to be consistent with Commissioner of Police v Director of Human Rights Proceedings [2007] NZHC 985; (2007) 8 HRNZ 364 (Clifford J, S Ineson and J Grant), a decision on Principle 11. We understand this decision to mean that while the term “necessary” sets a higher threshold than “expedient”, it does not set the highest of thresholds. The Court at [53] to [54]

agreed with a submission that something would be necessary when it was “required for a given situation, rather than that it was indispensable or essential” ...

[67] The collection of Mr Mills’ personal information by the HVDHB was from two sources. First, from Mr Mills’ Facebook page and second, from the telephone conversation between Employee X and Ms Ririnui on 15 November 2017.

[68] The information from both sources was collected in the context of the employment dispute between Mrs Mills and the HVDHB. We find the information was collected for a lawful purpose in connection with the functions of the HVDHB as an employer.

[69] The issue whether the collection was reasonably necessary in connection with the HVDHB’s role as Mrs Mills’ employer must be considered in light of the situation which then existed between the HVDHB and Mrs Mills. Mrs Mills had filed a statement of problem with the ERA. The HVDHB had doubts about Mr Mills’ heath condition and care needs. It had seen a Give-a-Little page referring to Mrs Mills as having been made redundant. Given the suspicions and lack of trust which had developed within the HVDHB about Mrs Mills’ leave requirements, we are prepared to accept that the threshold of “necessary for the purpose” in relation to both the Facebook collection and the collection of information during the telephone call of 15 November 2017 is met. However, as will be seen, collecting personal information for a lawful purpose is one matter. The circumstances in which that information may then be used is an entirely different matter. We return to this point when addressing IPP 8.

[70] Accordingly, we find no breach of IPP 1 by the HVDHB.

Whether the HVDHB breached IPP 2

[71] IPP 2 requires that where an agency collects personal information the agency must collect the information directly from the individual concerned, unless the agency believes on reasonable grounds that one of the permitted exceptions applies. In this case information was not collected directly from Mr Mills but from Facebook and from Employee X. The HVDHB therefore has the onus of proving one of the exceptions in IPP 2 applied. See s 87 of the Privacy Act.

Collection – Facebook

[72] In the case of the Facebook collection the HVDHB relies on IPP 2(2)(a), which allows an agency to collect information other than from the individual concerned if the agency believes, on reasonable grounds, that the information is publicly available information.

[73] Both Ms Paku and Ms Williams from the HVDHB gave evidence that they were able to access Mr Mills’ Facebook information as it was “public”. Mr Mills accepted this information was indeed public.

[74] Section 2(1) of the Privacy Act defines “publicly available information” as “personal information that is contained in a publicly available publication” and “publicly available publication” as a “magazine, book, newspaper or other publication that is or will be generally available to members of the public; and includes a public register”.

[75] The phrase “publicly available” as used in IPP 11(b) was considered by the Tribunal in Coates v Springlands Health Ltd [2008] NZHRRT 17 at [78] and [79]:

• [78] ... the exception in Principle 11 (b) should be interpreted as extending to include a situation (as in this case) in which a person makes the personal information about themselves which is at issue public. In this sense we consider that Parliament has used the word ‘publication’ in Principle 11 (b) as encompassing the first of the meanings given for the word ‘publication’ by the Oxford English Dictionary, i.e., “The action of making something publicly known; public notification or announcement; an instance of this.”

[79] ... if a person places a video piece about themselves on the internet, or keeps a blog, we would have thought that qualifies as a ‘publication’ of such personal information about the person in question as is contained in the video piece or the blog. It is thereby made ‘publicly available’. We see no reason to read the definition of ‘a publicly available publication’ as excluding that kind of information simply because it is not in magazine, book or other printed form.

[76] For the same reasons Facebook pages can in certain circumstances constitute publicly available information. On the facts we find that in relation to the collection of information from Mr Mills’ Facebook page the exception in IPP 2(2)(a) is made out.

[77] For the sake of completeness, we note that in connection with the collection of information from Facebook the HVDHB also submitted that it did not have to collect that information directly from Mr Mills as the HVDHB believed on reasonable grounds:

[77.1] Non-compliance was necessary for the conduct of proceedings before any court or tribunal, being proceedings that have been commenced or are reasonably in contemplation (IPP 2(2)(d)(iv)); or

[77.2] Doing so would prejudice the purposes of collection (IPP 2(2)(e)).

[78] Given our finding the information was publicly available we do not need to consider this submission. We nevertheless express doubt whether, on the facts, the alternative defence has been made out.

Collection - the telephone call of 15 November 2017

[79] Regarding the information collected during the telephone call between Employee X and Ms Ririnui, the HVDHB relies on IPP 2(2)(b). The submission is that the HVDHB held a belief on reasonable grounds that Mr Mills had authorised the collection of the information from Employee X.

[80] As with IPP 11, there is a subjective component (the belief) and an objective component (the reasonable grounds). To succeed, the HVDHB must establish that both elements existed as at the date of collection.

[81] The terms of authorisation from Mr Mills to Employee X were explicitly set out by Employee X in his own letter of 11 November 2017. The letter said “Richard has given permission to share this information with you ...”. The issue is whether those terms of authorisation could be read as impliedly permitting the collection by the HVDHB of Mr Mills’ personal health information beyond that already contained in the letter itself.

[82] On the direction of the HVDHB’s human resources department Ms Ririnui initiated the telephone call with Employee X. It is accordingly her belief on reasonable grounds that there was such implied authorisation which is relevant. We must consider whether in all the circumstances Ms Ririnui could have reasonable grounds to believe that Mr Mills’ authorisation, as expressed in Employee X’s letter of 11 November 2017, could be read as an authorisation for Employee X to disclose further personal medical information about Mr Mills.
[83] At the time of the 15 November 2017 telephone call Ms Ririnui had just received Employee X’s letter and she had that letter before her. On the face of the letter there was no authorisation to collect other information about Mr Mills’ health from Employee X. Ms Ririnui was also aware that Employee X initially told her that he thought he had to get permission to continue with the call. He continued only when she persisted with an assertion that authority had been given by Mr Mills.

[84] We find Ms Ririnui did not turn her mind to the Privacy Act issues and she admitted as much in her evidence. She had been instructed by the human resources department to call Employee X to “clarify” Mr Mills’ care needs. In view of the explicitly limited terms of the authority given by Mr Mills regarding disclosure of his personal information, the reluctance expressed by Employee X and the failure by Ms Ririnui to turn her mind to the requirements of the Privacy Act, we find there were no reasonable grounds for her to believe Mr Mills consented to the collection of any further information about him. The HVDHB cannot therefore rely on IPP 2(2)(b).

[85] In relation to the 15 November 2017 telephone call the HVDHB also relies on IPP 2(2)(e) which provides that an agency does not have to collect information directly from the individual concerned if the agency believes, on reasonable grounds, that doing so would prejudice the purpose of the collection.

[86] The focus of IPP 2(e) is on the purpose of collection. The HVDHB says the purpose of the collection was to obtain independent advice about Mr Mills’ care needs. It had not been dealing directly with Mr Mills. The HVDHB says it was reasonable in those circumstances for it to call Employee X rather than to contact Mr Mills directly. It was Employee X’s letter and so for him to provide clarification.

[87] In relation to this alternative submission four points must be made:

[87.1] First, in the telephone call Ms Ririnui never asserted that she was seeking independent advice. Rather, she said she was clarifying Mr Mills’ care needs.

[87.2] Secondly, even if the HVDHB was seeking independent advice, Ms Ririnui knew that Employee X was providing social support for Mr and Mrs Mills. As he was acting in the capacity of supporting Mr and Mrs Mills, he was not independent.

[87.3] Thirdly, Ms Ririnui knew that Employee X was a social worker who claimed no medical qualifications. He would have been unable to give any clinical assessment of Mr Mills’ care needs based on any medical prognosis. Indeed, in her evidence Ms Ririnui said she agreed with Employee X that he did not provide a clinical assessment.

[87.4] Ms Ririnui had no reasonable grounds to believe that collecting the information directly from Mr Mills would prejudice the purpose of the collection. In fairness she did not claim to have such grounds or such belief.

[88] The HVDHB could have contacted Mrs Mills (or Mr Mills) to request an independent medical assessment of Mr Mills’ needs. That would have been the proper course. We find that the HVDHB has not discharged the burden of proof required of it to be able to rely on IPP 2(2)(e).

[89] Accordingly, we find the HVDHB breached IPP 2 by collecting personal information about Mr Mills during the 15 November 2017 telephone call. Later in this decision we
address whether, as a consequence of this breach, there has been an interference with Mr Mills’ privacy.

Whether the HVDHB breached IPP 4

[90] IPP 4 provides that an agency shall not collect personal information by unlawful means, or by means that, in the circumstances, are unfair or intrude unreasonably upon the personal affairs of the individual concerned.

Collection – Facebook

[91] Mr Mills says he used Facebook as a means by which he could demonstrate to his children, his clients and to himself fortitude and dignity in the face of severe adversity. Mr Mills published information on Facebook specifically so that it could be seen. The Tribunal finds that collection by the HVDHB from Mr Mills’ Facebook page was not collection by unlawful means.

[92] Equally, there is nothing unfair about collecting information from a public Facebook page. In the main such posts are made with the knowledge and intention others will access them.

[93] As to the prohibition on collection that intrudes to an unreasonable extent upon the personal affairs of the individual concerned, we are of the view that accessing a publicly available social media profile is not unreasonably intrusive, as it is information that anyone can see.

[94] However, the use to which personal information may be put (once collected) is governed by (inter alia) IPP 8. The application of that principle is addressed later in this decision. First it is necessary to dispose of the allegation that IPP 4 was not complied with when Mr Mills’ personal information was collected by the HVDHB during the 15 November 2017 telephone call by Ms Ririnui to Employee X.

Collection – the telephone call

[95] In relation to the 15 November 2017 telephone call we find there was a breach of IPP 4.

[96] The reason for Ms Ririnui’s call was the employment dispute between the HVDHB and Mrs Mills and the suspicion Mrs Mills had overstated her care responsibilities to her husband. In her evidence to the Tribunal Ms Ririnui agreed the information collected in the course of the telephone call was for use by the HVDHB to challenge Mrs Mills’ bona fides around her leave requests.

[97] In these circumstances we find the HVDHB could (and should) have contacted Mrs Mills or Mr Mills directly to obtain the “clarification” sought from Employee X regarding Mr Mills’ health and his care needs. Alternatively, Ms Ririnui could have asked Employee X to obtain consent from Mr Mills to discuss his care needs with her. Instead, Ms Ririnui at the behest of the HVDHB’s human resources department persuaded Employee X to provide information he clearly did not wish to divulge.

[98] The facts demonstrate the rationale not only of the principle that personal information be collected directly from the individual but also of the principle which prohibits the collection of information by means that are unfair. In his letter dated 27 November
2017 addressed to Mr and Mrs Mills explaining his actions, Employee X left no doubt that it was his belief Ms Ririnui has misrepresented the purpose of her phone call. It was not, as claimed by Ms Ririnui in her evidence, to “clarify” the care needs of Mr Mills but for the HVDHB to obtain information against Mrs Mills. This had led to irreparable damage to the therapeutic relationship fostered by Employee X with Mr and Mrs Mills:

I have since been advised that Ms Ririnui has provided a 'file note' of our conversation as an exhibit (Document 13) in a sworn Affidavit in employment proceedings between Hutt Valley DHB and Tracey. There had been no suggestion whatsoever from Ms Ririnui that this was the purpose of her telephone conversation with me and I am extremely disappointed that she has chosen to use the information in this way without notice or consultation with me.

Furthermore the information provided in Document 13 is not portrayed accurately, is not a full assessment of Richard's support needs and does not represent my views of the support needs required by Richard, or Tracey’s role in supporting him. Ms Ririnui's account of the conversation indicates that Richard can be left alone; however it is neither my role nor scope to provide an assessment of whether or not it is safe to leave Richard on his own or his clinical care requirements. This is ultimately something for the patient and their whänau to decide.

I believe that Ms Ririnui has misrepresented herself with respect to the purpose of her phone call, and her actions to use this information against Tracey have caused irreparable damage to the therapeutic relationship I had fostered with Richard and Tracey to support them through an already challenging time, in addition to causing them additional stress.

[99] In all the circumstances we find it was unfair for Ms Ririnui to have continued the telephone conversation and to have collected the information which she did about Mr Mills. We therefore find the HVDHB breached IPP 4 in collecting information during the telephone call.

[100] All of these difficulties could have been avoided by the HVDHB approaching Mr Mills directly for the information. Instead, without apparent advice or guidance from the HVDHB’s Privacy Officer, Ms Ririnui was left to do the best she could.

The “use” IPPs

[101] Principles 8 to 11 govern the use, retention and disclosure of personal information. Only IPP 8 is relevant in the present context. It provides:

Whether the HVDHB breached IPP 8

[102] The key phrase in IPP 8 is “without taking such steps ... as are, in the circumstances, reasonable to ensure that, having regard to the purpose for which the information is proposed to be used...”. That phrase must be interpreted and applied having regard to the employment dispute between Mrs Mills and the HVDHB.

[103] The Facebook information was used in the ERA proceedings to support the belief held by the HVDHB that Mrs Mills had misrepresented the facts surrounding Mr Mills’ care needs. As was said by the HVDHB itself in its statement of reply in the ERA proceedings:

3.4 While sympathetic to the applicant’s situation and accepting that she has some care responsibilities, the respondent has reasons to believe this assertion to be overstated. The respondent understands that the progress of Mr Mills’ recovery to date has been such that he does not require that level of support. This understanding is based on Mr Mills’ own statements on social media [doc 12] and the information received from [Employee X] supporting Mr Mills. [doc 13].

[104] Mr Mills says the Facebook information should have been checked for accuracy and relevance before it was used in this manner against his wife. He points to the evidence of Ms Ririnui that she took no steps to verify the information taken from his Facebook page or from the Give-a-Little page. Nor did the human resources department make any mention of the need to speak directly to Mr Mills or his wife. On the evidence given to the Tribunal no advice or assistance was given to Ms Ririnui regarding the obligations on an agency when it requires an employee to collect the personal information of a third party.

[105] At the hearing counsel for the HVDHB said the litigation context was relevant to the obligation to check for accuracy. The HVDHB relies on Taylor v Orcon [2015] NZHRRT 15, (2015) 10 HRNZ 458 at [44] as authority for the proposition that because the information could have been tested in the ERA litigation, the IPP 8 duty to first check personal information was largely marginalised:

[44] A creditor who instructs a debt collection agency knows not only there is a good chance that legal debt recovery proceedings will follow, but also that the claimed debt will be registered with a credit reporting agency such as Veda. For many alleged debtors, it is the latter step which is potentially the most harmful and the most feared. In legal proceedings there is opportunity to challenge the claim before a court or tribunal skilled in the adjudication of disputes and bound by the rules of fairness. At a minimum a hearing of the dispute can be required. None of these protections apply when a credit reporting agency provides a credit rating. The request for a credit rating and the response occurs without notice to the person inquired about, without their knowledge and without an opportunity to be heard. There is little or no practical recourse when a person’s credit rating is reported in negative terms and there is no right of appeal. The right to request correction of credit information under the Credit Reporting Privacy Code is most often an ex post facto exercise and the individual affected may not even know an adverse credit report has been provided.

[106] However, in that case the Tribunal was not addressing the point presently in issue (ie whether an agency engaged in litigation is in some way constrained by IPP 8 in the way it conducts its case) and in fairness it must be recorded that the submission for the HVDHB as finally formulated did recognise that the litigation context does not oust the operation of IPP 8.

[107] The concession is properly made. It is well-established a lawyer has a professional responsibility not to make allegations without a sufficient basis or without reasonable grounds. See Gazley v Wellington District Law Society [1976] 1 NZLR 452 at 454. This duty is presently articulated in the Rules of Conduct and Client Care for Lawyers scheduled to the Lawyers and Conveyancers Act (Lawyers: Conduct and client care) Rules 2008. Rule 13.8 provides:

Reputation of other parties

13.8 A lawyer engaged in litigation must not attack a person’s reputation without good cause in court or in documents filed in court proceedings.

• 13.8.1 A lawyer must not be a party to the filing of any document in court alleging fraud, dishonesty, undue influence, duress, or other reprehensible conduct, unless the lawyer has taken appropriate steps to ensure that reasonable grounds for making the allegation exist.
• 13.8.2 Allegations should not be made against persons not involved in the proceeding unless they are necessary to the conduct of the litigation and reasonable steps are

taken to ensure the accuracy of the allegations and, where appropriate, the protection of the privacy of those persons. [Footnote citations omitted]

[108] The duty in r 13.8.1 to take “appropriate steps to ensure that reasonable grounds for making the allegation exist” and the duty in r 13.8.2 to take “reasonable steps ... to ensure the accuracy of the allegations” are particular analogues to the general duty under IPP 8. The fact that r 13.8.2 applies specifically to non-parties to a proceeding (Mr Mills was not a party to the ERA proceedings) and that there is reference to the “protection of the privacy of those persons” underlines the point.

[109] It would in these circumstances be untenable for a submission to be made that application of IPP 8 would impede parties engaged in litigation.

[110] The responsibility on a litigant making an allegation of intentional misrepresentation of facts or lack of good faith is a high one. An allegation of this kind should not be made unless there is a proper foundation in fact for it. Evidence to be relied on by a litigant making such an allegation should be checked and supported to a level higher than in relation to, say, incidental allegations and assertions of fact that do not go directly to the matters in issue or to the credibility of a witness. In Taylor v Orcon at [46] the point was made in the following terms:

[46] The language of Principle 8 makes it clear that the more serious the potential consequences of using the personal information held by the agency, the greater the degree of care which must be exercised before the information is used. The agency must be able to demonstrate it took such steps as were, in the circumstances, reasonable to ensure that, having regard to the purpose for which the information was proposed to be used, the information was accurate, up to date, complete, relevant, and not misleading.

[111] Here not even a rudimentary check was carried out by the HVDHB. Such a check should have been made:

[111.1] Mr Mills was not a party to the ERA proceedings and had no standing to contest the information or its interpretation.

[111.2] It was a simple matter for the information to be checked directly with Mr Mills or his wife. Alternatively, Employee X could have been asked to get instructions from Mr Mills regarding the allegations.

[111.3] Facebook pages commonly contain highly subjective information selected for the purpose of presenting the author in a favourable light. The letter dated 1 November 2018 from the Privacy Commissioner to Mr Mills expressed the point in the following terms:

While the information may have been posted by you, the purpose of social media is to project a tailored message to a broad audience. It is often a very limited snap shot of someone’s life that lacks broader context and nuance. It would be naïve to believe that information posted by an individual on social media represented a complete and accurate representation of their lives, in particular their medical conditions and health needs. We would have therefore expected a health agency to seek greater context and substance to verify any information collected from social media before they used or disclosed it.

[111.4] Mr Mills was endeavouring to paint a picture of “business as usual” in the face of the devastation cancer had brought to his and his family’s life. In the circumstances it was unreasonable to take his posts at face value, devoid of the context which reasonable enquiry would have otherwise revealed and clarified.
[112] Instead the information on Facebook was simply recorded by way of one or more screen shots and sent to the HVDHB human resources department where it was subsequently used in the statement of reply filed with the ERA.

[113] In conclusion we find the HVDHB breached IPP 8 by collecting Mr Mills’ Facebook information without taking such steps as were in the circumstances reasonable to ensure the information was accurate, up to date, complete, relevant, and not misleading.

Summary of breaches

[114] To summarise our conclusions regarding the CCDHB and the HVDHB, we find:

[114.1] CCDHB: Breach of IPP 11 in disclosing Mr Mills’ personal information during the 15 November 2017 telephone call.

[114.2] HVDHB: No breach of IPP 1.

[114.3] HVDHB: Breach of IPPs 2 and 4 in collecting Mr Mills’ personal information during the 15 November 2017 telephone call.

[114.4] HVDHB: Breach of IPP 8 by using Mr Mills’ Facebook information in the context of Mrs Mills’ ERA dispute.

[115] We must now consider whether these breaches gave rise to an interference with Mr Mills’ privacy.

WHETHER AN INTERFERENCE WITH THE PRIVACY OF MR MILLS HAS BEEN ESTABLISHED

[116] The term “interference with privacy” is defined in s 66. Only subs (1) is relevant on the facts:

66 Interference with privacy

(1) For the purposes of this Part, an action is an interference with the privacy of an individual if, and only if,—

• (a) in relation to that individual,—
  • (i) the action breaches an information privacy principle; or
  • (ii) the action breaches a code of practice issued under section 63 (which relates to public registers); or

(iia) the action breaches an information privacy principle or a code of practice as modified by an Order in Council made under section 96J; or

(iib) the provisions of an information sharing agreement approved by an Order in Council made under section 96J have not been complied with; or

(iii) the provisions of Part 10 (which relates to information matching) have not been complied with; and
(b) in the opinion of the Commissioner or, as the case may be, the Tribunal, the action—

• (i) has caused, or may cause, loss, detriment, damage, or injury to that individual; or
• (ii) has adversely affected, or may adversely affect, the rights, benefits, privileges, obligations, or interests of that individual; or
• (iii) has resulted in, or may result in, significant humiliation, significant loss of dignity, or significant injury to the feelings of that individual.

[117] Breach of an IPP does not on its own satisfy the statutory definition of “interference with the privacy of an individual” in s 66(1) of the Privacy Act. Before the Tribunal can grant a remedy, a harm threshold must be crossed and a causal connection established between the harm and the action of the agency. As to this two points must be made:
[117.1] It is only necessary to find that one of the forms of harm in s 66(1)(b)(i), (ii) or (iii) has been established on the evidence.

[117.2] Where the consequence of the breach is humiliation, loss of dignity or injury to feelings that consequence must be of sufficient seriousness to meet the “significant” threshold.

[118] The causation standard is explained in Taylor v Orcon Ltd [2015] NZHRRT 15, (2015) 10 HRNZ 458 at [58] to [61].

Whether the CCDHB interfered with Mr Mills’ privacy

[119] A finding having been made that the CCDHB breached IPP 11 the issue is whether any of the ss 66(1)(b)(i), (ii) or (iii) harm elements have been established together with a causative link between the harm and the breach of IPP 11.

[120] Given the facts of the case we address only s 66(1)(b)(iii) as there was no or no substantive evidence that Mr Mills experienced any of the forms of harm listed in s 66(1)(b)(i) or (ii).

[121] The question is whether Mr Mills experienced significant humiliation, significant loss of dignity or significant injury to feelings as a consequence of the IPP 11 breach. We address the “injury to feelings” element as the primary consequence of the breach.

[122] It was held in Winter v Jans HC Hamilton CIV-2003-419-854, 6 April 2004 at [36] that “injury to the feelings” can include conditions such as anxiety and stress. In Director of Proceedings v O’Neil [2001] NZAR 59 at [29] injury to feelings was described in the following terms:

[29] The feelings of human beings are not intangible things. They are real and felt, but often not identified until the person stands back and looks inwards. They can encompass pleasant feelings (such as contentment, happiness, peacefulness and tranquillity) or be unpleasant (such as fear, anger and anxiety). However a feeling can be described, it is clear that some feelings such as fear, grief, sense of loss, anxiety, anger, despair, alarm and so on can be categorised as injured feelings. They are feelings of a negative kind arising out of some outward event. To that extent they are injured feelings.

[123] The first time Mr Mills realised information about his health and care needs had been disclosed during the telephone call on 15 November 2017 was when Mrs Mills was served with the statement of reply filed by the HVDHB in the ERA proceedings. Mr Mills said that when he saw the statement of reply he felt betrayed and angry. Not only had there been unauthorised disclosure, the result of that disclosure had been that the information was used in proceedings against his wife to discredit her and to call into question her veracity. The disclosure placed significant stress on their relationship.

[124] On these facts alone significant injury to feelings has been established.

[125] However, assessment of Mr Mills’ case would be incomplete without particular account being taken of the fact that his personal information in issue was information about his health and treatment for ill-health. The importance of the confidentiality attaching to such information has been repeatedly affirmed at common law. It is a principle also recognised by the European Court of Human Rights. See R (W) v Secretary of State for Health (British Medical Association intervening) [2015] EWCA Civ 1034, [2016] 1 WLR 698 at 40:

The importance of the confidentiality attaching to information about a person’s health and treatment for ill-health has been repeatedly asserted in both common law and Strasbourg jurisprudence. As Baroness Hale of Richmond said in the Campbell case [2004] UKHL 22; [2004] 2 AC 457, para 145:

It has always been accepted that information about a person’s health and treatment for ill- health is both private and confidential. This stems not only from the confidentiality of the doctor-patient relationship but from the nature of the information itself. As the European Court of Human Rights put it in Z v Finland [1997] ECHR 10; (1997) 25 EHRR 371, 405-406, para 95: “Respecting the confidentiality of health data is a vital principle in the legal systems of all the contracting parties to the Convention. It is crucial not only to respect the sense of privacy of a patient but also to preserve his or her confidence in the medical profession and in the health services generally. Without such protection, those in need of medical assistance may be deterred from revealing such information of a personal and intimate nature as may be necessary in order to receive appropriate treatment and, even, from seeking assistance, thereby endangering their own health and, in the case of transmissible diseases, that of the community.”

[126] The link between confidentiality about a person’s health and the preservation of confidence in the medical profession and in health services generally has particular resonance in the present case. The interference by the CCDHB with the privacy of Mr Mills led directly to his loss of confidence in hospital-linked social workers and counsellors at precisely the point when he was most in need of their assistance. In his evidence Mr Mills explained:

[30] Being diagnosed with such an aggressive profoundly ghastly cancer is devastating enough to deal with emotionally and mentally, but to have the very people who are supposed to be able to help with coping with this stress, have ruined our trust.

[31] We have not felt safe and comfortable seeking any support whatsoever from Counsellors or Psychologists through the Hospital system due to this and this is unjust for us as patients, as it is our right under the Health Code.

...

[34] At a time when most brain cancer patients can reasonably expect to avail themselves of whatever limited resources the Hospital system has in terms of support, we are fearful and untrusting due to the actions of HVDHB and CCDHB.

[35] Therefore, we have felt isolated and intimidated by the DHBs.

[36] We now have a deep mistrust of the entire system, with the possible exception of the clinical, oncological and surgical team who seem to be of a higher level of integrity.

[127] Mr Mills was an articulate, persuasive and dignified witness. At no time have we had reason to doubt his credibility and in fairness his credibility was not put in issue by the DHBs. We therefore accept his evidence in its entirety.

[128] Employee X acknowledged in his response of 24 November 2017 that the use of Mr Mills’ personal information against his wife had caused “irreparable damage to the therapeutic relationship I had fostered with [Mr and Mrs Mills] to support them through an already challenging time ...”.

[129] We are satisfied that, on the balance of probabilities, the disclosure of information by Employee X during the telephone conversation of 15 November 2017 caused significant injury to the feelings of Mr Mills. It follows the breach of IPP 11 by the CCDHB caused an interference with the privacy of Mr Mills.

Whether the HVDHB interfered with Mr Mills’ privacy

[130] We have found the HVDHB breached IPPs 2 and 4 in collecting information from Employee X during the course of the 15 November 2017 telephone call. We have also found the HVDHB breached IPP 8 in failing to check the accuracy of the Facebook information before using it in the employment proceedings to support the HVDHB’s assessment of Mrs Mills’ leave applications.

[131] We therefore turn to consider whether, in connection with these breaches, the harm threshold in s 66(1)(b)(iii) was crossed and whether there was a causative link between the breach and the harm. We do not address s 66(1)(b)(i) and (ii) as neither of these forms of harm were established.

Collection of information during the telephone call

[132] We consider first the collection of information in the telephone call, namely whether the collection of the information caused Mr Mills significant injury to feelings. Here, the statements in R (W) v Secretary of State for Health (British Medical Association intervening) and the evidence of Mr Mills apply to the collection of information to the same extent that they apply to the disclosure of that information.

[133] Once again, we accept Mr Mill’s statements that the collection and use of his personal information in the context of the HVDHB response to the proceedings brought by Mrs Mills in the ERA made him feel angry and betrayed, and caused significant stress in his relationship with Mrs Mills. We are satisfied that, on the balance of probabilities, the collection of information by Ms Ririnui during the telephone conversation caused significant injury to the feelings of Mr Mills.

[134] We further find that in relation to the breaches by the HVDHB of IPP 2 and IPP 4 there is a direct causative link between the breaches and the injury to feelings experienced by Mr Mills.

Use of Facebook information without verification

[135] Mr Mills said he felt betrayed and angry when he found out his Facebook extracts appeared in the HVDHB statement of reply to support the contention that Mrs Mills may not have correctly represented her need for leave. Because he had unfairly not been given an opportunity to explain the extracts they had been interpreted out of context and then used in the employment dispute with his wife.

[136] We accept these statements and we are satisfied on the balance of probabilities that the HVDHB, by using the Facebook information in the manner it did, caused significant injury to the feelings of Mr Mills.

[137] We further find that in relation to the IPP 8 breach, the s 66(1)(b)(iii) causation element has been established and Mr Mills’ privacy has been interfered with.

[138] Our overall conclusion is that the breaches by the HVDHB of IPPs 2, 4 and 8 led to an interference with the privacy of Mr Mills.

REMEDY

[139] Where the Tribunal is satisfied on the balance of probabilities that any action of the defendant is an interference with the privacy of an individual it may grant one or more of the remedies allowed by s 85 of the Act:

85 Powers of Human Rights Review Tribunal

(1) If, in any proceedings under section 82 or section 83, the Tribunal is satisfied on the balance of probabilities that any action of the defendant is an interference with the privacy of an individual, it may grant 1 or more of the following remedies:

• (a) a declaration that the action of the defendant is an interference with the privacy of an individual:
• (b) an order restraining the defendant from continuing or repeating the interference, or from engaging in, or causing or permitting others to engage in, conduct of the same kind as that constituting the interference, or conduct of any similar kind specified in the order:
• (c) damages in accordance with section 88:
• (d) an order that the defendant perform any acts specified in the order with a view to remedying the interference, or redressing any loss or damage suffered by the aggrieved individual as a result of the interference, or both:
• (e) such other relief as the Tribunal thinks fit.

(2) In any proceedings under section 82 or section 83, the Tribunal may award such costs against the defendant as the Tribunal thinks fit, whether or not the Tribunal makes any other order, or may award costs against the plaintiff, or may decline to award costs against either party.
(3) Where the Director of Human Rights Proceedings is the plaintiff, any costs awarded against him or her shall be paid by the Privacy Commissioner, and the Privacy Commissioner shall not be entitled to be indemnified by the aggrieved individual (if any).
(4) It shall not be a defence to proceedings under section 82 or section 83 that the interference was unintentional or without negligence on the part of the defendant, but the Tribunal shall take the conduct of the defendant into account in deciding what, if any, remedy to grant.

[140] Section 88(1) relevantly provides that damages may be awarded in relation to three specific heads of damage:

88 Damages

(1) In any proceedings under section 82 or section 83, the Tribunal may award damages against the defendant for an interference with the privacy of an individual in respect of any 1 or more of the following:

• (a) pecuniary loss suffered as a result of, and expenses reasonably incurred by the aggrieved individual for the purpose of, the transaction or activity out of which the interference arose:
• (b) loss of any benefit, whether or not of a monetary kind, which the aggrieved individual might reasonably have been expected to obtain but for the interference:
• (c) humiliation, loss of dignity, and injury to the feelings of the aggrieved individual.

[141] Mr Mills is seeking a declaration of interference as well as damages for the injury to his feelings.

Section 85(4) – conduct of the defendants

[142] Addressing first s 85(4), it is no defence that the interference was unintentional or without negligence, but the Tribunal must nevertheless take the conduct of the two DHBs into account in deciding what, if any, remedy to grant.

[143] Turning first to the CCDHB, while Employee X was well-intentioned and believed he was assisting Mrs Mills in the mediation process, he nevertheless disclosed personal information about Mr Mills against his (Employee X’s) better judgment.
[144] We have considered the apology made by Employee X to Mr and Mrs Mills. The relevance of an apology was addressed in Williams v Accident Compensation Corporation [2017] NZHRRT 26 at [38] and [41]:

[38] An appropriate and timely apology can be taken into account under s 85(1)(4) of the Privacy Act when considering whether the defendant’s conduct has ameliorated the harm suffered as a result of the breach of privacy. See AB v Chief Executive, Ministry of Social Development [2011] NZHRRT 16 at [37]:

... an appropriate apology given at the right time is a matter that can be taken into account under s.85(4) of the Act in considering whether and to what extent the defendant’s conduct has ameliorated the harm suffered as a result of an interference with privacy. ...

[41] The apology cannot “erase” the humiliation, loss of dignity or injury to feelings caused by the interference with privacy. Nor is it a “get out of jail free” card. The question in each case is whether and to what degree the emotional harm experienced by the particular plaintiff has been ameliorated. While this is a fact specific inquiry it can be said that ordinarily an apology must be timely, effective and sincere before weight can be given to it. It is not inevitable an apology, even if sincerely and promptly offered, will ameliorate the emotional harm experienced by the plaintiff. Much will depend on who the particular plaintiff is and the particular circumstances of the case.

[145] In the present case the apology is contained in the short email dated 24 November 2017 sent by Employee X to Mr and Mrs Mills. The purpose of the email was to attach the response by Employee X to the file note made by Ms Ririnui and used by the HVDHB in the ERA proceedings. There is no apology in the response itself. The email apology is contained in the following paragraph:

Once again, I offer my sincerest apologies that this occurred and for any hurt that may have happened as a result.

[146] It is to be noted the apology is a personal one offered by Employee X. It is not an apology by the CCDHB itself. For that reason the degree to which it can be taken into account is problematical. In any event the weight which can be given to the apology is further diminished by the following:

[146.1] Both the email and the attached response have been carefully worded to contain the least admission of wrongdoing.

[146.2] Employee X acknowledged that the letter was drafted not by him but by the CCDHB human resources department.

[147] In view of these factors the single line in the email falls well short of what would be required by way of mitigating circumstances.

[148] As to the HVDHB, we find no mitigating factors. There was an overreaction by employees of the HVDHB to the content of Mr Mills’ Facebook pages. The Give-a-Little page was a factor which aggravated the situation. However, instead of approaching Mrs Mills or Mr Mills to address the concerns held by the HVDHB about their bona fides the human resources department instructed Ms Ririnui to obtain further information from a third party (Employee X). The HVDHB called no evidence to show that the IPPs were taken into account before Ms Ririnui was instructed to make the telephone call on 15 November 2017.

[149] We conclude there are no mitigating factors which operate in favour of the DHBs.

Declaration

[150] While the grant of a declaration is discretionary, declaratory relief should not ordinarily be denied. See Geary v New Zealand Psychologists Board [2012] NZHC 384, [2012] 2 NZLR 414 (Kós J, Ms SL Ineson and Ms PJ Davies) at [107] and [108].

[151] On the facts we see nothing that could justify the withholding from Mr Mills of a formal declaration that both the CCDHB and the HVDHB interfered with his privacy. Such declarations are made accordingly.

Damages for injury to feelings

[152] The Tribunal having found for the purpose of establishing liability under s 66(1)(a)(i) and (1)(b)(iii) that Mr Mills suffered significant injury to his feelings, it follows that injury to feelings has also been established for the purpose of awarding damages under s 88(1)(c). See Director of Human Rights Proceedings v Slater [2019] NZHRRT 13 at [164]:

... where, as here, it has been found for the purpose of s 66(1)(b)(iii) there was significant humiliation, significant loss of dignity and significant injury to the feelings of the plaintiff, it follows humiliation, loss of dignity and injury to feelings has been established for the purpose of s 88(1)(c) as this provision does not require that these forms of emotional harm be “significant”.

[153] As to the assessment and award of damages for (inter alia) injury to feelings, reference is to be made to Hammond v Credit Union Baywide [2015] NZHRRT 6 at [170] to [177]. We adopt the general principles relating to the award of damages set out in that decision which include:

[153.1] Damages are awarded not to punish a defendant for what he or she has done but to compensate the person aggrieved for the harm suffered. See [170.3].

[153.2] The very nature of the s 88(1)(c) heads of damages means there is a subjective element to their assessment. Not only are the circumstances of humiliation, loss of dignity and injury to feelings fact specific, they also turn on the personality of the aggrieved individual. See [170.5].

[153.3] The reference to Director of Proceedings v O’Neil [2001] NZAR 59 at [29] where the High Court stated that the feelings of human beings are not intangible things. They are real and felt, but often not identified until the person stands back and looks inwards. They can encompass pleasant feelings (such as contentment, happiness, peacefulness and tranquillity) or be unpleasant (feelings such as fear, anger and anxiety). However a feeling can be described, it is clear that some feelings, such as fear, grief, sense of loss, anxiety, anger, despair, alarm and so on, can be categorised as injured feelings. They are feelings of a negative kind arising out of some outward event. To that extent they are injured feelings. It is necessary to look at the totality of the injury and the emotional state of the complainant. Injury to feelings often comprises a complex mix of feelings and emotions, which are often hard to compartmentalise and overlap. See [170.7].

[154] In Hammond the Tribunal identified three bands within which damages awarded by the Tribunal range:

From this general overview it can be seen that awards for humiliation, loss of dignity and injury to feelings are fact-driven and vary widely. At the risk of oversimplification, however, it can be said there are presently three bands. At the less serious end of the scale awards have ranged

upwards to $10,000. For more serious cases awards have ranged between $10,000 to about (say) $50,000. For the most serious category of cases it is contemplated awards will be in excess of $50,000. It must be emphasised these bands are simply descriptive. They are not prescriptive. It is not intended they be a bed of Procrustes on which all future awards must be fitted. At most they are a rough guide and cannot abridge the general principles identified earlier in this decision.

[155] In the present case Mr Mills was extremely vulnerable. He had just been diagnosed with terminal cancer of the brain and operated on. He was acutely sensitive to the unauthorised disclosure of his personal information by his health service provider; particularly to his wife’s employer which had used that information in an employment dispute to suggest Mrs Mills had not been frank when asking for time off to care for her husband.

[156] Accepting as we do the importance of the confidentiality which attaches to information about a person’s health and treatment for ill-health (see R (W) v Secretary of State for Health (British Medical Association intervening)) we stress the following significant elements to Mr Mills’ case:

[156.1] His extreme vulnerability.

[156.2] The expressly limited terms of the authority given by him to Employee X as to what he (Employee X) could disclose about Mr Mills to the HVDHB, being Mrs Mills’ employer.

[156.3] The failure by the HVDHB to address its concerns directly to Mr Mills and Mrs Mills regarding their bona fides.

[156.4] The use of Mr Mills’ personal information to undermine the credibility of his wife in circumstances where the HVDHB had taken no reasonable steps to ensure that the information was accurate and not misleading. Those steps could have been easily taken by approaching Mr or Mrs Mills.

[156.5] The loss of confidence by Mr Mills in social workers and counsellors (particularly those linked to the CCDHB) at a time when he and his wife had an acute need for their support.

[157] Taking into account all the evidence we have heard we are of the view that the injury to feelings experienced by Mr Mills was significant and falls inside the second band of cases identified in Hammond v Credit Union Baywide.

[158] We see little to distinguish between the two defendants in terms of the injury to Mr Mills’ feelings. The HVDHB certainly collected and used the personal information to undermine the credibility of Mrs Mills and by inference, Mr Mills himself. This was extremely hurtful to Mr Mills at possibly the lowest point in his life. But the prior unauthorised disclosure of the personal information by Employee X was justifiably perceived by Mr Mills as a betrayal of trust. This led directly to Mr and Mrs Mills feeling unable to access DHB-provided assistance in the form of counselling and social worker services at a time when there was an acute need for those services.

[159] Looked at in the round we have concluded there is no real justification for awarding differentiated sums of damages. Each defendant contributed equally to Mr Mills’ injured feelings.
[160] Accordingly, Mr Mills should properly be compensated by an award of damages and that that award should be quantified as:

[160.1] An award of $20,000 against the CCDHB; and

[160.2] An award of $20,000 against the HVDHB.

Training

[161] Before leaving this case we feel bound to point out that none of the witnesses called by the CCDHB and the HVDHB appear to have been sufficiently aware of the confidentiality attaching to personal information, especially health information. The witnesses for the HVDHB in particular appear to have been lacking relevant, recent training in relation to the IPPs and consequently gave them little or no consideration at the time. Similarly, the human resources department from which Ms Ririnui and her team took instructions did not, on the evidence heard by the Tribunal, communicate to Ms Ririnui the need for caution when collecting personal information about Mr Mills in circumstances in which that information could potentially be used against his wife in the ERA proceedings. The HVDHB Privacy Officer appears to have had no or little input into the process.

[162] When the Tribunal raised with Mr Kynaston the apparent room for improvement in privacy training he correctly pointed out that in his statement of claim, Mr Mills had not put the adequacy of training in issue with the consequence the DHBs had not come to the hearing prepared to address the point. But while resisting a formal training order Mr Kynaston recognised the Tribunal may wish to recommend further training in privacy matters.

[163] For his part, Mr Mills expressed the hope that the Tribunal would recommend training of some kind so that the legacy left by him and his proceedings would be that others will not have to experience what he and his wife have suffered.

Training – recommendation by Tribunal

[164] A formal training order cannot be made in the present case for the reasons given by Mr Kynaston.

[165] However, on the evidence we have heard we are of the clear view that in relation to both DHBs (but more so in relation to the HVDHB) there is a demonstrated need for further and regular ongoing training of frontline and human resources staff. There needs to be an increased awareness of the practical application of the IPPs in the context of the everyday activities carried out by staff such as providing health care services. It also needs to be understood the information privacy principles apply also where (as here) the context is an agency’s dealings with its own staff. Employees should not be exposed to the risk of being blamed for privacy breaches which occur as a consequence of inadequate training and supervision. In this respect it is necessary we record that our decision should not be read as implying any personal criticism of any employee of the defendant DHBs.

[166] We accordingly recommend such training be given.

FORMAL ORDERS

[167] For the foregoing reasons the decision of the Tribunal is that it is satisfied that on the balance of probabilities an action of the Capital and Coast District Health Board and actions of the Hutt District Health Board were interferences with the privacy of Mr Mills and:

[167.1] A declaration is made under s 85(1)(a) of the Privacy Act 1993 that the Capital and Coast District Health Board interfered with the privacy of Mr Mills by disclosing personal information about him when it did not believe on reasonable grounds that any of the exceptions listed in Principle 11 of the IPPs had application.

[167.2] A declaration is made under s 85(1)(a) of the Privacy Act 1993 that the Hutt District Health Board interfered with the privacy of Mr Mills by breaching IPP 2, IPP 4 and IPP 8.

[167.3] Damages of $20,000 are awarded against the Hutt District Health Board under ss 85(1)(c) and 88(1)(c) of the Privacy Act 1993 for injury to the feelings of Mr Mills.

[167.4] Damages of $20,000 are awarded against the Capital and Coast District Health Board under ss 85(1)(c) and 88(1)(c) of the Privacy Act 1993 for injury to the feelings of Mr Mills.

COSTS

[168] Costs are reserved. Because Mr Mills represented himself the only costs recoverable by him are the disbursements incurred in preparing and presenting his case. If Mr Mills wishes to recover disbursements he should prepare an itemized list and send it to Mr Kynaston. Unless the parties come to an arrangement on costs the following timetable is to apply:

[168.1] Mr Mills is to file his submissions within 14 days after the date of this decision. The submissions for the CCDHB and the HVDHB are to be filed within the 14 days which follow. Mr Mills is to have a right of reply within seven days after that.

[168.2] The Tribunal will then determine the issue of costs on the basis of the written submissions without further oral hearing.

[168.3] In case it should prove necessary, we leave it to the Chairperson of the Tribunal to vary the foregoing timetable.