NZLII Home | Databases | WorldLII | Search | Feedback

Victoria University of Wellington Law Review

Victoria University of Wellington
You are here:  NZLII >> Databases >> Victoria University of Wellington Law Review >> 2005 >> [2005] VUWLawRw 20

Database Search | Name Search | Recent Articles | Noteup | LawCite | Download | Help

Evans, Katrine --- "Show Me The Money: Remedies under the Privacy Act - [2005] VUWLRev 20; (2005) 36 VUWLR 475" [2005] VUWLawRw 20; (2005) 36(3) Victoria University of Wellington Law Review 475


Katrine Evans[*]

This article examines the remedies available for breaches of the Privacy Act 1993. The author first explores the limited range of options available to the Privacy Commissioner, and highlights the success of the low-level approach to resolving cases which is adopted in practice. The Human Rights Review Tribunal has formal remedial powers, including the award of damages and costs. Although a tariff system is not realistic in privacy cases, the Tribunal has given strong guidance on how questions about remedies, including damages, will be decided. The author is of the view that the Tribunal has no jurisdiction to grant punitive damages but that an amendment to the Act to allow for this would be valuable. Parties to complaints need to be aware that formal remedies are rare and remain measures of last resort.


Complainants and agencies alike often focus on the possible availability of money as a remedy for a failure to abide by the Privacy Principles in the Privacy Act 1993.[1] Perhaps conditioned by the traditional focus of the common law on damages, complainants may view money as the most appropriate way to redress perceived breaches of their privacy. Also, agencies trying to see what risks may arise from breach of the Privacy Act look to the quantum of damages awarded by the Human Rights Review Tribunal (the Tribunal) as a guide to the level of risk. Even while a complaint is under investigation by the Privacy Commissioner (the Commissioner), parties to a complaint often request guidance as to the most appropriate financial level at which a complaint might be settled.

This focus on money can serve to disguise the fact that the Privacy Act (the Act) gives the Tribunal the power to award a range of remedies. Section 85 allows the Tribunal to give, for example, a declaration of breach or an order that the agency should not repeat the behaviour which caused the breach. Some of these alternative remedies may be far more appropriate than damages in a given situation. The focus on damages also can mislead those who complain to the Commissioner. First, the Commissioner cannot award a complainant compensation for breaches of the Act. The powers are recommendatory only, although the Commissioner's specialist knowledge and authority is unquestioned.[2] Second, a major focus of the Commissioner's complaints jurisdiction is to encourage conciliation between parties.[3] This does not always (or even mostly) involve money changing hands. Many settlements are achieved by using low or no-cost solutions, particularly if a complaint can be settled early. An unrealistic focus on money might mean that a complaint is less likely to be settled than might otherwise be the case. On the other hand, a financial settlement may sometimes be an appropriate and practical solution. Determining what it will take to settle an individual dispute is a major focus of the Commissioner's investigation.

More importantly, it has to be recognised that true compensation for privacy breaches may be an unattainable goal. It is extremely difficult to compensate a person meaningfully for a wrongful disclosure of personal information, for example. The person cannot be restored to his or her original position. Once information is disseminated, the subjects of it permanently lose the measure of control they once had over that information. Determinations of how to put a price on hurt and humiliation are also notoriously hard to make. Quantification of the level of damage is therefore a difficult task for parties and decision-makers alike.

This is not to say that it cannot or should not be attempted: similar problems are faced by the courts in almost every tort case they decide. However, the question of damages and the quantification of those damages bring to the fore fundamental considerations of what remedies in a particular area of law are designed to achieve, and how well they achieve that goal. This article aims to begin a discussion on this point in relation to the availability of damages under the Privacy Act. A future, wider, discussion will also assist with debates about purpose and quantum of damages in the developing common law privacy tort.[4]

After a discussion of the role of the Privacy Commissioner (part II), this article briefly considers the different types of remedies which are available, before moving on to the specific topic of damages and the level of damages which the Tribunal tends to award (part III and appendix A). In part IV, I discuss the difficulties with assessing what damages are or should be available through the Privacy Act's processes. I conclude earlier that monetary settlements which occur during the Commissioner's investigation process do not fit within the concept of damages at all, despite the frequent assumptions of parties involved in investigations. Instead, these agreements are essentially restorative: they provide a platform from which each party can then move forward constructively from a situation of conflict. This is completely in accordance with the Commissioner's powers to investigate and conciliate complaints and can be, in most instances of privacy breaches, a far more fruitful way to proceed than an award of damages as such. The blunt instrument of damages as some form of consolation (for a perhaps un-rightable wrong) is still available from the Tribunal, under section 88 of the Act. It is important, but its importance can be overstated. The Tribunal's processes focus naturally on winning and losing. The parties are automatically polarised. Some may find the process useful. But it is not an ideal solution for privacy disputes.

I argue that the Tribunal can only award compensatory not punitive damages, but that this is not fully appreciated particularly by complainants. I also suggest that it is difficult for the Tribunal to keep ideas of compensation separate from those of punishment, but that there is relevant experience in New Zealand to permit that assessment to be made, most notably in the area of accident compensation. However, I conclude that there are some arguments for punitive awards to be available in privacy cases in carefully circumscribed instances. These arguments have to take into account the additional risk aversion which the clear availability of punitive awards might create for agencies. The Act toes a delicate line between encouraging, rather than forcing, agencies to engage in best practice for personal information handling, while also recognising the need to react in appropriately strong ways to flagrant breaches of privacy. My own present view is that punitive damages are justifiable and manageable in truly exceptional cases, and that their availability would enhance the ability of the Tribunal to actively manage flagrant privacy breaches without unduly raising risks for agencies which make unfortunate errors but are still on a learning curve. Future work on this matter, however, is required.


It comes as a surprise to many who complain that the Commissioner has no statutory power to award compensation for breach of a Privacy Principle, to order apologies or changes of practice, or to enforce recommendations that access be given or corrections made to personal information. It is tempting for some parties to assume, therefore, that the Commissioner is essentially "toothless". This, however, misconstrues the true position.

The Office of the Privacy Commissioner has highly specialist knowledge and experience, built up over the 12 years in which the Act has been in force. It has access to knowledge built up in similar institutions across the world. It participates in international fora discussing privacy developments. This expertise is invaluable in informing people about the proper interpretation of the statute and guiding expectations of success. Quite simply, therefore, the Commissioner is the leading authority on the statute. As a result, ignoring the Commissioner's views can lead to incurring unnecessary expense or experiencing prolonged and stressful litigation with little chance of success. As the Tribunal said in the Ram decision:[5]

Although the Tribunal is not obliged to accept the opinion given by the Privacy Commissioner in any case, it ought to be obvious to ... litigants that when their case comes before the Tribunal they will need to be prepared to deal with any adverse opinion by the Privacy Commissioner. To approach litigation in the Tribunal on the basis that the substantive matters raised in the Privacy Commissioner's opinion can simply be ignored is extremely unwise.

This is not to say, of course, that the Commissioner's Office is always right. Apart from anything else, in privacy, as with all areas of law, there can be a spectrum of "right" and "wrong". So, the Tribunal may take a different view of a provision than that expressed by the Commissioner. Having the Tribunal as an additional forum in which privacy issues can be explored both gives the parties a day in court, when that is wanted, but also can enhance the sense of dialogue and development in the still relatively new field of information privacy protection. Disagreement is both inevitable and useful. Serious disagreement is not particularly frequent, however.

In any case, the fact that the Commissioner's opinions are not legally binding does not indicate a lack of confidence in the ability of the Commissioner to get a decision right. Instead, a more formal enforcement role would actually be antithetical to the tenor of the Act as a whole. First, the Commissioner's main focus is to promote and protect individual privacy,[6] using such tools as education,[7] public statements,[8] reporting to appropriate authorities,[9] monitoring legislation and,[10] after due consultation, issuing Codes of Practice to regulate particular practices, activities or industries.[11] In other words, the legislation looks to the Commissioner being able to play a highly proactive role in privacy protection. While the reactive role as regards complaints is important, since individuals and agencies need a mechanism to resolve disputes about privacy matters, it is not the main focus of the Act.

Second, the model for dispute resolution under the Act is investigation and conciliation. It does not focus on punishing agencies for breach, though it provides strong encouragement, and incentives, for agencies to abide by their legal obligations. There is a strong – and increasing – focus on conciliation and eduction throughout the Office's complaints process. Sometimes this may take the form of encouraging a face to face meeting between parties, perhaps at the Office with one of the Commissioner's staff as a facilitator. Most members of the complaints investigation team at the Office are trained in mediation and are available to assist parties in meetings where appropriate. In the interests of fairness and clarity, mediations are conducted by a person who has not been involved in investigating the complaint. Sometimes, the process is conducted through correspondence. So, for example, very early in an investigation, a complainant is asked what would resolve the complaint for them. This then gives guidance to the Office and agency alike as to how the matter might proceed from there, and whether a quick, uncontroversial solution is available. More in-depth conciliation focuses on facilitating greater understanding between the parties, and enabling both to move forward in a reasonably positive vein from a situation of conflict.

It also allows a complaint to be used as a relatively low-risk educational process about rights and responsibilities of parties. Complainants may become aware that their rights are not limitless. During the course of an investigation, agencies may realise that a mistake has been made and be prepared to alter their policies and practices. This alone is enough to satisfy many complainants who then feel that their complaint has had a positive outcome. The Office of the Privacy Commissioner learns about the practicalities of privacy protection in various areas of the agency's work and develops a sense of whether further guidance or policy development is needed in the area to better protect privacy while, at the same time, taking account of the legitimate needs of business and government.[12]

Sometimes, agencies make a settlement offer as part of a process of conciliation. This will often include an apology that, if carefully worded, can do much to enable the parties to move forwards from a grievance. It may include an assurance about a change of practice, to ensure that a particular situation does not arise again. It may also – but does not by any means always – include payment of money. That payment may have a somewhat compensatory flavour but more importantly it simply provides a formal recognition of what has occurred. As in other areas of law agencies may also take a pragmatic approach to payment, calculating the risks and costs of failing to settle, and therefore be prepared to make an offer simply to see an end of the matter. Whatever the motivation behind them, however, monetary settlements achieved during the conciliation process are essentially restorative in nature: they enable the parties to move forward from a state of conflict.

The Office does not at present give in-depth guidance about appropriate quantum of monetary awards which might serve to settle individual disputes. This is partly a philosophical view: conciliation is based on the parties themselves deciding what is appropriate for them, rather than having some form of tariff or external pressure to guide their views. Also, production of a tariff would be very difficult: privacy situations vary so widely that it is hard to give solid guidance as to what is appropriate in an individual dispute. For example, settlements in the Office have included a bunch of flowers or a gift basket, a holiday for a couple who had suffered considerable stress as a result of what had occurred, to cheques for many thousands of dollars.[13]

Despite the difficulties, though, the Office can still manage expectations where required. It is not particularly unusual, for example, that a complainant claiming a large sum of money is required to settle a matter which is at most worth a few hundred dollars or nothing at all. The Office can and does inform parties when they are being unrealistic. It can inform parties about amounts awarded in the Tribunal, to manage expectations of what is appropriate, and to enable a party to decide whether it is worth proceeding further with a matter. It can encourage the complainant to be more realistic and thereby make conciliation more of a possibility. Agencies may be able to assess their risks, and decide whether it is worth resisting the Commissioner's view of the law. Failure to conciliate where there is an interference with privacy, though, will usually result in the Commissioner deciding to refer the matter to the Director of Human Rights Proceedings, who then decides whether to bring proceedings in the Tribunal.

It is a measure of success of the Commissioner's work that the great majority of complaints do not go beyond the Commissioner's Office. They are either resolved, settled, or the complainants decide not to pursue the matter further after the investigation is completed. Sometimes, admittedly, this may be as a result of exhaustion – the complainant may still feel strongly, but not have the will to proceed further. Sometimes, the prospect of having to take a matter before a formal body, in a public hearing, is simply too daunting. But generally, it is because the parties consider that they have done all they can do, and they accept the result, even unwillingly.

In summary, therefore, despite the Commissioner's lack of formal power to award specific remedies, most complaints brought under the Act are resolvable (and are resolved) informally. This includes the usefulness of the investigative process to clarify the rights and responsibilities of the parties.

Having said that, it is obviously important that there should be an enforcement body to consider breaches of privacy and make appropriate orders where parties do not accept the Commissioner's opinion. Parties may need an opportunity to have their day in court. This body needs to have the power to make remedial orders where conciliation has failed and the agency is in the wrong. It also needs the power to make appropriate awards of costs against losing parties. The effect of costs awards is discussed towards the end of this article.


The Human Rights Review Tribunal is a specialist forum established under the Human Rights Act 1993.[14] Once the Privacy Commissioner has investigated a complaint,[15] the matter can be heard by the Tribunal. A case comes to the Tribunal in one of two ways. The first is that the Commissioner can refer a matter to the Director of Human Rights Proceedings (the Director)[16] who then makes an independent decision about whether to take the case, as the plaintiff, to the Tribunal.[17] This option is only available where the Commissioner is of the opinion that there is an interference with privacy which warrants referral to the Director.[18] The current Commissioner's recent practice is to refer cases where she finds an interference with privacy to the Director as a matter of course, unless the complainant does not wish to proceed or there is nothing further to be achieved for the complainant by taking the matter further. For example, if the case involved access to information, and the Commissioner finds there is no proper basis to refuse access (under sections 27-29 of the Act) then there is an interference with privacy under section 66(2). However, if the agency has complied with the Commissioner's recommendations and has provided the information to the complainant during the course of the investigation, or following receipt of the Commissioner's opinion, the case might not be referred to the Director unless there is an important point of principle, law or practice which it would be beneficial for the Tribunal to consider.

The second route to the Tribunal is for complainants to take matters there themselves. This option is open if the Commissioner finds an interference with privacy has occurred, but decides not to refer the case to the Director,[19] where the Director declines to take the case on behalf of the plaintiff,[20] or when the Commissioner finds that no interference with privacy has occurred or has discontinued the investigation.[21] The Tribunal is in no way bound by the opinion of the Commissioner, but hears the matter de novo.

The respondent agency cannot take a matter to the Tribunal: it is only the Director or the aggrieved individual who can do so. The way for an agency to test the matter in proceedings is therefore for the agency to refuse to accept the Commissioner's view, and then to see if the matter is taken further.

The Tribunal is able to award a variety of remedies to a successful plaintiff. It can, and often does, also award costs against losing parties, including plaintiffs in person.[22] These remedies are as follows:

85 Powers of [Human Rights] Review Tribunal

(1) If, in any proceedings under section 82 or section 83 of this Act, the Tribunal is satisfied on the balance of probabilities that any action of the defendant is an interference with the privacy of an individual, it may grant one or more of the following remedies:

(a) A declaration that the action of the defendant is an interference with the privacy of an individual:

(b) An order restraining the defendant from continuing or repeating the interference, or from engaging in, or causing or permitting others to engage in, conduct of the same kind as that constituting the interference, or conduct of any similar kind specified in the order:

(c) Damages in accordance with section 88 of this Act:

(d) An order that the defendant perform any acts specified in the order with a view to remedying the interference, or redressing any loss or damage suffered by the aggrieved individual as a result of the interference, or both:

(e) Such other relief as the Tribunal thinks fit.

A Declaration

A declaration provides a public, formal statement that the defendant was in the wrong. This is a useful educational tool for the agency concerned and also for others. It may also be the most appropriate remedy in access cases where, by the time of the hearing, the plaintiff may have received all the material. Technically, the plaintiff needs to ask for a declaration in the statement of claim: however, the Tribunal has been prepared to award a declaration even where one was not requested.[23]

B Order not to Continue or Repeat the Action

This is often something which plaintiffs wish to achieve from the process of taking a complaint. Usually, this matter can be dealt with during the investigation process, but sometimes the plaintiff will still be dissatisfied. A spirit of altruism – of ensuring that the same thing cannot happen to others – can provide a major motivator to take the matter to the Tribunal. Again, an order of this type can be an important educational tool for other agencies with similar practices.

C Specific Action

The Tribunal may order the defendant to take specified steps to remedy the interference with the plaintiff's privacy, or otherwise put right the harm caused. This might arguably extend to ordering correction of clearly inaccurate information, though the Tribunal has doubted whether it has this power. This provision, though, permits the Tribunal to order a targeted remedy.

D Other Relief

Potentially, the very broad reference to "such other relief as the Tribunal thinks fit" permits a highly inventive approach to remedial orders. Usually, by the time a matter reaches the Tribunal, such avenues will already have been tried, and the parties themselves are too entrenched to think laterally about appropriate relief. This would not necessarily prevent the Tribunal from inventing a solution under this heading: it is the one category of relief where the plaintiff would not have to be specific in their statement of claim but can leave the matter open. However, realistically, the Tribunal is unlikely to stray too far from standard judicial solutions to the dispute before it. The Tribunal, for example, has no explicit power to order an apology. However, this section gives it latitude to do so, if appropriate in the circumstances.

E Compensatory Damages

The Tribunal's ability to award damages is governed by section 88 of the Act:

88 Damages

(1) In any proceedings under section 82 or section 83 of this Act, the Tribunal may award damages against the defendant for an interference with the privacy of an individual in respect of any one or more of the following:

(a) pecuniary loss suffered as a result of, and expenses reasonably incurred by the aggrieved individual for the purpose of, the transaction or activity out of which the interference arose:

(b) loss of any benefit, whether or not of a monetary kind, which the aggrieved individual might reasonably have been expected to obtain but for the interference:

(c) humiliation, loss of dignity, and injury to the feelings of the aggrieved individual.

[(1A) Subsection (1) applies subject to subpart 1 of Part 2 of the Prisoners' and Victims' Claims Act 2005].

In part IV below, I consider whether section 88 permits, or should permit, the Tribunal to award punitive damages. In this part, however, I consider the quantum and circumstances of compensatory awards made by the Tribunal.

During the hearing into Parker v Ministry of Agriculture and Forestry counsel drew the Tribunal's attention to Gallen J's statements in the case of Laursen v Proceedings Commissioner,[24] suggesting that awards of damages were too low to represent the real harm suffered by plaintiffs.[25] While Laursen was a sexual harassment case, counsel invited the Tribunal to consider that the same arguments applied to awards in privacy cases.[26] The Tribunal noted the point, but also expressed the desire for more work to be done into appropriate comparators on levels of awards across different jurisdictions in privacy cases. It declined to "effectively raise the bar" in the Parker case itself, since the defendant appeared "to have acted as responsibly as one might expect it to have done in all the circumstances."[27] However, at the same time, it made an award of $4,000 for a case in which, in the Tribunal's assessment, the degree of humiliation experienced did not appear to be particularly high.

I suggest that, when compared with earlier awards, this did in fact signal a raising of the bar. Since the Tribunal was only at the start of a process to assess the relevant factors going to awards, this is not particularly surprising. The main point, however, is that the Tribunal recognised the need to move to a more transparent calculation and comparison of appropriate awards of damages in privacy decisions.

Since that time, the Tribunal has done further work on identifying appropriate factors for consideration in awards of damages. The main decisions demonstrating this thought process are Hamilton v The Deanery 2000 Ltd,[28] Feather v Accident Compensation Corporation,[29] and CBN v McKenzie Associates.[30] As I have argued elsewhere, the result of the Tribunal's deliberations is that the quantum of damages in the Tribunal is on the rise[31] but that the Tribunal has gone an important way towards developing a scale of seriousness which is relatively transparent to those involved in cases before it.

1 Level of damages

Early cases resulting in awards of damages were few and far between. This is likely to have contributed to the significant lack of clarity about the basis and quantum of awards, since experience is always necessary to test the boundaries of a new area of jurisdiction. The first case before the Tribunal in 1994 was an access case where an interference with privacy was found.[32] While the plaintiff's interests had not been materially affected by the lack of information (in this case, copies of sworn affidavits, where the plaintiff had copies of the unsworn versions) the Tribunal found that she was taken aback when that information appeared during a later court case. It awarded her a nominal sum of $500 for the humiliation or injury to feelings which she had suffered.[33]

In more recent cases with a fairly comparable level of injury to feelings, the Tribunal's assessment of a fairly nominal sum was $1,200 (failure to provide a prison inmate with personal information in a letter to the prison making allegations about his inappropriate behaviour while on parole)[34] and $2,500 (failure to provide a copy of a letter making a brief statement to a mortgagee about the plaintiff's insurance rights over the building).[35] Neither case appeared to involve a serious interference with the plaintiff's interests in the circumstances, perhaps fortunately for the defendants.

What these cases demonstrate, however, is that the awards of damages at the lower end of the spectrum are not completely inconsiderable, particularly if the defendant is an individual. But this is not unreasonable. After all, an award of damages is one of the risks of engaging in litigation, as opposed to settling a matter earlier. In the privacy field, realistic awards of damages also act as an important incentive to supporting the Commissioner's conciliation and investigation role.

However, the awards are not necessarily so high as to entice many complainants with marginal cases to take the matter further. This is particularly so given the fact that a potential award of damages is counterbalanced by a risk of an adverse costs award if the case is unsuccessful. This is an important point when considering how best to use the Tribunal's time, and the scarce resources involved. While access to justice is a fundamental principle, there is also a need not to actively encourage futile or seriously marginal claims. In the privacy field, this can arise particularly where the person has had an opportunity to withdraw a complaint during the Commissioner's investigation, and has declined to see that their claim is groundless. Again, therefore, the Tribunal's stance on remedies impacts directly on the ability of the Commissioner's Office to resolve matters at a low level, without undue expense, and early. The same is true of the ability to seek awards of costs against an unsuccessful party. Appendix B sets out a schedule of cases and amounts of costs awarded. Most of these awards were made against lay litigants, and, as the schedule shows, are not small amounts for an individual to have to pay.

Not all damages awards are small, and the larger awards also appear to be on the rise. There have been a few awards of $5,000-$10,000, a couple at $20,000 and one – the highest thus far – of $40,000 for a case which was "a very great deal more serious than any of [the preceding cases]".[36] I have included a full schedule of damages awards from the HRRT in Appendix A for general information on how much has been awarded, with an indication of the individual fact situations. The aim of the appendix is to give parties, counsel and commentators a general idea of what has happened in the past, so that risks and expectations can be more easily calculated. In the text, however, I focus on the types of factors which the Tribunal is starting to take into consideration when looking at quantum of damages.

2 Relevant factors

The key cases of Hamilton and Feather deal with disclosure of personal information. They have started to produce some useful guidance on mitigating and aggravating factors in cases involving breaches of Principle 11.[37] Some of those factors will also be relevant to calculations of damages under other Principles. This is particularly so with Principles 1-5 and 8, 10 and 12 where adverse consequences, as listed in section 66(1), are required in addition to a breach of a Principle, in order to find an "interference with privacy". Principles 6 and 7, which involve information privacy requests, are slightly different in that the plaintiff does not have to show that an adverse consequence has followed from the failure to provide access to or correction of personal information. A breach of principle 6 or a refusal to correct information under Principle 7 is an interference with privacy per se.[38] Slightly different calculations may therefore be needed about the level of compensation appropriate in these cases. There will also be some parallels, however.[39]

The Hamilton case involved an unusually serious and harmful disclosure of personal information about the plaintiff.[40] Paula Hamilton, a British model and celebrity, had settled in New Zealand. She had undergone treatment at the defendant clinic, The Deanery, an exclusive private alcohol treatment clinic in Christchurch. One of the directors of The Deanery, Ewan McLeod, contacted the New Zealand Immigration Service while Ms Hamilton was back in Britain on a visit. He told the Service that Ms Hamilton was an active drug user and that he was withdrawing his support for her application for permanent residence in New Zealand. He had a subsequent conversation with an immigration officer. His motivation was apparently to make life difficult for her: her relationship with The Deanery had deteriorated and this appeared to be some type of retaliation. As a result of his disclosures, Ms Hamilton was searched and interviewed when she returned to New Zealand. Some of her baggage was impounded. She had to undergo proceedings before the Removal Review Authority and appeals to the High Court. She was unable to return to Britain without risk that she would not be allowed to come back to New Zealand. Mr McLeod also told a New Zealand media organisation how long she had been at The Deanery, and that she had "failed" the programme. He gave reporters her contact details, with inevitable results. He also communicated similar information to two newspapers in Britain, one of which was embroiled in a defamation suit with Ms Hamilton.

The Tribunal awarded Ms Hamilton $40,000 for humiliation, the highest award it has granted so far. It listed various factors which contributed to this being a particularly serious interference with her privacy. Leaving issues of causation aside for a moment, these can be categorised as follows:[41]

(1)The nature of the agency which disclosed the information. Here, this was the healthcare provider itself, not a rogue employee, or a third party. Greater care is expected of agencies handling this type of information.
(2)Whether there were internal standards prescribing an appropriate information handling practice. In its promotional literature, The Deanery emphasised that its service was discreet and confidential. It had therefore breached its own standards.
(3)The number of disclosures and width of disclosure. There were multiple disclosures to different parties, with very wide subsequent knowledge about Ms Hamilton's affairs.
(4)Whether the disclosure was deliberate. The disclosures were completely deliberate.
(5)The nature of the information. Health information is inherently highly sensitive.
(6)Motivations of the discloser. Mr McLeod was, as far as the Tribunal could tell, motivated by malice.
(7)Knowledge of consequences of disclosure. Mr McLeod gave the information to the press, knowing that it would be very widely published (both nationally and internationally).
(8)Whether there was an admission of wrongdoing or attempt to mitigate injury. Mr McLeod was "unashamedly unrepentant". There was no attempt to resolve the injury: in fact he sent her copies of correspondence to increase the pressure on her.
(9)Knowledge of the legislation. This generally should make no difference, particularly since the Privacy Act and the Health Information Privacy Code have been in place for over a decade. However, the fact that Mr McLeod was fully aware that what he was doing was contrary to law did not help his cause. His behaviour was "irresponsible in the extreme."

This can be contrasted with the case of Feather v Accident Compensation Corporation.[42] That case involved a disclosure of information by the Accident Compensation Corporation (ACC) to a third party of information about Mr Feather's income (against which which his compensation entitlement was assessed). That information, via a somewhat circuitous route, got back to Mrs Feather, who had previously been unaware of her husband's earnings. This caused a serious rift in their 50 year marriage.

Measuring this against the Hamilton standards, one sees the following:

(1)The nature of the agency which disclosed the information. ACC is essentially an insurance body, handling large amounts of health information. It is also a public agency. Its duties are constrained by statute and by public law standards, therefore. However, a third party was instrumental in passing the information to Mrs Feather. The third party's intervention was therefore a key part of the reason the harm was so great. However, again, greater care is expected of agencies handling this type of information.
(2)Whether there were internal standards prescribing an appropriate information handling practice. ACC has strong internal standards about information handling practices. The disclosure of Mr Feather's information would have breached those standards.
(3)The number of disclosures and width of disclosure. There was a one-off disclosure. The information was not widely published, and the third party had a part to play in that publication, not just ACC.
(4)Whether the disclosure was deliberate. The disclosure was inadvertent.
(5)The nature of the information. Financial information is inherently highly sensitive.
(6)Motivations of the discloser. The defendant had not behaved maliciously.
(7)Knowledge of consequences of disclosure. The disclosure was wider than might ordinarily have been expected because of the actions of the third party. However, ACC was still held to be responsible for what occurred.
(8)Whether there was an admission of wrongdoing or attempt to mitigate injury. ACC accepted responsibility throughout, and offered an apology. It never made an issue of the fact that the disclosure had been made by a third party. It took steps to try to correct what had occurred.
(9)Knowledge of the legislation. ACC is extremely familiar with privacy legislation and deals with it, and the standards expected under it, on a daily basis.

In addition, the Tribunal considered another factor: the extent to which the plaintiff was the author of his own misfortune. While this does not affect liability as such, it may have an impact on the quantum of damages. The Tribunal attempted to avoid making a moral judgment on Mr Feather's failure to tell his wife relevant financial information. However, the award of $8000 reflected the fact that, though the effect on the plaintiff was very serious, the Tribunal did not hold ACC responsible for all the resulting disharmony in the marriage. The responsible behaviour of the defendant, detailed above, was also very significant in the relatively low award. As the Tribunal commented:[43]

We wish to make it clear that our award would have been higher but for the way in which the ACC has dealt with the matter and conducted its case in the Tribunal. Had the ACC adopted an uncompromising stance the case would have occupied very much more time and it would inevitably have been a very great deal more stressful for Mr Feather. The ACC is entitled to appropriate recognition for the responsible way in which it has responded to the situation created by the disclosure of information about Mr Feather's income.

3 Mitigation

The need for the Tribunal to take into account the behaviour of the defendant as a factor is specifically anticipated by section 85(4) of the Act:

(4) It shall not be a defence to proceedings under section 82 or section 83 that the interference was unintentional or without negligence on the part of the defendant, but the Tribunal shall take the conduct of the defendant into account in deciding what, if any, remedy to grant.

This does not appear to relate to the defendant's conduct in proceedings, as such. However, its conduct in an investigation before the Privacy Commissioner may well be relevant: if the matter could have settled a great deal earlier, with greater cooperation from the defendant, this is a matter which the plaintiff may raise in the Tribunal.

There is a question about whether section 85(4) operates only to require the Tribunal to take into account behaviour which mitigates the result for the defendant. On its plain wording, this seems to be the case. Lack of intention, or lack of negligence are not defences, but – together with other aspects of the defendant's behaviour – must be considered as mitigating factors. The Tribunal is not directed to take into account aspects of the defendant's behaviour which aggravate the situation. But, under normal remedial principles, such a statutory direction is not necessary. A remedy, particularly damages, will be calculated bearing in mind any aggravating factors: aggravated damages are, after all, a common component of damages awards. Section 85(4) should therefore not be read narrowly as prohibiting the Tribunal from considering aggravating factors. It simply sets out, to save arguments on the point, that a breach of the Privacy Principles does not have to be intentional, nor does it have to be the result of negligence. Breaches of privacy result from genuine mistakes. The Tribunal will consider such matters carefully. But, it has to be said, it should be rare for a matter where there has been a genuine mistake to reach the Tribunal. As discussed above, the conciliation and settlement focus of the Commissioner's Office will generally deal successfully with such situations without the need for more formal action.

The list above is not an exhaustive list of the factors which the Tribunal can or will take into account. The power to grant remedies is, after all, heavily discretionary. For instance, the Tribunal might also have regard to other, related statutes which are more prescriptive. An example from the Tribunal's own jurisdiction is section 92P of the Human Rights Act 1993 which states that if issuing remedies as well as or instead of damages the Tribunal must take account of the following matters:

(a) whether or not the defendant in the proceedings has acted in good faith:

(b) whether or not the interests of any person or body not represented in the proceedings would be adversely affected if 1 or more of the actions referred to in section 92O is, or is not, taken:

(c) whether or not the proceedings involve a significant issue that has not previously been considered by the Tribunal:

(d) the social and financial implications of granting any remedy sought by the plaintiff:

(e) the significance of the loss or harm suffered by any person as a result of the breach of Part 1A or Part 2 or the terms of a settlement of a complaint:

(f) the public interest generally:

This introduces several matters which have been little mentioned in Privacy Act cases (such as the fact that a matter is a test case). The Tribunal will also no doubt be directed to principles of the common law which reflect the experience of the courts over a long period of time. But the factors identified by the Tribunal so far give some strong guidance as to how questions of remedies, and particularly quantum of damages, will be decided.

4 Causation

An important aspect of both the Hamilton and Feather decisions was the Tribunal's focus on the need to demonstrate that the damage claimed was the direct result of the breach of the privacy principle. It is a common difficulty for plaintiffs, unfamiliar with legal principles of causation, to anticipate that taking a Privacy Act complaint will result in resolution of all the difficulties in their relationship with the defendant. So, for example, an ACC claimant with a long history of dealings with the Corporation, and a sense of grievance, may not appreciate that failure to grant access to a non-essential item of personal information will not result in a large award of damages (or may not result in an award of damages at all). Or a person engaged in an employment dispute may not comprehend that a casual disclosure of information about the existence of that dispute will not be compensated by a large award covering all the circumstances of their personal grievance. So, for example, Ms Hamilton claimed the maximum amount of $200,000 in damages for lost opportunity to work, storage of furniture while her residence was determined, and legal costs to deal with the immigration issues and the defamation case as well as damages for hurt and humiliation.[44] However, the Tribunal commented that it was not convinced all the extra costs were necessarily caused by the disclosure. It needed a stronger connection between the sums claimed and the act of interference with privacy.[45] The award of $40,000 was solely for the very serious humiliation and injury to feelings which the defendant's actions had caused.

5 Conclusion

The Tribunal has therefore gone some way towards developing an approach which will deal with the highly varied circumstances of privacy cases while at the same time giving some guidance as to what might be expected in the way of remedies in any given situation. Complete clarity is not possible: a tariff system will never be achievable in this area of law, any more than in defamation or negligence cases.[46] Compensation for human harm is not susceptible to such computations. But guidance is useful to create and support incentives for early settlement and manage expectations of parties. The Tribunal has taken some useful first steps, which will be developed over time.


At common law, a separate category of damages has developed where the court thinks it appropriate to punish the defendant for its behaviour or to make an example of the defendant to deter others from behaving in the same way. While these aims are different, they clearly interrelate in many fact situations, and the terms "punitive" and "exemplary" damages are therefore seen as interchangeable ways of referring to damages awarded over and above what is required for compensation.[47]

I have chosen to use the less common term "punitive damages" here. This is because, anecdotally, more plaintiffs appear to be punishment focused (rather than deterrence focused) when they are taking the significant extra step of bringing a case to the Tribunal. This is unsurprising. The deterrence factor is usually able to be adequately catered for during the Commissioner's investigation process. The Commissioner cannot, however, formally punish the defendant for its actions.

The 1964 House of Lords case of Rookes v Barnard is one of the best known authorities on punitive damages,[48] though it has not been accepted in New Zealand.[49] As Forrest Miller has explained Rookes v Barnard confined punitive damages to three categories of case:[50]

(a) Offensive, arbitrary, or unconstitutional conduct by government servants. This includes police, local authority employees, and other officials in the performance of governmental functions but does not include private persons.

(b) Conduct calculated to make a profit that may exceed the compensation payable to the plaintiff. It is not necessary that a financial calculation be made by the defendant to identify the rewards, nor that a pecuniary profit be made in fact. The award is based on the defendant's expectation rather than the gain actually made.

(c) Express authorisation by statute.

Though the categorisation in the case has not been accepted in New Zealand, certain aspects still hold good. For example, punitive damages are available only for the wrong done to the plaintiff, not wrong done to others.[51] An award can only be made if compensation is insufficient to punish and deter the defendant.[52] However, punitive damages are also available even if an award of compensation is not made. This is particularly evident in New Zealand because of the operation of the accident compensation regime, which bars awards of compensation for personal injury through court action,[53] but specifically permits actions for exemplary damages.[54]

There is no strict definition of what type of conduct will justify an award of punitive damages. "Contumelious disregard for the plaintiff's rights",[55] or truly outrageous conduct will lead to consideration of whether an award is appropriate.[56] Generally, the defendant's conduct will be intentional, or at least reckless: this gives a relatively clear rule of thumb for courts to consider.[57] It may even be malicious, though malice is not required. However, other types of outrageousness, even gross negligence, may be sufficient.[58] As the Privy Council stated:[59]

The starting point for any discussion of the limits of the court's jurisdiction to award exemplary damages is to identify the rationale of the jurisdiction. This is not in doubt, although different forms of words have been used, each with its own shades of meaning. For present purposes the essence of the rationale can be sufficiently encapsulated as follows. In the ordinary course the appropriate response of a court to the commission of a tort is to require the wrongdoer to make good the wronged person's loss, so far as a payment of money can achieve this. In appropriate circumstances this may include aggravated damages. Exceptionally, a defendant's conduct in committing a civil wrong is so outrageous that an order for payment of compensation is not an adequate response. Something more is needed from the court, to demonstrate that such conduct is altogether unacceptable to society. Then the wrongdoer may be ordered to make a further payment, by way of condemnation and punishment.

Their Lordships continued:

The absence of intentional wrongdoing and conscious recklessness will always point strongly away from the case being apt for an award of exemplary damages. That is a very important factor to be taken into account by the judge. But if the judge decides that, although the case is not one of intentional wrongdoing or conscious recklessness, the defendant's conduct satisfies the outrageous test and condemnation is called for, in principle the judge has the same power to award exemplary damages as in any other case satisfying this test.

It is not inconceivable, for example, that the Tribunal could be faced with a claim for punitive damages where the defendant has deliberately breached the plaintiff's rights in order to make a profit. On the whole, compensation will be sufficient to deal with such a situation, or some sort of restitutionary principle may come into play. But there may be instances where it is necessary for the Tribunal to go further and consider whether an additional award is justifiable.

However, it is not at all clear that the Tribunal can grant awards of punitive damages at all. While section 85 says that the Tribunal can award "other relief as it thinks fit", the section specifically states that damages awards are made in accordance with section 88.[60] Section 88 makes no mention of exemplary damages. On the contrary, it permits awards of liquidated damages, loss of benefit, or compensation for humiliation or injury to feelings. As we have seen, however, compensatory damages are different from punitive damages. Section 88(1)(c) therefore does not appear to allow for punitive damages at all. The Tribunal does not have inherent jurisdiction, unlike the courts which have developed punitive damages at common law. Its jurisdiction is restricted to the terms of its statute. If punitive damages are not mentioned, therefore, they are not available.

There might be a temptation to try to read in the availability of punitive damages by some form of necessary implication. Parliament, after all, intended the Tribunal to be able to deal robustly with serious cases of breaches of privacy, and to award appropriate damages where the Commissioner has been unable to bring the parties to settlement. The possible involvement of the Director of Human Rights Proceedings intensifies the seriousness with which interferences with privacy are to be seen. My conclusion, though, is that it is not possible to infer an ability to make such awards. Not only is the statute itself silent, but Parliament has made a specific statutory reference to punitive damages in a closely related statute.

The Tribunal also hears cases under the Human Rights Act 1993 (the HRA), and the Health and Disability Commissioner Act 1994 (the HDC Act). Section 92M of the HRA is in identical terms to section 88(1) of the Privacy Act. If punitive damages are not available under the Privacy Act, they are therefore not available under the HRA. Section 57(1) of the HDC Act is also identical except that it permits the Tribunal not only to award damages for pecuniary loss, for loss of benefit, for humiliation but also for:

(d) Any action of the defendant that was in flagrant disregard of the rights of the aggrieved person. [my emphasis]

This therefore makes it plain that, in cases under the HDC Act, the Tribunal is expressly permitted to award punitive damages. By contrast, the silence on this point in the HDC Act's sister statutes is very marked. Consequently there is a necessary implication that the Tribunal is not permitted to award punitive damages under the Privacy Act or the HRA.

The Tribunal has never made an outright award of punitive damages. Arguably, some of its awards are fairly high in compensatory terms: it could therefore be questionable whether a punitive element was included. This is largely explicable, however, because of aggravating factors in those cases. As discussed above, the conduct of the defendant is clearly a relevant consideration when determining the type and level of a remedy under the Act. That conduct can serve either to aggravate or to mitigate the award. However, the Tribunal must grant that remedy under normal principles of compensation, including aggravated damages. It cannot go one step further and actively punish the defendant for what it has done. In this regard, the Tribunal is in a mirror-image position to that of the courts under accident compensation legislation, where compensation for many injuries is statute-barred, but punitive damages are still available. The experience of the courts in distinguishing between these categories of damage in the accident compensation arena may therefore be valuable for the Tribunal in undertaking what can be a delicate balancing exercise.[61] For clarity in future cases, and to guide respondents' decision-making, it may also be useful for the Tribunal to clearly state whether there is an aggravated damages element in the compensation award.

A Reform to Permit Punitive Damages?

To go one step further, however, it is arguable, that the statute should be revised to include a provision such as that in the HDC Act, permitting punitive damages for flagrant disregard of the plaintiff's rights. While such awards need not be high, their availability would send an important signal to those who maliciously, arrogantly or inexcusably trample on the privacy of individuals. Such a provision was probably not appropriate earlier in the life of the statute. Although it was entirely in line with similar statutes overseas, the Privacy Act represented a new world order for New Zealand in some respects, particularly with its application to the private sector as well as the public sector. It was bound to take some time for the statute to bed down, for agencies to realise that the Privacy Principles reflect good business practice, and for individuals to become aware of their rights and responsibilities as reflected in the legislation. However, twelve years after the statute came into force, there are still occasional incidents of astounding disregard for the privacy of individuals. Hamilton is one such example.[62] Where they arise, the Tribunal needs to be able to appropriately punish the breach of what is, after all, a human right.

An award of punitive damages is not, of course, the only way in which such punishment can occur. Another method is to include offence provisions in the Act that address flagrant disregard for the Principles. The current offence provisions in section 127 only address such matters as hindrance of the exercise of powers under the Act, refusals to comply with lawful orders, making misleading or false statements, and misrepresentation of authority. They do not include actions such as deliberate destruction of documents or malicious revelations of highly sensitive information. Offences are not dealt with in the Tribunal, however, which is the body charged with judging the conduct of the defendant in relation to breaches of the Privacy Principles. Instead, they would be prosecuted through the District Court, which is not a specialist authority on the Privacy Act. Although there would be a punitive and deterrent function of offence provisions, such matters would be better dealt with by the Tribunal in the whole context of a privacy dispute. As such, availability of punitive damages is a better tool than an offence provision. This, presumably, explains the inclusion of the provision in the HDC Act.

Naturally, there is a serious argument that the availability of punitive damages may make agencies more risk-averse than is reasonable. There may also be concern that more plaintiffs might focus on punishment. However, the first concern can be addressed by careful and transparent control over such awards. The second concern can be answered by saying that plaintiffs will at least be encouraged to be more open about what it is that they are trying to achieve through action in the Tribunal. If their real motive is to punish the defendant, this gives the Tribunal an ability to deal with that aspect of the claim directly. Also, awards of punitive damages will only ever be reasonably modest.[63]

It is also possible to argue that plaintiffs may be more likely to take hopeless cases to the Tribunal if they are seeking a punitive award against the defendant. However, there are two important limitations on this potential "floodgates" situation. The first is that section 66 of the Act still requires that the plaintiff suffer some form of adverse consequence (except for access and correction situations) before there will be an interference with privacy. Unless there is an interference with privacy, the Tribunal cannot grant a remedy of any sort. Unlike in the common law, therefore, an award of punitive damages is not available in situations where compensation is not payable. The operation of section 66 means that an award of punitive damages will only be available in situations where the plaintiff has also suffered sufficient loss to trigger a finding of interference with privacy. Section 66 currently operates to bar recovery in situations where there is no serious damage to the plaintiff, and this would continue.

The second important limitation is, again, the availability of costs against a losing plaintiff, including costs against plaintiffs in person. As Appendix B shows, the Tribunal has not been shy of issuing costs awards, including fairly large sums. As a rough estimate, the Chairman has recently indicated that an average costs award can be around $2500 per day of hearing, to be adjusted depending on circumstances.[64] This is a substantial sum for a party without much chance of success to consider risking.

As well as deterring the hypersensitive and the foolish, the availability of costs can also act as a barrier to access to justice, where the plaintiff genuinely believes that an error has occurred in the Commissioner's process and that he or she has an argument to make. However, privacy cases are no different from other types of litigation. Plaintiffs as well as defendants have to bear the risks of losing the case. While costs awards are, as ever, at the Tribunal's discretion, it is important that potential plaintiffs and defendants bear in mind their availability when deciding whether to proceed with action, or to settle or abandon the claim.

Legislative change, therefore, is required for the Tribunal to be able to punish defendants with a separate award in privacy cases. However, it is worth considering further whether this would serve a valuable purpose in the privacy field, in those rare cases where an award is justifiable.

The situations in which punitive damages would be appropriate in privacy cases are rare, but not unheard of, as Hamilton indicates.[65] The Tribunal would have to develop factors which govern their availability in the same way as it has had to develop factors which govern the availability and quantum of compensation. However, there is a considerable amount of authority at common law, only briefly indicated in this article, which could enable the Tribunal to do exactly that.


The remedies which are available in the Tribunal have a direct impact on the Commissioner's ability to investigate complaints, and the ability to achieve conciliation where possible. What occurs during litigation gives parties the ability to look into a crystal ball to judge what will happen if a dispute does not settle, in whatever way is most appropriate (for example by abandonment of a claim by the complainant after clarification about the law, or an early offer of an apology from a defendant). An awareness of awards enables risk management exercises to be undertaken by both sides in a dispute, and also by those contemplating how to develop their policies and procedures to deal with privacy needs and concerns.

Despite that, privacy protection is not about how many dollars a person should receive for breach. The first aim of the Act is to prevent harm from occurring at all by encouraging compliance based on sound understanding of privacy matters.[66] The Act also deals with disputes, which are inevitable in any sphere of activity. But it does so again by engaging the understanding of the parties, and by seeking low-level, even lateral, solutions to individual difficulties and, ultimately, better privacy protection as a result. A formal remedial order, let alone an award of damages, is a last resort, rarely applied for and even more rarely granted. Engaging with the processes of the Commissioner's Office ultimately achieves more than holding out for money, or worrying about how much one might have to pay at the end of the day.


For ease of reference, I have listed the damages awards in separate categories depending on the privacy principle under which they were decided. I have also listed them in ascending order of quantum, rather than chronologically.

Case name
Facts material to award
$ awarded
Mitchell v Police Commissioner
Failure to ask obvious questions. Information produced, causing some embarrassment and frustration. Threshold under section 66 met [Tribunal believed it was necessary to show harm in relation to access request].
Proceedings Commissioner v Commissioner of Police
Request wrongly refused on grounds that it was vexatious or frivolous. Humiliation and so on.
$200 + $500 = $700 total
W v Director-General of Social Welfare
Failure to have adequate training to prevent disclosures of information
MacMillan v Department of Corrections
Prison inmate not given copy of letter alleging improper association with teenage girl when on temporary release. Might have affected his ability to get parole or influence his conditions. Some anxiety likely as a result, and inability to respond to the allegations as he would otherwise have been able to do. Award fairly nominal, however.
S v Dept of Child Youth and Family
Undue delay. Historical records about S when in care of Department as a child. System errors, changes in computer systems, archiving, contributed to problem. Some humiliation. Not all anger and so forth down to the breach of privacy, though some exacerbation.
CBN v McKenzie Associates
Solicitors’ lien asserted, which is not a withholding ground under the Act – the defendant should have been well aware of that. Should have had the information four or five months earlier than he did. Defendants provided everything on the file eventually, though they would have been entitled to take a more restrictive view.
Apostolakis v Sievwrights
Failure to provide letter sent to mortgagee about insurance on plaintiff’s building. Letter lost from files. Could have sought another copy from the mortgagee itself, to provide access.
[Under Appeal at time of printing]
W v P
Doctor gave mother information about adult daughter’s medical condition. Relationship between mother and daughter severely damaged. Doctor acting out of concern for mother (who was also his patient). Ignorant of provisions of Act. But knew relationship was volatile.
Plumtree v Attorney-General
Failure to provide access to historical vaccination records and a letter written while the plaintiff was in Vietnam requesting reduction of his engagement. Humiliation and so forth in way his requests were dealt with by defendant. But difficult to disentangle hurt as result of denial of access, from hurt about way in which the Army had treated him in general.

Parker v Ministry of Agriculture and Fisheries
Information about animal welfare inspection. Defendant behaved as responsibly as one might expect it to have done in the proceedings. There was breach of the Act, though, and injury to Mrs P’s feelings. Need to not set damages at too low a level noted.
B v Commissioner of Inland Revenue
Disclosure of income information to former partner of Plaintiff's husband. Abusive telephone calls to her as result, during pregnancy. Highly upsetting.
DAS v Child Youth and Family Service
Undue delay in provision of information about sexual abuse of child in plaintiff’s care. Plaintiff highly aggrieved by way he was treated by CYFS. Humiliation and so on.
Proceedings Commissioner v Health Waikato (HC)
Failure to disclose two letters, though they might have been relevant to constructive dismissal claim before the Employment Court. Felt ambushed and stressed when he realised, too late, that the letters had not been provided.

Feather v Accident Compensation Corporation
Inadvertent disclosure of financial information to a third party, who then divulged it to Mr Feather’s wife. Serious breakdown of relationship. Defendant admitted fault, behaved very responsibly in trying to deal with the matter.
Steele v Department of Work and Income
Sensitive information about benefits and personal circumstances given to a neighbour of the plaintiff by case worker at a party. Small community: risk that information would become widely known.
5 and 11
Proceedings Commissioner v Commissioner of Police
Police officer revealed information about service of a protection order. Media followed officer to house and filmed service. Highly embarrassing.
Jans v Winter (HC)
Information about plaintiff’s mortgagee sale not provided by real estate agent. Defendant was highly uncooperative. Information went missing, permanently, during request and complaint period. Uncertainty of not knowing what information might have revealed about possible availability of court proceedings as a result of the sale process. No significant humiliation – fell short of threshold. Worse than Health Waikato but not considerably worse.

L v N
Defendant had deliberately concealed information from plaintiff about an allegation of indecent assault on a child in his care. The process of getting personal information resulted in more people learning about the unsubstantiated allegation against him. This led to substantial humiliation, which was self-evident.
Hamilton v The Deanery 2000 Ltd
Deliberate and possibly malicious disclosures of health information to media and to immigration authorities


In the case of Smits v Santa Fe Gold, the High Court supported the Tribunal’s ability to make awards of costs against a plaintiff in person.[67] The current Tribunal is certainly of the view that costs will normally follow the event, that is, that the losing party in an action will have to pay costs to the other party, unless there is good reason why this should not occur. Costs are awarded pursuant to section 92L of the Human Rights Act 1993. Costs will not be awarded unless papers have been served on the defendants.[68]

The following is a schedule of the costs awarded against parties to date, again in amount order rather than chronological order.

Case name
Award against plaintiff/defendant?
Basis of costs decision
$ of costs award
Poysden v Lower Hutt Memorial RSA
Plaintiff sought award; none made
Lay plaintiff. Needs to show evidence of costs incurred. None provided. Also, Mr Poysden was using Tribunal proceedings to make a point which had nothing to do with privacy.
Jans v Winter
Privacy Commissioner sought award of costs against Mr W.
Unusual for Privacy Commissioner to apply for costs. Raises different calculations from when for example Director of Human Rights Proceedings applies for costs: Commissioner’s counsel is there as amicus not as party. No sufficient reason to award here.
Villablanca v Jos Arrillaga
Against plaintiff
Further evidence not supplied to Tribunal, despite requests.
Mayes v Owairaka School Board of Trustees
Against (successful) plaintiff
Plaintiff successful, but on a technicality. Burden on defendants disproportionate to outcome. Other costs lay where they fell

Ilich v ACC
Against plaintiff
Two brothers who were claimants – mistake made giving information about one to the other in response to access request. ACC behaved responsibly, disclosure in good faith. Credibility queries with plaintiff.
Wallingford v National Beekeepers Association
Against plaintiff
Wanted access to identity of author of letter printed in magazine. News activity. Reasonable contribution to cost of defence
Henry v McCarthy and others
Against plaintiff
Claims struck out. All represented by Crown Law. Overlap between material which had to be filed, and types of arguments. Significant discount, therefore, on what would otherwise be awarded.
$300 x 4 = $1,200 total.
Yakas v Kaipara District Council
Against plaintiff’s estate
Decision to dismiss proceedings made without substantive hearing, and before significant preparation. Had to file statement of defence, but no discovery, exchange of witness statements etc.
Plumtree v Attorney-General
Against defendant
Actual disbursements (proof provided) incurred by lay plaintiff
O v N
Against defendant and against Privacy Commissioner
Reimbursement of airfares and so forth – expenses itemised.
$668.95 against D; $668.95 against PC = $1,337.90
Williams v Department of Corrections
Against plaintiff
Very modest sum claimed. Despite indications from plaintiff that unable to pay, award made – nothing to depart from usual principle.
Marino v Department of Corrections
Against plaintiff
Claim by defendant was modest. Full day hearing, and protracted period of preparation. Safe to infer that this is only a part of the actual costs incurred by the Department.

O’Neill v Ministry of Health
Against plaintiff
Claim abandoned, after some largely semantic discussions about who defendant was.
Ram v KMart
Against plaintiff
Plaintiff, despite requests for explanation, had not given any thought to Privacy Act Principles or why Commissioner was in error. Completely unable to assist Tribunal, which agreed with Commissioner’s findings. Hearing was avoidable.
Smits v Santa Fe Gold
Against plaintiff
Costs upheld by High Court. Plaintiff engaged in crusade – not really concerned with privacy breaches at all. Plaintiff had sought award of $240,000 against defendant – required serious response.
Blackford v Cullen
Against plaintiff
Plaintiff’s counsel had not paid attention to detail, and did not comply with directions of Tribunal.
CD v Hawkes Bay District Health Board
Against plaintiff
Plaintiff warned by defendant that would be seeking costs if she proceeded with the case. Little chance of success. Four day hearing. Costs for period after warning until end of hearing (under half of actual expenditure).
Henderson v Inland Revenue Department
Against plaintiff
Case needed attention at senior level. Two day hearing after which Mr H was unsuccessful. Had been essentially successful on preliminary point. But room for a view that had pursued the matter despite practical alternative (indicated at earlier hearing) being available.
W v Christchurch Casinos (2002)
Against plaintiff and defendant
Unnecessarily protracted proceedings. Shared responsibility for that. Petty dispute.
$12,500 against P; $3,545.82 against D

[*] Assistant Commissioner (Legal) at the Office of the Privacy Commissioner, formerly Senior Lecturer, School of Law, Victoria University of Wellington. Please note that this article represents the views of the author alone. It should not be taken as reflecting the view of the Privacy Commissioner or any other member of the Office.

[1] Section 6 of the Privacy Act 1993 sets out 12 Information Privacy Principles governing collection and handling of personal information held by agencies.

[2] Ram v KMart NZ (6 August 2003) HRRT 9/03, Decision No 27/03, para 55.

[3] Privacy Act 1993, ss 74, 76(2) and 77.

[4] See Hosking v Runting [2004] NZCA 34; [2005] 1 NZLR 1 (CA).

[5] Ram v Kmart NZ, above n 2, para 55.

[6] Privacy Act 1993, Long Title.

[7] Privacy Act 1993, s13(1)(a) and (g).

[8] Privacy Act 1993, s 13(1)(h).

[9] Privacy Act 1993, s 13(1)(e), (f), (l), (p) and (r).

[10] Privacy Act 1993, s 13(1)(f) and (o).

[11] Privacy Act 1993, part 6.

[12] Privacy Act 1993, s 14(a).

[13] See for example Privacy Commissioner's case notes 55528 [2003] NZPrivCmr 8; and 51765 [2003] NZ Priv Cmr 13.

[14] The Tribunal hears cases under the Privacy Act 1993, the Human Rights Act 1993, and the Health and Disability Commissioner Act 1994.

[15] "Investigation" is defined in the case of Steele v Department of Work and Income (21 October 2002) HRRT 04/02, Decision No 12/02, paras 39-48; see also Waugh v NZ Association of Counsellors Inc (17 March 2003) HRRT 5/2002.

[16] Privacy Act 1993, s 77(2).

[17] Privacy Act 1993, s 77(3). Section 82(5) says that the plaintiff cannot be a party when the Director decides to take proceedings on the Plaintiff's behalf.

[18] Privacy Act 1993, s 77(2). The Commissioner will try one more time to settle the matter, but if this is not possible, then a referral will be considered.

[19] See the case of KI v Gilligan Sheppard (Decision on Jurisdictional Issues) (22 July 2005) HRRT 002/04, Decision No 21/05.

[20] Privacy Act 1993, s 83(b).

[21] Privacy Act 1993, s 71(1) and (2). See the recent clarification in the case of Lehmann v Radioworks Ltd (Preliminary Issues Revisited) (22 July 2005) HRRT 08/04, Decision No 20/05 showing that the Tribunal does have jurisdiction to hear cases where the Commissioner has discontinued an investigation, not just in cases where the Commissioner has formed a legal opinion on the merits of a case. For reasons explained in the argument before the Tribunal section 83 of the Act itself is somewhat ambiguous on this point.

[22] This is discussed below, and a list given in Appendix B.

[23] Hamilton v The Deanery 2000 Ltd (29 August 2003) HRRT 36/02, Decision No 28/03.

[24] Laursen v Proceedings Commissioner (1998) 5 HRNZ 18, 27-28 (HC) Gallen J.

[25] Parker v Ministry of Agriculture and Forestry (23 September 2002) HRRT 46/01, Decision No 9/02.

[26] Parker v Ministry of Agriculture and Forestry, above n 25, para 21-22.

[27] Parker v Ministry of Agriculture and Forestry, above n 25, para 22.

[28] Hamilton v The Deanery 2000 Ltd, above n 23.

[29] Feather v Accident Compensation Corporation (4 September 2003) HRRT 17/03, Decision No 29/03.

[30] CBN v McKenzie Associates (30 September 2004) HRRT 020/04, Decision No 48/04.

[31] "The Rise and Rise of Damages Awards for Breaches of Privacy? Hamilton v The Deanery 2000 Ltd" (2003) 10 PLPR 127.

[32] Mitchell v Police Commissioner (4 November 1994) CRT 2/94, Decision No 3/94. The Tribunal was then known as the Complaints Review Tribunal. Its name was later changed to the Human Rights Review Tribunal.

[33] Mitchell v Police Commissioner, above n 32, 21.

[34] MacMillan v Department of Corrections (3 August 2004) HRRT 40/03, Decision No 41/04.

[35] Apostolakis v Sievwrights (14 February 2005) HRRT 44/03, Decision No 01/05. This case is on appeal to the High Court at the time of writing.

[36] Hamilton v The Deanery 2000 Ltd, above n 32, para 51.

[37] Or rule 11 if a Code of Practice, such as the Health Information Privacy Code 1994, is involved.

[38] Privacy Act 1993, s 66(2). This provision is rather ambiguously worded, but it was recently clarified by the High Court in Winter v Jans (6 April 2004) HAM CIV-2003-4190854J.

[39] Note that in section 88 of the Act, the level of humiliation or injury to feeling required to attract an award of damages does not have to be "significant": Winter v Jans, above n 38, para 61. However, before the Tribunal, or the Court, can award a remedy, there needs to be an interference with privacy under section 66. Where humiliation is pleaded, that humiliation needs to be at a significant level to meet the threshold required. In essence, therefore, one will always be compensating for significant (that is, reasonably serious) humiliation, not for lower levels of embarrassment or annoyance.

[40] Hamilton v The Deanery 2000 Ltd, above n 23.

[41] Hamilton v The Deanery 2000 Ltd, above n 23, para 49.

[42] Feather v Accident Compensation Corporation, above n 29.

[43] Feather v Accident Compensation Corporation, above n 29, para 26.

[44] The Human Rights Review Tribunal can make an award of damages up to the level permitted in District Court proceedings: Privacy Act 1993, s 89; Human Rights Act 1993, s 92Q(2).

[45] Hamilton v The Deanery 2000, above n 32, para 44.

[46] "The Rise and Rise of Damages Awards", above n 31, 129.

[47] See Forrest Miller "Exemplary Damages" in Civil Remedies in New Zealand (Brookers, Wellington, 2003) 531-534 for further discussion on the differences between the terms. Miller argues convincingly that the availability and quantum of the award will vary depending on whether the court aims to punish or to deter.

[48] Rookes v Barnard [1964] UKHL 1; [1964] AC 1129 (HL).

[49] Taylor v Beere [1982] NZCA 15; [1982] 1 NZLR 81 (CA). See generally Stephen Todd (ed) The Law of Torts in New Zealand (4 ed, Brookers, Wellington, 2005) 1190-1200.

[50] Miller, above n 47, 528-530.

[51] Rookes v Barnard, above n 48, 1227 Lord Devlin.

[52] Rookes v Barnard, above n 48, 1228 Lord Devlin. The availability of punitive damages in cases where criminal proceedings have occurred or are likely are discussed in Daniels v Thompson [1998] NZCA 3; [1998] 3 NZLR 22. However, since this will rarely be the situation in privacy cases before the Tribunal, I have not discussed this aspect of punitive damages here.

[53] Injury Prevention, Rehabilitation, and Compensation Act 2001, s 317.

[54] Section 319 of the Injury Prevention, Rehabilitation, and Compensation Act 2001 makes this plain. For an early exposition of the principle see Donselaar v Donselaar [1982] NZCA 13; [1982] 1 NZLR 97 (CA).

[55] Taylor v Beere, above n 49, 93.

[56] A v Bottrill [2002] UKPC 44; [2003] 1 AC 449 (PC).

[57] Miller, above n 47, 545-546, discussing and criticising the Privy Council decision in A v Bottrill, above n 56 66.

[58] See for example A v Bottrill above n 56. For general information on damages from a United Kingdom perspective, see England and Wales Law Commission Aggravated, Exemplary and Restitutionary Damages [1997] EWLC 247.

[59] A v Bottrill, above n 56, para 21 Lord Nicholls.

[60] Privacy Act 1993, s 85(1)(c).

[61] Queenstown Lakes District Council v Palmer [1998] NZCA 190; [1999] 1 NZLR 549 (CA).

[62] Hamilton v The Deanery 2000 Ltd, above n 23.

[63] See the recent decision of McDermott v Wallace (9 June 2005) CA 208/04, Glazebrook, Hammond and O'Regan JJ and in particular the schedule of awards at para 97.

[64] Oral comment when the issue of costs was raised in the hearing of Golden v Ministry of Economic Development (20 September 2005) HRRT Wellington.

[65] Hamilton v The Deanery 2000 Ltd, above n 23.

[66] For example, under section 23 of the Act agencies have to have a privacy officer, whose role is not only to manage disputes but also to encourage compliance.

[67] Smits v Santa Fe Gold (1999) 5 HRNZ 593 (HC).

[68] See for example Flynn v Work & Income/ Ministry of Social Development (10 August 2004) HRRT 27/04, Decision No 36/04.

NZLII: Copyright Policy | Disclaimers | Privacy Policy | Feedback