A recent case serves as a reminder that claims under the Privacy Act 2020 could have significant consequences for employers – in this case to the tune of $30,000.
In Cummings v KAM Transport Limited [2025] NZHRRT 8, the Human Rights Review Tribunal determined that an employer breached an employee’s privacy and that this caused the employee humiliation and a loss of dignity.
We are experts in privacy law and can provide bespoke training to businesses to assist with training in this area. If you are interested, or if you have any further questions regarding this case, please do not hesitate to get in touch.
Refusal of a random drug test
In this case, Mr Cummings was employed by KAM Transport Limited (KAM) as a truck driver. He was required by KAM to undertake a random drug test in accordance with the terms and conditions of his employment. Mr Cummings refused to undertake the test which, under KAM policy and the terms of his employment, was grounds for misconduct. He was stood down pending a disciplinary process.
Mr Cummings subsequently undertook a drug test on 4 September 2020, which returned clear. Mr Cummings returned to work after that, although the disciplinary process remained in place.
The rumour mill
It soon became apparent to Mr Cummings that false rumours regarding the drug test and its outcome had spread amongst his colleagues. Mr Cummings was confronted by a forklift driver who told him that she and others had heard that he was a drug dealer and had been dismissed from his job. He was told by another colleague that they had heard from another KAM employee, Mr Jzaden Kremm, that Mr Cummings had failed a drug test and had left his employment. Mr Cummings was taken by surprise and denied that this was the case. He felt anxious and was distressed by the implications of the rumour for his safety and reputation.
Mr Cummings raised concerns with KAM which investigated the matter and found that no privacy breach had occurred. KAM also issued Mr Cummings a warning for refusing to undergo the random drug test. The parties met but no resolution was reached.
Loss of trust leads to resignation
On 14 December 2020, Mr Cummings wrote to KAM to advise that he was resigning from his employment with immediate effect, citing – among other things – a loss of trust. The parties then attended mediation, but no resolution was reached.
Mr Cummings subsequently lodged a complaint with the Privacy Commissioner regarding his allegation that KAM had interfered with his privacy. Following the conclusion of the Privacy Commissioner’s investigation in May 2022, Mr Cummings filed his claim in the Tribunal.
Human Rights Review Tribunal Decision
Mr Cummings claimed that KAM had interfered with his privacy by disclosing his personal information without authorisation regarding his refusal to undertake a drug test – in breach of Information Privacy Principle (IPP) 11 of the Privacy Act 1993 (PA).[1] Consequently Mr Cummings claimed that he had suffered detriment and loss and that his rights and privileges were adversely affected causing him significant humiliation, loss of dignity and injury to his feelings.
The Tribunal considered:
- Whether there had been a disclosure: Yes, the employer disclosed information to Mr Kremm, who was not part of the KAM management group and had no need to know such sensitive information about Mr Cummings;
- Whether this disclosure could have been lawfully made under one of the exceptions provided by IPP 11: No, KAM also did not plead that any of the exceptions applied and did not rely on them (depending instead on the argument that no disclosure had been made, which was not accepted);
- (If not) whether the disclosure constituted an interference with privacy by causing actual or potential harm: Yes, the matters disclosed involved personal information of a highly personal and sensitive nature. The harm Mr Cummings suffered amounted to significant humiliation, loss of dignity and injury to his feelings, particularly given his long career and status as a senior truck driver. There was a sufficient casual connection between the harm suffered and the disclosure; and
- (If so) whether it should grant any statutory remedies: Yes, the Tribunal considered that a declaration (that KAM interfered with Mr Cummings’ privacy without his consent), and damages of $30,000 for humiliation, loss of dignity and injury to feelings[2] were appropriate remedies. However, his loss of earnings claim of $295,366.50 and for loss of benefit damages were not awarded, due to a lack of causal connection between the breach and the harm suffered.
[1] The PA was repealed and replaced by the Privacy Act 2020 on 1 December 2020. Given the timing of the alleged disclosure and interference with privacy, the determination was made under the PA. There is no substantive difference between the provisions engaged under the 1993 Act and the 2020 Act.
[2] Under s 88(1)(c) of the PA.
