We have seen an increase in employee privacy related claims and complaints, and employers and employees alike are seeking our opinion on privacy related matters more frequently.
The Privacy Act 1993* establishes 12 information privacy principles that set out how agencies may collect, store, use and disclose personal information. An agency is any individual, organisation or business, whether in the public sector or the private sector (so includes an employer). Broadly, an employer will hold personal information and so they must comply with the privacy principles. “Personal information” is any information about an individual as long as that individual can be identified.
Employers must comply with the principles when dealing with employees’ personal information.
The Privacy Commissioner recently considered a complaint by an employee in February 2018, who was justifiably dismissed from her employment. She subsequently complained that her privacy had been breached as a result of her employer sending a company wide email outlining reasons for her leaving her employment – the employer had discovered drugs and drug-taking tools in the employee’s car while it was parked in the company carpark (Case Note 276280 [2018] NZPriv Cmr 2: Staff told of employee sacked for drug use).
It had come to light through the Commissioner’s investigation that the ex-employee’s colleagues had seen the drugs and drug paraphernalia in her car while it was parked in the work carpark (a clear breach of the employer’s drug and alcohol policy). One of her colleagues had even taken a photo of the items. The employer (a large, national company) had met with the woman to discuss the situation and the woman agreed to leave her employment.
Three days after her departure, her manager emailed all employees disclosing the reasons for her leaving, which included details of the possession of drugs and drug related items. The woman found out about the email and complained to the Privacy Commissioner’s office.
She said that email had caused her stress, humiliation and embarrassment and the impact it would have on her finding another job.
The employer said it was company practice to send an email to employees advising of staff changes and to be transparent about why an employee was leaving. However, the content of the email was usually discussed and agreed with the departing employee. In this case, the manager inadvertently sent the email about the woman’s departure to all employees, rather than to the woman first. The manager had included the information about the woman’s possession of drugs because it was apparent that staff already knew the information, and because the company had strict policies on drugs and alcohol in the workplace.
The company did not consider it had breached principle 11, which says personal information should not be disclosed for purposes other than those for which the information was obtained.
The company accepted that personal information was disclosed but claimed there was no breach because many staff already knew the information. In addition, the company said it did not cause harm by sending the email because the information was already widely known.
After evaluating the responses of both parties, the Commissioner referred to two 2015 decisions of the Human Rights Review Tribunal. Referring to Hammond v Credit Union Baywide, the Commissioner was of the view that the difficulty with the company’s defence was that the exceptions outlined in principle 11 do not include the circumstances where the information disclosed is already known to the recipient.
The Commissioner considered that it was unlikely that Parliament had intended that the operation of principle 11 be dependent on the subjective state of mind of the recipient of the information.
The Commission held that the email disclosed personal information causing significant harm to the ex-employee. Referring to Taylor v Orcon Limited, the Commission confirmed that all a complainant is required to show is that the disclosure was a contributing or material cause of that significant harm. In other words, the act or omission causing the harm did not need to be the sole cause of the harm.
The Commission considered that the disclosure made via email from a manager had considerably more weight, and would have been significantly more humiliating and embarrassing for the ex-employee, than the gossip already present in the workplace. Consequently, the Commission’s view was that the company’s action amounted to an interference with the ex-employee’s privacy from which she had suffered significant humiliation, loss of dignity or hurt feelings.
Following receipt of this view the parties arranged for mediation between themselves and a settlement was reached.
This is another reminder that an employer needs to stop and think every time information about an employee is disclosed.
*Changes to the Privacy Act Imminent
Last week the Government introduced a new Privacy Bill to the House. Click the button below to view the article on this significant change to privacy law in New Zealand:
Robo advice for financial matters proposed law change brings this closer to reality
Workplace Law team
If you have any queries in respect of the above, or any other Workplace Law issues, please contact a member of Lane Neave’s Workplace Law team:
Employment: Andrew Shaw, Fiona McMillan, Gwen Drewitt, Maria Green, Hannah Martin, Joseph Harrop, Holly Struckman, Alex Beal, Giuliana Petronelli, Abby Shieh
Immigration: Mark Williams, Rachael Mason, Daniel Kruger, Nicky Robertson, Julia Strickett, Ken Huang, Mary Zhou, Shi Sheng Cai (Shoosh), Sarah Kirkwood, Janeske Schutte, Lingbo Yu
ACC: Andrew Shaw
Health and Safety: Andrew Shaw, Fiona McMillan
Seminar series
The Lane Neave Workplace Law Team is hosting seminars in Christchurch, Wellington, West Coast and Auckland with dates for Rotorua and Queenstown to be announced shortly.
News and events
Click here for other Employment Law articles.
