office of the privacy commissioner · office of the privacy commissioner procedures manual: dispute...
TRANSCRIPT
Office of the Privacy Commissioner
Procedures Manual:
Dispute Resolution and
Investigations
Updated August 2018
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 2
Contents
Chapters
1. About this Procedures Manual ......................................................... 10
2. Overview of our complaints and investigations role ..................... 12
3. Receiving and screening complaints From when it arrives, to
when it lands on an IO’s desk .......................................................... 16
4. Promoting conciliation and settlement ........................................... 45
5. Investigating a complaint From the “pink” assessment form, to
making a decision .............................................................................. 55
6. After the investigation From notifying our decision, to closing
the file ................................................................................................ 79
Appendices .................................................................................................... 87
Appendix 1. Initial call checklist............................................................... 88
Appendix 2. Notification by email (cover email) .................................... 90
Appendix 3. Investigations Team Inbox ................................................. 95
Appendix 4. Checklists for conciliation and settlements ..................... 98
Appendix 5. Teleconferences ................................................................. 105
Appendix 6. Natural disasters ................................................................ 107
Appendix 7. Escalation Policy and Procedure ..................................... 109
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 3
Contents
All headings
1. About this Procedures Manual .......................................................................... 10
Purpose and contents of this Manual ................................................................ 10
Scope of this first section of the Manual ........................................................... 10
2. Overview of our complaints and investigations role .......................................... 12
Introduction ....................................................................................................... 12
Our investigative function ............................................................................. 12
Our “conciliator” function............................................................................... 12
The impact of our decisions: Legal and practical consequences .................. 13
Our complaints role in context: One of a range of tools for addressing non-compliance ............................................................................................ 13
Legal checkpoints: Key statutory and common-law rules ................................. 14
Act within the law .......................................................................................... 14
Customer focused approach ......................................................................... 14
Natural justice ............................................................................................... 14
Using our discretion ...................................................................................... 14
Secrecy and privileged information ............................................................... 14
Other legal rights and interests ..................................................................... 15
Learning the language: Some terms and abbreviations we use ....................... 15
3. Receiving and screening complaints From when it arrives, to when it lands
on an IO’s desk ................................................................................................. 16
Introduction: Key legal checkpoints .................................................................. 16
Our systems ................................................................................................. 16
Is the complaint within our jurisdiction? ........................................................ 16
Should we investigate the complaint? .......................................................... 17
Requirement to investigate ........................................................................... 17
Fielding complaints and forwarding them to the rostered Team Member ......... 17
Introduction ....................................................................................................... 17
Is it a complaint? ........................................................................................... 17
Administrative steps when a complaint first arrives: Channel by channel ......... 18
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 4
Flowchart: Fielding complaints and forwarding them to rostered Team
member ............................................................................................................. 20
Procedure for identification and notification of “Easy Access” complaints ........ 21
Step one ........................................................................................................... 21
Step two ............................................................................................................ 21
Step three ......................................................................................................... 22
Step four ........................................................................................................... 22
Step five ............................................................................................................ 22
Step six ............................................................................................................. 22
Initial screening by rostered Team member: Is this a complaint we can and should investigate? ....................................................................................... 23
Is it intended to be a formal complaint? ............................................................ 23
If it is a complaint, is it one we have jurisdiction to investigate? ........................ 24
People and bodies outside our jurisdiction ................................................... 24
Not a privacy problem ................................................................................... 26
Not “personal information” ............................................................................ 26
Facts incapable of amounting to a breach .................................................... 26
Harm ............................................................................................................. 26
Exclusions such as “domestic affairs” ........................................................... 27
If we have jurisdiction, should we decline to investigate under 71(1)? .............. 28
Our discretionary power ............................................................................... 28
Para (a): Length of time since the incident ................................................... 28
Para (b): Trivial ............................................................................................. 29
Para (c): Frivolous, vexatious, not in good faith ............................................ 30
Para (d): Individual doesn’t want action taken .............................................. 33
Para (e): Insufficient personal interest .......................................................... 33
Para (f): No use of Code’s complaints procedure ......................................... 34
Para (g): Other adequate means of challenge .............................................. 35
Notification requirements if we decline to investigate under 71(1) .................... 36
Exercising our discretion: Section 71 and our “gatekeeper” role ....................... 36
Referring a complaint or part of a complaint to other agencies ......................... 37
Referrals to Ombudsmen, Health and Disability Commissioner or IGIS ........... 37
When will a complaint “more properly” belong with the Ombudsmen? ......... 38
When will a complaint “more properly” belong with the Health and Disability Commissioner? ............................................................................ 39
When will a complaint “more properly” belong with IGIS? ............................ 39
Administrative processes with Ombudsman correspondence ........................... 40
Agreed protocols for transferring complaints .................................................... 41
Potential Transfer (from Ombudsman to OPC) ................................................. 41
Transfer ............................................................................................................ 41
Potential Transfer (OPC to Ombudsman) ......................................................... 41
Referrals to overseas privacy agencies ............................................................ 42
Which office? – Assigning to Wellington or Auckland ....................................... 42
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 5
Criteria for assigning complaints to a particular office ....................................... 42
Easy answers: Fixed rules for certain agencies ............................................ 42
Guidelines for all other cases ....................................................................... 42
Administrative steps after the complaint is assigned to an office ...................... 43
Who: the Team Secretary Wellington ........................................................... 43
Who: the Team Secretary for that office ....................................................... 43
Tasks: ........................................................................................................... 43
Which Investigator? – Assigning the complaint to an Investigator .................... 44
The decision: relevant factors ........................................................................... 44
Checking the Investigator’s assessment and investigation plan ....................... 44
Difficult callers ................................................................................................... 44
4. Promoting conciliation and settlement .............................................................. 45
Overview ........................................................................................................... 45
Our Settlement Target .................................................................................. 45
Conciliation and settlement: Our statutory obligations and powers ................... 46
Power to encourage a settlement ..................................................................... 46
Obligation to promote settlement if a complaint has substance ........................ 46
What does the “best endeavours” standard require of us? ........................... 47
Promoting conciliation from the outset .............................................................. 47
Tools we can use to try to reach a settlement ................................................... 48
There are several tools we can use to promote settlement of a complaint: .. 48
1. First teleconference with the complainant and respondent ....................... 48
2. Case management conference ................................................................. 48
3. Power to call compulsory conference ....................................................... 48
Settlements and “party autonomy”: It’s up to them ........................................... 48
Assessing the potential for a settlement ........................................................... 49
Giving guidance to the parties and managing expectations .............................. 49
Specific settlement measures ........................................................................... 50
Giving guidance on financial settlement amounts ............................................. 50
Guidance from Tribunal awards .................................................................... 51
Preparing for a settlement conference .............................................................. 51
Process issues .................................................................................................. 51
Preparing the parties for the conference ........................................................... 52
Preparing yourself ............................................................................................. 52
Drafting a settlement agreement ....................................................................... 52
Each conciliation or settlement conference will be different, and the needs of the parties will vary. This means the level of involvement required from the Investigator in helping the parties draft an agreement will depend on a case by case assessment of their relationship with each other, their relative vulnerability, and their general ability to clearly and accurately express themselves. Some further questions to consider: ............................................. 53
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 6
5. Investigating a complaint From the “pink” assessment form, to making a
decision ........................................................................................................ 55
The framework for your investigation ................................................................ 55
Key legal checkpoints ....................................................................................... 55
Notification ......................................................................................................................... 55
Respondent’s right to respond ..................................................................................... 56
Promoting conciliation and settlement ....................................................................... 56
Investigating with “due expedition” (proper speed)................................................ 56
Respondent’s right to be heard before any “adverse comment” ....................... 56
Tailoring the process to the particular case ...................................................... 56
Investigating with proper speed (“due expedition”) ........................................... 57
What does the “due expedition” rule require of us? .............................................. 57
Keeping control of the investigation process ........................................................... 57
Breach and harm: Investigating them concurrently ........................................... 57
Burden of proof ................................................................................................. 58
Settlem .............................................................................................................. 59
Completing the Complaint Assessment form (“The pink”) ................................. 60
Summary .......................................................................................................... 60
Purpose of the Complaint Assessment form ..................................................... 60
What information to include on the form ........................................................... 60
The most important thing is being clear with parties about what we are doing and what they can expect. ............................................................................ 61
Investigating vs enquiries/conciliation: Telling the difference ............................ 61
The boundary between preliminary enquiries and investigating ....................... 61
Conciliating vs investigating .............................................................................. 62
Identify the complainant and person alleged to be aggrieved ........................... 62
Notification: Telling the parties you’re going to investigate ............................... 63
Form of notification: In writing ........................................................................... 64
Using the notification template letters ........................................................................ 64
Notification by email ........................................................................................................ 64
What amounts to “notification” .......................................................................... 64
Notification must be precise .......................................................................................... 64
Notifying individual respondents as well as the principal agency ...................... 65
Why it’s important to get it right ................................................................................... 66
Triggers for notifying individual respondents as well as the principal agency ................................................................................................................................ 66
What we have to tell the individual ............................................................................. 66
Case conferences ............................................................................................. 67
An early case conference is a default step ....................................................... 67
Purpose of a case conference .......................................................................... 67
Format for case conference .............................................................................. 67
Was there a breach? – Key questions, principle by principle ............................ 68
Principle 1 – Purpose of collection.............................................................................. 68
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 7
Principle 2 – Source of the information ..................................................................... 68
Principle 3 – What the person must be told when information is collected from them ........................................................................................................................... 68
Principle 4 – Manner of collection ............................................................................... 68
Principle 5 – Storage and security .............................................................................. 69
Principle 6 – Access ........................................................................................................ 69
Principle 7 – Correction .................................................................................................. 70
Principle 8 – Checking accuracy and so on before use ....................................... 70
Principle 9 – How long information may be held for .............................................. 70
Principle 10 – Limits on using information for different purpose ........................ 70
Principle 11 – Limits on disclosure ............................................................................. 71
Principle 12 – Unique identifiers .................................................................................. 71
Was there harm? .............................................................................................. 71
Has the complainant suffered harm? ................................................................ 71
Did the breach cause the harm? ....................................................................... 72
What standard of evidence should a complainant provide in relation to harm? 72
Inviting comment from the parties: When and how ........................................... 73
Key points ......................................................................................................... 73
The “adverse comment” rule: Its scope and effect ............................................ 73
Summary ............................................................................................................................ 73
Scope of the “adverse comment” rule: What statements does it apply to? .... 74
What makes a comment “adverse”? .......................................................................... 74
Discharging our obligation under the “adverse comment” rule: What we have to do ......................................................................................................................... 74
Setting a timeframe for a written response ....................................................... 75
Public-law fairness: What it requires ................................................................. 75
Discontinuing under section 71 ......................................................................... 75
Discontinuing an investigation under section 71(1) ........................................... 75
“Undesirable or unnecessary”: Discontinuing under section 71(2)) .................. 76
Examples ............................................................................................................................ 76
Notification requirements if we discontinue ....................................................... 77
File management and record-keeping .............................................................. 77
Corresponding with the parties ......................................................................... 77
Managing your own filing system ...................................................................... 78
Record-keeping and maintaining the file ........................................................... 78
Maintaining the Objective metadata .................................................................. 78
Nine month file review....................................................................................... 78
6. After the investigation From notifying our decision, to closing the file .......... 79
Introduction: Key legal checkpoints .................................................................. 79
Notifying the result ........................................................................................................... 79
Obligation to use best endeavours to secure a settlement ................................. 79
Referrals to the Director ................................................................................................. 80
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 8
Reporting misconduct or breaches of duty............................................................... 80
Notifying the result of our investigation ............................................................. 80
Presenting your findings to the parties: How to write a sound and persuasive opinion .............................................................................................................. 80
Issuing a Certificate of Investigation to the complainant ................................... 80
What is a Certificate of Investigation? ....................................................................... 80
When to issue a Certificate of Investigation ............................................................. 81
Using our template for the certificate ......................................................................... 81
Guidance on using the template and completing the certificate ........................ 81
Obligation to promote settlement if complaint has substance ........................... 83
Referrals to the Director of Human Rights Proceedings ................................... 83
Overview ........................................................................................................... 83
Failure to settle – a statutory precondition for referral ....................................... 84
Our criteria for referral....................................................................................... 84
Is the case ready to go to the Director? ............................................................ 84
Case notes on referral ...................................................................................... 85
Closing the file .................................................................................................. 85
It is essential that in every case the Investigator asks “what can others learn from this case?” and considers avenues to distribute those messages, such as a case note or blog post. The Communications team can help with this. Remember, up to now, all of your energy, training and judgement has helped two people: the complainant and the respondent. With help from the Communications team, you could now influence thousands of people. ............ 85
When a file will be closed .................................................................................. 85
Procedure for closing the file ............................................................................ 85
Reporting misconduct and breaches of duty ..................................................... 86
Further action: Other tools for addressing non-compliance .............................. 86
Types of further action ...................................................................................... 86
APPENDICES ................................................................................................... 87
Appendix 1. Initial call checklist ........................................................................ 88
Appendix 2. Notification by email (cover email) ............................................... 90
Covering email – Form and content .................................................................. 90
Creating a template for the covering email ....................................................... 91
Using an email template ................................................................................... 93
Appendix 3. Investigations Team Inbox ........................................................... 95
Responsibility .................................................................................................... 95
Purpose ............................................................................................................ 95
Assignment ....................................................................................................... 95
“Actioned Folder” .............................................................................................. 96
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 9
Access to the inbox ........................................................................................... 96
Mailing from the inbox ....................................................................................... 97
Appendix 4. Checklists for conciliation and settlements ................................... 98
During the investigation .................................................................................... 98
During the investigation (continued) ................................................................. 99
Before the settlement conference ..................................................................... 99
Before the settlement conference (continued) ................................................ 100
During the settlement conference ................................................................... 100
During the settlement conference (continued) ................................................ 101
After the settlement conference ...................................................................... 101
After the settlement conference (continued) ................................................... 102
Checklist for written settlement agreements ................................................... 103
Agreements that are intended to be legally binding and enforceable ............. 103
Agreements not intended to be legally enforceable (for example, protocols of behaviour or future interactions) .................................................. 103
Appendix 5. Teleconferences ......................................................................... 105
The Language Line process ........................................................................... 105
The caller indicates they need an interpreter – check which language is needed. ...................................................................................................... 105
Getting disconnected during a teleconference ................................................ 106
Appendix 6. Natural disasters ......................................................................... 107
Appendix 7. Escalation Policy and Procedure ................................................ 109
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 10
1. About this Procedures Manual
Purpose and contents of this Manual
The purpose of this Procedures Manual is to help to:
ensure that our work is lawful
provide certainty and consistency in our administrative processes
preserve our “institutional memory” by recording the knowledge and experience we’ve
accumulated in the last two decades
reinforce and support our investigations staff in exercising their statutory discretion
The Manual does this by setting out:
the key statutory requirements or legal checkpoints for the complaints and
investigations scheme
best-practice guidelines where there aren’t specific statutory requirements
guidance to our investigations staff in exercising their discretionary powers under the
Privacy Act
our internal administrative processes for handling complaints and investigations.
Scope of this first section of the Manual
This first section of our Procedures Manual covers our complaints and investigations role
under Part 8 of the Privacy Act.
Subsequent sections of this Manual may cover other areas of our work, including topics
such as: litigation, breach notifications, information matching, and processes for
developing codes of practice.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 11
Marking a shift to more flexibility in managing complaints
This section of our Procedures Manual also reflects a shift in some of our
investigation processes, towards a more flexible approach that allows our
investigations staff to tailor the process to the needs of resolving each case.
This more proactive case-management approach is consistent with the
considerable autonomy and discretion that the Privacy Act gives the
Commissioner in responding to and investigating complaints.
This more flexible approach is also in line with changes in case-
management in the New Zealand courts, away from a strict standardisation
of procedural steps and towards more customisation and more proactive
management by judges and court officials.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 12
2. Overview of our complaints and
investigations role
Introduction
The Privacy Act provides the Privacy Commissioner the role of receiving, investigating and
conciliating complaints about privacy.
What the Act says: Section 69, Investigation of interference with privacy of
individual
(1) The functions of the Commissioner under this Part shall be –
(a) to investigate any action that is or appears to be an interference with the
privacy of an individual:
(b) to act as conciliator in relation to any such action:
(c) to take such further action as is contemplated by this Part.
(2) The Commissioner may commence an investigation under subsection (1)(a)
either on complaint made to the Commissioner or on the Commissioner’s own
initiative.
Our investigative function
In general the Privacy Act doesn’t provide detailed procedural requirements for our
investigations. Instead, there are a relatively small number of key mandatory requirements
or legal checkpoints – such as the requirement to formally notify the parties before any
investigation. The Act gives the Commissioner and the OPC staff (acting as his delegate) a
significant amount of autonomy and discretion in carrying out investigations, as well as a
discretionary power to decline to investigate if certain grounds exist.
Our “conciliator” function
Our conciliation function under section 69(1)(b) is supported by some significant powers
and obligations aimed at helping the parties come to a resolution without our office having
to investigate, or investigate fully and reach a determination.
The Act emphasises the parties’ autonomy in deciding whether to settle the complaint and
how to settle it. Regardless of whether the Commissioner thinks it’s in the wider public
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 13
interest that the case go to the Human Rights Review Tribunal we can’t refer a case on to
the Director of Human Rights Proceedings if the parties have agreed to settle. Our
conciliation role is discussed in detail in chapter 4, “Promoting conciliation and settlement”,
at page 44.
The impact of our decisions: Legal and practical consequences
Although the Commissioner has no power in respect of investigations to make binding
rulings and provide remedies such as compensation, our decisions do affect the legal
rights of complainants and respondent agencies further down the path. If we decline to
investigate a complaint for lack of jurisdiction (see page 23), or using our section 71
discretion (page 28), the complainant will not have access to the Human Rights Review
Tribunal. While our decision to decline to investigate can’t be taken to the Tribunal it is
subject to review by the Ombudsmen or to judicial review in the High Court.
In this way we have something of a gatekeeper role, directly limiting access to judicial
decision-makers who can provide remedies. In general, however, we exercise that
gatekeeper role in an expansive, rather than a restrictive way. Although we must be careful
that the limited resources of our office aren’t wasted on complaints that are incapable of
succeeding or that are an abuse of process, the thresholds for rejecting a complaint on
those grounds are appropriately set quite high: see chapter 2, “Receiving and screening
complaints”, from page 23.
Our complaints role in context: One of a range of tools for
addressing non-compliance
Investigating Officers need to bear in mind that investigations of individual complaints is
only one of the means established by the Privacy Act for addressing breaches of the
privacy principles.
If, for example, our initial assessment of a complaint or enquiry or investigation of a
complaint finds there’s been a breach but no harm, this does not exhaust our statutory
functions. Not everyone that brings a matter to this office is wanting to pursue a formal
complaint under Part 8 of the Act. We need to think of the range of options that are
available in these situations, whether that is a report to the Minister, a case note or
contacting an industry body.
We have a number of other options for addressing systemic or otherwise significant
privacy problems within a particular agency or type of agency.
Whatever action we take, we can amplify that effect through our policy engagement and
through the work of our Communications team. Conveying a message to stakeholders or
the wider public enables us to have a much greater influence.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 14
Legal checkpoints: Key statutory and common-law rules
Below are some key legal rules and principles that provide a framework for all actions and
decisions in our complaints and investigations role.
The other chapters of this Manual also set out other, more specific legal checkpoints that
apply at certain stages of the investigation process – see for example at page 55 of the
“Investigating a complaint” chapter.
Act within the law
Don’t exceed the power given by the Privacy Act or interpret its provisions
unreasonably.
Customer focused approach
Don’t assume either the complainant or the respondent will have knowledge of our
process.
Don’t try and interpret facts in order to fit a Privacy Act complaint.
Do try and work out what the complainant and respondent are trying to achieve and
help direct them the most appropriate place for that.
Do try and manage expectations about what we can and cannot do.
Natural justice
Give people a reasonable chance to have a say, and listen to them.
Give clear reasons for our decisions and actions.
Significant discussions with a party over the telephone should be followed up with a
letter putting it in writing.
Using our discretion
The processes we follow shouldn’t be so rigid that we fetter our discretion under the
Act.
But at the same time be as consistent as possible. Our decisions should be consistent
with the Commissioner’s earlier interpretations of the law and of established judicial
authority – and if we do change our mind, we need to acknowledge the change and
carefully justify the change with clear reasons.
Secrecy and privileged information
Maintain the secrecy of all information and matters that come to your attention during
your work, unless we need to disclose the information to fulfil the purposes of the Act
(section 116).
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 15
Protect privileged information (section 96(4)). Make sure that privileged information we
receive as part of an investigation remains privileged. We can see it, but no-one else
should.
Other legal rights and interests
Take into account other rights and interests, including:
important human rights and social interests that compete with privacy, such as the
general desirability of the free flow of information and the right of government and
business to achieve their objectives in an efficient way (section 14(a))
New Zealand’s international obligations, and general international guidelines relevant
to privacy (section 14(b), (c))
rights protected under the New Zealand Bill of Rights Act 1990, such as freedom of
expression
rights under Te Tiriti o Waitangi.
Learning the language: Some terms and abbreviations we
use
“Corro” is the “Complaints Correspondence” mailbox in Objective (it’s found under
Utilities/Mailbox)
An “enquiry”, depending on the context, can be used in the everyday sense of a
simple request for information or advice, but we also use it in a special internal
administrative sense to mean a communication that we treat as an “Enquiry” rather
than as a complaint to be investigated – for example, a complaint that we don’t have
jurisdiction to investigate or that we decide not investigate on one of the grounds in
71(1). See the discussion on the following pages about how we distinguish a
“complaint” from an “enquiry”.
“Objective” is our complaints management software.
A “prov” is an informal term we sometimes use internally to mean a provisional view
that a complaint has substance and that we communicate to the respondent agency.
(We also sometimes use it as a verb – as in “I then prov’d the complainant”). In our
correspondence we refer to it as a “preliminary view”. Internally we sometimes also
use the term “PV”.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 16
3. Receiving and screening complaints From when it arrives, to when it lands on an IO’s
desk
What this chapter covers
This chapter explains:
the key legal checkpoints that apply when we receive and screen
complaints
the process for receiving complaints and forwarding them to a Team
member for initial screening
initial screening by the rostered Team member to determine whether
the complaint is one that we can and should investigate
when a complaint should be referred to another agency such as the
Ombudsmen
assigning a complaint to one of our two offices, and the relevant factors
for this decision
assigning a complaint to a particular Investigator, and the relevant
factors.
Introduction: Key legal checkpoints
Our systems
We must have a good system for receiving and considering communications that
might be complaints.
Is the complaint within our jurisdiction?
Do we have jurisdiction? That is, is the communication an allegation of an action or
omission that is, or appears to be an interference with privacy? (section 67)
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 17
Is the complaint about something that falls more properly within the jurisdiction of the
Ombudsmen, the Health and Disability Commissioner, the Inspector-General of
Intelligence and Security, or an overseas privacy agency? (sections 72 – 72C)
Should we investigate the complaint?
If we do have jurisdiction, consider whether there are grounds under section 71(1) for
deciding not to investigate the complaint.
If a ground exists, decide whether to exercise the discretion under 71(1) to decline to
investigate.
Requirement to investigate
If we have jurisdiction over the complaint and none of the grounds in section 71(1)
exists, we must investigate it (section 70).
Fielding complaints and forwarding them to the rostered
Team Member
Introduction
The Office of the Privacy Commissioner receives a range of complaints, enquiries and
other communications from the public, and through a range of different channels, such as
email, online complaint or old-fashioned mail.
This section explains our systems for ensuring that all these communications are recorded
and actioned in the appropriate way. It explains who monitors the relevant channel and first
handles the communication, and what administrative steps they must take.
Is it a complaint?
Although many of the communications we receive are clearly intended to be complaints,
and are also clearly within our jurisdiction to accept and investigate, others may have a
murkier status – for example:
some will be intended as complaints but nevertheless fall outside our jurisdiction
because what they allege is incapable of being a privacy breach – these we record
administratively as “Enquiries”
some communications may begin in a less certain way as apparently just an enquiry
but, after clarification with the individual and consultation between the Enquiries
Officer and the rostered Team member, are then processed as a complaint and
assigned to an Investigator.
The processes set out below provide a framework for ensuring that all communications
that may be complaints are given proper attention and processed in the appropriate way.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 18
Administrative steps when a complaint first arrives: Channel by
channel
This section explains, for each channel through which a complaint may arrive, which staff
member will first field the complaint, and what they should do with it:
How it arrives Who first fields
it
What they do with it
Post or fax This could be either a letter or a hard copy of our complaint form
Administration Officer Wellington
Scan the complaint
Load the PDF of the scanned complaint into Objective (into the “Complaints Correspondence” mailbox)
Give the original hard copy of the complaint to the Team Secretary Wellington.
After these complaints have been assigned to an office by the rostered team member, the Wellington Team Secretary will:
make up the Wellington files, and
send the Auckland complaints to the Auckland Team Secretary in the overnight bag.
Online complaint form Administration Officer Wellington
Load the complaint into Objective (“Complaints Correspondence” mailbox).
Email to “Enquiries” Enquiries Officer The Enquiries Officer who fields the complaint will:
if it is clearly a complaint, forward it to the rostered team member
if it could be a complaint rather than an enquiry, consult with the rostered team member and their manager
If the email will be treated as a complaint, the rostered team member will then load the complaint into Objective.
Email to “Investigations”
The rostered team member
Load the complaint into Objective (“Complaints Correspondence” mailbox)
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 19
How it arrives Who first fields
it
What they do with it
Email to individual IO’s address
If the IO has dealt with that complainant before, the complainant may send their complaint to the IO’s individual email address.
The Investigating Officer
The IO forwards the email to the rostered team member.
The rostered team member loads the complaint into Objective (“Complaints Correspondence” mailbox).
Complaint to Orb website
We log into the Orb Website and move any correspondence there into our system by email
The rostered team member
The rostered team member loads the complaint into Objective (“Complaints Correspondence” mailbox)
Transferred by another organisation
We can have complaints referred to us by the Ombudsman, the HDC or IGIS. These will usually come to us via email after an initial consultation with a Team Manager
One of the Team Managers, or General Counsel
The team manager will load the complaint into Objective (“Complaints Correspondence” mailbox)
Who’s the rostered Team member today?
To find out which Team member is currently rostered on, check with your
own Team Manager.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 20
How we get the complaint
Who first handles the complaint
Flowchart: Fielding complaints and forwarding them to rostered
Team member
Online complaint form
Email to individual IO
Email to “Investigations”
Orb website
Email to “Enquiries”
Enquiries Officer
Consults with rostered
Team Member
as needed
Automatically
forwarded
Post or fax
Administration
Officer
Initial
screening
by
rostered
Team
Member
The Investigating Officer
Rostered Team Member monitors
the “Investigations” inbox
Administration
Officer
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 21
Complaints can be oral
Complaints do not have to be in writing (section 68(1)). We can’t therefore
insist to a complainant that they must put their complaint in writing before
we can accept it.
However, the Act also says an oral complaint must be put into writing as
soon as practicable, and that we have to give the complainant “such
reasonable assistance as is necessary in the circumstances” to enable
them to put it in writing (section 68(2), (3)).
Procedure for identification and notification of “Easy
Access” complaints
Step one
The investigator or team manager on incoming correspondence identifies an “easy access
IPP/HIPC/CRPC 6” complaint and flags it as such in the “unallocated files” by writing
“EASY ACCESS 6” on an electronic sticky note.
For a file to be considered “easy access”, it will need to fulfil the following criteria:
There has been a specific, sufficiently detailed request for information (so it is clear what we would be notifying on).
There is a copy of the request on file, or a copy of the response from the respondent which makes it clear the request has been made
The request was made more than 20 working days ago
Adequate contact details for both the complainant and the respondent have been provided
There are no “red flags” (e.g. repeat complainant, obvious mental health issues, or any other matters that would make early notification without speaking to the complainant undesirable).
Step two
Secretary, Investigations (Auckland)/Team Secretary, Investigations (Wellington) will
identify the easy access files in their complaints inbox by the “EASY ACCESS 6” sticky
note, and:
Make up the electronic and physical complaint file
Complete the metadata
Draft notification letters for both complainant and respondent
Take the file to a team manager.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 22
Step three
A team manager allocates the complaint file to an investigator and provides the file to the
investigator immediately, flagged as an “EASY ACCESS 6” file, with the draft of the
notification letters enclosed.
Step four
The investigator, within two working days:
Completes the pink
Reviews the draft notification letters, making any amendments they feel are necessary,
Confirms with Corporate Services that the notification letters can be sent to the complainant and the respondent.
Step five
Corporate Services sends the notification letters to the complainant and the respondent
once approved by the investigator, and files the copies in the Objective file, and the
physical complaint file.
Step six
The investigator manages the file from that point forward.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 23
Initial screening by rostered Team member:
Is this a complaint we can and should investigate?
When we first receive a communication, we need to:
establish whether the person intends it to be a complaint under the Privacy Act
decide whether it’s a complaint we have jurisdiction to investigate.
If we do have jurisdiction, we then need to decide whether we should decline to investigate
it using our discretion under section 71(1), if one of the grounds in that provision applies.
This section of the Manual gives guidance about each of those stages.
Is it intended to be a formal complaint?
It’s important to remember to ask the obvious questions – such as “Do we in fact have a
complaint here?” – rather than simply assume that we do. It’s possible that although the
person thinks their privacy has been interfered with, they don’t in fact want to file a formal
complaint, or haven’t yet decided what they want to do.
They may not realise that their one-paragraph email to “Enquiries”, written in haste and
irritation, could potentially trigger a formal investigation of the relevant business or
government agency under the Privacy Act. They may simply want us to know what
happened, or perhaps they simply want to vent some irritation and frustration. If you think
there’s doubt about this, confirm with the sender – preferably by phone as soon as
possible.
It’s up to the individual whether they want to formally complain or not. We can explain how
the complaints and investigations scheme works, but it’s not our job to persuade or
discourage them complain.
A note on terminology: “Complaints” and “Enquiries”
At the OPC the word “enquiry” can be used in two different ways:
Everyday sense – Sometimes it’s used in the everyday sense of
asking for information or advice
Special internal, administrative sense – Sometimes we use it in a
specialist way internally to mean any communication to the OPC that
we decide not to investigate as a complaint, either because we don’t
have jurisdiction (for example, because there is no potential privacy
breach even if the person’s claimed facts are true) or because we
decided not to investigate on one of the grounds under section 71 – for
example, the complaint is brought too late.
This means that something that on the face of it is a complaint may in fact
be dealt with, as an “enquiry”, even though the person concerned thinks it’s
a complaint.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 24
On the other hand, a communication that may seem to be just a request for
information or advice may in fact become a complaint that we investigate,
as we get more details from the individual – for example, an email to
“Enquiries” asking simply what a person’s privacy rights are in a particular
situation.
Alternatively, it could be a “notification”, where someone just wants to let us
know something. No matter what it is, we still have to figure out what, if any,
of our available tools we can best apply to it.
Even if it is clear the individual has suffered no harm, and therefore can’t
make a complaint under Part 8, the complaint may disclose something we
might want to draw to the respondent’s attention to improve compliance, or
to the government’s attention. We might want to initiate an “own-motion
inquiry”.
If it is a complaint, is it one we have jurisdiction to investigate?
People and bodies outside our jurisdiction
Not an “agency”
We won’t have jurisdiction to investigate the complaint if it concerns a person or body that
is not an “agency” within the terms of section 2 of the Privacy Act.
What the Act says: Section 2(1)
“agency means any person or body of persons, whether corporate or unincorporate,
and whether in the public sector or the private sector; and, for the avoidance of doubt,
includes a department ….”
The definition then continues with a lengthy list of exclusions. Note that there are
organisations that don’t fall within the definition of “agency” for the purposes of their
interactions with the public, but are “agencies” in relation to the personal information they
hold on their employees. For example, we can’t investigate complaints about courts or
tribunals in relation to judicial functions (section 2(1), definition of “agency”, para (b)(vii),
(viii)). That exclusion covers judges and court/tribunal officials – but it doesn’t cover other
people in a court or judicial context, such as lawyers or witnesses. For the application of
this exclusion to registrars and other courts officials, see Ministry of Justice v S (High
Court, Wellington, CIV-2005-485-1138, 7 Apr 2006 – available at
www.nzlii.org/nz/cases/NZHC/2006/357.pdf).
You may need to determine whether the respondent body or individual is a “tribunal” under
the Act. The term “tribunal” essentially refers to statutory bodies with a judicial function
(Director of Human Rights Proceedings v Catholic Church for New Zealand [2008] 3 NZLR
216. To determine, however, whether a body is acting judicially as a “tribunal” rather than
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 25
administratively is not always easy. The key distinction is whether the activity is more
judicial than administrative and takes into account a number of factors set out in the
leading case, Trapp v Mackie [1997] 1 All ER 489 (HL).
Case Note 232848 [2012] NZ PrivCmr 3 (June 2012)
Case Note 209125 [2009] NZPrivCmr 9 (May 2009)
Case Note 92895 [2008] NZPrivCmr 11 (August 2008)
Tribunal decisions L v W (unreported Decision No CRT 9/98 5 June 1998)
Clearwater v Accident Compensation Corporation (Decision No 02/04 HRRT
56/02, 23 February 2004 relying on Kuipers v Accident Compensation
Corporation (CRT Decision No 23/99, 10 August 1999)
High Court decision (upholding the Tribunal) Commissioner of Inland Revenue v B [2001] 2
NZLR 566
Our limited jurisdiction over intelligence organisations
What the Act says: Section 57, “Intelligence organisations”
“Information privacy principles 2, 3, and 4(b) do not apply to information collected by
an intelligence and security agency.”
Our jurisdiction over intelligence and security agencies – that is, the Security Intelligence
Service and the Government Communications Security Bureau – excludes complaints
under principles 2, 3, and 4(b).
See also the specific exception in IPP10(2) that allows an intelligence and security agency
to use personal information for a secondary purpose and the exception in IPP11(fa) that
permits the disclosure of personal information by any agency that believes on reasonable
grounds that the disclosure is necessary for an intelligence and security agency to perform
any of its functions.
Parallel jurisdiction with IGIS?
When we do have jurisdiction to investigate a complaint, check if the
complaint “more properly” belongs with the Inspector-General of
Intelligence and Security. Usually complaints about access and correction
“more properly” belong to the Office of the Privacy Commissioner, but other
complaints may require consultation with IGIS before deciding where they
“properly belong”. The statutory process in these cases is explained at
page 39 of this Manual.
For more information see: Intelligence and Security Act amendments to
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 26
Privacy Act: FAQs
Not a privacy problem
Sometimes a complainant will present us with a problem that, on the face of it, doesn’t
concern the Privacy Act. Don’t assume this must be a privacy problem simply because
they’ve contacted our office. It could be, for example, that they’re approaching a number of
government agencies and complaints bodies with their problem and we’re just one of them.
As always you should make sure you have all the details of the complaint and that you’re
clear about what the person is alleging. But our job is not to try to find a way to fit every
complainant’s problem into the Privacy Act scheme, even those that don’t seem to involve
privacy issues. If the complainant’s problem doesn’t involve a possible interference with
privacy, then we won’t be able to help them – other than giving them some guidance about
who else may be able to help.
On the other hand, if their problem does appear to involve privacy, remember it’s not their
responsibility to frame their complaint in terms of the specific rules and structure of the
Privacy Act scheme – that’s our job. A complainant doesn’t have to cite a specific privacy
principle or rule for us to be able to accept their complaint. If they believe their privacy has
been interfered with, and the alleged facts are capable of being an interference within the
terms of the Act, it’s then our job to investigate and establish whether their complaint has
substance (subject to our discretion to decline to investigate under section 71).
Not “personal information”
We will not have jurisdiction to investigate the complaint if:
the information in question is clearly corporate information, not information about an
individual, or
the information is not about an identifiable individual
However, if there’s any doubt about those questions, we should accept the complaint. The
question of whether it’s personal information should be determined as part of our
investigation.
Facts incapable of amounting to a breach
We won’t have jurisdiction if, on the facts alleged by the complainant, the action or
omission complained of is incapable of amounting to a breach of any information privacy
principle or rule – for example if the complainant says the information-holder hasn’t
responded to their information privacy request but the 20 working day limit hasn’t yet
expired.
Harm
Although harm is a necessary element for any actions that are an interference with privacy
under s 66(1), (harm not being required for actions that are interferences with privacy
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 27
under s 66(2)), that doesn’t mean that we should refuse to accept a complaint for
investigation simply because the complainant hasn’t specifically alleged any harm in their
complaint.
If, on the face of it, the alleged action or omission is capable of having caused harm, we
should accept the complaint for investigation. Whether the person has in fact suffered any
harm will then be one of the issues for your investigation to determine.
You should also not reject a complaint merely because the complainant has alleged what
appears at first sight to be only a low level of harm – for example, they say they felt
embarrassed. Here, it will be a matter for our investigation whether the harm suffered
meets the statutory threshold of “significant humiliation, significant loss of dignity, or
significant injury to the feelings of that individual” in section 66(1)(b)(iii). You shouldn’t
assume that the harm suffered is incapable of meeting that threshold.
However, there may be some cases where on the facts alleged by the complainant it is
clear that no harm was, or could have been, suffered by the complainant. In those cases
we have no jurisdiction to investigate, as the action or omission is incapable of being an
interference with privacy (unless their complaint concerns principle 6 or 7). An example
might be where the complaint is that an agency sent out a completely innocuous email
without using the BCC (blind copy) function.
An early open ended conversation with the complainant might well help you to establish
whether the complaint is likely to meet the harm threshold.
Exclusions such as “domestic affairs”
What the Act says: s56 Personal information relating to domestic
affairs
(1) Nothing in the information privacy principles applies in respect of—
(a) the collection of personal information by an agency that is an individual; or
(b) personal information that is held by an agency that is an individual,—
where that personal information is collected or held by that individual solely or
principally for the purposes of, or in connection with, that individual’s personal, family,
or household affairs.
(2)The exemption in subsection (1) ceases to apply once the personal information
concerned is collected, disclosed, or used, if that collection, disclosure, or use would
be highly offensive to an ordinary reasonable person.
If the privacy principles are clearly excluded in this case – for example, by the section 56
“domestic affairs” exclusion – then we should reject the complaint for lack of jurisdiction. If,
however, there is doubt, we should accept the complaint for investigation. It could be
unclear whether the particular facts come within the exclusion, or it could be that the
interpretation of the exclusion is still legally uncertain.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 28
For example, if it’s possible the “domestic affairs” exclusion wouldn’t apply to the complaint
because of the “highly offensive” qualification added to section 56 in July 2015, this should
be investigated.
If we have jurisdiction, should we decline to investigate under
71(1)?
Our discretionary power
Section 71(1) gives us a discretion to decline to begin an investigation if, in our opinion,
one of the seven grounds set out in that subsection exist.
(Section 71(1) can also be used to discontinue an investigation that has already begun:
see page 75.)
The words that begin section 71(1) and provide our discretion are as follows:
The Commissioner may in his or her discretion decide to take no action or, as the case
may require, no further action, on any complaint if, in the Commissioner’s opinion, –
Para (a): Length of time since the incident
(a) the length of time that has elapsed between the date when the subject matter of
the complaint arose and the date when the complaint was made is such that an
investigation of the complaint is no longer practicable or desirable
Key questions here will include:
Are we still practically able to investigate the complaint? It may be that the
evidence we need or the people we need to talk to are no longer available, or that the
passing of time will have made memories less reliable. As the phrase “no longer
practicable” in para (a) makes clear, this limb is intended to address where there are
simple practical difficulties with trying to investigate because of the time that has
passed.
Why has the complaint been made only now? Have the facts only just come to the
complainant’s attention – or have they simply sat on the issue when they could in fact
have come to us earlier? The phrase “no longer … desirable” in para (a) is broad. It
allows us to decline to investigate if we think that in this case the complainant
shouldn’t be allowed to use the complaint process and put the relevant agency to the
expense and stress of an investigation into old events, including if events have moved
on.
- However, remember that the complainant may have been aware of some key
facts but not others. For example, they may have been aware there was a
breach, but the harm may only have just come to their notice.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 29
- They may also have had a good reason for not complaining earlier – for
example, they may have been making serious efforts to try to resolve the
problem through negotiation or other methods. It will depend on the particular
case.
We will therefore not apply any absolute time limit but will look at all the circumstances. For
example:
We may decide not to investigate a complaint if the relevant incident was 12 months
ago and the complainant could have complained earlier.
We may decide to investigate if the incident was some years ago but the information
has only just come to the complainant’s knowledge.
In all cases, clearly document your reasons. We might have to defend your decision to the
Ombudsman, or in judicial review.
Case notes 219105 (2011)
Tribunal decisions DAS v Department of Child Youth and Family Services,
No 45/04, HRRT 47/03, 10 Sep 2004
Para (b): Trivial
(b) the subject matter of the complaint is trivial
Look at all the circumstances
Whether the subject matter of the complaint is trivial will depend on all the circumstances
of the particular case. For example, though the information may appear to us to be trivial, it
may be particularly relevant for the complainant’s own purposes, and therefore be
significant in that context.
The threshold for invoking para (b)
We should be cautious about invoking para (b) to decide to not investigate or to
discontinue an investigation.
Sometimes, clarifying the complaint with the complainant may show their real concern was
something other than any alleged breach – like heavy-handed or unresponsive treatment.
In those cases, it may arguably be appropriate and a tidy result to decline to investigate
under the “trivial” limb. But remember that we’re in the business of dispute resolution, and
telling a complainant their problem is “trivial” may get in the way of a practical resolution,
causing them to dig their heels in and seek vindication for complaining in the first place.
Try to look at it from the complainant’s point of view. Although it might seem a minor matter
to us, remember they’ve gone to the trouble of making a complaint. If they’ve also been
treated poorly by the agency, this is likely to be a significant piece of the context for the
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 30
purposes of trying to resolve the complaint. Generally it will be better, if possible, to decline
to investigate on some basis other than the “trivial” ground.
If, for example, it’s become clear that the complainant isn’t in fact alleging any breach, then
it would generally be appropriate to decline for lack of jurisdiction. If on the other hand this
only becomes apparent after notification, you could invoke section 71(2) – that further
action is unnecessary or undesirable.
Para (c): Frivolous, vexatious, not in good faith
(c) the complaint is frivolous or vexatious or is not made in good faith
Overview
The Ombudsmen have published a helpful summary of the case-law on “frivolous or
vexatious”. Translating that summary to the privacy complaints scheme, we will be justified
in rejecting a complaint as frivolous or vexatious if the complainant is clearly abusing the
rights granted by the scheme, rather than exercising those rights in good faith.
As that summary indicates, the three concepts in para (c) – “frivolous”, “vexatious” and “not
made in good faith” – partially overlap and to some extent circle back on each other.
A high threshold
In general, the threshold for declining to investigate on those grounds is a high one.
Dealing with an application to have someone declared a vexatious litigant, the High Court
said:
“[B]ecause of the impact upon rights of access it is proper for the Court to be
reluctant to make an order unless the grounds are clearly made out….”
A-G v O’Neill [2008] NZAR 93 at [101]
However, in proper cases our discretion here serves an important purpose. In O’Neill the
High Court continued, quoting from Attorney-General v Jones [1990] 1 WLR 859 (CA):
“[t]here must come a time when it is right to exercise that power, for at least two
reasons. First, the opponents who are harassed by the worry and expense of
vexatious litigation are entitled to protection; secondly, the resources of the
judicial system are barely sufficient to afford justice without unreasonable delay
to those who have genuine grievances, and should not be squandered on those
who do not.”
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 31
Below is some more specific guidance on the individual terms in para (c).
“Frivolous”
Its everyday meaning = “Not having any serious purpose or value” (Concise Oxford
Dictionary)
The threshold for declining to investigate on this ground is a high one. To strike out a
case as “frivolous”, the courts have said that the pleading must be “so clearly
frivolous that to put it forward would be an abuse of the process of the court”
(Young v Holloway [1895] P 87 at 90).
Comments by the New Zealand courts echo the theme of abuse of process:
“A proceeding is frivolous if it trifles with the Court’s processes.”
Koyama v NZLS [2015] 3 NZLR 29 (HC)
“The claims by [the parties] are frivolous. The parties are using the pleadings to
direct insults at each other. This proceeding is not being used to uphold interests
which the law of torts sets out to protect.”
Deliu v Hong [2011] NZAR 681 (HC) at 687
"The proceeding cannot be described as frivolous or vexatious. There is a
genuine attempt to resolve issues in the High Court ….”
NZLS v Deliu [2015] 2 NZLR 224 (HC)
However, for a complaint to be rejected as “frivolous” on the basis that it’s an abuse of
process it’s not necessary for the complaint to be completely untenable: “This decision
that the pleadings are frivolous does not turn on whether [the parties] have tenable
causes of action for their claims, although that is a relevant consideration.” (Deliu v
Hong at 687)
“Vexatious”
Its everyday meaning = “Causing annoyance or worry” (Concise Oxford Dictionary)
A “vexatious” complaint is one that no reasonable person could properly treat as
having been made in good faith (Norman v Matthews [1916-1917] All ER 696).
The test is therefore an objective one, in that it focuses on what a reasonable person
would think of the complaint – not on the subjective view of the complainant on the
merits of their case (they may well believe it’s an important complaint made in the
public interest), and also not the subjective view of the Investigating Officer (who may
have a long history of frustration with this particular complainant).
Remember that under s71(1)(c) it’s the complaint that must be vexatious, not the
complainant. Just because someone has previously made a number of possibly time-
consuming complaints, even ones that could themselves be called “vexatious”, that
doesn’t of itself mean their next complaint can automatically be rejected as vexatious.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 32
It depends on the nature of the current complaint, considered in light of the
surrounding circumstances.
On the other hand, those surrounding circumstances can include the complainant’s
conduct and their purpose in bringing the complaint, and therefore you’re entitled to
take those factors into account.
The O’Neill High Court decision gives some relevant guidance here – though you
need to remember it involved an application to have someone declared a vexatious
litigant. The string of vexatious cases Mr O’Neill had taken to the Human Right Review
Tribunal had included, for example, a claim that he’d been discriminated against by
the use of Latin phrases in legal submissions in another matter. The High Court
summarised:
“Mr O’Neill’s proceedings are generally characterised by meritless claims, often
directed at individuals for no reason other than they have made decisions
adverse to Mr O’Neill. There is also the pattern, often apparent in claims by
vexatious litigants, of the extension of proceedings to take in an increasing circle
of potential defendants including the Chair of the Tribunal, members of the
Tribunal, and Ministers of the Crown.” [95]
Again, the threshold for declining to investigate on the “vexatious” ground is a high
one. A complaint will not be vexatious simply because we have previously found the
particular complainant to be difficult, or we think the current complaint is a minor one.
A complaint can be a vexatious one even though it discloses “the germ” of a legitimate
complaint (A-G v O’Neill [2008] NZAR 93 at [43]).
Cases where the “vexatious” ground may be relevant can include, for example, where
we’ve already dealt with one or more complaints from the same person based on
basically the same allegations (see Koyama v NZLS [2015] 3 NZLR 29 (HC)).
“Not made in good faith”
The everyday meaning of “good faith” = “Honesty or sincerity of intention” (Concise
Oxford Dictionary)
Although “vexatious” and “good faith” are related concepts, “vexatious” relates mainly
to the complainant’s intention in making the complaint – that is, are they doing it
simply to cause annoyance and worry? By contrast, “good faith” relates more to
whether their action in bringing the complaint is done honestly. A complaint not made
in good faith might include, for example, where a complainant already knew that the
matter had been settled, or where they knew they had in some way contributed to the
breach they’re complaining about.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 33
Para (d): Individual doesn’t want action taken
(d) the individual alleged to be aggrieved does not desire that action be taken or, as
the case may be, continued
This ground may be relevant where:
the relevant individual (who potentially may be someone other than the complainant)
informs us that they no longer want to continue
we’ve informed the complainant that their complaint is unlikely to succeed (for
example, because an exemption clearly applies) and that if we don’t hear back from
them we’ll assume they don’t want to pursue the complaint any further.
Para (e): Insufficient personal interest
(e) the complainant does not have a sufficient personal interest in the subject matter
of the complaint
The Privacy Act allows someone to make a complaint even if they’re not the person whose
privacy has allegedly been interfered with. However, that jurisdictional opening is subject in
turn to our discretion to reject a complaint under 71(1)(e) if we don’t think it’s appropriate to
investigate.
Here are some key factors to consider:
Practical obstacles? – Does the fact that the complainant isn’t the individual affected
present practical difficulties for investigating the complaint? It may be that we simply
can’t get all the facts we need from the complainant.
Systemic issues? – Does the complaint raise a systemic problem or an issue of
public interest? This may argue for us investigating compared with an allegation of
what appears to be an isolated or very specific breach.
Another stake in the game? – Does the complainant have some other kind of
interest in the issue that they would like to further through the privacy complaints
process? For example, are they a political player? Although they may be complaining
in good faith about what is, in the wider sense, a legitimate concern, we may decide
it’s not appropriate for the complaints scheme to be used in this way, given that the
scheme is focused on providing individuals with a means of protecting their own
privacy interests and autonomy. The following is an example of that kind of complaint:
“Highly politicised and publicised” – Example of 71(1)(e) in action
In 2014, in the wake of the publication of Nicky Hager’s Dirty Politics, we
declined to investigate a complaint from the Green Party into the alleged
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 34
disclosure by the Minister of Justice of a public servant’s contact details and job
title to the blogger Cameron Slater.
In the Commissioner's blog of 26 August 2014, he explained our decision:
“The Privacy Act is fundamentally concerned with the preservation and
promotion of individual autonomy. It protects the right of an individual to
determine, or at least influence, the extent to which their personal information is
placed into the public domain and becomes the subject of public discussion.
“That purpose would not be served if we were to investigate a complaint in a
highly politicised and publicised environment that is neither on behalf of, nor
supported by, the affected individual.”
Para (f): No use of Code’s complaints procedure
(f) where—
(i) the complaint relates to a matter in respect of which a code of practice
issued under section 46 is in force; and
(ii) the code of practice makes provision for a complaints procedure, –
the complainant has failed to pursue, or to pursue fully, an avenue of redress
available under that complaints procedure that it would be reasonable for the
complainant to pursue
In the vast majority of cases it will be reasonable to expect the complainant to have used
the Code of Practice complaint process first.
Cases where we may still accept the complaint can include the following:
Urgency – If there is immediate and ongoing harm, it may not be reasonable to
expect the complainant to wait for the agency’s internal complaints process to run its
course – for example, if information had been posted online.
Complaint-handler is the problem – if the complainant has found that the person
who handles the complaints process at the agency was directly involved in the alleged
breach, it may be reasonable for the complainant to come to us first. Here the agency
itself isn’t a safe place for the complainant to take their problem. This may be more
likely to happen with smaller agencies – a GP’s office for example – whereas large
agencies will be more likely to have a separate complaints team.
Of course, if the complainant has approached the agency and the agency hasn’t
responded within a reasonable time, then para (f) won’t apply – especially if the agency
hasn’t met its own stated timeframes for responding.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 35
Not using the agency’s complaints process in non-Code cases
We have a limited statutory basis for declining to investigate where the
complainant hasn’t first complained to the agency itself and a Code of Practice
doesn’t apply. These cases would be unlikely to be captured by para (g) (see
below), which generally applies to judicial or other external fora that can
provide a remedy or appeal, rather than to an agency’s internal complaints
processes. It may be that we can refer the complainant to industry-specific
schemes such as the Banking Ombudsman or Utilities Disputes Ltd.
In more extreme cases, and depending on the nature of the complaint, we may
be able to decline on the basis that the complaint is "vexatious" (see para (c)
above).
In these cases, while we may find it difficult to decline to investigate, you
should strongly urge the complainant to approach the agency first. Emphasise
to them that this is likely to be the fastest and most effective of getting the
result they want. You should give them maximum assistance, perhaps even
providing them with details for the privacy officer or other contact person at the
agency. Tell the complainant that their problem isn’t addressed within a certain
time, they should let us know.
Once we’ve explained this to complainants and equipped them as much as
possible to pursue the problem with the agency, complainants are almost
always happy to do this.
Para (g): Other adequate means of challenge
(g) there is in all the circumstances an adequate remedy or right of appeal, other
than the right to petition the House of Representatives or to make a complaint to
an Ombudsman, that it would be reasonable for the individual alleged to be
aggrieved to exercise
Other relevant remedies or appeal rights that may be relevant here include:
complaining to the Human Rights Commission, if the complaint is fundamentally about
discrimination rather than privacy
impending civil or criminal proceedings that will provide the complainant with an
opportunity to apply for access to information earlier denied to them
Case notes No 211597 (2010)
when there’s a complaints or disciplinary body for that particular sector or profession
that can deal adequately with the complaint – for example, complaints against
healthcare providers, against banks covered by the Banking Ombudsman scheme, or
against lawyers.
Case notes No 93953 (2007)
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 36
Tribunal decisions Lehmann v Radioworks, No 31/04,
HRRT 8/02, 5 Aug 2004
What is the complaint really about?
Remember – where a complaint does not relate to concerns about privacy at all, then we
have no jurisdiction. We do not need to invoke the discretion under section 71(1) in those
cases. In cases where we have parallel jurisdiction with some other agency, you will need
to ask: What is this complaint really about? Is it mostly about privacy or mostly about
something else? For example, if it’s a complaint about a bank, is it mostly about privacy
and information, or is it really a banking dispute?
Many disputes we receive complaints about contain only a very small privacy element.
We should explain to the complainant in these cases that there is another complaints
agency that’s better placed to deal with their dispute than us, and that we’ll most likely just
muddy the waters if we get involved. The complainant may be unaware of the other
agency and its jurisdiction and be happy to redirect their complaint to a more appropriate
place.
The complainant can come back
If we decline to investigate under para (g) on the ground that a court or other agency has
jurisdiction to deal with the complainant’s problem, we should tell the complainant that this
doesn’t prevent them coming back to us with a complaint if the other process doesn’t
provide the remedy they’re seeking for their privacy issue.
This doesn’t mean we put their complaint on hold. Administratively there’s no difference to
when we decline on other grounds: we close the file as normal. However, we should
assure the complainant that this does not prevent them making a complaint about the
issue in the future.
Notification requirements if we decline to investigate under 71(1)
If we decide under section 71(1) not to investigate the complaint, we must inform the
complainant of this and also give him or her reasons (section 71(3)). The reasons should
set out clearly why the particular ground for declining to investigate applies. This
notification should be in writing. The effect of us declining to investigate is that the
complainant cannot go to the Human Rights Review Tribunal. The complainant can ask us
to reconsider our decision to decline to investigate.
If we still decline to investigate, we should notify the complainant of his or her right to
complain to the Ombudsman.
Exercising our discretion: Section 71 and our “gatekeeper” role
If we decide to investigate a complaint and notify the parties accordingly, this has
significant consequences for the question of access to the Human Rights Review Tribunal.
It means that whatever the outcome of our investigation, the complainant will be able to
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 37
take a case about the matters we investigated to the Tribunal. The respondent will
therefore be exposed to the Tribunal’s jurisdiction, whatever our investigation finds. This
means that we must think carefully about the scope of our investigation.
Our decision about whether to investigate under a particular principle is not subject to
review by the Tribunal, although the parties can challenge the process we followed by
going to the Ombudsmen. (See further the discussion of the significance of notification in
DHRP [NKR] v ACC [2014] NZHRRT 1, HRRT No 002/2012.)
“Keeper of the keys”
The Tribunal has said that, if we decline to investigate under section 71(1): “… then
that is the end of the matter. To that extent the Privacy Commissioner is the keeper of
the keys to the gate through which aggrieved individuals must pass in order to come to
the Tribunal.”
DAS v Department of Child Youth and Family Services
No 45/04, HRRT 47/03, 10 Sep 2004
However, although the statutory scheme may in this way make us a “gatekeeper” to the
Tribunal, we do not take as our default that protecting respondents from the Tribunal’s
jurisdiction is more important than giving complainants access to it – or in other words, that
it’s better to keep people out than to let them in. In general we exercise our gatekeeper
role in an expansive rather than restrictive way. As the above discussion indicates, the
thresholds for rejecting a complaint for lack of jurisdiction or under section 71 are
appropriately set quite high.
Referring a complaint or part of a complaint to other
agencies
Referrals to Ombudsmen, Health and Disability Commissioner or
IGIS
Sections 72 – 72B
If it looks like the complaint, or part of the complaint, belongs more properly with the
Ombudsmen, the Health and Disability Commissioner or the Inspector-General of
Intelligence and Security, then we must:
consult with the relevant agency without delay (“forthwith”)
decide what to do
refer the complaint, or the relevant part of it, to the other agency without delay if we
think it belongs there
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 38
notify the complainant that we’ve done this.
What the Act says: Section 72, “Referral of complaint to Ombudsman”
(1) Where, on receiving a complaint under this Part, the Commissioner considers
that the complaint relates, in whole or in part, to a matter that is more properly
within the jurisdiction of an Ombudsman under the Ombudsmen Act 1975 or the
Official Information Act 1982 or the Local Government Official Information and
Meetings Act 1987, the Commissioner shall forthwith consult with the Chief
Ombudsman in order to determine the appropriate means of dealing with the
complaint.
(2) As soon as practicable after consulting with the Chief Ombudsman under
subsection (1), the Commissioner shall determine whether the complaint should
be dealt with, in whole or in part, under this Act.
(3) If the Commissioner determines that the complaint should be dealt with, in whole
or in part, under the Ombudsmen Act 1975 or the Official Information Act 1982 or
the Local Government Official Information and Meetings Act 1987, the
Commissioner shall forthwith refer the complaint or, as the case requires, the
appropriate part of the complaint to the Chief Ombudsman to be dealt with
accordingly, and shall notify the complainant of the action that has been taken.
[Sections 72A and 72B, which deal with referrals to the Health and Disability
Commissioner and the IGIS respectively, follow the same structure and wording as
section 72.]
When will a complaint “more properly” belong with the Ombudsmen?
A complaint or part of it will, or may, fall more properly under the Ombudsmen’s jurisdiction
in the following cases:
Official information – it is mainly about official information, rather than personal
information
Administrative action – it is mainly about the reasonableness of some administrative
action by a government body or official – for example, if the complainant is unhappy
with the substance of a particular decision or with how they were treated.
Sometimes complainants (or their lawyer or advocate) may seek to cloak a challenge to a
decision or process under Principle 8 arguments, particularly in the immigration context.
We should be wary of that kind of complaint. On the other hand, we must be careful that
we do not miss a valid Principle 8 complaint by too hastily transferring a complaint to the
Ombudsmen.
In some cases it may be appropriate for our office and the Ombudsmen to run parallel
investigations, where we deal with the privacy aspect and they deal with the other aspect,
and with the two offices keeping in touch during our investigations.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 39
However, our two investigations will often be working to two different statutory timelines.
Further, this will require the complainant to deal with two different investigating agencies.
Usually, however, it will be better for just one agency to deal with the complaint, according
to the nature of the complaint and which agency can best address it.
Sometimes a complainant may want to have two separate investigations –
it may make them feel their complaint is more important, or they may
genuinely believe it will deal more comprehensively with their concerns. In
these situations, however, sections 72 to 72B give us the power to say no,
and to refer their complaint on to the other agency.
When will a complaint “more properly” belong with the Health and Disability
Commissioner?
Examples of where a complaint will or may more properly belong with the HDC include:
Physical privacy – complaints about physical or bodily privacy rather than the privacy
of health information. For example, a complainant may be unhappy about a doctor not
closing the curtains of a cubicle before a physical examination, and they may have
complained to us assuming that we have jurisdiction over complaints about physical
privacy under the Code of Health and Disability Services Consumers’ Rights.
Ethical obligations & competence – a complainant alleging a breach of the privacy
principles by a doctor or other health professional may be mainly concerned about the
health professional’s competence in relation to their ethical obligations around
patients’ privacy and information. If the complainant’s concern is not mainly about the
consequences of the breach for them, about any harm, but rather with the doctor’s
ongoing conduct, then it may be more appropriate to have the case dealt with by the
Health and Disability Commissioner.
When will a complaint “more properly” belong with IGIS?
The IGIS provides oversight of the activities of the New Zealand Security Intelligence
Service (NZSIS) and the Government Communications Security Bureau (GCSB). Those
two agencies have wide-ranging powers that can affect the privacy of individuals, and the
role of the IGIS includes ensuring that those powers are used lawfully and appropriately.
The IGIS has substantial powers to access documents and information held by the SIS
and GCSB.
Privacy complaints to the Privacy Commissioner about the SIS and GCSB may therefore
be more properly within the IGIS’s jurisdiction when they involve broader issues relating to
those agencies’ surveillance and information-gathering activities.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 40
Administrative processes with Ombudsman correspondence
Formal consults: Forward these to the General Counsel, cc Litigation secretary. Flag
email red and leave in Inbox so that the Litigation secretary can store in Objective. No
further action required.
Informal consults: Respond and file in Objective under Informal Consultations (File
Plan/Ombudsmen Consultations/Informal Consultations/appropriate Year – then create a
file divider under appropriate year and name – Year-month-day, Informal Consult, Name/s
of parties).
If the Ombudsman (OOTO) has chosen to consult informally, they are pretty sure of the
privacy interest and are only asking us to confirm it. If you do not agree with their
assessment or do not have enough information to make up your mind, you can ask them to
defer to a formal consult.
Potential transfers: Review to confirm there is personal information and the OOTO has
identified it. Check Objective to make sure we don’t already have a duplicate complaint.
If we already have a complaint or enquiry file on the same matter:
Add OOTO correspondence to existing file and advise OOTO no transfer is
required as we already have it and either the complaint it awaiting allocation to an
investigator, or if we are not investigating briefly explain the steps taken (eg we
have told the complainant to contact the agency directly first).
If we don’t have a complaint or enquiry file:
Advise OOTO to transfer or partially transfer the complaint. Drag your response
out of your “Sent” items and into the OOTO corro folder. Flag the emails with your
own colour and leave in the Inbox until the formal transfer arrives (usually within a
day or two). When OOTO sends formal transfer letters, attach all relevant
correspondence to a new email yourself and then add to Incoming with the usual
naming convention: [Year-month-day Name of Complainant (received by OOTO
corro)].
If OOTO proposes or agrees to a joint investigation:
Ensure complainant and respondent contact details are provided. If not, ask for
them
Add relevant correspondence to Incoming – include note that it is a joint
investigation/led by OOTO.
If it isn’t personal information and we don’t agree to the transfer:
Treat as an enquiry from OOTO. Create an enquiry file for correspondence. Use
the name of the OOTO investigator and the name of the complainant in the Enquiry
file so they are searchable with “attempted transfer”.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 41
Agreed protocols for transferring complaints
The Ombudsman and OPC have agreed upon protocols to transfer complaints. Those
protocols are outlined below:
Potential Transfer (from Ombudsman to OPC)
Subject line: ‘Potential Transfer’ – Our case reference – name of the complainant
Body of email:
Name of complainant
Name of agency
Identify whether: Decision on information request OR Other potential interference with privacy
Date information request made to agency (if an information request)
Date complaint made to Ombudsman
Brief description of the complaint/information at issue
OOTO contact
OOTO team
The email will be sent to OPC’s general email address: [email protected].
Timeframe for responding: we hope OPC would be in a position to respond to emails within
3 working days or so (our reporting target for complaints outside jurisdiction is to close
within 1 month of receipt).
Transfer
OPC would respond to the Ombudsman’s ‘Potential Transfer’ email, advising whether we
accept the file or not. If OPC agrees to the transfer, the Ombudsman will draft up the
standard transfer correspondence. This correspondence will be sent by email to OPC’s
general email address: [email protected].
It would be helpful for the subject line of the email to contain the term ‘Transfer’, the case
reference and the name of the complainant.
Potential Transfer (OPC to Ombudsman)
Subject line: ‘Potential Transfer’ – OPC case reference – name of the complainant
Body of the email:
Name of complainant
Name of agency
Identify whether: Decision on information request OR Other potential Ombudsman Act complaint (ie, administrative act or decision of a scheduled agency
Date information request made to agency (if an information request)
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 42
Date complaint made to OPC
Brief description of the complaint/information at issue
OPC contact
OPC team
The email will be sent to the Ombudsman’s general email address:
Timeframe for responding: we would hope the Ombudsman would be in a position to
respond to emails within 3 working days or so.
Referrals to overseas privacy agencies
The Privacy Act reference: section 72C
If it looks like the complaint belongs more properly with an “overseas privacy enforcement
authority” (defined in s 72C(4)), like the Australian Information Commissioner, then:
we may consult with the overseas agency about this
after any such consultation we must decide where the complaint should be dealt with
if we think it belongs with the overseas agency, and if both the agency and the
complainant agree, we may refer the complaint, or part of it, to the overseas agency.
Which office? – Assigning to Wellington or Auckland
Who makes the decision:
The rostered Team member
Criteria for assigning complaints to a particular office
Easy answers: Fixed rules for certain agencies
Complaints about the Government Communications Security Bureau (GCSB) or the
New Zealand Security Intelligence Service (SIS) are dealt with in Wellington, and by
OPC staff who have security clearance.
Complaints about Auckland District Health Board (ADHB) or Auckland Council are
dealt with by our Auckland office.
Guidelines for all other cases
For other cases there are no set rules for which complaints go where, but here are some
factors to consider:
If the complainant has a current complaint, or has had other complaints arising from
the same facts, it may be best to deal with the new complaint in the same office (and
probably by the same Investigator).
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 43
If the respondent is based in Wellington or Auckland it may be best to assign it to the
relevant office, as it will be easier for the Investigator to meet with the respondent if
they want to do this – for example, if it’s a small medical centre in suburban Auckland,
send it to Auckland; if it’s Wellington City Council, send it to Wellington)
If the respondent is a large public-sector agency like the Police, MSD or Corrections,
then ensure that complaints about that agency are split evenly over time between
Wellington and Auckland.
Take into account the current workload of each office.
For some specific complainants it may be better to assign their complaints to the office
where they don’t live.
Administrative steps after the complaint is assigned to an office
Who: the Team Secretary Wellington
Tasks: After these complaints have been assigned to an office by the rostered Team
member, the Team Secretary Wellington will make up the Wellington files and send the
Auckland complaints to the Team Secretary Auckland in the overnight bag.
Who: the Team Secretary for that office
Tasks:
Open an electronic file in Objective (these are ordered alphabetically by complainant
name), drop the complaints documents into that file, and complete the file metadata
Open a hard-copy file
Send an acknowledgement letter to the complainant and a copy of the Information
Sheet
- The Acknowledgement letter templates are found at:
Acknowledgement letter (NEW)#2.obr
Acknowledgement letter - with letterhead (NEW)#5.obr
- The Information Sheet is found at:
Information Sheet for Complaints (Feb 2016)#2.obr
- The Assessment form (pink) 2015 is found at:
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 44
Assessment form (pink) 2015#2.obr
- The Closing Coversheet for Files form (pink) 2015 is found at:
Closing Coversheet for Files.obr
Put an Assessment form (pink) on the file electronic and physical files.
Put a Closing Coversheet for Files (pink) on the electronic and physical files.
Give the hard-copy file to the Team Manager for assigning to an Investigator.
Which Investigator? – Assigning the complaint to an
Investigator
Who makes the decision:
The Team Manager in the office to which the complaint is assigned
The decision: relevant factors
the Investigator’s current workload
the Investigator’s particular experience and specialist knowledge
whether the Investigator already has complaints against that agency
whether the Investigator already has complaints from that complainant
whether there is any conflict of interest that could affect the Investigator’s suitability for
the particular complaint.
Checking the Investigator’s assessment and investigation plan
When they assign the complaint to an Investigator, the Team Manager will note on the
Complaint Assessment sheet (“the pink”) whether they want to review it once the
Investigator has completed it.
Usual practice in both offices is for the Team Manager to check the completed “pink”
so that they can review the Investigator’s assessment of the complaint and their
investigation plan.
Difficult callers
Our policy “Escalation Policy and Procedure applies [see Appendix 7].
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 45
4. Promoting conciliation and
settlement
What this chapter covers
This chapter has guidance for Investigators about:
our statutory obligations and powers in relation to promoting
conciliation and settlements between complainants and respondents
assessing the potential for a settlement
providing guidance to the parties about possible settlement outcomes
preparing for settlement conferences
drafting settlement agreements.
Overview
One of our key statutory functions is to act as “conciliator” in relation to anything that is or
appears to be an interference with privacy (section 69(1)(b)).
We are therefore always trying – before, during and after any investigation – to reach a
resolution of the complaint through some form of settlement.
We need to be very clear with the respondent about what we are doing and why, including
addressing questions they may have about whether settling implies the matter has
substance.
OUR SETTLEMENT TARGET:
We aim to settle 50 percent of all complaints
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 46
Conciliation and settlement: Our statutory obligations and
powers
Power to encourage a settlement
Consider whether settlement may be possible, either after considering the complaint alone,
or after the respondent has come back to us in writing. If we think it may be possible, we
may use our “best endeavours” to achieve a settlement (section 74).
What the Act says: Section 74, “Settlement of complaints”
Where it appears from a complaint, or any written response made in relation to a
complaint under section 73(b)(ii), that it may be possible to secure a settlement
between any of the parties concerned and, if appropriate, a satisfactory assurance
against the repetition of any action that is the subject matter of the complaint or the
doing of further actions of a similar kind by the person concerned, the Commissioner
may, without investigating the complaint or, as the case may be, investigating the
complaint further, use his or her best endeavours to secure such a settlement and
assurance.
Obligation to promote settlement if a complaint has substance
After the investigation, if we’ve concluded that the complaint has substance, we must use
“best endeavours” to try to achieve a settlement, and we may try to get an assurance from
the respondent against any repetition (section 77).
What the Act says: Section 77, “Procedure after investigation”
(1) Where the Commissioner, after making any investigation under this Part, is of the
opinion,—
(a) in the case of a complaint, that the complaint has substance, the
Commissioner shall use his or her best endeavours to secure a settlement
between any parties concerned and, if the Commissioner considers it
appropriate, a satisfactory assurance against the repetition of any action
that was the subject matter of the investigation or the doing of further
actions of a similar kind by the person concerned; or
(b) in any other case, that the matter ought to be proceeded with, the
Commissioner shall use his or her best endeavours to secure such an
assurance as is referred to in paragraph (a).
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 47
What does the “best endeavours” standard require of us?
The High Court has treated the “best endeavours” standard as being the same as
“reasonable endeavours” (see below).
“A best endeavours obligation is a substantial one, reflecting the importance that the
legislation attaches to settlement, but it also recognises that there is no single correct
approach. There is much room for subjective judgement about how and when to
promote settlement, and each case depends on its facts. … I think it appropriate to
approach the issue by asking, as [the Commissioner] invited me to do, whether a
reasonable Commissioner could have conducted herself as the Commissioner did
here. That approach assumes that best endeavours is synonymous with reasonable
endeavours, which need not be correct, but the assumption favours the Commissioner
and I do not think anything turns on the distinction.”
Henderson v Privacy Commissioner [2010] NZHC 554 at [98]
The High Court found in that case the Commissioner did not use best endeavours to settle
the complaint, and could not have reasonably concluded that she was unable to secure a
settlement when it was referred to the Director of Proceedings. The Commissioner had
failed to advise the respondent of both an invitation to settle and a substantive settlement
offer made by the complainant, and did not consider calling a compulsory conference
under s 76.
Promoting conciliation from the outset
As the High Court noted in the Henderson case, the scheme of the Privacy Act’s
complaints provisions requires us, from the very beginning of the complaints process, to be
proactive in trying to resolve the complaint through conciliation.
“… the Commissioner must be alert to the possibility that the parties may be willing to
settle at an early stage, before the complaint has been investigated and before the
Commissioner is able to offer any guidance on the merits; an obligation to promote
conciliation and settlement arises at the outset.”
Henderson v Privacy Commissioner [2010] NZHC 554 at [101]
In line with that principle, we place a lot of emphasis on early complaint resolution and
settlement. Our aim is to settle complaints, if appropriate, after we’ve made an initial
assessment and contacted the parties to clarify the issues.
In particular, a key question the Investigator will need to ask of the complainant very early
on is what would resolve the complaint for them.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 48
Tools we can use to try to reach a settlement
There are several tools we can use to promote settlement of a complaint:
1. First teleconference with the complainant and respondent
2. Case management conference
3. Power to call compulsory conference
The Privacy Act gives us the power, under s 76, to call a compulsory conference of the
parties, in order to try to resolve the dispute.
We do not invoke this power when we convene a case conference at the start of an
investigation. Case conferences are held (usually by telephone) to clarify the issues in a
dispute and work out a process and timetable for our investigation. There should usually
be a case conference within two weeks of our notification of the start of the investigation.
For more about case conferences, see page 67 of this Manual.
What the Act says: Section 76, “Compulsory conferences”
(1) The Commissioner may call a conference of the parties to a complaint by—
(a) posting to each of them a notice requesting their attendance at a time and
place specified; or
(b) such other means as is agreed to by the parties concerned.
(2) The objectives of the conference shall be—
(a) to identify the matters in issue between the parties; and
(b) to try to obtain agreement between the parties on the resolution of those
matters.
(3) Where a person fails to comply with a request under subsection (1) to attend a
conference, the Commissioner may issue a summons requiring the person to
attend a conference at a time and place to be specified in the summons.
(4) Section 159 of the Criminal Procedure Act 2011 applies to a summons under this
section as if it were a witness summons issued under that section.
Settlements and “party autonomy”: It’s up to them
It’s up to the complainant to decide what will resolve their complaint. We can make
suggestions – such as an apology, a change in the respondent’s processes, or
compensation – but we can’t require a complainant, or a respondent, to agree to any
particular settlement.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 49
If after the investigation we conclude that the complaint has substance, we’re then required
by the Privacy Act to use best endeavours to secure a settlement, even if we think it would
otherwise be appropriate to refer the case to the Director of Human Rights Proceedings:
see page 83 of this Manual.
“The legislation … recognises party autonomy, in that the parties may settle a
complaint and the Commissioner must encourage them to do so, whether or not [the
Commissioner] sees the complaint as a good opportunity to establish a precedent.”
Henderson v Privacy Commissioner [2010] NZHC 554 at [89]
Assessing the potential for a settlement
Complaints tend to be much easier to settle at this early stage and there is often a real
willingness to resolve them on the part of both sides. Generally, complaints about access
requests are the most amenable to resolution at this stage, but most types of complaints
are potentially open to being settled early on.
In particular, an early settlement may be possible if the complaint is similar to one we have
previously investigated. We can explain to the parties the outcome of that complaint and
then, depending on that outcome, the complainant may tell us they don’t want to continue
or the respondent agency may realise they have to accept liability and try to settle.
Some complaints simply won’t be amenable to early settlement, even if the complaint itself
seems to be a relatively minor matter.
This can depend on various factors, but often the indicators would include:
a complaint where the parties’ views and expectations are at opposite ends of the
spectrum
a complainant with unrealistic expectations about the level of a monetary settlement
a respondent that is unwilling to accept and recognise a breach.
Giving guidance to the parties and managing expectations
The Investigator’s role includes managing the expectations of both sides in order to
achieve a resolution that is acceptable to both. This process may include telephone
diplomacy and negotiation, or face-to-face conciliation where the Investigator meets with
both parties or meets with each of them separately.
The Investigator should have an overview of what would be a reasonable outcome in the
context of the parties’ expectations. We’re not obliged to support any unreasonable
expectations that a party might have.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 50
It’s appropriate at all points of the process to provide the parties with reality checks about
the effect of the law, the limitations of our process, and the potential consequences if a
complaint isn’t resolved through our process.
Specific settlement measures
Settlements will often include:
an apology
an assurance that the breach won’t be repeated
a promise to take action, like training staff and adopting privacy policies
money, goods, services or other remediation
an agreement to release information.
However, although those are common types of settlement outcomes, we’ve also seen a
wide and creative range of measures over the years – for example, flowers, gift baskets
and, in one case, an overseas holiday for the complainant and their partner. It’s a matter of
what will resolve the complaint for the particular complainant and respondent. (See Roth at
PVA74.5 of Privacy Law and Practice for examples of settlements.)
The power of an apology
It’s hard to overstate the significance that an apology can often have for
complainants. If given in good faith and taken by the complainant to be
genuine, it can go a very long way to resolving a dispute for them, by
demonstrating to the complainant that their problem has been taken
seriously and that the respondent agency will take real steps to prevent any
repetition.
Giving guidance on financial settlement amounts
Although conciliation usually doesn’t involve a financial settlement, we’re often asked by
the parties what would be an appropriate financial settlement for a particular complaint.
We don’t give detailed guidance, as conciliation is about the parties’ deciding what will
resolve the complaint for them. It’s also in the nature of privacy breaches that they vary
widely, depending on the particular case, so it’s difficult to assign a dollar figure to any
particular breach. However, we can give the parties examples of specific settlements and
the type or level of breach or harm in each case.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 51
The amount of any settlement, or the specific settlement outcome if it’s a
non-monetary settlement, will be included in the Objective metadata for
each complaint.
Guidance from Tribunal awards
Awards in the Human Right Review Tribunal will give some guidance about appropriate
settlement awards. You can read a useful 2015 LawTalk article about Tribunal awards,
including a table of awards from 2012 to 2015, at:
www.lawsociety.org.nz/lawtalk/issue-879/the-human-rights-review-tribunal,-
employment-institutions-and-the-adequacy-of-remedies
For a useful discussion of Tribunal awards and relevant principles, see Hammond v Credit
Union Baywide [2015] NZHRRT 6.
Preparing for a settlement conference
Be absolutely clear about where we are with the complaint. Have we completed our
investigation? Are we satisfied we have all the information we need? Or are we still open
minded, and prepared to investigate further? Is the process designed to elicit information
for our investigation (eg the level and nature of harm).
Here are some other questions for you to consider when you’re preparing for a settlement
conference:
Process issues
Does the conference need to be in person, or would by phone be just as good or
better?
Are there any barriers to communication? Do we need an interpreter or other
assistance?
Does the complainant need a support person? Will the numbers on each side of the
table be equal?
Is the venue neutral and mutual? Are there breakout rooms? Will there be tea, coffee,
water? Is parking available?
Have you allowed plenty of time for the meeting? Better to book three hours and finish
early than run out of time drafting an agreement.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 52
Preparing the parties for the conference
Are the parties and you the Investigator all in agreement about what is in dispute?
Would it be useful to prepare a statement of agreed facts and details before the
conference?
Do the parties have a shared understanding of the purpose of the meeting?
Have the parties each been sent an “expectation” letter? (These letters should set out:
the date, time and venue for the meeting; who will attend; the purpose of the
conference; what will happen at the conference; some ground rules for how it will run,
like taking turns to speak and not interrupting.)
Does the respondent have authority to settle?
Is the respondent ready to talk about policies or procedures?
Does the complainant need to bring evidence of harm?
Preparing yourself
What approach will you use for the conference? Is one person going to lead the
conversation or will you use some alternative model?
Do you know the file frontwards and backwards?
Have you looked at similar complaint settlement outcomes?
Can you use case notes or tribunal decisions to guide the parties towards each other?
Do you have a draft settlement agreement ready to go?
Do you have all the evidence needed to make a finding or reach a settlement?
You can also find a more detailed checklist in Appendix 3 of this Manual
(see page 95). This covers: preparing for the conference, the process at the
conference itself, and tasks to be done after the conference.
Drafting a settlement agreement
It is important that a settlement agreement between the parties is clear, covers all of the
issues, and accurately reflects what both parties want. The checklist below includes some
guiding principles to help ensure that settlements facilitated by the Investigator are
effective.
Agreements should be “SMART”:
Specific
Measurable
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 53
Achievable
Relevant
Time-bound.
Some key questions for ensuring the agreement is “SMART”:
Are the parties correctly identified?
Does the agreement only contain relevant information?
Is the agreement dated?
Is the agreement signed?
Each conciliation or settlement conference will be different, and the needs of the parties
will vary. This means the level of involvement required from the Investigator in helping the
parties draft an agreement will depend on a case by case assessment of their relationship
with each other, their relative vulnerability, and their general ability to clearly and
accurately express themselves. Some further questions to consider:
Who is responsible for drafting the agreement?
- the conciliator?
- the advocates?
- the parties themselves?
Should the agreement be witnessed by the conciliator?
Will there be any follow-up by the conciliator after the agreement has been signed?
Appendix 3 includes a further checklist for settlement agreements – see
page Error! Bookmark not defined., “Checklist for written settlement
agreements”. This is broken down for agreements that are intended to be
legally enforceable and those that are not (protocols of behaviour or future
interactions for example). We have no role in enforcing settlement
agreements, nor does the Human Rights Review Tribunal. Rather,
settlement agreements are enforceable as contracts.
54
Notify the result of the investigation (s 75)
Consider referral to DHRP if no settlement (s 77(2))
Must try to settle if complaint has substance (s 77(1)(a)
May try to settle complaint (s 74)
Ask agency for comment if you find a breach (s 120)
Notify the parties before investigating (s 73(b))
Investigate with “due expedition” (s 75)
Key legal checkpoints for your investigation: Before, during and after
Investigation begins
Investigation ends
File is closed
Determine if complaint has substance
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 55
5. Investigating a complaint From the “pink” assessment form, to making a
decision
What this chapter covers
This chapter of the Manual provides Investigators with guidance in carrying
out an investigation, including:
the overall framework for investigations, including the key legal
checkpoints and our investigative approach given that statutory context
completing our internal Complaint Assessment form (the “pink”)
the boundary between making preliminary enquiries and investigating
notifying the parties that we intend to investigate
case conferences
guidance around the issues of breach and harm
when to invite comments from the parties, including the “adverse
comment” rule
discontinuing an investigation under section 71
file management and record-keeping.
The framework for your investigation
Key legal checkpoints
Notification
As soon as practicable after we decide to investigate, notify the complainant and
respondent of this and explain what our investigation process is going to be (section
70(2), 73).
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 56
Respondent’s right to respond
Provide the respondent agency with an opportunity to give a written response to the
complaint within a reasonable time (section 73(b)(ii)).
Promoting conciliation and settlement
Consider whether settlement may be possible - both before and after you get a
response from the respondent agency.
If we think it may be possible, we may use “best endeavours” to settle the complaint
(section 74).
Investigating with “due expedition” (proper speed)
Conduct the investigation with “due expedition” (section 75).
Respondent’s right to be heard before any “adverse comment”
If you find that the complaint has substance, you must give the respondent a chance
to respond to this before you reach a final view and notify the parties under
(section 120).
Tailoring the process to the particular case
The Privacy Act gives investigators a significant amount of autonomy in handling
complaints. Rather than a large number of detailed procedural rules, there are instead a
relatively small number of significant legal checkpoints and boundaries – such as the
requirement to formally notify the parties before any investigation (see above,
“Introduction: Key legal checkpoints”).
Subject to those checkpoints and boundaries, our Investigators are empowered to make
enquiries and reach conclusions about whether there has been an interference with
privacy. The Commissioner expects them to exercise discretion, to tailor their investigation
to what is needed to resolve the particular case, and to seek guidance from senior staff
when necessary.
Although the Investigator should tailor the process to the needs of resolving the particular
complaint, there should be some default steps in the process. For example, a case
conference should normally be held by telephone early on to clarify the disputed issues
and work out a process and timetable for our investigation.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 57
Investigating with proper speed (“due expedition”)
What the Act says: Section 75
Where any investigation is made following a complaint, the Commissioner shall
conduct the investigation with due expedition ….
What does the “due expedition” rule require of us?
In everyday language, “due expedition” means we should investigate with something like
“proper speed” or “appropriate speed”. (“Expedition” is defined in the Concise Oxford
Dictionary as “promptness or speed”, and “due” is defined as “proper; appropriate”.)
Clearly, our obligation here includes avoiding unnecessary delays. It implies that, in any
particular case, there must be a reason for each action or step in our investigation process,
including where the investigation effectively halts because we’ve invited a written response
by a certain date. (For more guidance on this point, including on applying the “adverse
comment” rule in section 120, see page 72 of this Manual.)
Keeping control of the investigation process
It’s important that, as the Investigator, you take and keep control of the investigation. You
should ensure that the parties respond in good time and keep to timetables set at case
conferences.
But you also need to be aware of the administrative realities for large agencies – a
response from them may need to go through four different sign-off levels before it can get
to us.
The existence of the statutory “due expedition” requirement may sometimes provide a
useful lever to use against respondents who drag their feet in providing information or
comment. You can emphasise to them that the law requires our investigations to happen
within a reasonable time.
Breach and harm: Investigating them concurrently
When you investigate whether there has been an interference with privacy and harm is a
necessary element, you should investigate the two necessary elements concurrently:
Did the respondent agency breach an information privacy principle or rule?
Has the complainant suffered harm as a result of that breach?
In the past we have sometimes separated these two inquiries – that is, we enquired about
harm only if we’d first concluded that there’d been a breach. At that point we would write to
the complainant telling them we’d found a breach and asking what harmful consequences
they’ve suffered.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 58
Instead, where harm is a necessary element we should always have a conversation about
harm as early as possible. This ensures we have the information we need to form a full
view on the complaint early in the investigation. The complainant may need to supply
evidence later to back up the nature and quantum of the remedy.
Burden of proof
The Act requires the Privacy Commissioner to form an opinion on whether the complaint
has substance, including whether an available exception excuses any breach. The Act
doesn’t assign any evidentiary burden to a particular party, and the High Court has held
specifically that the respondent does not have the burden of establishing that an exception
applies (see Henderson v Privacy Commissioner [2010] NZHC 554).
However, if we ask a respondent agency for evidence of their assertion that an exception
applies, but they refuse to engage with us or don’t give us the information, we’re entitled to
form a conclusion on the basis of the information we have. If in that case we find that the
alleged action or omission did occur, but we have insufficient information to conclude that
an exception applies, then we are entitled to conclude that there has been a breach.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 59
Settlem
Case conference, 2 weeks after
notification (s 76) Settlement
Flowchart
Complete the Complaint
Assessment form (“the Pink”)
Finding: Complaint has
substance
Assess facts & parties’ responses;
Form a view
Finding: Complaint doesn’t
have substance
Investigation: Fact-finding &
gathering information
Assess response,
form a final view
Give the respondent a chance to comment
in writing (s 120)
Parties provide information as agreed
at case conference
Phone the complainant to tell
them your finding
Notify your decision (s 75)
Close the file
Notify parties of start of investigation
(s 73)
Contact parties to clarify complaint as
necessary
Notify your decision (s 75)
Close the file
Complainant has further comments / information to add
Complainant has no further comments / information to add
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 60
Completing the Complaint Assessment form (“The pink”)
Summary
When a complaint is assigned to an Investigator, their first step is to complete our internal
Complaint Assessment sheet – informally, we usually call this “the pink”.
Purpose of the Complaint Assessment form
The purpose of completing the pink Complaint Assessment form is to:
record an initial summary and assessment of the complaint
develop and record a plan for investigating the complaint
provide the Team Manager (and, in the most complex cases, the Privacy
Commissioner and the Assistant Commissioner (Policy & Operations)) with an
opportunity to review the assessment and investigation plan and test the Investigator’s
intended approach.
What information to include on the form
Summary of the complaint – Include the basic facts of the complaint, including any
relevant dates, and what the complainant is unhappy about. In general, a 5-10 line
summary of the complaint will be appropriate here, so that the Team Manager, more
senior managers, and any other investigative staff who work on the complaint later on
will be able to see a brief but reasonably complete summary of what it’s about. A
single sentence will usually not be enough here.
Relevant principles – Identify the principles or rules to be applied. If these are
agreed to by the Team Manager, these should then be reflected in the notification
letter, and they will ultimately determine the Tribunal’s jurisdiction.
Investigative plan – Propose what investigative action you think is appropriate. For
example, do we need more information? If so, what information? Or is the complaint
ready for notifying the respondent agency? This is also a useful place to record any
early thoughts about settlement opportunities.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 61
Just what do you think you’re doing –
Preliminary enquiries, or an investigation?
If you’re an Investigator making preliminary
enquiries about a complaint, be careful that your enquiries
don’t slide over into investigating whether there has in fact been
an interference with privacy in this particular case – particularly when you’re
making early phone contact with the respondent. Remember we have an
important statutory obligation to formally notify the respondent and
complainant before we begin any investigation.
The following section explains what does and what doesn’t amount to
“investigating” a complaint.
The most important thing is being clear with parties about what we are doing and what they can expect.
Investigating vs enquiries/conciliation: Telling the
difference
Because we have a statutory obligation to notify the parties before we start any
investigation, it’s important to be clear about exactly what does and what doesn’t amount
to “investigating” a complaint.
The boundary between preliminary enquiries and investigating
Whenever we receive a complaint, the rostered Team member may need to make some
preliminary enquiries as part of their initial screening of the complaint, to find out whether
it’s within our jurisdiction and to establish whether we can and should decline to investigate
(see page 21). After a complaint goes to an Investigator, the Investigator may also still
need to make some enquiries before they can investigate, as certain gaps or uncertainties
may have become apparent when they completed the Complaint Assessment form (“the
pink”). The Investigator will also be looking to see if the complaint can be resolved.
The preliminary enquiries may therefore include:
clarifying with the complainant exactly what they’re alleging, including what harm, if
any, they claim to have suffered
finding out exactly who the respondent is, and whether they’re an “agency” within the
terms of the Privacy Act
finding out what practical outcome the complainant wants
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 62
finding out from both the complainant and the respondent about their willingness – or
not – to settle the complaint.
However, you are likely to be verging into an investigation if you:
invite a response from the respondent about the substance of the complaint
assess comments from the respondent about the substance of the complaint
seek and receive information from a third party who may know something about the
relevant incident.
You will need to apply careful judgment in pursuing any of these steps. Generally, it is not
good practice to carry out any of those actions without first formally notifying the
respondent agency in writing that we’re going to investigate. The risk is that if you go
ahead without notifying the respondent agency, we may been in breach of our statutory
requirements.
Conciliating vs investigating
Early discussions with the two sides for the purpose of trying to resolve the dispute are
central to our role. Here we’re carrying out our statutory function as a conciliator
(section 69(1)(b)), as opposed to our investigator function (69(1)(a)).
However, it’s important to make it clear in your discussions with the parties that at this
point you’re not in fact investigating, and that both sides will be formally notified in writing
before we begin any investigation.
In particular, you should be clear when talking to the respondent that you’re not asking
them to respond to the substance of the complaint, and are merely asking the two parties
to settle the complaint between themselves at this stage. The purpose here is to say to the
respondent, in effect:
“This is what the complainant is saying has happened, and this is what they want.
Is it possible to resolve this between you?”
These early attempts at dispute resolution can be very productive. It may be the agency
has simply overlooked responding to the complainant and is eager to fix this. Or it may be
that they’re less than eager but will nevertheless begrudgingly give the complainant what
they want now that they’ve received a phone call from our office.
Identify the complainant and person alleged to be aggrieved
Before notifying, it is important to identify if the complainant is also the person alleged to be
aggrieved. The person alleged to be aggrieved does not have to be the complainant. It is
an important point to clarify, as both the complainant, the person alleged to be aggrieved
and the person to whom the investigation relates (the respondent) must be notified.
“Because s 73(b) requires the Privacy Commissioner to inform the person to whom the
investigation relates of details of the complaint or the subject matter of the investigation, the
Commissioner must necessarily first identify the complainant and the person alleged to be
aggrieved (if that person is not also the complainant) because at the complaint stage the
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 63
complainant and the individual alleged to be aggrieved do not have to be the same person
(though they often are). It is also possible for a complainant who is making a complaint on
behalf of the person alleged to be aggrieved to be at the same time an aggrieved person in
his or her own right. This would most commonly occur where, for example, one spouse or
partner might lodge a complaint on behalf of him or herself as well as the other partner; or
where a parent or guardian makes a complaint in his or her own right but also on behalf of his
or her child or guardian.
While conceptually it is not difficult to envisage a circumstances in which a person may at the
same time be a complainant for a third party as well as a person aggrieved, care must be
exercised to ensure the difference in roles is given due recognition throughout the statutory
process in Part 8. In particular:
Section 73(b)(i) and (ii) necessarily require that the person to whom the investigation
relates not only details of the complainant but also who the complainant is and if the
complainant is different to the individual alleged to be aggrieved, the identity of the
allegedly aggrieved individual. Otherwise, the person to whom the investigation
relates is not given adequate “details of the complaint” or, as the case may be, the
“subject matter” of the investigation.
If the person making the complaint and the third party are both persons aggrieved,
the person to whom the investigation relates is entitled to have this particularised so
that the opportunity to be heard mandated by ss73 and the other provisions of Part 8
is an effective opportunity to deal with both complaints.”
Edwards v Capital and Coast DHB (Strike-Out Application) [2016] NZHRRT 20, [63].
Notification: Telling the parties you’re going to investigate
Who does this:
The Investigator handling the complaint. In complaints involving principle 6, this may be
done by the Team Secretary.
What the Act says: Section 73, “Proceedings of Commissioner”
Before proceeding to investigate any matter under this Part, the Commissioner –
(a) shall inform the complainant (if any), the person to whom the investigation
relates, and any individual alleged to be aggrieved (if not the complainant), of the
Commissioner’s intention to make the investigation; and
(b) shall inform the person to whom the investigation relates of –
(i) the details of the complaint (if any) or, as the case may be, the subject
matter of the investigation; and
(ii) the right of that person to submit to the Commissioner, within a reasonable
time, a written response in relation to the complaint or, as the case may be,
the subject matter of the investigation.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 64
Form of notification: In writing
You must notify the respondent in writing. Although the Privacy Act doesn’t specifically
require notification to be in writing, you are required to do this as a matter of internal
administrative practice.
This creates a clear written record that the respondent agency was notified, and exactly
what they were notified of. This may be significant if the complaint leads later to Tribunal
proceedings and the respondent agency disputes the Tribunal’s jurisdiction on the ground
that they were not properly notified of the complaint and our investigation into it.
Written notification can be by letter or email, but in either case the correspondence must
be saved into Objective.
Using the notification template letters
Template letters for notifying the parties can be found at:
- Notifications.obr
Notification by email
We notify major agencies by email and would encourage investigators to email respondent
agencies where practicable.
We have a standard covering email that we send, and the notification letter is sent as an
attachment to that email. The covering email is included as Appendix 2 of this Manual (see
page 90).
What amounts to “notification”
Your notification letter to the respondent agency should:
tell them that a complaint has been made
tell them who the complainant is and, if the complainant is different to the individual
alleged to be aggrieved, the identity of the allegedly aggrieved individual
tell them what events we are investigating
tell them what privacy principles, or Code of Practice rules, are involved
ask them to respond in writing to the complaint
give them a reasonable time to respond to the complaint.
Notification must be precise
It’s not sufficient to inform the respondent in general terms that you’re investigating an
allegation against them of an interference with privacy. You must tell the respondent
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 65
precisely what actions or omissions the complaint relates to, including which privacy
principles or code rules may apply.
If after the respondent is notified our investigation reveals that a different – or additional –
principle or rule is relevant, then you must notify the respondent again under section 73(b).
Again, this must tell them they have the right to make a written response within a
reasonable time, and you must then consider that response (see DHRP [NKR] v ACC
[2014] NZHRRT 1, HRRT No 002/2012, at [29], [30]).
You should make sure that this further notification is made in separate correspondence. If
you combine a new notification with other matters, such as a preliminary view, it increases
the risk the issues will be lost or confused.
Notifying individual respondents as well as the principal agency
For more detailed guidance on this issue, see our Practice Note:
Notification (November 2014). The Practice Note also includes a suggested
wording for the notification letter.
It is for us to determine the appropriate respondent on a complaint. Usually, a respondent
organisation will be the best agency to notify. However, from time to time it may be
appropriate for us to also notify an individual employee, member or agent. It is important
that we identify this early and make an appropriate decision about whether to notify an
individual in addition to an organisation. Our decision will have an impact on the
complainant’s ability to take proceedings against these agencies later. Whatever our
decision on the appropriate respondent, we must ensure that it is made very clear to the
complainant at the outset.
If you are in doubt about what to do, please seek further advice from your Team Manager
or from General Counsel.
The Human Rights Review Tribunal has ruled that if we don’t notify the individual, that
person can’t be a respondent in any later Tribunal proceedings.
“… no action can be taken by an aggrieved individual [against an individual employee]
unless the employee … has been the subject of an investigation as contemplated …
under s 82(1)(a).
We are not willing to accept that a person who has not been given notice that he or
she is personally at risk in an investigation, before the investigation is carried out, can
be said to have been the subject of that investigation. …
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 66
We are not willing to regard employees of an agency that is investigated as falling
within s 82(1)(a) of the Act just because they happen to have been the employees who
were (at least to some extent) involved in the matter.”
Duffy v Drury No 30/09, Ref no HRRT 33/08, at [16], [17], [20]
(See also DHRP [NKR] v ACC [2014] NZHRRT 1, No HRRT 002/2012 at [29])
Why it’s important to get it right
Failing to notify the respondent so that Tribunal proceedings can’t be taken against
them may be unfair to the complainant, denying them a remedy they would otherwise
be entitled to.
The Privacy Act regime can be brought into disrepute if technical legal issues allow
people to get away with privacy breaches.
It may mean significant inefficiencies and delays in the legal process – for example,
the Director of Human Rights Proceedings may already have spent significant time on
the file, or time in the Tribunal may be taken up with debates about jurisdiction.
Triggers for notifying individual respondents as well as the principal agency
Factors alerting us that we may need to also notify an individual include:
cases of employees browsing through the employer organisation’s databases, or other
intentional misuse or unauthorised access
where the organisation may be able to argue it did all it reasonably could to avoid a
breach
where the actions complained about were those of a contractor (here there may be
questions about the scope of the contract, and whether and to what extent the
contractor was acting as agent)
where the respondent is a “fragile” company – that is, there’s a risk this agency will
rearrange its ownership or go out of business to try to avoid litigation (for example,
there’s a history of ownership changes due to insolvency or other risk factors).
What we have to tell the individual
Your notification letter to the individual respondent should:
tell them that a complaint has been made
tell them what events we are investigating
tell them what privacy principles, or Code of Practice rules, are involved
tell them that they may be personally liable
ask them to respond in writing to the complaint
give them a reasonable time to respond to the complaint.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 67
Case conferences
An early case conference is a default step
There should usually be a case conference involving the
complainant, the respondent and the Investigator within two
weeks after notification of the start of the investigation.
Purpose of a case conference
The purpose of a case conference is to ensure all parties have:
a clear and common understanding of process and of the timing for various steps in
the process, and
equivalent expectations of each other and of the Office of the Privacy
Commissioner.
A case conference may also help to clarify the disputed issues, and enable parties to work
out how to resolve the issues.
However, in large part a case conference is a timetabling exercise. The conference may
establish that, for example, by a particular date the complainant will provide the
Investigator with additional information, by a particular date the respondent agency will
give the Investigator the result of its internal review of the relevant incident, and that by a
particular date the Investigator will make his or her decision.
The case conference is therefore not intended to achieve a resolution of the complaint by
itself, although the Investigator should be alert to any possibility of that happening. Instead
it’s intended to work out a path to resolving it. Each party should leave the conference with
a clear understanding of the investigation process, and also some sense of ownership of it.
A case conference is different from a “compulsory conference”. These are called under our
statutory power in section 76, and their main objective is to try to resolve the dispute. (For
compulsory conferences, see page 48 of this Manual.)
Format for case conference
Case conferences will normally be by telephone. However, we can – and increasingly will –
use video-conferencing technology to hold case conferences.
You may find it helpful to go through some of the information in the Initial Call Checklist
with the parties at the start of the case conference, to remind the parties about the nature
of your role and key aspects of the complaints and investigation processes: for this
checklist, see Appendix 1 of this Manual, at page 88.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 68
Was there a breach? – Key questions, principle by
principle
Here is a list of some of the questions you may need to ask in relation to each privacy
principle.
Principle 1 – Purpose of collection
Was any information collected?
What was the purpose of collecting the information?
Is the purpose unlawful? (For example; was information collected for the purpose of
discriminating under the Human Rights Act?)
Is the purpose connected with a function or activity of the agency?
Is the collection necessary to achieve the purpose?
Principle 2 – Source of the information
Was any information collected from someone other than the individual?
If so, do any of the exceptions apply?
Does the agency have a belief on reasonable grounds, as is necessary for each
exception?
Principle 3 – What the person must be told when information is collected
from them
Was the information in fact collected? It may be that the information was sought but
not collected (see AB v ACC [2002] HRRT 17).
Was the information collected directly from the complainant?
What was the complainant told about the purpose of collecting the information?
If the complainant wasn’t notified at the time the information was collected, were they
told as soon as practicable afterwards? (See principle 3(2))
Principle 4 – Manner of collection
Was any information collected?
Were the means unlawful?
- Is the action regulated by law?
Were the means unfair?
- For example, was the complainant misled about the purpose, the intended
recipients and so on?
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 69
Were the means unreasonably intrusive?
- Consider whether the circumstances justified the means in this case.
Note: Principles 1 to 4 don’t apply to unsolicited information. However,
once an agency holds information, even if unsolicited, the information is
subject to the principles about storage, accuracy, use and disclosure
(Principles 5 and 8 – 11).
Principle 5 – Storage and security
What type of information does the agency hold? Is it particularly sensitive information?
What sorts of security steps are reasonable for that type of information? For example,
is special staff training necessary?
Did the agency take those reasonable steps?
Does the agency have policies, procedures or training programmes in place? Were
they followed in this case?
Principle 6 – Access
Did the agency respond within 20 working days, and was the response a decision on
the request?
Did the agency comply with the procedural requirements in Part 5?
If information was withheld, was it legitimately withheld under any of section 27 to 29?
Was a charge levied? (Public-sector agencies cannot charge: section 35). If it’s a
private agency, was the charge reasonable? (See section 35(5), and HIPC, clause 6)
Access complaints: Check the requested information yourself
If information has been withheld, you must obtain the
information from the respondent agency and review the
information yourself, to establish whether it’s been withheld
justifiably. In these cases you can’t just take the agency’s word for it.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 70
Principle 7 – Correction
Did the complainant ask for information to be corrected?
If yes, what was the agency’s response?
If the agency refused to make the change sought, has the complainant prepared a
statement to be attached to the information?
Principle 8 – Checking accuracy and so on before use
Has the agency taken steps to ensure that the information is accurate and so on
before using or disclosing it?
Were the agency’s steps reasonable in the circumstance? (Note that the agency will
not necessarily be in breach merely because it held or used incorrect information.)
Is the complaint about a process or decision, rather than the information itself?
“The language of Principle 8 makes it clear that the more serious the potential
consequences of using the personal information held by the agency, the greater the
degree of care which must be exercised before the information is used.” (emphasis in
original)
Taylor v Orcon Ltd [2015] NZHRRT 15, No 022/2014, at [46]
Principle 9 – How long information may be held for
Does the agency still hold the information?
Does it have a lawful purpose for continuing to hold the information?
Principle 10 – Limits on using information for different purpose
What was the purpose for which the information was collected?
Has the individual authorised it being used for another purpose?
Does an exception apply?
Is there a directly related purpose?
- For a purpose to be “directly related” to the original purpose it must have an
uninterrupted and immediate relationship to the original purpose: see Director
of Human Rights Proceedings v Crampton [2015] NZHRRT 35 at [86] to [92]
and Boyce v Westpac New Zealand Ltd [2015] NZHRRT 41 at [60]
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 71
Principle 11 – Limits on disclosure
What was disclosed?
Who was it disclosed to?
Did the recipient already have the information?
When, why, how and where was the information disclosed?
Are there witnesses? Can they provide any useful further information about what
happened?
- If you’re interviewing a witness, you need to be careful not to disclose
information yourself unnecessarily – don’t tell the witness everything you
know. However, sometimes you will need to disclose information to get
information.
If information was disclosed, does an exception apply?
Principle 12 – Unique identifiers
Has the agency assigned a unique identifier to the complainant?
Has the agency required or used another agency’s unique identifier to identify the
complainant?
Was there harm?
In cases where harm is a necessary element for any interference with privacy, you’ll need
to ask:
has the complainant suffered any harm?
was the breach (if there was one) a contributing cause of the harm?
Has the complainant suffered harm?
If there has been a breach of principles 1 – 5 or 8 – 12, there will be an interference with
privacy only if the complainant has suffered a type of harm described in section 66(1)(b)
(see below).
In those cases, we will therefore need to get the complainant to tell us what harm has
resulted, or may result, from the alleged breach.
What the Act says: Section 66(1)
[As well as a breach, section 66(1) requires the following for an interference with
privacy to exist:]
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 72
(b) in the opinion of the Commissioner or, as the case may be, the Tribunal, the
action –
(i) has caused, or may cause, loss, detriment, damage, or injury to that
individual; or
(ii) has adversely affected, or may adversely affect, the rights, benefits,
privileges, obligations, or interests of that individual; or
(iii) has resulted in, or may result in, significant humiliation, significant loss of
dignity, or significant injury to the feelings of that individual.
Did the breach cause the harm?
The breach must have caused the harm. However, it doesn’t have to be the only cause, or
even the main cause, of the harm – it simply has to be a contributing or material cause.
The Tribunal on harm and causation:
Was the breach a “contributing or “material” cause?
“Given these factors a plaintiff claiming an interference with privacy must show the
defendant’s act or omission was a contributing cause in the sense that it constituted a
material cause. The concept of materiality denotes that the act or omission must have
had (or may have) a real influence on the occurrence (or possible occurrence) of the
particular form of harm. The act or omission must make (or may make) more than a de
minimis or trivial contribution to the occurrence (or possible occurrence) of the loss. It
is not necessary for the cause to be the sole cause, main cause, direct cause, indirect
cause or ‘but for’ cause. No form of words will ultimately provide an automatic answer
to what is essentially a broad judgment.”
Taylor v Orcon Ltd [2015] NZHRRT 15, No 022/2014, at [61]
What standard of evidence should a complainant provide in relation to harm?
1. Threshold: low standard to pass initial threshold for harm. What is the ‘vibe’?
2. Quantum: medium – high standard to justify quantum. A respondent will need to be
able to justify the expenditure to shareholders, senior management or Ministers.
Therefore the evidence is needed to support a claim – particularly when it is a large
amount.)
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 73
Inviting comment from the parties: When and how
Investigators need to exercise judgement about whether it’s necessary to invite a written
response from a party on a particular issue. This shouldn’t be a standard, reflex step
whenever we, for example, first come to a view about whether a complaint has substance.
Instead you’ll need to consider the needs of the particular case, and what the Act and the
principles of public-law fairness require in that situation. This section of the Manual gives
guidance on these questions.
Key points
In general, you should invite a written response only if:
you need more information, or
you’ve made assumptions and you need to check that these assumptions are correct,
or
you anticipate making an adverse comment about that party.
If we’ve found that a respondent agency has breached the Privacy Act the statutory
“adverse comment” rule will require us to present this to them in writing as a provisional
view and to invite them to respond in writing within a reasonable time.
If we’ve reached a view that a complaint doesn’t have substance, the “adverse comment”
rule doesn’t apply. However, public-law principles of procedural fairness and natural justice
mean that we should usually phone the complainant to tell them we’ve come to this view.
Notifying a “prov” view
We have updated our practice around notifying a preliminary view. If we
have found an interference with privacy, then the “adverse comment” rule
requires us to give the respondent a chance to comment in writing before
we notify a final view. That rule does not require us to give a complainant a
separate opportunity to comment in writing. However, the investigator
should contact the complainant to let him or her know our opinion as that is
good practice and consistent with principles of natural justice.
The “adverse comment” rule: Its scope and effect
Summary
In the context of our investigations function, the effect of the statutory “adverse comment”
provision is that we must give a respondent a reasonable time to respond in writing if, after
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 74
investigating a complaint, our view is that the respondent has breached a privacy principle
or rule.
Usually the “adverse comment” rule won’t require us to give a complainant a similar
opportunity if we’ve found their complaint doesn’t have substance.
What the Act says: Section 120, “Adverse comment”
“The Commissioner shall not, in any report or statement made pursuant to this Act or
the Crown Entities Act 2004, make any comment that is adverse to any person unless
that person has been given an opportunity to be heard.”
Scope of the “adverse comment” rule: What statements does it apply to?
The scope of the adverse comment rule includes notifications, under section 75, of the
result of an investigation. This means that an Investigator cannot notify the parties of a
finding that the respondent has breached a privacy principle or rule unless the respondent
had been given the opportunity to respond to this potential finding.
The rule also applies to:
publishing general reports and case notes (section 13(2))
reports to the Prime Minister (section 13(1)(p), (r))
public statements about privacy issues (section 13(1)(h))
our Annual Report (section 24)
reports of a breach of duty or misconduct (section 80).
What makes a comment “adverse”?
A comment will not be “adverse” to someone simply because it goes against their interests
or rejects an allegation or legal argument that they’ve put forward:
A finding that a respondent agency has breached a privacy principle or rule is an
adverse comment.
A finding that a complaint has no substance is not of itself an adverse comment
against the complainant.
However, some additional or more specific comment about an unsuccessful
complainant could be an “adverse comment” – for example, if we told them we
believed they had intentionally lied to us.
Discharging our obligation under the “adverse comment” rule: What we have
to do
To discharge the “adverse comment” obligation, we should:
notify the party in writing of our provisional finding, including giving reasons for it
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 75
invite them to respond in writing
give them a reasonable time to respond – this should usually be 20 working days.
Setting a timeframe for a written response
Always ask for responses to be provided by a certain date. We usually say it should be
20 working days from the date of our letter.
Sometimes complainants will stress about this time limit. However, there is no statutory
requirement to respond within a particular period – this is an administrative matter for us,
and it’s therefore fine to give them an extension.
Any extension should, however, be for no more than a reasonable time. We can’t keep
files open indefinitely.
Public-law fairness: What it requires
Public-law principles of procedural fairness or natural justice require that our findings must
have a reasonable basis. Our investigation processes must therefore be reasonable, and
usually this will require us to inform the relevant party of our findings and the reasons for
them, and to give them a chance to comment (see Roth, Privacy Law and Practice, at
PVA75).
However, those natural justice steps don’t have to follow an inflexible format that is formal
and time-consuming. Usually formal written correspondence and a set response date won’t
be necessary – unless the statutory “adverse comment” rule also applies, as it will where
we’ve found a breach (see above). This means that, where we’ve found that a complaint
has no substance, it will usually be sufficient to have a phone conversation with the
complainant where we explain our decision and ask if they have any further to add in
response.
This will be a matter for the Investigator’s discretion. It will depend on the particular
complaint and complainant. You’ll need to consider whether the process has been fair to
both parties and whether the finding you’ve come to is sound.
Discontinuing under section 71
Discontinuing an investigation under section 71(1)
As well as being available before an investigation, section 71(1) can also be used to
discontinue an investigation after it has begun. The different limbs in 71(1) are discussed
from pages 28 to 34 of this Manual.
It may be that the further enquiries made during the investigation have shown that it’s
appropriate to discontinue on one of those grounds.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 76
Also, section 71(1)(d) may come into play if the complainant decides not to pursue the
dispute (“the individual alleged to be aggrieved does not desire that action be taken or, as
the case may be, continued”). It may be that they’ve simply changed their mind. Or it may
be that they’ve decided not to pursue it in response to guidance from us that their
complaint, although within our jurisdiction, is unlikely to succeed because it’s covered by
an exception or we’ve made a finding on a similar case.
“Undesirable or unnecessary”: Discontinuing under section 71(2))
What the Act says: Section 71(2)
… the Commissioner may in his or her discretion decide not to take any further action
on a complaint if, in the course of the investigation of the complaint, it appears to the
Commissioner that, having regard to all the circumstances of the case, any further
action is unnecessary or inappropriate.
Examples
Section 71(2) may be invoked if, for example:
the complaint is settled
the complainant fails to respond to our routine investigative enquiries and the deadline
we gave the complainant for this has passed (in that case section 71(1)(d) may also
justify discontinuing the investigation)
the agency has made the complainant a reasonable offer but the complainant has
rejected it
resolving disputed facts would be difficult and time-consuming and to little advantage,
or resolving the facts may not even be possible at all.
Case notes 207201 (2010)
25347 (2003)
Notification under section 73 a precondition for using 71(2)
Section 71(2) can’t be used to discontinue an investigation and close the
file if the parties haven’t been notified under section 73 that there is going to
be an investigation. This is because section 71(2), unlike 71(1), only applies
after an investigation has already begun (“… if, in the course of the
investigation of the complaint …”).
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 77
Notification requirements if we discontinue
If we decide under section 71(1) or (2) to take no action or no further action, we must
inform the complainant of this and also give him or her reasons (section 71(3)).
You should do this in writing.
File management and record-keeping
Corresponding with the parties
Acknowledge all incoming mail.
If you’re writing to a prisoner, place the letter in a sealed envelope with a covering
letter to the prison manager, asking the manager to forward the sealed letter to that
prisoner. We have a template for these covering letters.
- Letter to prison manager.obr
These internal documents give some guidance on wording your letters:
- Complaints Style Guide.obr
Don’t copy correspondence from one party to the other
Sometimes we are asked by one party for a copy of correspondence
that we’ve received from the other party. We deny these requests,
relying on sections 55(e) and 116.
You should instead simply summarise the substance of the relevant
allegations and arguments from the first party. Here you should be careful
about exactly what you relay to the other party. For example, it would be
counterproductive to report a lengthy tirade from a complainant to the
respondent agency, where they might be making outrageous allegations.
Similarly, it would not be helpful to report to a complainant seeking access
to health information that the health provider believes that the complainant
has a personality disorder that makes them obsessive. Even if this is true,
it’s not relevant to the question of whether the complaint has substance,
and therefore not relevant to our investigation.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 78
Managing your own filing system
Investigator’s are responsible for managing their own filing systems, including their
own reminder system for when a file is due to be reviewed or when a response is due.
Record-keeping and maintaining the file
During your investigation you must keep a record of all incoming and outgoing
correspondence, both on the hard-copy file and on the Objective file. Ideally, you
should file any correspondence on the Objective file immediately – this will ensure that
the Team Manager is looking at the most up-to-date version of the file.
All telephone conversations are to be entered on the files on the day of the call.
Sometimes it’s useful to do a file note explaining why you’ve followed a particular line
of inquiry. This would help any staff member subsequently assigned to the file to know
what information you were trying to get and why.
Maintaining the Objective metadata
The Investigator is responsible for updating the metadata for the complaint in Objective.
This includes, for example:
ticking the checkbox for the date of notification
which principles have been notified
noting whether personal contact with each party has been achieved
noting if the contact person for the respondent changes
noting the amount of any financial settlement
transferring custody of the file when it closes.
Nine month file review
OPC seeks to resolve all complaints as quickly as possible and will ensure all
investigations are completed within 12 months of receipt. Where an investigation has been
underway for nine months, the Commissioner will be briefed on the particular complaint
with a view to assisting the investigation to be completed within 12 months.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 79
6. After the investigation From notifying our decision, to closing the file
What this chapter covers
This chapter covers:
the key legal checkpoints
notifying the parties of the result of the investigation
our obligation to promote settlement if we’ve found that the complaint
has substance
referring complaints to the Director of Human Rights Proceedings
closing the file
reporting significant misconduct or breaches of duty
taking further action to address non-compliance with the Privacy Act.
Introduction: Key legal checkpoints
Notifying the result
As soon as practicable after the investigation is finished, we must tell the complainant
and respondent what the result of the investigation, and about any further action we
propose to take. (Section 75)
Obligation to use best endeavours to secure a settlement
If we concluded that the complaint has substance, we must use our “best
endeavours” (reasonable efforts) to secure a settlement (section 77(1)).
We may also seek an assurance from the respondent that the breach won’t be
repeated (section 77(1)).
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 80
Referrals to the Director
Consider referring the complaint to the Director of Human Rights Proceedings if we
can’t achieve a settlement (section 77(2)).
Reporting misconduct or breaches of duty
We must report any significant breaches of duty or misconduct to the appropriate
authority (section 80).
Notifying the result of our investigation
What the Act says: Section 75, “Parties to be informed of result of
investigation”
… the Commissioner … shall inform the parties concerned, as soon as reasonably
practicable after the conclusion of the investigation and in such manner as the
Commissioner thinks proper, of the result of the investigation and of what further
action (if any) the Commissioner proposes to take in respect of that complaint.
Presenting your findings to the parties: How to write a sound and
persuasive opinion
An opinion/final view will be sound if it:
is based on correct information
addresses all relevant matters
is logically organised, and
correctly and clearly applies the law.
If there is any doubt about the facts or there are gaps in the story, go back to the parties
and clarify the facts.
Issuing a Certificate of Investigation to the complainant
What is a Certificate of Investigation?
We provide Certificates of Investigation to complainants so that they can potentially bring
proceedings to the Tribunal themselves. The Certificate provides evidence that the Privacy
Commissioner investigated their complaint, and therefore that the Human Rights Review
Tribunal has jurisdiction to hear their case.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 81
The concept of a Certificate of Investigation is the creation of OPC in conjunction with the
Tribunal. It is an administrative document not an obligation under statute. It gives the
Tribunal confirmation that the Commissioner has investigated certain matters and of the
result of the investigation.
“For the assistance of the Tribunal and to ensure clarity as to what ‘action alleged’ has
been investigated by the Privacy Commissioner, the Commissioner issues a
Certificate of Investigation particularising the subject of the investigation. It is this
certificate which potentially sets the boundary of the Tribunal’s jurisdiction. The
certificate does not have any statutory basis and in that respect is informal and is
capable of challenge.”
DHRP [NKR] v ACC [2014] NZHRRT 1, No HRRT 002/2012, at [33]
When to issue a Certificate of Investigation
You will issue a Certificate of Investigation if either:
we have investigated the complaint and decided not to refer it to the Director of Human Rights Proceedings, or
we began an investigation but in the course of it decided to close the matter under section 71(2).
A certificate can only be issued if we have notified the respondent and, therefore,
investigated the complaint.
Using our template for the certificate
You will find a template for the certificate at:
HRRT Certificate#3.obr
Guidance on using the template and completing the certificate
Subheadings on the
form
Instructions
Complainant Include
the complainant’s full name
our reference number
Respondent Full name of the individual or organisation
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 82
Subheadings on the
form
Instructions
Matters investigated State the facts briefly, including
the relevant dates (for the incident, request, disclosure and so on)
the respondent’s actions – including, for example, withholding grounds that they relied on, or steps they took to make sure a correction statement was properly placed, or unjustified delays
Principle(s) applied Set out each principle or other breach of the Act that
has been notified and investigated. (It’s useful to
present them in the form of numbered points or bullet
points.)l
Commissioner’s opinion: Include the date of the opinion here.
Application of
principle(s)
For each of the principles investigated state the
outcome – that is, breach or no breach. Make sure
that the numbers and outcomes correlate between
here and the “Principle(s) applied” section.
Don’t give reasons for the opinion. These are not
required.
Adverse consequences Using the same numbering as above and in the
“Principle(s) applied” section, state whether harm has
been found and, if harm was found, which of the three
potential harms applies. If harm is not required (IPP 6)
state “Not applicable”.
Don’t give reasons for the finding. These are not
required.
Interference with privacy State whether there was an interference with privacy.
Again, use the numbering from the “Principle(s)
applied” section.
Don’t give reasons for the finding. These are not
required.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 83
Obligation to promote settlement if complaint has
substance
After the investigation, if we’ve concluded that the complaint has substance, we must use
“best endeavours” to settle (section 77).
The High Court has treated the “best endeavours” standard as being the same as
“reasonable endeavours” (Henderson v Privacy Commissioner [2010] NZHC 554 at [98]).
See page 45-46 of this Manual for the text of section 77 and an extract from the High
Court’s decision.
Referrals to the Director of Human Rights Proceedings
Overview
If we’ve found an interference with privacy but we’ve been unable to achieve a settlement,
we may refer the complaint to the Director of Human Rights Proceedings, so that they can
decide whether to take action in the Human Rights Review Tribunal.
What the Act says: Section 77(2), “Procedure after investigation”
(2) If, –
(a) in the circumstances referred to in section 74, the Commissioner is unable
to secure such a settlement and assurance as is referred to in that section;
or
(b) in the circumstances referred to in paragraph (a) or paragraph (b) of
subsection (1), the Commissioner is unable to secure such a settlement
and assurance or, as the case may be, such an assurance as is referred to
in either of those paragraphs; or
(c) in any case to which section 74 or subsection (1) applies, it appears that
the action that was the subject matter of the complaint or, as the case may
be, the investigation was done in contravention of such an assurance as is
referred to in that section or that subsection, given on a previous occasion,
or that any term of such a settlement as is referred to in that section or that
subsection, reached on a previous occasion, has not been complied with, –
the Commissioner may refer the matter to the Director of Human Rights
Proceedings for the purpose of deciding whether proceedings under section 82
should be instituted against the person against whom the complaint was made or
in respect of whom the investigation was conducted.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 84
Failure to settle – a statutory precondition for referral
Section 77(2) allows us to refer a complaint to the Director only if we’ve been unable to
achieve a settlement.
Regardless of whether we think it would be desirable for the Tribunal to set a precedent on
this issue, we must try to achieve a settlement if we’ve concluded after investigating that
the complaint has substance. Only if we’re not able to do this can we then refer the
complaint to the Director.
“The legislation … recognises party autonomy, in that the parties may settle a
complaint and the Commissioner must encourage them to do so, whether or not she
sees the complaint as a good opportunity to establish a precedent.”
Henderson v Privacy Commissioner [2010] NZHC 554 at [89]
Our criteria for referral
We may decide to refer the complaint to the Director if it involves the following factors:
seriousness of the issue
continuing harm
an impact on a larger number of people
unreasonable conduct by the respondent
an opportunity to set a precedent in respect of a novel or significant issue of law.
We may decide not to refer the complaint if:
it involved an information request and the information has now been provided
there are no systemic issues or major concerns, or any systemic issues or concerns
have now been addressed by the agency
the complainant hasn’t suffered a loss for which a remedy is required.
Is the case ready to go to the Director?
We will refer a complaint to the Director only if we have already developed the case to an
advanced stage. Although we do not have to provide the Director with a complete case,
the Investigator should be confident that there’s enough evidence to found a case in the
Tribunal.
Specifically, before we can consider a case for referral the Investigator should have:
established a clear factual chronology
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 85
established that the evidence the Director will need will be available – the Investigator
should know that the necessary witnesses will be available and should know what
they’ll say.
Case notes on referral
No 71808 (2006) – local residents and a property developer
No 89271 (2007) – daughter’s photo from school holiday programme
No 92895 (2008) – court employee disclosed info to the ex-partner of a man who had
contacted the court about making an ex p application
No 204595 (2009) – couple complained about their accountant
Closing the file
It is essential that in every case the Investigator asks “what can others learn from this
case?” and considers avenues to distribute those messages, such as a case note or blog
post. The Communications team can help with this. Remember, up to now, all of your
energy, training and judgement has helped two people: the complainant and the
respondent. With help from the Communications team, you could now influence thousands
of people.
When a file will be closed
A complaint file will be closed when:
the complaint is settled, or
we’ve completed our investigation and formed a final view that there has, or hasn’t,
been a clear interference with privacy, or
we’ve discontinued our investigation (see page 75).
Procedure for closing the file
When you close the file you will need to:
complete the closing coversheet
update the Objective metadata with the settlement figure (if this applies).
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 86
Reporting misconduct and breaches of duty
What the Act says:
Section 80, “Commissioner to report breach of duty or misconduct”
If, during or after any investigation, the Commissioner is of the opinion that there is
evidence of any significant breach of duty or misconduct on the part of any agency or
any officer or employee or member of an agency, the Commissioner shall refer the
matter to the appropriate authority.
Further action: Other tools for addressing non-compliance
Types of further action
A warning letter
Monitor the agency
Approach the Chief Executive, the Minister, or an industry association
Education for the agency or industry
Transfer the matter to another investigating agency
Public comment (naming, media release, blog, Privacy News, social media comment)
Naming the respondent: https://www.privacy.org.nz/about-us/transparency-and-
accountability/opc-policies/naming-policy/
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 87
APPENDICES
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 88
Appendix 1. Initial call checklist
Office of the Privacy Commissioner – Introductory Discussion
Checklist
Complaint number: Complainant’s name:
Date of conversation: Investigator:
The role of the investigating officer Completed
1. Investigator is independent, neutral, not an advocate for either party
2. Investigator’s role is to communicate between parties to help them try and reach a resolution
3. Investigator has no decision making power
4. Investigator cannot disclose information it receives from one party to the other party and our communications are not personal information you can request. It is the respondent agency’s responsibility to provide information directly to the complainant – we cannot pass information between parties
Complaint process
5. Explain the three stages of the process:
a. Facilitation and (telephone) case conference b. Investigation c. Preliminary and final view
6. The complaint can be settled at any time during the process
7. The complainant can withdraw the complaint at any stage
8. If the complainant accepts an offer from the respondent it is in full and final settlement of the complaint
9. Our final views are persuasive but not binding. If the complainant wishes to pursue the matter they may do so in the HRRT
10. Check the complainant has received the information sheet (if this hasn’t been sent already, send a copy to complainant along with any other relevant information sheets or brochures)
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 89
Introductory Discussion Checklist (continued)
11. The timeframe for looking into your complaint can vary. It can depend on the parties willingness to resolve the matter, information needed, whether experts are required, whether the Commissioner’s ruling is needed. We try to finish most investigations within six months
12. Discuss confirmation of complaint
Contact details
13. Check contact details – eg:
a. Check the spelling of the complainant’s name b. Do you have all the necessary contact details? c. Is there a best time or way to contact the complainant? d. Is it ok to leave a message on the phone?
Note: highlight on file if any contact details are to be kept CONFIDENTIAL
14. Check the complainant is entitled to bring the complaint
15. Confirm the complainant has your name and contact details
16. Tell complainant when you next plan to be in contact with them
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 90
Appendix 2.
Notification by email (cover email)
Covering email – Form and content
We have been trialling notification by email for a number of agencies. We have a standard
covering email that we send, and the notification letter is sent as an attachment to that
email.
Below is the text of that covering email:
[Subject line] Notification of Privacy Act Complaint from X – C/reference
Dear X
Please find attached a notification letter to your agency about a complaint we have
received from _______________.
As agreed, we will not send you a hard copy of this letter (but are happy to do so
upon request).
Please acknowledge receipt of this notification as soon as possible, and:
Give us your reference number (if any); and
Provide the name of the contact person at your agency who is available to liaise
as necessary with our Investigator responsible for this complaint: [name of
Investigator and phone number and email address]
Please note that a response to the complaint itself is due by
____________________.
I welcome the opportunity to discuss it with you at your earliest convenience.
Sincerely/Kind regards,
[Insert your signature here]
For steps on how to create a template for the covering email, see the
following pages.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 91
Creating a template for the covering email
You can either save the above text for the covering email somewhere and copy and paste it each
time, or else you can set this up as a template in Outlook using the instructions below:
Creating a new email template
1 Copy the standard covering email text (see above) into a new email. You can also complete
the subject line with standard text and, if you wish, apply a tag to the email (e.g. “High
Importance”). Emails created from a template will inherit everything you create in the
template.
Add your signature block to the end of the email, if you haven’t got Outlook to automatically
add it to new emails.
2 Click on File/Save As. Then:
In the Windows Explorer window, click on the down arrow beside the “Save as type”
field and select “Outlook Template”.
Give your template a name in the File name field – e.g. “Email for notification letter”
Click on Save
Once you have saved your email as a template, you can close the email.
See the screenshot below.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 92
Creating a new email template (continued)
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 93
Using an email template
3 In the Home tab in Outlook, click on New Items/More Items/Choose Form.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 94
Using an email template (continued)
4 In the Choose Form window:
Click on the down arrow beside the Look In field and select “User Templates in File
System”.
Double click on the template you want (or click on the template you want, then click on
Open).
A new email will be created for you using the template you’ve chosen. It will be pre-populated
with your specified content (including any tags you might have applied e.g. “High Importance”).
Use the new email as you would any other email.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 95 95
Appendix 3.
Investigations Team Inbox
Responsibility
Every investigator and team secretaries should check the inbox regularly for
correspondence concerning their own complaint files.
Responsibility for clearing the inbox (correspondence not related to active investigation
files) sits with the investigator on the incoming roster (“the rostered team member”).
The roster should be in each team member’s calendar and shared with corporate services
and enquiries officers.
Purpose
The investigations team inbox is for receiving correspondence concerning investigations
files and can be used by both internal and external correspondents.
It can be used by complainants to submit new complaints, or by investigators who would
(for whatever reason) prefer that parties to a complaint do not have their personal email
address.
It will also be used by the team secretaries to send correspondence on complaint files that
have not been assigned for investigation yet.
Assignment
Each team member has been assigned a colour category within the inbox e.g. Riki - black.
When a new email enters the inbox the rostered team member will review the
correspondence and decide who is best placed to deal with it. The rostered team
member will then mark the correspondence in the appropriate person’s colour and forward
the email to them (‘the assignee’).
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 96 96
The rostered team member will leave the original email in the inbox for the assignee to file
in Objective.
If the rostered team member enters into any correspondence with the sender of the email
(without having created a file in Objective for it) they should drag the sent email into the
inbox so that the assignee can file all relevant emails in Objective. The inbox is grouped by
the title of the email, so that multiple emails on the same topic group together.
Once the assignee has received an email for response from the rostered team member it
is their responsibility to go into the inbox and retrieve the original for filing. It is then also
the assignee’s responsibility to move all assigned emails to the ‘Actioned’ sub-mailbox so
that the rostered team member knows these have been dealt with. Flagged emails should
be filed in Objective within three days.
IMPORTANT: If a team member, not acting in the “rostered team member” capacity,
accesses the inbox, PLEASE mark any emails you read (not already assigned) as
‘unread’, so that the assigner knows that these are yet to be dealt with. Do not read
emails and leave them “read” so the rostered team member doesn’t notice them.
“Actioned Folder”
Emails should not be moved into the actioned folder by anyone but the rostered team
member, or by a team member who has filed the email in Objective. Emails older than 3
months in the actioned folder may be permanently deleted.
Access to the inbox
Only the investigations team and corporate services may have access to the mailbox.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 97 97
Mailing from the inbox
If you reply to an email in the inbox directly ensure that either your signature block or your
name is at the bottom of the email so that the recipient knows which member of the team
has replied.
If you are using the [email protected] email address to send correspondence
to an external recipient please ensure you put the complaint reference number in the
subject line.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 98 98
Appendix 4.
Checklists for conciliation and
settlements
During the investigation
Task Completed Date
Ensure parties understand the complaints process and how
settlement conference fits within that – explain this at the outset
of the investigation if the possibility of a settlement conference is
highlighted in the pink or becomes clear once initial response has
been received
Ensure parties understand how the law applies to the complaint –
make it clear what principles/rules are engaged and why.
Also ensure parties understand what issues that we do not have
jurisdiction to consider and why
Get information from both C and R as to their view of the
complaint and attempt resolution without making a determination
where possible
Ensure parties understand OPC current assessment of complaint
–
send a preliminary view and discuss this view with both parties over the phone (where possible)
Ensure that all relevant information about the breach is obtained from R and that C’s harm is provided to R in advance
Ensure that C knows R’s position on the complaint
Ensure that all parties are aware of what C is seeking to resolve, and that both have realistic expectations about the likely outcome
Review feedback from both parties
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 99 99
During the investigation (continued)
Review complaint with Investigations Team and consider whether
there are any other options for resolution that have not been
attempted. If not, get a clear understanding of OPCs position on
the complaint (conduct any necessary research and be ready to
form a final view if necessary)
TM and Investigator to review file and decide if settlement
conference appropriate (consider facts, parties, likelihood of
resolution, resources and whether there are any special
requirements of the parties to be aware of e.g. security/panic
buttons or two OPC staff for any difficult behaviours)
Discuss whether both parties are open to the possibility of
settlement conference
Get approval from AC for settlement conference
Before the settlement conference
Task Completed Date
Get agreement from parties as to the time, date, location, format,
needs and attendees. Advise both parties who will be attending,
including a support person for C if desired, any additional OPC
staff members (including appropriate support for Investigator if
required) and ensure that the appropriate technical experts/levels
of delegation from R are attending
Confirm details with AC and get assistance from support staff to
book meeting rooms and make travel arrangements
Confirm in writing for both parties once all details finalised.
Advise that if for any reason they are unable attend, they must let
the Investigator know as soon as possible
Review the file again with TM and prepare for settlement
conference (ensure all of the above steps are properly
completed and that we have all of the relevant information, have
completed the investigation and have formed a preliminary view)
Investigator to call both parties separately and ensure they are
prepared for the settlement conference and know what to expect
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 100 100
Before the settlement conference (continued)
Provide documents to parties in advance - agenda, relevant law,
case notes and case law and allow time to review and comment
TM to call both parties separately the day before the settlement
conference to ensure understanding of the process and focus on
resolution
Take the file with you (if it can be done securely) and ensure that
you have the address and contact details for the venue, and
contact details for both parties
Arrive at the venue early to ensure meeting room is set-up
appropriately
During the settlement conference
Task Completed Date
Welcome and introduce parties
Explain at the outset:
Thank parties for attending, acknowledge it has been done voluntarily, explain the benefits of a voluntary resolution and acknowledge how difficult it may be (especially for C)
Acknowledge there may be difficult material discussed and that this should be done with respect, and that anyone can ask for a break at any time
Set out the format for the settlement conference
Encourage content and involvement that will aid resolution (not a forum for testing evidence or credibility)
Encourage constructive communication (no interrupting when others are speaking, no blame etc.)
Encourage a range of possible resolution options that are based on needs and interests
Prepare parties for potential to compromise
Phones off
Confidentiality requirement
Explain how this process differs from OPC making a final determination and what the outcome could be if it is not resolved
Anything else required in introduction that is relevant to the complaint (OPC view of the complaint, summary of relevant principles etc.)
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 101 101
During the settlement conference (continued)
Ask C to start by explaining the complaint from their perspective
and what they are seeking to resolve their complaint
Clarify issues as required and confirm that C has had an
opportunity to express everything they wanted to
Ask R to continue by responding to C and explaining its view of the
complaint
Clarify issues as required and confirm that R has had an
opportunity to express everything it wanted to
Set out OPC view of any disputed issues (if required or it will
assist)
Allow C a chance to respond
Move into focusing on resolution (can be done in a variety of ways)
Take notes of relevant points throughout
Bring parties together at conclusion, summarise agreed outcomes,
thank parties for their participation and agree on next steps
Draft and complete Settlement Agreement if possible
After the settlement conference
Task Completed Date
Make a detailed file note about the discussions including any
agreed outcomes
Call both parties to debrief and confirm understanding
If resolved at settlement conference :
Draft Settlement Agreement for TM approval (if not done during
settlement conference which is preferable where possible) and
finalise any agreed outcomes
Send Settlement Agreement to R for approval and then send to C
for signature(send two copies to C if they also want an original)
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 102 102
After the settlement conference (continued)
C to send completed Settlement Agreement straight to R. R to sign
and send a completed copy to OPC and C, and arrange for
implementation of any agreed outcomes
Review complaint and close file
If not resolved at settlement conference :
Debrief with TM and AC
Agree on next steps in the investigation (if any)
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 103 103
Checklist for written settlement agreements
Agreements that are intended to be legally binding and
enforceable
Does the agreement fulfil all the elements of contract?
Does it follow the SMART principles: Specific, Measurable, Achievable, Relevant,
Time-bound?
In particular:
Are the parties correctly identified? Yes
Is the agreement signed by all relevant parties? Yes
Is the signatory for the respondent/s authorised to sign? Yes
Is the agreement dated? Yes
Does the agreement contain only relevant information? Yes
Does the agreement contain irrelevancies? No
Do any clauses contain hypotheses? No
Are there any contingent clauses? No
Do any clauses depend on the consent or actions of third
parties?
No
Agreements not intended to be legally enforceable
(for example, protocols of behaviour or future interactions)
Is the agreement:
- Clear?
- Explicit?
- Certain?
- Robust?
- Capable of being monitored?
Are there specific consequences if protocols are not observed?
How will breaches be dealt with?
Is the agreement to be supervised, and, if so, by whom?
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 104 104
Are there to be scheduled follow-up meetings?
Has the agreement been signed and dated?
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 105 105
Appendix 5.
Teleconferences
The Language Line process
The caller indicates they need an interpreter – check which language is needed.
Language Line provides interpreters for the following languages:
Amharic
Arabic
Assyrian
Bengali
Bosnian
Cantonese
Cook Island
Maori
Croatian
Dari
Farsi
Filipino
French
German
Gujarati
Hindi
Japanese
Khmer
Korean
Kurdish
Lao
Mandarin
Māori
Myanmar
Nepali
Niuean
Pashto
Portuguese
Punjabi
Russian
Samoan
Serbian
Sinhalese
Somali
Spanish
Tamil
Thai
Tokelauan
Tongan
Tuvaluan
Ukrainian
Urdu
Vietnamese
Press “Conf” button (Conference) is displayed at bottom of screen. Press “OK”.
Dial 0800 000 260. Give your name and business unit and the region of the call. Give
the required language (and specify the gender of the translator, if necessary).
You will then be put through to the interpreter. Introduce yourself and give a brief
background, and explain what telephone equipment you are using.
Press the “OK” button to connect the original caller to the conference call.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 106 106
Getting disconnected during a teleconference
Occasionally you may lose the connection with one or both of the parties during a
teleconference. It’s a good idea to let the parties know beforehand what they should do if
this happens:
Suggest they call the 0800 line if they get disconnected.
The next best option would be to email you, provided you have easy access to your
email during the teleconference, and you know how to turn off the email send-delay.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 107 107
Appendix 6.
Natural disasters
In the event that a natural disaster affects either the Auckland or Wellington offices of OPC
with the effect that the Affected Office (“AO”) is unable to function as normal, the following
should occur where necessary:
Internal communication
Management shall ensure that all OPC staff are updated with any details relating to
the welfare and wellbeing of colleagues. All OPC staff are to be kept updated with
the status of the AO and any alternate arrangements for work. Where possible
periodic meetings (by VC or teleconference) shall be arranged to ensure that staff in
both offices are able to maintain quality communication with each other.
External communication
An agreed OPC response for stakeholders shall be prepared so that information
about the AO and any change in normal business shall be communicated
consistently, particularly when the Unaffected Office (“UO”) receives queries by
phone or email.
Postage
The physical mail shall be re-directed to the UO where corporate services will scan
the mail to Objective and where appropriate send the link by email to the Investigator
(where one has been allocated), the Investigation inbox (to consider whether a
complaint) or to the Enquiries inbox. The physical mail for the AO shall be kept in an
allocated cupboard for distribution to the AO when business returns to normal.
Enquiry (0800) line
The enquiry line shall be transferred to the UO. A replacement roster shall be drafted
by the UO as soon as practicable for the staff available to answer enquiry calls
(where possible accommodating break times).
Complaint files
Where it is not possible to provide safe and secure storage of physical complaint files
at the AO or at any temporary office space occupied by the AO, those files shall be
secured at an alternate storage facility as soon as possible or alternatively sent to the
UO for storage. Any new physical complaint files shall be sent to the UO for
temporary storage. The UO shall allocate storage space for such files.
Unallocated complaint files
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 108 108
The physical unallocated complaint files shall be transferred to the UO. The files
shall be managed, in the first instance, by the Team Manager in the UO.
Security files
Any security related (SIS, GCSB) complaint files which are transferred to the
Auckland office where Wellington is the AO, shall be held in secure storage by the
General Manager of the Auckland office (as no Auckland staff have sufficient security
clearance).
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 109 109
Appendix 7.
Escalation Policy and Procedure
The following policy applies when any staff member at the Office of the Privacy Commissioner (OPC) receives aggressive contact from a complainant, a respondent or a member of the public. As the majority of our contact is over the telephone, this policy is primarily aimed at telephone communications, however, it can be adapted to apply to contact in writing or in person. It is important for all staff to remember that their health and safety is paramount. They have a number of options available to them, to ensure that any difficult calls are handled safely and efficiently. These options should be applied as appropriate (and after discussion with your manager in most cases). However, the preference is to exhaust the first options (least restrictive) before we move onto the final options (most restrictive). It is also important to note that often, a caller’s circumstances will change. So, if we have decided to restrict the caller in a certain way on one occasion or for one particular complaint, we need to regularly review this decision to ensure we are being fair and accessible to everyone.
Name the offensive behaviour and ask the caller to stop – tell the caller that you do not appreciate them “swearing at you” or “threatening you” etc and ask them to stop. Refer to the Process for Terminating Calls at the end of this Policy for scripting you may find useful. It is important that you specifically name the behaviour you find offensive, and ask the caller to stop. If that does not work, and the behaviour continues:
Place the call on hold - tell the caller first that you are doing this, and then take the time that you need to speak with a team member, gather your thoughts or plan your next move. This may also give the caller time to calm down.
Terminate the call if the offensive behaviour continues – see below Process for Terminating Calls.
Escalate the call to a Manager – this option should be used if the caller asks to speak with a manager, or if you think they might benefit from it. It is important that you do not tell the caller you are transferring them to a manager until you have permission to do so (e.g. your manager may not be available, they may need time to prepare for the call etc.). Alternatively, if your manager is not available to take the call at the time, tell the caller that they will receive a call back by close of business the next working day. It can also help to ask what number the caller would like us to use, and if there is any time in particular that they are not available (but do not lock your manager into calling back at a specific time as this is not always possible). In certain extreme cases, you may also agree with your manager that they are the best person to handle any further contact from this person.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 110 110
If the offensive behaviour continues after using the above options -
Discuss with your Manager about placing restrictions on certain callers – for example, if a complainant calls your direct dial five times a day, your manager may advise them that they can only speak with you at 10:00am on a Tuesday, or that you will not be returning any voicemail messages from them until after a certain date (when you are expecting further information). Options to consider:
o Caller to be told they can only speak with you at a certain time. o Caller to be told you will not respond to any messages until after a particular date.
You can remind them if they do call despite receiving this advice, and end the call quickly.
o Caller is not to have direct contact with you in future, but any messages will be returned by your manager.
o Caller can be transferred to our 207 extension for a message to be recorded (refer below Process for Transferring to Extension 207).
You and your manager will need to discuss the best way to advise the
caller if you decide to use any of these options, and it would be a good
idea to follow up any discussion in writing.
Decline to take any further telephone calls from this caller and/or request that any further contact with the OPC is made in writing – see the attached Practice Note on Blocking Telephone Contacts.
Discuss other alternatives with your team members, Manager and the Assistant Commissioner (Policy and Operations) – for example, if the caller has made a complaint about the OPC to another body (such as the Ombudsmen or the Human Rights Commission), we could ask that any further contact with the OPC be made by that body.
Remember the importance of debriefing after any difficult calls.
Process for Terminating Calls
If a caller is being verbally abusive towards you, tell them that verbal abuse will not be tolerated, and that if the behaviour continues you may be required to terminate the call.
Use the following termination warning - “I’m sorry but I don’t think we can discuss your concerns while you are speaking this way. Unless we can discuss this calmly I will have to terminate the call”.
It may also be helpful to name the behaviour, for example, “I do not think we can discuss your complaint while you are swearing at me. If you cannot stop using offensive language, I will have to terminate the call”.
If the caller still displays difficult behaviour, remind them that you have already asked them to stop speaking to you that way. Tell them that you are terminating the call and that another staff member (usually your manager) will call them back.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 111 111
Make sure you tell your manager about any terminated calls as soon as possible. They will need to decide who will be calling back (if anyone), whether other staff members need to know, or whether any further action is required.
Process for Transferring to Extension 207
Where a caller is unable for whatever reason to write to us, or if they display difficult behaviour and the above options have been exhausted, you can offer the option of leaving a message with details of their enquiry or complaint on a dedicated answer phone line.
Use the following script – “I am finding it difficult to speak with you while you are
(name the behaviour). If you would like to continue speaking with me, I need you
to calmly explain your Privacy Act issue and give me time to respond. If we can’t
discuss this calmly, I will transfer you to another extension, where you will be able
to leave a message with the details of your complaint”. Note – this script will need to
be modified where the caller is not difficult, but wants to use this option for another
reason.
If caller does not allow you to continue the conversation – “As we can’t discuss this
matter calmly, I will now transfer you to another extension. Please listen to the
recorded message and follow the instructions provided”.
The recorded message then states – “You have reached the Office of the Privacy
Commissioner’s complaints and enquiries message service. You will now have
five minutes to provide us with a brief summary of your complaint or enquiry.
Please include your name and contact details, and the name and contact details of
the person or organisation you have concerns about. If you have contacted the
person or organisation about your concerns already, please also provide details of
their response. We will review your message and contact you to discuss the next
steps”.
If you use this option, email your MANAGER immediately, so that they can arrange for
the message to be cleared. Currently, the Assistant Commissioner (Policy & Operations)
and the Team Secretary, Wellington have access to the voicemail.
Practice Note: Guidance on taking action to block offensive callers
This practice note is to assist staff in the best practice for blocking offensive or belligerent
telephone behaviour from callers to the office. It is directed at telephone calls only but the
general principles can be modified and applied to other forms of communications with our
office.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 112 112
Background
Our processes allow for a variety of contact points into the office to facilitate an efficient
and easy complaint process. Contact can be made by letter, email, fax or phone and
individuals are entitled to request an appointment to meet with a member of staff.
Having interaction with the office is a statutory right and we are obliged to provide
appropriate communication options. A particular contact option is a privilege and not a right
and personal contact may be withdrawn if the individual abuses the right through
belligerent, offensive or abusive behaviour. At the very least we would accept written
communications on the understanding that it would not be considered if it was abusive or
offensive.
Aggressive and abusive threats to a staff member over the telephone are never
acceptable. It is appropriate to end telephone calls of this nature. Our usual practice
applies; that is to warn the caller that the behaviour is unacceptable and that if it persists
the call will be terminated.
In the case of phone contact we are able to block callers who are belligerent, abusive or
offensive. This practice note sets out the action that we all need to adhere to when
blocking such a caller.
A very useful practice manual dealing with unreasonable conduct is “Managing
Unreasonable Complainant Conduct – A Manual for Staff and Management”, NSW
Ombudsmen. 2nd Edition, May 2012. It can be accessed at:
http://www.ombo.nsw.gov.au/__data/assets/pdf_file/0004/3568/GL_Unreasonable-
Complainant-Conduct-Manual-2012_LR.pdf
Our Practice
Where a caller has displayed belligerent, abusive or offensive phone behaviour it is
appropriate to consider withdrawing the ability to contact OPC by phone. Abusive or
offensive behaviour is usually self-evident on the face of the contact. Belligerence would
include behaviour that is overly aggressive, argumentative, repetitive or confrontational.
Such behaviour might also result in the efficient administration of the office being
significantly affected. Where the phone manner of an individual is concerning to staff the
following steps are to be taken:
At an early stage the caller is to be put on notice that a continuation of the type of behaviour may result in the privilege of using the phone being withdrawn.
If the concerning behaviour continues the incident/s are to be brought to the attention your immediate supervisor.
At all times the incident in which the behaviour is demonstrated needs to recorded fully and accurately in the OPC file.
If you are aware that other staff members are being confronted by the behaviour, accurate records of those incidents are also to be captured on the file.
OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 113 113
Only after discussion with your supervisor, the caller may be officially put on notice that if the behaviour continues all calls will be blocked. This notice may be given in person on the phone, by email or by letter. The warning can be made by the staff member or the supervisor. The warnings are to be recorded on or copied to the OPC file.
If the behaviour continues beyond the official notice, a brief report is to be generated for referral to the General Manager who will arrange for the caller to be blocked. That report shall include sufficient details to enable the General Manager to identify the caller’s telephone number. The General Manager will act as an additional scrutineer of the process.
NOTE: Many of these types of callers contact our office in the context of complaints. It is
not unusual for a wide variety of staff within the office to be exposed to these people. It is
important that when you become involved in a cycle of abusive or worrying calls that you
consult widely with your colleagues to ensure that all incidents are known and captured. In
most instances it would be appropriate that the operational staff (investigations and policy)
manage the process envisaged by this practice note.
As these incidents develop, a record of the memo to the General Manager and any other
record of action taken shall be aliased or copied into the general Objective file named
“Banned Blocked and Abusive Individuals” under Complaints/04 Summary Reporting –
Complaints/Complaints Reports.