Obtaining Hager’s Westpac data, David Fisher, the Privacy Act

As posted in Hager raid court documents published by Scoop included are two affidavits by Herald senior reporter David Fisher.

And this morning the herald have an item written by Fisher on aspects of the court details in Police got Hager data without court order. Did Fisher write that headline? It may sound worse than what happened, Westpac bank may have complied with the Privacy Act giving the police data they requested.

Scoop published the documents early on the first day they could legally do this – ‘Saturday, 24 October 2015, 12:05 am’.

Fisher could have happened be up just after midnight and noticed the Scoop scoop, and then written up his article after reading through the documents. But that’s implausible if it made the print edition of the Herald this morning.

The online Herald article is shown as published at ‘5:00 AM Saturday Oct 24, 2015’. Fisher could have read the documents and written his article in that time frame.

But Fisher writes:

The details are revealed in documents obtained from the High Court by the Scoop news site, which intends to publish the full material today.

If Fisher had read the documents after being published just after midnight he would know they had already been published. It sounds like he knew in advance about the intended publication but didn’t know what time they would be published.

So Fisher must have been given the court documents in advance and had been in communication with Scoop about it.

Why does the Herald assign Fisher this topic when Fisher is so closely involved? Obviously his knowledge of the issue helps, but he may be too close to aspects of the story to give impartial and balanced coverage.

Fishers article starts with an implication that the handing over of data to the Police by Westpac not legal and has a Government connection.

Westpac handed over private details without judicial authorisation, though other firms declined, court documents show.

Detectives investigating the Dirty Politics hacker Rawshark sought the banking, telephone and travel records of author and journalist Nicky Hager without any search order or other legal power.

Court records show Westpac – the government’s banker for 26 years – handed over “almost 10 months of transactions from Mr Hager’s three accounts” at the request of detectives investigating the hacking of Whale Oil blogger Cameron Slater’s email and social media accounts.

Why did Fisher point out that “the government’s banker for 26 years”? He should be aware that that will feed the conspiracy theorists who claim that the Government are directing the Police to harass Hager.

Fisher appears to me to be deliberately seeding conspiracy by using an irrelevant reference.

Other companies that were asked for Hager’s private details told police to come back with a court order, which would have legally obliged them to surrender the information.

As they have the right to do.

Hager’s legal teams used police documents to detail how detectives sought information on him in late September last year – just after the election – from 16 “bank contacts”, Air NZ, Jetstar, Spark, Trade Me and Vodafone. The request to Air NZ also sought information about anyone Hager might have been travelling with, the documents show.

Detectives told the companies they needed the information for an inquiry into “suspected criminal offending, namely fraud, dishonest access of a computer system”, telling the bank the information would help avoid “prejudice to the maintenance of the law through the detection of serious offending”.

Have you read this far? How does it sound so far about Westpac providing Hager’s banking details?

The Privacy Act allows those holding personal information to waive the law if there are “reasonable grounds” to believe it would assist “maintenance of the law”.

That puts Westpac’s supply of data in a different light. Now I knew this, because I have sought clarification from the Privacy Commission on exactly the same issue of what I can and can’t do under the Privacy Act.

But readers who weren’t aware of this may have built a different picture. Did Fisher deliberately construct his article to mislead?

There is no sign in the High Court documents of Westpac – or any of the agencies – being supplied with additional information that might assist with the “reasonable grounds” test.

The documents do show the other companies rejected the request without a legal order.

Back to an apparent portrayal of Westpac bad, others good.

I would be very surprised if Westpac didn’t already have knowledge of the Privacy Act that enabled them to make an informed decision on whether they should provide the Police with data on request without a court order, or as Fisher repeated “without judicial authorisation” or “without any search order or other legal power”.

Westpac sent detectives transaction details from December 2013 until September last year, with other personal details.

The police decision to seek detailed information without a legal order appears contrary to the position stated by Assistant Commissioner Malcolm Burgess to the Weekend Herald last March.

He said there were “controls around how information is both requested and provided … While the Privacy Act provisions can be used to access low-level information, such as basic account details, higher-level data must be obtained through a production order,” he said.

It’s fair to ask whether Westpac should have provided the amount of detail they did “without a legal order” but this can be read as implying that what they did was illegal.

Hager’s lawyers told the court there were no reasonable grounds for police to seek information without a legal order and questioned whether such an order would have been granted were it applied for.

Fisher has written how there are legal grounds for the Police to seek information without an order, but goes back to suggest there are no reasonable grounds.

Here are quotes from Wriiten submissions for the applicant Redacted in an application for judicial review.

V. INFORMATION REQUEST

Introduction

5.1. As set out above in paragraphs 1.30-1.32, during September and October 2014 the Police made information requests to 16 bank contacts as well as Trade Me, Spark, Vodafone, Air New Zealand, and Jetstar. The information requests sought the disclosure of Mr Hager’s private information. In response to some, the Police obtained Mr Hager’s private information.

5.2. This was done without obtaining any production orders and in circumstances where production orders would not have been available. Mr Hager says that the information requests were unlawful and constituted unreasonable searches and seizures in breach of his rights under s 21. Detail of the information requests General bank request

5.3. On 24 September 2014, the Police sent information request sent to 16 bank contacts relied on an accusation of “suspected criminal offending, namely Fraud, Dishonest access of a computer system”.506 It claimed the information sought would “allow for a preliminary investigation to determine the scale of suspected offending (if any), thereby avoiding prejudice to the maintenance of the law through the detection of serious criminal offending, in respect of; HAGER/Nicky DOB: 04 384 5074 [sic] 73B Grafton Road, Roseneath, Wellington”.507 It asserted that it fell within the exception to the Privacy Act 1993 set out in Principle 11(e)(i) in s 6.

5.4. That request sought information about any accounts in his name, or for which he was a signatory, the date they were opened, current balances and account numbers, details of any signatories, details of all transactions on each account for the last 3 months, the dates, times and locations of the last week of transactions, and any past accounts, including the reasons they were closed.

Westpac bank request

5.5. On 29 September 2014, the Police sent an information request to Westpac Bank. It relied on the same accusation of suspected Fraud and Dishonest Access of a Computer System. It claimed the information would “provide evidential material to identify suspects for the alledged [sic] offending, thereby avoiding prejudice to the maintenance of the law through the detection of serious criminal offending, in respect of; HAGER/Nicky DOB: 04 3845074 [sic] 73B Grafton Road, Roseneath, Wellington”. It sought the details of all transactions for Mr Hager between December 2013 and May 2014.

requests to other companies are detailed.

Responses

5.14. Police received a range of responses to these requests.516 Private information was disclosed in response to some of those requests. In particular, two information requests resulted in the Police receiving the details of almost 10 months’ worth of transactions from Mr Hager’s three accounts.

5.15. On 25 September 2014, Police received detailed information about Mr Hager’s bank account from Westpac Bank including some of Mr Hager’s bank statements.517 On 30 September 2014, the Police received the requested further transaction information from Westpac on almost exactly the same basis as the 24 September 2014 request.

Information requests were unlawful

5.16. The Privacy Act 1993 prohibited these third parties from disclosing Mr Hager’s information except within limited exceptions.519 As set out above, the Police asserted that their requests fell variously within the exceptions set out in Principles 11(e)(i) and 11(e)(ii) in s 6 of that Act. The principle and claimed exceptions state that:

An agency that holds personal information shall not disclose the information to a person or body or agency unless the agency believes, on reasonable grounds,… (e) that non-compliance is necessary—

(i) to avoid prejudice to the maintenance of the law by any public sector agency, including the prevention, detection, investigation, prosecution, and punishment of offences; or

(ii) for the enforcement of a law imposing a pecuniary penalty

5.17. Under the SSA, the Police can obtain a production order to force companies, such as those listed above, to produce copies of documents they hold.520 In order to obtain such a production order the Police must have reasonable grounds:

(a) to suspect that an offence has been committed, or is being committed, or will be committed (being an offence in respect of which this Act or any enactment specified in column 2 of the Schedule authorises an enforcement officer to apply for a search warrant); and

(b) to believe that the documents sought by the proposed order—

(i) constitute evidential material in respect of the offence; and

(ii) are in the possession or under the control of the person against whom the order is sought, or will come into his or her possession or under his or her control while the order is in force.

5.18. The Police did not obtain such production orders.

5.19. The Police had reasonable grounds to believe that an offence had been committed by the Source. However, the Police did not have reasonable grounds to believe that the documents they were seeking in relation to Mr Hager would constitute evidential material in respect of that offence. The Police also lacked any reasonable grounds to believe that Mr Hager had committed any offence. And, in particular, the Police have discovered no documents to support any suggestion of fraud.

5.20. This is denied by the Police. However, the Police have failed to assert any such reasonable grounds in their evidence. Nor have any reasonable grounds been disclosed by the documents provided by the Police in discovery.

More paragraphs with details.Then:

5.27. The Police therefore lacked any lawful authority for these information requests.

A breach of s 21

5.28. Further, the information requests constituted unreasonable searches and seizures in breaches of s 21 of the Bill of Rights

Fisher chose to imply Westpac were wrong to have supplied Hager’s banking data without an order, and imply that it was illegal based on the document, but doesn’t say whether there has been a ruling on this so it’s unknown (to me anyway) whether he is correct or not.

Scoop states that this is all of the “files which have been released so far”.

Here is the advice I received from the Privacy Commissioner:

Principle 11 generally requires agencies not to disclose personal information, unless exception set out in principle 11 applies.  In other words, although you are not obliged to disclose personal information to a third party (in this instance, the New Zealand Police), you have the discretion to disclose personal information in certain circumstances, provided you can rely upon one of the exceptions set out in principle 11 to do so.

One of the exceptions for disclosure is principle 11(e)(i), where non-compliance is necessary for the maintenance of the law function.  So, if you believe it is necessary for the Police to have this information for their maintenance of the law function, this is one of those exceptions that permits disclosure in those circumstances.  Also, principle 11(e)(i) applies irrespective of whether the Police have asked you to make such a disclosure, or whether you make the disclosure of your own volition to the Police.

However, it is a good idea to only disclose personal information to the extent necessary.

Of course, if the Police were to produce a search warrant or court order for the information, you would need to comply with that search warrant or court order.

(This was advice from he Privacy Commissioner’s Office, not legal advice)

Fisher appears to have taken sides on this in his article, or at least strongly leant towards one side.

I’m genuinely interested in legal clarification on this, because as a blogger/publisher I can be requested to provide private information and I need to be sure under which circumstances I can or should do this.

The Privacy Act: https://www.privacy.org.nz/the-privacy-act-and-codes/privacy-principles/limits-on-disclosure-of-personal-information-principle-eleven/

UPDATE: there’s been a lot about this on Twitter, with predictable outrage at Westpac handing over data without a court order.

@PeteDGeorge @paulbrislen @nzherald the judgement is expected out fairly soon.

11 Comments

  1. kiwi_guy

     /  24th October 2015

    “Why does the Herald assign Fisher this topic when Fisher is so closely involved? Obviously his knowledge of the issue helps, but he may be too close to aspects of the story to give impartial and balanced coverage.”

    Talking of balanced coverage, these stats on the NZ Herald’s treatment of stories about the National government, posted over at Kiwiblog, show a huge bias against the government. Which is ironic because the comrades at The Stranded never stop wailing about the NZ Herald being little more than a National Party mouthpiece:

    • Trav

       /  24th October 2015

      Perhaps the negative coverage by a commentator has more to do with legitimate raising of issues where the govt (nat or labour) needs to rightly lift there game. I’ve never had much nice to say about Pol Pot or Idi Amin, not because they may be left or right leaning in any direction, they just werent the best leaders a country might be blessed with. I really couldn’t comment on their particular leanings, but they certainly had a fair amount of negative comment around them. Perhaps its the same thing here.

  2. kiwi_guy

     /  24th October 2015

    ^ There’s some provisos too:

    It only covers “opinion” columns and editorials. It does not cover news stories. It is designed to shed light on what the newspaper or journalist/columnist thinks – rather than what the story is. Of course it is influenced by the stories of the moment.

    http://www.kiwiblog.co.nz/2015/10/2nd_biannual_media_opinion_statistics.html

  3. traveller

     /  24th October 2015

    David Fisher was engaged and remunerated as the official biographer of Kim Dotcom. During and since the book’s release he has been advocating on Dotcom’s behalf and using a seemingly compliant NZ Herald as the conduit for positive KDC messaging. Kim Dotcom knew before DP’s release that Slater was “going down” and said as much to Wayne Tempero (see below) Rawshark’s Slater docs were uploaded to Mega. Dot join dot join…..

    Fisher can rate himself and virtually award himself a Pulitizer in his affidavit but this man’s shilling for Dotcom and the associated pecuniary interests should preclude his evidence of being of value. His affadavit even includes an article where acting as Dotcom’s private press agent, he alleges that police bank investigations caused a KDC’s mortgage application to be denied.

    • @traveller, agree with you on Fisher. I have read plenty of what he has written and i have to say its hardly what i term good journalism. His affidavit sounded like he was just blowing kisses to himself. Your KDC material above proves that point. One must also remember Fisher will do anything to take a shot at Slater, just like the clowns over at The Standard.

  4. Missy

     /  24th October 2015

    I am not sure fully of the legislation the police work under, but I do know that under the tax administration act IRD can get banking details and private info from banks without requiring a court order, it is possible (and logical) that there is a similar provision for the police, otherwise I would imagine the police would be constantly running to the courts when investigating crimes.

  5. Thingy

     /  24th October 2015

    “I’m genuinely interested in legal clarification on this, because as a blogger/publisher I can be requested to provide private information and I need to be sure under which circumstances I can or should do this.”

    Cant you just call yourself a ‘Journalist ‘ ?

    • Kevin

       /  24th October 2015

      At a guess I would say if the cops have a search warrant and the information requested falls within the search warrant then you have to provide the info to the police.

      • jaspa

         /  24th October 2015

        Presumably you would provide the police with information they could obtain anyway, if they came back with a warrant. Which they would.

        Anyway, who the hell does David Fisher think he is to comment on Kiwibank’s lending (to dodgy convicted criminals) procedures?

        What a gripper.

  1. Hager raid court documents published by Scoop | Your NZ
  2. Westpac Privacy Statement on information disclosure | Your NZ