Beneficiaries and Privacy Commissioner on MSD investigation breaches

Newshub Nation interviewed beneficiaries who had been investigated by MSD, and then Privacy Commissioner John Edwards on the breaches of law and what MSD will do now.

On Newshub Nation: Emma Jolliff interviews Privacy Commissioner John Edwards

Jolliff: The Privacy Commissioner says MSD’s powers to investigate have been taken too far. I asked him how serious the breaches have been.

Edwards: That’s hard to rank them because everything is so contextual. I was really troubled by the breadth of the ministry’s data collection in these cases, particularly of text message content. In most law enforcement contexts, you wouldn’t be able to get that information without a warrant issued by some judicial officer — that means an independent person has to look at the case that you’re making for getting access to it, they have to decide whether what you’re seeking is proportionate to the need, and then issue the instruction. These are just demands issued by some clerk or bureaucrat or investigator without adequate checks and balances, in my view. And especially given the sensitive nature of that information, in ranks pretty highly.

In simple terms, how do you see that MSD has breached the law?

By simply ignoring the statutory requirement to seek the information from the beneficiary first, unless doing that would prejudice the maintenance of the law. That’s the headline story. Beneath that, there are a number of instances in which I think the ministry has just lost track of the kind of developing jurisprudence that governs these things. Getting 10 years worth of banking records to investigate one year worth of benefit entitlement us just completely disproportionate. We’ve got to keep recalibrating those enforcement techniques against what we know is legally acceptable in terms of the Bill of Rights Act, you know — the right to be free from unreasonable search and seizure.

Do you see that MSD has accepted that its breached the law?

I’m happy that the ministry has accepte my report. I’m happy that the Chief Executive has assured me that they are going to implement all the recommendations, and they have conceded that the actions that they’ve taken have been unlawful.

MSD justified its collection of personal information about beneficiaries from third parties by saying clients wouldn’t volunteer information, and it was just quicker to go to the third parties. What do you say to that?

Well, that’s not the law, and it also presupposes that the only reason you notify the beneficiary first is to get access to the information. I mean, a beneficiary probably can’t delivery up 10 years of banking information, but what it does do is it informs them that those inquiries are being made. It gives them the opportunity to exercise some autonomy over that.

Could MSD identify any cases where evidence tampering occurred because a client was approached before a third party?

Not as far as I’m aware.

The Privacy Commissioner’s office expressed concerns to MSD about collection of information as far back as 1998, yet they carried on with the practice. This just suggests that they are disregarding the requests of your office, doesn’t it?

Back in 1998 the reference in our report was to the inadequacy of the record-keeping in the ministry because one of the things that was difficult in our investigation is that they simply didn’t have good records. They couldn’t tell us how many times they were issuing these notices, how many times they were going to a beneficiary first. We would ask, and we would get one set of records, then we’d get a completely different version.

So it hasn’t improved despite your requests?

No, it hasn’t improved, and it needs to. And that’s one of our recommendations, and I’m pleased that the ministry have said that they’re going to implement that. We need to have nationally consistent reporting of how these tools are used.

How important is that, and why is that?

Well, it’s really important, and, again, this is about the integrity of the public service. Everybody recognises that beneficiaries have some duties to the ministry, to the government, in terms of their eligibility. The ministry also has duties to act within the law and to demonstrate that it’s acting proportionally. If it is not complying with its obligations, how can it, with any moral authority, expect anyone else to?

Your report also found the MSD had issued notices under Section 11, stating that they’d been approved by the Privacy Commissioner. Was the misleading?

Well, utterly. It was wrong. It was misleading. I’m not able to speculate on the origins of that. I would very much doubt somebody intended to mislead, but they’ve got the wrong end of the stick. We’ve called them out on it, and, to their credit, they withdrew those.

So does this suggest that the Privacy Commission needs greater powers, do you feel?

I have made a call for greater powers, but in fact, when it comes to my monitoring of government agencies, I think that the authority that we have is sufficient. I mean, you will come back to the ministry, as the Nation — as TV3 — in 12 months, and say, ‘Look, tell us what you’ve done to implement the Privacy Commissioner’s recommendations.’ And if they haven’t, then you’ll hold them to account. That, I think, is really important.

You shouldn’t really want to rely on the fourth estate to do that, though. You should have your own powers, shouldn’t you?

Well, you have a role. Other members of parliament and advocacy groups in the community have a role. They will all hold them to account. I was very pleased to see the Minister reacting to our report, and saying, ‘Well, actually it’s great that the ministry have said that they accept the recommendations, that they’re going to implement them, but I think we need to have another look at the legislative underpinnings of this, and see whether there needs to be a law change.’ That’s really positive as well.

Some legal experts have suggested that beneficiaries could take legal action against MSD under the Bill of Rights. Would you agree that that is an avenue that they could pursue, and should they be entitled to compensation?

Certainly if somebody felt that they had experienced significant humiliation or significant injury to feelings because of breaches of the Privacy Act, they could bring a complain to my office. Now, because of the numbers involved in this mismanagement by the ministry over many years, I’m recommending that if somebody does feel that they might’ve been caught up with this, they first direct their inquiry to the Ministry of Social Development.

Can you remind us what those numbers were because you said that was something difficult to ascertain as well?

Starting point — about 15,000 cases.

MSD’s committed to ceasing their blanket policy, as you say, in approaching third parties for information, reviewing the code of conduct, having their investigative practices independently assessed. Does that go far enough?

Look, I think that goes a long way. What we need to do here is to restore the integrity of the system, so that people who are receiving benefits know that they have duties, know that they will be treated fairly and according to the law.

What concerns were raised by private sector agencies like the telcos over the information that they felt they were being compelled to provide?

Those industry groups have felt really uncomfortable about this. They provide services to customers, and they don’t feel like they should be snooping around in their private lives, but when they receive one of these notices from the ministry, they are under a legal obligation to comply.

Have these people, these 15,000 or so, been denied a fundamental human right?

Well, everybody has the right to avoid arbitrary interferences with their liberty and their privacy. So, in some cases, yes, they will have.

Transcript from Newshub Nation/Able/Scoop

Hager takes Westpac to Human Rights Review Tribunal

Recently the Privacy Commissioner upheld Nicky Hager’s complaint against Westpac for breaching his privacy – see Privacy Commissioner upholds Hager complaint against Westpac.

That is only advisory (toothless) so Hager has now filed a case against Westpac with the Human Rights Review Tribunal.


Nicky Hager files proceedings in the Human Rights Review Tribunal

Nicky Hager has filed a case against Westpac with the Human Rights Review Tribunal. This is yet another step in Mr Hager’s response to the unlawful search of his home and private information by Police.

The Privacy Commissioner recently upheld Mr Hager’s complaint against Westpac for breaching his privacy. However, the Privacy Commissioner’s decision is advisory only. To obtain binding orders, Mr Hager needs to take his case to the Human Rights Review Tribunal.

Mr Hager believes the attitude of Westpac has left him with no choice but to continue with his case. “He has asked Westpac to acknowledge that it breached his rights.

Despite the Privacy Commissioner’s ruling, it has not been prepared to do that,” Mr Hager’s lawyer Felix Geiringer said.

Mr Hager will be asking the Human Rights Review Tribunal for binding orders requiring that Westpac not give its customers’ bank transaction data to the Police without a production order.

There may be thousands of people in the same position as Mr Hager, but who do not know it. “He has also asked the Human Rights Review Tribunal for an order requiring Westpac to notify everyone whose privacy may have already been breached,” Mr Geiringer said.

Even if Mr Hager is successful before the Human Rights Review Tribunal, the broader issue may remain. “This issue does not just relate to Westpac. All New Zealand’s banks had the same arrangement with the Police. Many other companies have also been releasing personal information without asking for a production order.”

A claim against the Police for making the requests is still before the High Court.

Privacy Commissioner upholds Hager complaint against Westpac

Felix Geiringer (Nicky Hager’s lawyer):

Westpac “believes that every customer has authorised the disclosure of all of their information… to Police for whatever reason Police give it seems untenable that Westpac would genuinely hold this belief… it would come as a surprise to a great many of Westpac’s customers…”

c5evujouoaadkzt

And:

The Privacy Commissioner’s decision:  Privacy Act Complaint: Nicky Hager and Westpac New Zealand (Our Ref: C/28047) 

Journalist or not?

I referenced this recently but it’s worth a look at this full post last week by Privacy Commissioner John Edwards:

When is a journalist not a journalist?

Last week’s decision of Clifford J in the Wellington High Court found that in the context of the Evidence Act, Nicky Hager was a journalist in relation to the publication of Dirty Politics, and was therefore entitled to assert privilege under s.68 of the Evidence Act 2006.

The High Court decision to classify Hager as a journalist echoes my office’s decision to do the same, in a complaint made against him by blogger Cameron Slater. This is important because the Privacy Act only applies to agencies – and the definition of “agency” excludes “ in relation to its news activities, any news medium.”  Journalists working in their capacity in the news media do not come under my office’s remit.

However, if we accorded Hager the news media protection, why did we flip-flop in another case and deny it to journalist John Roughan?

We don’t usually make public comment on cases that we have investigated. But apparent inconsistencies in approach have been picked up by parties and questioned. Those questions are legitimate, and important, so I’m happy to try and explain, by discussing elements of the complaints to our office that have been placed into the public domain by the parties.

There are three other relevant cases, all with familiar parties:

Dotcom v Attorney-General

The Crown (being sued by Kim Dotcom) asked the Court to force Kim Dotcom to produce documents held by a journalist (David Fisher), who he’d fully co-operated with when Mr Fisher wrote the biography The Secret Life of Kim Dotcom. This is a process called discovery. Usually, one party can ask the other party to give up all relevant information that is within their control. If a third party has information relevant to the proceedings, there is a special process by which they can be compelled to produce information for the proceedings as well. This is called “third party discovery”.

The Crown argued that because Kim Dotcom had a right under the Privacy Act to access personal information held by an agency, any such information was within his control, and therefore he should exercise his right to procure and produce it.

David Fisher was, they said, an agency under the Privacy Act, and Kim Dotcom could get all the information held by him. The Court considered whether David Fisher was an agency, given he was a journalist, working for a major NZ daily newspaper, who had regularly written news articles about Kim Dotcom.

Then Chief High Court Judge, Justice Winkelmann concluded that in David Fisher’s capacity as an author of a book, he was not “news media” as the definition refers to “articles”, not “books”. The result seemed to be that Mr Fisher would not be subject to the Privacy Act for an article published in the New Zealand Herald, but if a collection of such articles were published as a book, he would be.

Cameron Slater v Nicky Hager

Nicky Hager received a hard drive from an unnamed source with a significant amount of personal correspondence to and from blogger Cameron Slater. He then used that information as source material for his 2014 book Dirty Politics.

Mr Slater made a complaint to my office that the means by which Mr Hager obtained his private communications, and then subsequently published them, breached his privacy

The matter the High Court was addressing in Dotcom v Attorney-General was based on an individual’s right of access (that is, information privacy principle 6). The question we faced in the Slater v Hager complaint was about the means by which an investigative journalist collected and disseminated information (that is information privacy principles 1-4, and 11), so there were differences in the basic facts of the case.

We, and others found the High Court decision in Dotcom troublesome from a number of perspectives, not the least being that it effectively puts my office in the position of having to form a view on what information parties are entitled to have access to for court proceedings, but I have no power to order the production of the information. If the Privacy Act is to be the means for providing third party discovery there will be significant delays in cases before the courts as parties come through my office, and then on to the Human Rights Review Tribunal before going back to the court hearing their dispute.

When lawyers find a precedent case inconvenient, they seek to “distinguish” it from the facts of other cases it might otherwise apply to.

In determining whether Mr Hager was ‘news media’ for the purposes of the publication of a book, my senior investigating officer decided the facts of the complaint were quite different from those in the Dotcom case. He was obliged to take into account s.14 of the Privacy Act which requires that in performing functions under the Act, we have to have due regard for the protection of important human rights and social interests that compete with privacy.

And he had to think about s.6 of the New Zealand Bill of Rights Act 1990 (NZBORA)  which provides “Wherever an enactment can be given a meaning that is consistent with the rights and freedoms contained in this Bill of Rights, that meaning shall be preferred to any other meaning“.

Section 14 of the NZBORA provides for “freedom of expression, including the freedom to seek, receive, and impart information and opinions of any kind in any form”.

And so we made the decision that the writing and publication of Dirty Politics was the collection and dissemination of news, by a journalist, and that as such we had no jurisdiction to consider a complaint that its publication or research that lead to it, was a breach of the Privacy Act.

Roughan v Prime Minister John Key

So if Nicky Hager is a journalist when he writes a book, why isn’t John Roughan when he does?

Mr Roughan wrote a book about Prime Minister John Key.  Lawyers for Bradley Ambrose, the cameraman suing Mr Key for defamation as a result of the “teapot tapes” events asked the Prime Minister for discovery, including material held by his biographer John Roughan. They were asking him to exercise his right under the Privacy Act to access personal information about him, so it could be produced to the Court. Lawyers for the Prime Minister obliged and made the request of Mr Roughan, who refused on the basis that he was a journalist.

Here, we had a case that was “on all fours” with the earlier decision of Justice Winkelmann. A journalist working for New Zealand Herald writes a book about a well known individual who is a party to legal proceedings. I made the decision that as a statutory officer faced with a case with identical facts to those directly ruled on by a senior judicial officer, I was bound by that precedent. There was simply no “wiggle room”.

Privacy, freedom of press and the courts

A freely functioning press is vital to a healthy democracy. Press freedom, and freedom of expression are not absolute values, and are like other rights, subject to limitations. That’s why we have defamation laws, laws against incitement, and limits to protect  privacy.

This is also why Nicky Hager ultimately succeeded in his judicial review of a warrant to search his property for evidence that might identify the source of the information Hager used for his book Dirty Politics.

I agree with critics that consistency in the law and its application is an important value. With the Government committed to reform of the Privacy Act, it could be timely to take the opportunity to clarify the position of journalists, privacy, discovery and the Courts.

  • Privacy Commissioner John Edwards