CEU v Ombudsman

The case of CEU v Ombudsman involves a dispute regarding the alleged breach of privacy provisions under the Privacy and Personal Information Protection Act 1998. The respondent, the Ombudsman, is accused of breaching sections 17 and 18(1) of the Act in relation to the handling of personal information. The complainant, CEU, argued that the Ombudsman had improperly disclosed personal information in violation of the statutory privacy protections. The matter was heard by the Administrative Appeals Tribunal, which was tasked with determining whether the Ombudsman's actions were justified under the investigative agency exemption provided by section 24(1) of the Act.

The primary legal issue before the Tribunal was whether the Ombudsman's disclosure of personal information was justified under the investigative agency exemption in section 24(1) of the Privacy and Personal Information Protection Act 1998. This exemption permits an agency to disclose personal information if it reasonably believes the individual would not object to the disclosure. The Tribunal had to assess whether the Ombudsman had a reasonable belief that the individual would not object to the disclosure, given the circumstances of the case. Furthermore, the Tribunal examined whether the Ombudsman adhered to the conditions stipulated in the Act for such disclosures.

In its reasoning, the Tribunal found that the Ombudsman had indeed breached section 18 of the Privacy and Personal Information Protection Act 1998. The Tribunal concluded that the Ombudsman did not have a reasonable belief that the individual would not object to the disclosure of their personal information. The Tribunal held that the exemption under section 24(1) was not applicable, as the Ombudsman failed to meet the necessary criteria for such a disclosure. Consequently, the Tribunal determined that the Ombudsman had violated the statutory privacy protections.

The Tribunal, pursuant to section 55(2) of the Privacy and Personal Information Protection Act 1998, decided to take no further action on the matter. This decision was based on the conclusion that the breach had already been established, and further action was not necessary. The Tribunal's ruling highlights the importance of agencies adhering to privacy laws and the stringent requirements for invoking exemptions under the Act.