C v Accident Compensation Corporation
[2020] NZHC 2229
•28 August 2020
ORDER PROHIBITING PUBLICATION OF NAMES OR IDENTIFYING PARTICULARS OF THE APPELLANT. IN THE HIGH COURT OF NEW ZEALAND WELLINGTON REGISTRY
I TE KŌTI MATUA O AOTEAROA TE WHANGANUI-A-TARA ROHE
CIV-2020-485-000116
[2020] NZHC 2229
UNDER section 123 of the Human Rights Act 1993 BETWEEN
C
Appellant
AND
ACCIDENT COMPENSATION CORPORATION
Respondent
Hearing: 18 August 2020 Counsel:
C Boys for the Appellant
S Kinsler for the Respondent
Judgment:
28 August 2020
JUDGMENT OF DOOGUE J
This judgment was delivered by Justice Doogue on 28 August 2020 at 2.30 pm
pursuant to Rule 11.5 of the High Court Rules.
Registrar/ Deputy Registrar Date:
Solicitors:
Assure Legal, Wellington Meredith Connell, Wellington
C v ACCIDENT COMPENSATION CORPORATION [2020] NZHC 2229 [28 August 2020]
Introduction
[1] The appellant, Mr C, appeals a decision of the Human Rights Review Tribunal (the Tribunal), relating to a complaint of a breach of his privacy arising from disclosure of his medical records by the respondent, the Accident Compensation Corporation (ACC).1
[2]Mr C seeks:
(a)a declaration under s 85(1)(a) of the Privacy Act 1993 (the Act) that ACC interfered with his privacy;
(b)an order that ACC publish an apology;
(c)damages of $50,000 under s 88(1)(c) of the Act for emotional harm;
(d)an order preventing the publication of his name or identifying details, given the sensitive nature of the information contained in the appeal; and
(e)costs.
Background
[3] In 1994, Mr C was in a car accident, and suffered serious physical injuries, including to his back. He also suffered serious psychological injuries. His treatment and rehabilitation was covered by ACC. This resulted in ACC holding an extensive file relating to Mr C’s physical and psychological injuries.
[4] In July 2014, Mr C sustained a back injury as a result of an accident at a work social event. He submitted a claim form to ACC.
[5] Because the accident occurred at a work outing, Mr C’s claim was identified as a work claim. His employer at the time was ANZ Bank (ANZ), an accredited
1 [C] v Accident Compensation Corporation [2020] NZHRRT 3.
employer pursuant to ss 181-189 of the Accident Compensation Act 2001. Aon was contracted by ANZ to provide accident and injury cover for its employees, and Aon therefore covered Mr C’s 2014 back injury.
[6] On 18 September 2014, ACC requested Dr Antoniadis, a specialist occupational physician, carry out a medical case review concerning the 2014 back injury. Dr Antoniadis was asked to advise whether Mr C’s injury was caused by the 2014 accident, and to provide an opinion on the relationship between Mr C’s injury and the 1994 accident. The purpose of the review was to establish which of the two accidents was the cause of Mr C’s injury. If it was caused by the 1994 accident, then cover would be provided by ACC. If it was caused by the 2014 accident, at work, then cover would be provided by Aon.
[7] ACC provided a large number of Mr C’s medical records to Dr Antoniadis for the purpose of this review (the referral documents). These included extensive records relating to the 1994 injuries, and contained sensitive information (the sensitive information) relating to Mr C’s: mental health, including depression, delusions of persecution, hospitalisation, and ECT treatment; impaired function due to traumatic brain injury; internal injuries; criminal offending in his youth; family mental health history; drug use and alcohol addiction; sexual disfunction; self-harm; stress-related hair loss; urological issues; and sexual health tests.
[8] On 19 September 2014, Aon requested a copy of the referral documents from ACC, and provided a consent form signed by Mr C dated 26 July 2014. On 23 September 2014, ACC provided the referral documents to Aon (the disclosure). This disclosure is the subject of Mr C’s complaint.
[9] On 10 October 2014, Dr Antoniadis provided his report to ACC. The report contained reference to some of the sensitive information from the referral documents.
[10] On 16 October 2014, Aon requested a copy of the report from ACC. Mr C worked with his ACC case manager to identify sections of the report he wished to redact before it was provided to Aon. On 21 November 2014, ACC discussed the
redacted version of the report with Aon, and Aon advised it had received an unredacted copy of the report directly from Dr Antoniadis.
[11] Aon then provided a copy of the unredacted report to ANZ. Mr C became worried about who had accessed his personal information, and he began to have problems at work. He subsequently resigned.
[12] In October 2015, Mr C made a complaint to ACC about a breach of his privacy. On 2 November 2015, Mr C met with ACC to discuss ACC’s release of the referral documents to Aon. A file note from that meeting records that ACC acknowledged they would handle the process differently in future, and consult about the disclosure of this type of information. On 17 November 2015, ACC wrote to Mr C, apologising for not communicating more effectively in relation to the information released to Aon.
[13] Mr C made a complaint to the Office of the Privacy Commissioner (the Privacy Commissioner). Following an investigation, the Privacy Commissioner found that as Mr C had signed a consent form to allow Aon to collect the information, disclosure by ACC was allowed under r 11(1)(b)(i) and 11(1)(c) of the Health Information Privacy Code 1994 (the Code).2 The Privacy Commissioner found there had been no interference with Mr C’s privacy.3
[14] In February 2018, Mr C filed proceedings under the Act in the Tribunal against ACC, Aon, ANZ Bank, and Dr Antoniadis. As the Privacy Commissioner had only notified ACC of Mr C’s complaint, the other parties were removed as defendants at a procedural teleconference on 31 May 2018.4
The law
[15]Rule 11 of the Code places limits on the disclosure of health information:
Rule 11
Limits on Disclosure of Health Information
(1)A health agency that holds health information must not disclose the information unless the agency believes, on reasonable grounds:
2 At [21].
3 At [21].
4 At [22].
…
(b)that the disclosure is authorised by:
the individual concerned; or
…
(c)that the disclosure of the information is one of the purposes in connection with which the information was obtained;
…
[16] Section 66 of the Act establishes what constitutions an interference with a person’s privacy:
66 Interference with privacy
(1)For the purposes of this Part, an action is an interference with the privacy of an individual if, and only if,—
(a)in relation to that individual,—
(i)the action breaches an information privacy principle; or
… and
(b)in the opinion of the Commissioner or, as the case may be, the Tribunal, the action—
(i)has caused, or may cause, loss, detriment, damage, or injury to that individual; or
(ii)has adversely affected, or may adversely affect, the rights, benefits, privileges, obligations, or interests of that individual; or
(iii)has resulted in, or may result in, significant humiliation, significant loss of dignity, or significant injury to the feelings of that individual.
…
[17] Section 85 of the Act provides that the Tribunal, upon finding an interference with the privacy of an individual, may grant various remedies, including: a declaration that the action is an interference with the privacy of an individual;5 or damages in accordance with s 88.6
[18] Section 88(1)(c) of the Act provides that the Tribunal may award damages for an interference with the privacy of an individual in respect of humiliation, loss of dignity, and injury to the feelings of the aggrieved individual.
5 Privacy Act 1993, s 85(1)(a).
6 Section 85(1)(c).
Human Rights Review Tribunal decision
[19] After canvassing the background facts, the Tribunal set out the legal framework in r 11 of the Code and s 66 of the Act.7 Before the Tribunal, ACC bore the onus of proof to establish that an exception to r 11 applied.8
[20]The Tribunal considered the issues to be determined were:
[25.1] Does the Tribunal have jurisdiction to consider whether the disclosure of the referral document to Aon was in breach of Rule 11?
[25.2] Did ACC release an unredacted copy of Dr Antoniadis’ report to Aon?
[25.3] Did ACC believe on reasonable grounds that the disclosure of [Mr C’s] health information to Aon was authorised by [Mr C]?
[25.4] Did ACC believe on reasonable grounds that the disclosure of the information was one of the purposes in connection with which the information was obtained?
[21] The Tribunal found it had jurisdiction to consider whether the disclosure was a breach of r 11.9
[22]The Tribunal found ACC did not release the unredacted report to Aon.10
[23] The Tribunal found ACC did believe the disclosure was made with Mr C’s consent,11 but there were no reasonable grounds for that belief.12 Therefore, the disclosure was not permitted under r 11(1)(b)(i).13
[24] However, the Tribunal did find that the disclosure was permitted under r 11(1)(c), because the disclosure of the information was one of the purposes in connection with which the information was obtained. The Tribunal held that the information was collected for the purposes of determining Mr C’s entitlements and
7 [C] v Accident Compensation Corporation, above n 1, at [23]-[24].
8 At [26].
9 At [36].
10 At [39].
11 At [45].
12 At [49].
13 At [51].
ongoing management and rehabilitation needs, and was provided to Aon for this purpose.14
[25] The Tribunal noted it had no jurisdiction to consider the disclosure of the unredacted report by Dr Antoniadis to Aon, or the disclosure by Aon to ANZ.15
[26] The Tribunal held an interference with the privacy of Mr C had not been established, and dismissed his claim.16
Approach on appeal
[27] An appeal from a decision of the Tribunal relating to a complaint made to the Privacy Commissioner follows the same process as a complaint made to the Human Rights Commissioner.17 The Court may: confirm, modify, or reverse the order or decision appealed against, or any part of that order or decision; 18 exercise any of the powers that could have been exercised by the Tribunal in the proceedings to which the appeal relates;19 or instead of determining any appeal, refer the whole or any part of the matter to the Tribunal for further consideration.20
[28] The principles in Austin, Nichols & Co Inc v Stichting Lodestar apply.21 The appellant has the onus of satisfying the Court that it should differ from the decision under appeal, and the Court must make its own assessment of the issues.22
The appeal
[29] Mr C appeals the Tribunal’s finding that the disclosure was permitted under r 11(1)(c), on the grounds that the referral documents contained information which had no reasonable connection to the injury being managed, and ACC did not have a
14 At [56].
15 At [58].
16 At [58].
17 Privacy Act, s 89.
18 Human Rights Act 1993, s 123(6)(a).
19 Section 123(6)(b).
20 Section 123(7).
21 Austin, Nichols & Co Inc v Stichting Lodestar [2007] NZSC 103, [2008] 2 NZLR 141.
22 Ministry of Health v Atkinson (2010) 9 HRNZ 47 at [8].
genuine belief that the sensitive information was sufficiently related to Aon’s management of the 2014 injury to justify disclosure.
[30]Mr Boys, for Mr C, submitted the issues on appeal are:
(a)What were the purpose(s) for which the information in question was originally obtained?
(b)What were the purpose(s) for which the information was disclosed to Aon?
(c)Was there a reasonable connection between the purpose(s) for collection and the purpose(s) for disclosure?
(d)As a question of fact, did ACC hold a reasonable belief that the disclosure to Aon was one of the purposes in connection with which the information was obtained, as required by r 11(1)(c)?
(e)If ACC has breached Mr C’s rights under the Code by making the disclosure, what damages or remedies should follow?
Submissions
Mr C
[31] Mr Boys submitted the referral documents were obtained by ACC for the purpose of managing claims for the injuries arising out of the 1994 accident. He submitted the sensitive information was obtained principally to manage the psychological effects of Mr C’s injuries.
[32] Mr Boys submitted the purpose of the disclosure to Aon was to manage a claim for the back injury arising out of the 2014 accident.
[33] Mr Boys submitted there was no reasonable connection between the purposes of the collection and the disclosure of the sensitive information. He submitted the Tribunal was wrong to find the sensitive information was necessary for Aon to manage
the 2014 claim, and submitted in doing so it applied an overly broad and mechanical interpretation of the rule. He submitted the rule requires a “real connection, underpinned by the question of what is necessary for the purpose to be fulfilled.” He submitted Aon’s interest in the referral documents only extended to information which related to entitlements that might flow from the 2014 injury. He noted Dr Antoniadis’ report found a connection between the 2014 back injury and the 1994 back injury, but not the psychological, sexual, or addiction issues.
[34] Mr Boys submitted ACC’s evidence before the Tribunal did not show that the case manager who disclosed the information to Aon held a reasonable belief that the exception in r 11(1)(c) applied.
[35] Mr Boys submitted Mr C was retraumatised by the disclosure, which he found humiliating and believes led to the loss of his employment with ANZ. Although he acknowledged loss of income and employment are impossible to prove on the facts, he submitted the harm to Mr C’s dignity and the loss and suffering it has caused are apparent, and sought damages of $50,000.
ACC
[36] Mr Kinsler submitted the Tribunal was correct in its interpretation of r 11(1)(c). He submitted ACC obtained the referral documents for the purpose of determining Mr C’s entitlements under the Accident Compensation Act, and disclosed the referral documents for that purpose.
[37] Mr Kinsler submitted ACC had reasonable grounds for considering that Aon needed the information that it had access to, in order to make decisions about Mr C’s entitlements.
[38] In response to Mr Boys’ reliance on the findings in Dr Antoniadis’ report, Mr Kinsler noted that it was not before ACC at the time of the disclosure, and so could not have been used to determine that there was no relationship between the 2014 injury and the 1994 injuries.
[39] In the event the Court finds a breach of r 11, Mr Kinsler submitted the disclosure did not constitute interference with Mr C’s privacy, as there is insufficient evidence to establish one of the forms of actual or potential harm in s 66 of the Act. He submitted there is insufficient evidence to show a causal connection between any breach and the difficulties Mr C has suffered (especially his loss of employment). He submitted Mr C’s losses must flow from the relevant disclosure by ACC, not subsequent disclosures by Dr Antoniadis or Aon (in other words, the disclosure to ANZ). He also submitted the damages sought are excessive.
Analysis
Was there a breach of r 11 of the Health Information Privacy Code?
[40] It may be true that ACC obtained the sensitive information in order to determine eligibility under the Accident Compensation Act, and disclosed it to Aon for that same purpose. However, I consider there must be a reasonable connection between the two purposes, determined with reference to what is necessary for the purpose to be fulfilled.
[41] In the present case, I consider the only information necessary for Aon to determine Mr C’s eligibility was the information relating to his physical back injuries. The sensitive information, particularly relating to his mental health and sexual function, was not necessary in determining whether the 2014 injury was connected to the 1994 accident. While it may have been necessary for Dr Antoniadis to receive the full records, in order to complete the medical review, it was not necessary for Aon to receive all of the sensitive information, especially without ACC consulting with Mr C.
[42] Any belief ACC may have had that the disclosure to Aon was one of the purposes in connection with which the information was obtained was unreasonable. It should have been clear that the sensitive information was not relevant to the 2014 injury. I note a later case manager recognised this, and worked with Mr C to redact Dr Antoniadis’ report before releasing it to Aon. I also note a report prepared by a physiotherapist, before the disclosure, recorded the nature of the injury (as a
physical back injury) and made no reference to any mental health issues or other issues contained in the sensitive information.
[43] Mr C has shown that the exception in r 11(1)(c) was not made out, and ACC’s release of the sensitive information to Aon was therefore a breach of r 11 of the Code.
Does the disclosure constitute an interference with Mr C’s privacy, as per s 66 of the Act?
[44] In order to establish a case for damages for emotional harm, Mr C must first show that the disclosure resulted in an interference with his privacy as it: breached an information privacy principle;23 and resulted in significant humiliation, significant loss of dignity, or significant injury to his feelings.24
[45]I consider the breach of r 11 of the Code constitutes a breach of principle 11:25
Principle 11
Limits on disclosure of personal information
An agency that holds personal information shall not disclose the information to a person or body or agency unless the agency believes, on reasonable grounds,—
(a)that the disclosure of the information is one of the purposes in connection with which the information was obtained or is directly related to the purposes in connection with which the information was obtained; or
…
[46] The Tribunal considered loss of dignity and injury to feelings, for the purposes of s 66, in Hammond v Credit Union Baywide:26
[152] As to loss of dignity, we refer to the description given in Law v Canada (Minister of Employment and Immigration) [1999] 1 SCR 497 at [53] where Iacobucci J delivering the judgment of the Supreme Court of Canada stated:
53 … Human dignity means that an individual or group feels self-respect and self-worth. It is concerned with physical and psychological integrity and empowerment. Human dignity is harmed by unfair treatment premised upon personal traits or circumstances
23 Privacy Act, s 66(1)(a)(i).
24 Section 66(1)(b)(iii).
25 Section 6.
26 Hammond v Credit Union Baywide [2015] NZHRRT 6.
which do not relate to individual needs, capacities, or merits … Human dignity is harmed when individuals and groups are marginalized, ignored, or devalued …
[153] As to what is included in “injury to the feelings”, it was held in Winter v Jans HC Hamilton CIV-2003–419–854, 6 April 2004 at [36] that “injury to the feelings” can include conditions such as anxiety and stress. In Director of Proceedings v O’Neil [2001] NZAR 59 at [29] injury to feelings was described in the following terms:
[29] The feelings of human beings are not intangible things. They are real and felt, but often not identified until the person stands back and looks inwards. They can encompass pleasant feelings (such as contentment, happiness, peacefulness and tranquillity) or be unpleasant (such as fear, anger and anxiety). However a feeling can be described, it is clear that some feelings such as fear, grief, sense of loss, anxiety, anger, despair, alarm and so on can be categorised as injured feelings. They are feelings of a negative kind arising out of some outward event. To that extent they are injured feelings.
[47] It appears Mr C has suffered a loss of dignity and injury to feelings, primarily as a result of his employer accessing the sensitive information. His anxiety about not knowing who had access to his information, and the subsequent impact on his employment relationship, appears genuine and I consider meets the threshold in s 66.
[48] However, the primary issue in the present case, under s 66, is one of causation. Dr Antoniadis provided an unredacted copy of his report to Aon, which contained reference to the sensitive information. I understand it is the unredacted report, not the sensitive information itself, that was provided to Mr C’s employer. This is the disclosure that appears to have caused the harm to Mr C.
[49] I do not consider the disclosure to Aon caused significant humiliation, significant loss of dignity, or significant injury to Mr C’s feelings. Rather, the alleged disclosure by Aon of the unredacted report to Mr C’s employer appears to have caused the harm. Mr C has therefore not established that the disclosure of the sensitive information by ACC to Aon was an interference with his privacy under s 66 of the Act.
Conclusion
[50] Mr C has shown that the exception in r 11(1)(c) was not made out, and ACC’s disclosure of the sensitive information to Aon was therefore a breach of r 11 of the Code.
[51] The disclosure of the sensitive information by ACC to Aon was a breach of privacy principle 11.
[52] Although I acknowledge Mr C has potentially suffered significant humiliation, significant loss of dignity, or significant injury to his feelings, I do not consider this was caused by the disclosure by ACC. Mr C has not established an interference with his privacy under s 66.
[53]The appeal is dismissed.
Orders
[54] Given the sensitive nature of the information in this appeal, I make an order preventing the publication of Mr C’s name or identifying details.
Doogue J
0
2
0