Edwards v Capital and Coast District Health Board
[2016] NZHC 3167
•20 December 2016
IN THE HIGH COURT OF NEW ZEALAND WELLINGTON REGISTRY
CIV-2016-485-487 [2016] NZHC 3167
UNDER the Privacy Act and appeal under
Section 89 of the Act
BETWEEN
JASON EDWARDS Appellant
AND
CAPITAL AND COAST DISTRICT HEALTH BOARD
Respondent
Hearing: 25 October 2016 Appearances:
M Edwards for appellant
P White for respondentJudgment:
20 December 2016
JUDGMENT OF CULL J
Introduction
[1] Jason Edwards1 appeals the decision of the Human Rights Review Tribunal (the Tribunal), which struck-out his claim for breaches of his privacy.2 Jason claims against Capital and Coast District Health Board (CCDHB) for disclosing private information to Child, Youth and Family (CYF). The Privacy Commissioner’s
investigation found that there had been no interference with his or his mother’s
privacy and no breach of the Privacy Act 1993 (the Act).
[2] This appeal is brought under s 89 of the Act, which provides that certain provisions of the Human Rights Act 1993 (HRA) shall apply to proceedings under
ss 82 or 83 of the Act, as if they were proceedings under ss 92B, 92E, or 92H of the
1 The names of the parties have been anonymised to protect medical confidentiality and privacy matters.
2 Edwards v Capital and Coast District Health Board [2016] NZHRRT 20.
EDWARDS v CAPITAL AND COAST DISTRICT HEALTH BOARD [2016] NZHC 3167 [20 December 2016]
HRA.3 Section 123 of the HRA provides that a party to a proceeding may appeal to the High Court against all or any part of a decision of the Human Rights Review Tribunal.
[3] Jason Edwards is aged 16 and his mother, Moira Edwards, filed this appeal on behalf of her son and sought leave, together with Jason’s grandmother, to appear on behalf of Jason Edwards. Leave was granted under s 27(1)(b)(ii) of the Lawyers and Conveyancers Act 2006 to both to appear as advocates for Jason Edwards.
Background facts
[4] On 12 June 2013, Jason Edwards, aged 14, was admitted to the Emergency Department of Wellington Hospital (ED), following a suicide attempt. Ms Edwards is a single parent of three children. Jason has previously been diagnosed with an autistic spectrum disorder and related psychological conditions. In 2012, the Child and Adolescent Services of CCDHB changed Jason’s medication which, Ms Edwards alleges, triggered a serious deterioration in his behaviour and mood, including three suicide attempts. Ms Edwards attempted on several occasions to have the original medication, prescribed by Jason’s private psychiatrist, reinstated.
[5] There is some dispute about the order of events which followed, which can only be resolved by hearing evidence. As this is an appeal, without oral evidence, I deal with the facts as they are pleaded by each party and contained in the disclosed documents, which comprise the correspondence among the parties and the Privacy Commissioner.
[6] When Jason and Ms Edwards arrived at ED on 12 June 2013, they waited for the Mental Health Crisis Assessment and Treatment Team (CATT) to assess Jason. It took some time for them to arrive. Ms Edwards, concerned that her two other children were at home alone, approached a doctor about leaving. The ED doctor allegedly told Ms Edwards that she could not leave and that if she did, he would make a report to CYF. CCDHB claims that the doctor enquired as to whether
Ms Edwards planned to return to the hospital and that she replied in the negative.
3 By virtue of ss 92Q to 92W and Part 4 of the Human Rights Act 1993.
According to CCDHB, he explained that a report to CYF would facilitate further support being provided to the family. This response is challenged by Ms Edwards.
[7] Ms Edwards claims that she waited for some time and then approached a nurse to explain the situation. At that point, the ED doctor interrupted. According to Ms Edwards, he was “angry and belligerent” and she told the nurse that she did not want to deal with him. CCDHB’s version of events is that the doctor explained to Ms Edwards that the nursing staff did not dictate patient plans and that she could not give clearance for Ms Edwards to leave. Ms Edwards says that the nurse gave her permission to leave and said that the hospital would call to update her. She says further that she planned to return when the CATT team arrived. The reason she left was not to abandon her son, but to settle her two daughters down for the night, making sure they were put to bed. At the time Ms Edwards left, Jason was happy for her to leave and there was a security person sitting with Jason.
[8] Soon afterwards, the CATT team arrived. During the assessment, Jason mentioned several altercations he had with his sisters. Ms Edwards claims that the notes are vague about what was said. According to CCDHB, Jason disclosed verbal and physical bullying from his sisters, in response to questions about what led him to self-harm. Although Ms Edwards was willing to return to the hospital to talk to the CATT team, the CATT team did not require her to do so and was happy to talk to her over the phone.
[9] Following the incident on 12 June 2013, Jason was allowed to return home and the CATT team discussed Jason’s care with Ms Edwards over the phone. The following day, staff at CCDHB reported to CYF about Jason and his mother.
[10] Two years later, Ms Edwards sought work as a lawyer at the Ministry of Social Development and as a result of background employment checks, she discovered that CCDHB staff had made complaints about her to CYF, which Ms Edwards claims are false.
[11] The ED doctor from CCDHB had written to CYF, stating that Ms Edwards left her son unattended in ED after being instructed to stay and that Ms Edwards had
said that she could not look after him anymore. Nobody at CCDHB contacted Ms Edwards to check the facts before making the complaints and two years have passed without Ms Edwards’ knowledge that this information was sent to CYF. Ms Edwards’ complaint is that CCDHB has made serious allegations about her, without making any attempt to check the facts or give her an opportunity to respond.
[12] CCDHB also told CYF that Jason had disclosed physical (non-sexual) violence from an older sister. Jason was not informed that this information may be used for a CYF report and complains that this information is misleading and should be corrected. Through his mother, Jason likewise made a complaint, seeking the correction of personal information about him.
[13] From the evidence filed, it appears that Ms Edwards made the complaint on behalf of her son in relation to the alleged breaches of his privacy, as well as complaining about breaches affecting her privacy. In the letter from the Privacy Commissioner’s office dated 11 November 2015, setting out its preliminary findings, it refers to the alleged breaches of the appellant’s privacy in relation to rules 2 and 7 of the Health Information Privacy Code (HIPC). Ms Edwards sent a further email to the Privacy Commissioner’s office dated 19 February 2016, requesting that the Commissioner investigate all of the alleged breaches of the appellant’s privacy, which were contained in the statement of claim filed with the Tribunal. The Privacy Commissioner responded on 29 February 2016, declining to investigate those alleged breaches, on the basis they had already been investigated.
[14] The appellant’s sister has filed a similar complaint about breach of privacy and seeks correction of the information about her, which was supplied to CYF, although her complaint is not part of these proceedings.
The decision
[15] The principal issue before the Tribunal was whether it should strike out the appellant’s claim, because his complaint had not yet been investigated by the Privacy Commissioner. To determine the strike-out application, the Tribunal focused on whether it had jurisdiction to hear the appellant’s claim.
[16] There were two parts to the Tribunal’s decision that it had no jurisdiction to
hear the appellant’s claim. They were:
(a) the threshold test under ss 82 and 83 of the Act had not been met, because there was no investigation into the appellant’s complaint; and
(b)under s 73 of the Act, CCDHB had not been notified of the appellant’s complaint and had not responded to it. This was fatal to the appellant’s ability to bring proceedings before the Tribunal.
Sections 82 and 83(a) of the Act – No investigation
[17] The Tribunal concluded that Ms Edwards’ complaints to the Privacy Commissioner alleged breaches of her own privacy only; they did not allege breaches of Jason’s privacy. The Tribunal found that the investigation by the Privacy Commissioner had proceeded on the basis that the complaint concerned only Ms Edwards’ privacy, notwithstanding that the events in issue involved Jason’s health.
[18] The Tribunal found that the requirements of s 83(a) and (b) of the Act “were overlooked” by the appellant in his submissions and there was no standing for him to institute proceedings before the Tribunal. The Tribunal held it had no jurisdiction, because the appellant’s claim had not been investigated. Further, it found there was no evidence that the Director of Human Rights Proceedings either agreed to the appellant bringing proceedings or declined to take proceedings.
[19] The Tribunal noted that its conclusion did not preclude the appellant from “now making a complaint to the Privacy Commissioner” and if he is dissatisfied with the Commissioner’s decision and the statutory pre-requisites to the Tribunal’s jurisdiction are satisfied, the appellant could institute new proceedings before the Tribunal.
Section 73 – Notification to CCDHB
[20] The Tribunal focused on the “mandatory statutory duty” of the Privacy Commissioner in ss 70(2) and 73(2) of the Act to notify the person to whom the complaint relates that the Commissioner intends making an investigation and to inform that person of the details of the complaint, providing the concomitant right to submit a written response. Although steps were taken in relation to the amendment and expansion of the information privacy principles involved in the inquiry, there was never an enlargement as to the identity of the complainant (to include the appellant) alleged to be aggrieved.
[21] The Tribunal found that “this is the rock on which [the appellant’s] submissions founder.”4 The allegations made by the appellant or his sister were never notified to CCDHB, as being included in the Commissioner’s investigation. The Tribunal held that its jurisdiction must be determined by what was done by the Privacy Commissioner under part 8 of the Act, not by what an aggrieved person believes should have been done by the Privacy Commissioner, following the
discussions which took place among Jason, his mother, his sister and CCDHB in
June 2015, outside the Privacy Act process.
Grounds of appeal
[22] The appellant filed seven grounds of appeal, which included errors of law, mistake of fact, failure to consider relevant evidence and procedural unfairness. Those grounds can be summarised as follows:
Errors of law
The Tribunal erred:
(a) in misconstruing ss 82 and 83(a) of the Act;
4 Edwards v Capital and Coast District Health Board, above n 2, at [76].
(b)in focussing on the scope of the Privacy Commissioner’s letters of notification to CCDHB under ss 70 and 73 of the Act instead of the scope of the actual investigation; and
(c) in conducting a collateral review of the Privacy Commissioner’s
process.
Error of law and fact
(d)Further, the Tribunal erred in failing to recognise that the requirements of s 83(a) of the Act were met, because the Privacy Commissioner had conducted an investigation into the appellant’s complaint and confirmed it was taking no further action.
Procedural errors
The Tribunal made the following procedural errors by:
(a) placing the onus on the appellant to show s 83(a) of the Act was met, when the documentary evidence revealed that the Privacy Commissioner had conducted an investigation;
(b) denying access to justice to the appellant by striking out his claim;
(c) failing to act according to the merits, contrary to ss 89 and 105 of the
HRA; and
(d) failing to consider an alternative to strike out.
The CCDHB response
[23] CCDHB’s response is that the Privacy Commissioner’s investigation was limited to Ms Edwards as an aggrieved person and did not investigate breaches of the appellant’s privacy.
[24] CCDHB supports the Tribunal’s decision, in finding that it had no jurisdiction to determine the appellant’s claim. CCDHB claims there was no investigation carried out by the Privacy Commissioner into the appellant’s privacy breaches, which prevents the Tribunal assuming jurisdiction.
[25] For that reason, CCDHB submits that the gateway under ss 82 and 83 of the Act has not been reached. CCDHB relied on Waugh v New Zealand Association of Counsellors Inc, as authority for the jurisdictional gate approach, whereby the Complaints Review Tribunal acquires jurisdiction, only if there has been an investigation by the Privacy Commissioner under the Privacy Act or by the Human
Rights Commission in a HRA case.5
[26] By reference to correspondence from the Privacy Commissioner and the appellant, CCDHB submits that the only complaint that had been investigated was that of Ms Edwards, not her son, the appellant. Thus, the appellant does not qualify as “an aggrieved individual” under ss 73, 82 and 83 of the Act.
New evidence
[27] Following the Tribunal’s decision of 8 June 2016, Moira Edwards made a request under the Official Information Act 1982 (OIA) of CCDHB for its correspondence. On 5 September 2016, she received a copy of a letter of 29 October
2015 from CCDHB to the investigating officer of the Privacy Commissioner. This was a five page response to Moira Edwards’ complaint against the DHB, together with reference to rules 2, 3, 7, 8 and 11 of the Act. Importantly, the letter addresses the information provided by CCDHB to CYF, in respect of both Moira Edwards and the appellant, and responds to both Ms Edwards’ and the appellant’s complaints.
[28] The full CCDHB response of 29 October 2015 was not disclosed to either the Tribunal or the appellant prior to the Tribunal’s hearing of 17 May 2016 or by the date of its decision of 8 June 2016. Because of the fulsomeness of the reply, it is
relevant to the Tribunal’s focus and its findings on the appellant’s standing under
5 Waugh v New Zealand Association of Counsellors Inc HRRT 5/2002, 17 March 2003.
ss 82(2) and 83(a) of the Act and the s 73 notification by the Privacy Commissioner to CCDHB.
Relevant correspondence
[29] The Tribunal based its conclusion on the following evidence, which chronicles the timeline of correspondence among the appellant, his mother, CCDHB and the Privacy Commissioner. The following is the Tribunal’s timeline and its commentary on the items of correspondence relied on.6
[48.1] On 15 April 2015 the Ms Edwards wrote to the CCDHB about the events at Wellington Hospital on 12 June 2013 and complained about alleged interferences with her privacy. By the time Ms Edwards and the Jason met with the CCDHB on 12 June 2015 (with the Jason’s sister participating by telephone) notice had been given to the CCDHB by Ms Edwards and her children that both Jason and his sister had their own complaints.
[48.2] When on 10 September 2015 the Privacy Commissioner gave notice to the CCDHB a complaint under the Privacy Act had been made, it was made crystal clear first, that that complaint was by Ms Edwards and by Ms Edwards alone and second, that the complaint related to an alleged breach of Principle 7 in respect of Ms Edwards and Ms Edwards only.
[48.3] When on 29 September 2015 the Privacy Commissioner gave notice to the CCDHB that the investigation had been broadened the Commissioner made it clear first, that the complaint was still by Ms Edwards in relation to alleged interferences with her privacy and second, that the broadening applied only to the inclusion in her complaint of Principles 2, 3, 8 and 11.
[48.4] The Privacy Commissioner's letter of 12 November 2015 to the CCDHB which advised the file would be closed again had as its exclusive focus the complaint made by Ms Edwards about her privacy.
[48.5] While the Commissioner's letter of 10 September 2015 made reference to Jason, the reference was in the context of the narrative of facts explaining the circumstances in which the complaint by Ms Edwards (alleging a breach of her privacy) had been made. The reference cannot reasonably be construed as an express or implied notice to the CCDHB under s 73(b) that the investigation related also to a complaint by Jason. Quite apart from the terms of the letter making it clear the Commissioner was investigating a complaint by Ms Edwards, there was at that date no complaint by Jason with the Commissioner.
[48.6] The Certificate of Investigation dated 12 November 2015 signed by
Ms Jamieson-Smyth faithfully reflects those matters in relation to which the
6 In the Tribunal’s proceeding, Ms Edwards was the first plaintiff and the appellant, the second plaintiff. Their names have been inserted in the quote for ease of reference.
CCDHB had been given notice by the Privacy Commissioner. Such notice related to Ms Edward’s complaints regarding interferences with her privacy.
[48.7] However interpreted, the statement by Mr Stephen in his letter dated
28 January 2016 that Ms Edwards had complained about the collection and
disclosure of her “and her son Jason’s personal information” cannot alter the fact that the CCDHB was never given notice by the Privacy Commissioner of any complaint by Jason.
[30] There were two items of correspondence, which were available to this Court on the appeal hearing but were not available to the Tribunal, either at its hearing or before the delivery of its decision. The first is the letter from CCDHB dated
29 October 2015 was not disclosed to either the appellant, Ms Edwards or the Tribunal. This is described and referred to in the previous section under “New evidence”.7
[31] The second letter is the final letter from the Privacy Commissioner dated
8 July 2016, which confirms that the Privacy Commissioner will not investigate the appellant’s complaint dated 19 February 2016, because the events at issue have already been investigated in respect of Ms Edwards’ complaint. Each of these letters will be considered under the analysis of the issues raised in the proceeding.
Analysis
[32] The issues raised in this proceeding can be summarised as follows:
(a) Did the Tribunal err in fact or in law, in finding it had no jurisdiction under ss 82 and 83(a) of the Act?
(b)Did the Tribunal err in finding that CCDHB was never notified of the allegations made by the appellant?
(c) Did the Tribunal, in striking-out the appellant’s claim, act consistently with s 105 of the HRA?
[33] I will deal with each of the issues, under the respective headings.
7 At [27] and [28].
Did the Tribunal err in fact or in law, in finding it had no jurisdiction under ss 82 and 83(a) of the Act?
[34] The basis of the Tribunal’s finding that it had no jurisdiction was that the Privacy Commissioner had not investigated the appellant’s complaint, because the Commissioner had not notified CCDHB of his complaint. I agree with CCDHB that the starting point for determining the Tribunal’s jurisdiction is ss 82 and 83 of the Act. These sections provide a jurisdictional gateway for proceedings before the Tribunal. I will deal with the legal requirements of the Act before addressing the facts.
[35] For completeness, the sections provide:
Section 82 – Proceedings before Human Rights Review Tribunal
(1) This section applies to any person—
(a) in respect of whom an investigation has been conducted under this Part in relation to any action alleged to be an interference with the privacy of an individual; or
(b) in respect of whom a complaint has been made in relation to any such action, where conciliation under section 74 has not resulted in a settlement.
(2) Subject to subsection (3), civil proceedings before the Human Rights Review Tribunal shall lie at the suit of the Director of Human Rights Proceedings against any person to whom this section applies in respect of any action of that person that is an interference with the privacy of an individual.
…
(5) Where proceedings are commenced by the Director of Human Rights Proceedings under subsection (2), the aggrieved individual (if any) shall not be an original party to, or, unless the Tribunal otherwise orders, join or be joined in, any such proceedings.
Section 83 – Aggrieved individual may bring proceedings before Human
Rights Review Tribunal
Notwithstanding section 82(2), the aggrieved individual (if any) may himself or herself bring proceedings before the Human Rights Review Tribunal against a person to whom section 82 applies if the aggrieved individual wishes to do so, and—
(a) the Commissioner or the Director of Human Rights Proceedings is of the opinion that the complaint does not have substance or that the matter ought not to be proceeded with; or
(b) in a case where the Director of Human Rights Proceedings would be entitled to bring proceedings, the Director of Human Rights Proceedings—
(i) agrees to the aggrieved individual bringing proceedings; or
(ii) declines to take proceedings.
[36] The Tribunal observed that consistent with the scheme of the Act, only the Director of Human Rights Proceedings or the aggrieved individual can seek remedies from the Tribunal.8
[37] The Tribunal found it did not have jurisdiction to consider claims where the Privacy Commissioner had not turned its mind to the issue. It noted that s 82 of the Act permits civil proceedings to be taken before the Tribunal at the suit of the Director of Human Rights Proceedings, where the defendant is a person in respect of whom an investigation has been conducted, in relation to “any action” alleged to be an interference with the privacy of an individual. Alternatively, s 83 enables an “aggrieved individual” to have standing to institute proceedings, provided the intended defendant is a person to whom s 82 applies, namely a person in respect of whom an investigation has been conducted by the Privacy Commissioner and the Privacy Commissioner is of the opinion that the complaint does not have substance.
[38] In Waugh v New Zealand Association of Counsellors Inc, the Tribunal there described s 83 of the Act as being a filtering mechanism.9 It said:
It seems to us to be implicit that the Privacy Commissioner must first have turned his mind to the issue which is the proposed subject of the proceedings so as to reach one or other of [the two options in s 83(a)]. The requirement is part of a deliberate legislative ‘filtering’ mechanism that applies to cases before they can be brought to the Tribunal. It would in our view defeat the object of that filtering process if the Tribunal were to purport to assume jurisdiction over issues in respect of which the Privacy Commissioner… has not formed with one of the two options specified in section 83(a).
[39] Adopting that approach, the Tribunal here accepted that Ms Edwards had expanded her complaint to include breaches of further HIPC rules, but did not accept that the expansion related to breaches alleged by the appellant. The Tribunal was of
the view that the complaint was that of Ms Edwards alone.
8 Edwards v Capital and Coast District Health Board, above n 2, at [62] and see ss 84, 85 and 88.
9 Waugh v New Zealand Association of Counsellors Inc, above n 5, at [20(c)].
[40] The Tribunal noted that separate complaints were anticipated to be filed by Jason and his sister, but this was not carried through, because in subsequent discussion with the investigating officer, Ms Edwards gained the impression the investigation was to be expanded to include complaints by her son and daughter.
[41] The Tribunal focused on the Privacy Commissioner’s letter of 29 September
2015, in which the investigator gave notice to CCDHB that, following discussion with Ms Edwards, in addition to investigating a possible breach of rule 7, he was now giving notice of an expanded investigation which would enquire additionally into alleged breaches of rules 2, 3, 8 and 11. The letter was “still headed”, “Privacy Act Complaint: Ms Edwards and CCDHB”, which the Tribunal noted was the same heading of the letter dated 10 September 2015, following Ms Edwards’ complaint to the Privacy Commissioner. The Tribunal said further “Significantly, however, the letter made no mention of the investigation being expanded to include the [appellant]
or [his sister.]”10
[42] Although the Privacy Commissioner’s letter of 10 September 2015 made reference to the appellant, the Tribunal viewed the reference to him as being in the context of the narrative of facts, explaining the circumstances in which the complaint by Ms Edwards had been made.
[43] The Tribunal also observed “as an aside” that the “Certificate of Investigation” is routinely issued by the Privacy Commissioner to a party intending to file proceedings in the Tribunal, as prima facie evidence that certain pre-requisites in ss 82 and 83 of the Privacy Act have been satisfied. The Certificate of Investigation dated 12 November 2015 referred only to Ms Edwards. As part of its reasoning, the Tribunal focussed on s 73 of the Act and the Commissioner’s notification to CCDHB, which it found never broadened to anyone else other than Ms Edwards. On that basis, the Tribunal found that the “action” referred to in s
82(1)(a) and (b) of the Act is an action in respect of which notice is given by the Privacy Commissioner under s 73(b). Because the Tribunal considered the notice did not include the appellant, it found it did not have jurisdiction under s 82(1)(a) or
(b) of the Act.
10 Edwards v Capital and Coast District Health Board, above n 2, at [36].
[44] I consider that the Tribunal has erred in law, by asking itself the wrong question. Although the Tribunal placed reliance on Waugh, a critical passage was overlooked, which reminds the Tribunal that it is not for the Tribunal to question the way in which the Privacy Commissioner carries out his statutory responsibilities but whether he has in fact conducted an investigation into the matters that are to be the
subject of a hearing in the Tribunal.11
[45] Here, the Tribunal focussed on the notification from the Privacy Commissioner to CCDHB to define the Tribunal’s jurisdiction, rather than ascertaining whether “an investigation has been conducted … in relation to any action alleged to be an interference with the privacy of” the appellant. This is considered further below in the discussion on the notification issue, following the next section on the evidence.
[46] I now turn to consider the evidence that was both before the Tribunal and before this Court. On the evidence before this Court, it is plain that the Privacy Commissioner considered the appellant’s complaint dated 19 February 2016, had already been investigated, because the events at issue in respect of Ms Edwards’ complaint had already been investigated. The following key documents, the last one of which was not available to the Tribunal, demonstrate the Privacy Commissioner’s decision.
(a) Letter dated 11 November 2015.
This letter was available to the Tribunal but no reliance was placed upon it. Under alleged breach of rule 2, the Privacy Commissioner says:
Accordingly, it is my view there is no breach of rule 2, as there is no evidence the DHB collected information that was not from you or your son.
Under rule 7, the Privacy Commissioner records:
You also objected to the line “Jason also disclosed physical
(non sexual) violence from the older sister”. You sought to
11 Waugh v New Zealand Association of Counsellors Inc, above n 5, at ;31(b)]..
have additional comment added to this line to convey that the DHB did not make any efforts to check the accuracy of this record, and that it is in dispute. The position of the DHB is that this information was taken from a confidential disclosure, and any further investigation of the veracity of the statement is the responsibility of the investigating agency and not the DHB. Therefore it declines to amend this information, on the basis that it is accurate and not misleading.
Under rule 8, the Privacy Commissioner also observed:
You also said you disagreed with the allegation that your son had suffered physical abuse at home, and you alleged this was not checked for accuracy before being reported to CYF. The DHB said that when it makes a report of concern to CYF, its staff aim to provide sufficient detail to indicate a potential need for further investigation by CYF staff. The DHB said its staff may not have the opportunity to verify the information, and in many cases requesting more information from family of a patient may be inappropriate.
(b)The Privacy Commissioner’s letter dated 28 January 2016, sent to the Tribunal, following the filing of the statement of claim by Ms Edwards.
The Privacy Commissioner confirms that he did investigate a complaint by Ms Edwards involving a possible interference with rules 2, 3, 7, 8 and 11 of the HPIC. Pertinently, the Privacy Commissioner adds:
[Ms Edwards] complained about the Capital and Coast District Health Board’s collection and disclosure of her and her son’s [Jason’s] personal information in 2013. She also complained the DHB failed to ensure the accuracy of the information before disclosing it to Child Youth and Family. [Ms Edwards] also alleged the DHB failed to respond appropriately to her request for correction.
In addition, the Privacy Commissioner highlighted a jurisdictional problem for the Tribunal, in relation to issues under rule 6 of the Act only. As Ms Edwards did not bring up any rule 6 issues during the Privacy Commissioner’s investigation, he was of the view that the Tribunal did not have jurisdiction. Notably, no similar statement was
made about lack of jurisdiction in respect of Ms Edwards son’s
disclosure of personal information in 2013.
(c) The Privacy Commissioner’s email to Ms Edwards dated 29 February
2015.
This deals with the appellant’s standing with regard to “these proceedings” noting that there was a new complaint to the Privacy Commissioner on behalf of the appellant and his sister. The letter details the facts of the appellant’s complaint regarding the information obtained by CCDHB and forwarded to CYF.
(d) The Privacy Commissioner’s email to Ms Edwards dated 29 February
2016.
In this email, the Privacy Commissioner advised Ms Edwards that the matters raised in the complaint of 19 February, from the appellant and his sister, was information that was covered by the same set of facts, which was investigated in Ms Edwards’ complaint. In relation to the CCDHB doctor who took the appellant’s information, the Privacy Commissioner said:
… It is my view these are part of the same set of facts which were investigated in C/27145.12 We have already investigated the CCDHB regarding these matters, and we did not find there had been a breach of your privacy. I do not consider it necessary to notify this matter when the CCDHB’s use of information concerning the events of June
2013 has already been investigated.
(e) Letter from CCDHB to the Privacy Commissioner dated 29 October
2015.
This is the letter referred to under the section “New evidence”, which
was not disclosed to the Tribunal or to Ms Edwards.
12 The reference number for the complaint from Ms Edwards.
[47] In light of the importance of the letter dated 29 October 2015 from CCDHB, it is relevant to set out its material responses to each of the alleged breaches of the HIPC’s rules, in relation to the appellant:
(a) Under rule 2, CCDHB responds that it cannot find any example of an incident where the DHB has sought information from anyone other than Ms Edwards “or her son, Jason”.
(b)Under rule 3, CCDHB responds that “an applicable exception to rule 3 would be that compliance would prejudice the interests of the individual concerned (Jason) or prejudice the purpose of collection.”
(c) Under rule 7, CCDHB addresses Jason’s complaint that Jason also disclosed physical (non-sexual) violence from an older sister and CCDHB’s position is set out, noting that the disclosure was made by a patient to the crisis team and that further investigation as to the veracity of the statement is the responsibility of CYF, not the DHB. This was in response to Jason’s request to change the record of his disclosure to CCDHB.
(d)Under rule 8, it is noted that Ms Edwards takes issue with the failure to check the accuracy of the allegation made by Jason that he had suffered physical abuse at home. CCDHB’s response is given in full on that issue.
(e) Under rule 11, CCDHB’s response that s 7 of the Act overrides the general principles of the Act, which in the context of the letter from CCDHB merges both the complaints of the appellant and his mother.
[48] Those documents illustrate the following:
(a) CCDHB was fully informed of the nature of the allegations from the appellant, as well as his mother.
(b)The Privacy Commissioner considered that it had investigated the appellant’s complaint, by dint of the investigation into the same facts and circumstances surrounding the complaint from Ms Edwards.
(c) The Privacy Commissioner was indicating clearly that it was not
going to investigate the appellant’s complaint any further.
[49] A further letter of confirmation from the Privacy Commissioner was sent to Ms Edwards dated 8 July 2016. It confirmed the previous advice from the Privacy Commissioner that it would not investigate the appellant’s complaint of 19 February
2016, as the events had already been investigated in respect of Ms Edwards’ complaint. The Privacy Commissioner would however investigate the complaint dated 8 June 2016 relating to an alleged breach of rule 7 of the HIPC.
[50] Although the 29 October 2015 and 8 July 2016 letters were not available before the Tribunal at its hearing, it is evident from the information disclosed that the Privacy Commissioner had reached a preliminary view that the matters affecting the appellant and his mother did not amount to interference with their privacy. On that basis, the requirements of ss 82(1)(a) and 83(a) were met, because the Privacy Commissioner has made a finding about the complaints from the appellant and his mother, as a result of his investigation.
[51] Contrary to the Tribunal’s finding therefore that “the requirements of s 83(a) and (b) appear to have been overlooked in the submissions” made on behalf of the appellant, the evidence clearly points to the fact that the Privacy Commissioner considered he had investigated the appellant’s complaints and reached a final decision.
[52] I have considered the Tribunal’s reference to the wording of the Certificate of Investigation, which refers to Ms Edwards only. I note that the Tribunal refers to it “as an aside.” I consider it is relevant that the certificate was not signed by the Privacy Commissioner’s investigating officer for this matter and as the Tribunal
noted in Director of Human Rights Proceedings v Wilson,13 certificates are not
13 Director of Human Rights Proceedings v Wilson [2010] NZHRRT 8 at [17].
always accurate and where there is other relevant evidence, a certificate will not be determinative.
[53] I find that the Tribunal has erred in fact, in finding it had no jurisdiction to hear that part of the statement of claim, which relates to the appellant’s complaint, because the Commissioner considers he has, in fact, conducted an investigation into those matters raised by the appellant and has confirmed his view in writing twice.
Did the Tribunal err in finding that CCDHB was never notified of the allegations made by the appellant?
[54] The Tribunal defined “the critical and determinative point” in relation to its jurisdiction as whether CCDHB was given notice of any expansion in the scope of the inquiry as to the identity of the appellant. The determinative provisions for the Tribunal were ss 70(2) and 73(2) of the Act, which respectively require the Privacy Commissioner to “advise … the person to whom the complaint relates” and “inform” that person “of the Commissioner’s intention to make the investigation” and of their right to respond to the details of the complaint.
[55] For the reasons canvassed above in respect of the documentary evidence, CCDHB was notified of Ms Edwards’ complaint, as well as the appellant’s. The letter of 29 October amply demonstrates that not only was CCDHB advised of the appellant’s complaint, it was informed of the details, such that CCDHB was able to provide a full written response. It is surprising and concerning that the 29 October letter, which was critical to the Tribunal’s findings, was not disclosed. It took an OIA request by Ms Edwards after the Tribunal hearing to flush out CCDHB’s full response, covering both Ms Edwards and her son’s complaints.
[56] The CCDHB response is further reason that the Tribunal’s finding, that the “action” referred to in s 82(1)(a) and (b) is an action in respect of which notice was given by the Privacy Commissioner under s 73(b), cannot stand.
[57] Sections 70 and 73 govern investigations by the Privacy Commissioner and prescribe the procedural steps to be taken in investigating a complaint of breach of privacy. Although the Tribunal was correct to observe that the Privacy
Commissioner has mandatory obligations under ss 70 and 73 to notify and inform the person to whom the complaint relates of the matters prescribed, it is difficult to construe these sections as determining the meaning of “action” referred to in s 82, which specifically concerns the jurisdiction of the Human Rights Review Tribunal. As already discussed,14 the critical threshold test under s 82 is whether an investigation has been conducted in relation to any action alleged to be an interference with the privacy of an individual.
[58] Under ss 70 and 73, the Commissioner’s duty is to advise and inform of his intention to make an investigation into a complaint and the right to respond. The Tribunal referred to L v T, where the Tribunal held that s 73 governs the scope of the investigation and the scope of the investigation in turn governs the jurisdiction of the
Tribunal.15 This approach conflicts with the statutory framework of the Act and with
other authority.
[59] Sections 70 and 73 are placed under the headings “Investigations by Commissioner” and “Proceedings of Commissioner” respectively. They concern the Commissioner’s procedures, before an investigation commences. Sections 82 and 83 are under the heading “Proceedings before Human Rights Review Tribunal” and concern the standing of persons entitled to bring proceedings to the Tribunal and the Tribunal’s jurisdiction.
[60] The Tribunal has accepted the reasoning in Director of Human Rights Proceedings [NKR] v Accident Compensation Corporation (Strike-out application)16 that “any investigation by the Privacy Commissioner is likely to be ambulatory”, because as an investigation progresses and the facts become clearer, the investigation may widen, narrow or change direction.
[61] Having adopted the reasoning in NKR, the Tribunal accepted the investigation broadened from rule 7 to include rules 2, 3, 8 and 11 but decided that the
investigation never broadened to include the appellant’s complaint. The Tribunal
14 At [45].
15 L v T (1998) 5 HRNZ 30.
16 Director of Human Rights Proceedings [NKR] v Accident Compensation Corporation [2014] NZHRRT 1, (2014) 10 HRNZ 279.
then elevated s 73 to be the threshold test for the jurisdiction of the Human Rights Review Tribunal, on the basis of whether CCDHB had received adequate notice and had a right to be heard.
[62] In this way, the Tribunal determined its jurisdiction threshold was s 73, making the Privacy Commissioner’s notification the “critical and determinative point”, rather than the approach in Waugh, namely determining whether an investigation had been conducted. The Waugh approach is more consistent with the framework of the Act.
[63] In doing so, the Tribunal overlooked the documentary evidence that was before it, which indicated clearly the Privacy Commissioner considered he had completed the appellant’s investigation. To restrict the definition of “action” in ss 82(1)(a) and (b) to be an action in respect of which notice was given by the Privacy Commissioner under s 73(b), restricts the ambit of the Privacy Commissioner’s investigation. The approach in NKR accords with the nature of undertaking investigations, which as they progress, may well widen, narrow or change direction, as the facts become clearer.
[64] In this case, the investigation did broaden and as the CCDHB response of
29 October 2015 demonstrates, CCDHB had been fully and fairly advised and informed of the nature of the complaints raised by both the appellant and Ms Edwards.
[65] I do not consider the Tribunal has undertaken a collateral review of the Privacy Commissioner’s process, but I do find, as above, that in determining its jurisdiction, the Tribunal has erred by finding that the Privacy Commissioner’s notification determines the scope of a subsequent investigation and the jurisdiction of the Tribunal.
Did the Tribunal, in striking-out the appellant’s claim, act consistently with s 105 of the Human Rights Act 1993?
[66] The Tribunal struck-out the appellant’s claim, stating that the strike-out
would not prevent the appellant from “now making a complaint to the Privacy
Commissioner.” The Tribunal stated further that if the appellant was satisfied with the Commissioner’s decision and if the statutory pre-requisites to the Tribunal’s jurisdiction are satisfied the appellant can institute new proceedings before the Tribunal.
[67] The correspondence from the Privacy Commissioner confirms that even if the Privacy Commissioner was prepared to investigate the appellant’s complaint again, he is precluded from doing so, because he has already made findings that CCDHB’s actions did not amount to an interference with the appellant’s privacy.
[68] The appellant submits that by striking-out his claim, the Tribunal has effectively deprived him of access to justice. The impact of a strike-out, where there are access to justice issues, have been taken into account in strike-out decisions.17 In addition to the access to justice considerations, s 89 of the Act requires certain provisions of the HRA, relevantly part 4 of the HRA, to apply in respect of proceedings under ss 82 or 83 of the Act.
[69] Part 4 of the HRA includes s 105, which provides:
Substantial merits
(1) The Tribunal must act according to the substantial merits of the case, without regard to technicalities.
(2) In exercising its powers and functions, the Tribunal must act—
(a) in accordance with the principles of natural justice; and
(b) in a manner that is fair and reasonable; and
(c) according to equity and good conscience.
[70] Before exercising its strike-out jurisdiction, the Tribunal must take into account the substantial merits of the case, without focusing on technical deficiencies or an overly stringent approach to matters concerning a breach of rights or access to
justice.
17 Duffy v Drury [2009] NZHRRT 30 at [22].
[71] In this case, the Tribunal ultimately found that it had no jurisdiction, because the appellant’s claim had not been investigated. Rather than resorting to strike-out, it was open to the Tribunal to stay or adjourn the proceedings, to ascertain from the Privacy Commissioner (or to require Ms Edwards to provide confirmation) whether the Privacy Commissioner had completed an investigation into the appellant’s claim.
[72] As has become apparent in this hearing, the Privacy Commissioner again confirmed his previous advice that his office would not investigate the appellant’s complaint, as the events at issue had already been investigated in respect of Ms Edwards’ complaint.
[73] It is unfortunate that strike-out procedures, which should be used as a last resort, were used by the Tribunal, in the mistaken belief that the appellant had another opportunity to have his claim investigated by the Privacy Commissioner.
Decision
[74] For the foregoing reasons, I find that the Tribunal has erred in:
(a) Overlooking that the s 83(a) requirements were met in this case because the Privacy Commissioner has made it clear that:
(i)it has investigated the appellant’s complaint of privacy breaches; and
(ii)decided that the complaint is not upheld or does not have substance. There was no onus on the appellant to show that s 83(a) was met.
(b)Failing to have regard to the disclosed correspondence, which shows that the Privacy Commissioner considered it has investigated the appellant’s complaint, as it arose from the same set of facts underlying Ms Edwards’ complaint.
(c) Finding the scope of the notification by the Privacy Commissioner to CCDHB determines the Tribunal’s jurisdiction under s 82 and 83 of the Act, when the threshold test for the Tribunal’s jurisdiction is whether an investigation has been conducted.
(d)Failing to act according to the merits of the complaint under s 105 of the HRA when the respective complaints of the appellant and his mother justify a merits-based approach in this case, particularly as the information reported by CCDHB is both misleading and damaging to the appellant and his mother.
(e) Striking out the proceedings without verifying whether the Privacy
Commissioner had investigated the appellant’s complaint.
[75] Additionally, the reply from CCDHB to the Privacy Commissioner dated
29 October 2015, which was not disclosed to the Tribunal or to the appellant, clearly shows that CCDHB was notified of the appellant’s complaint.
Expenses
[76] The appellant’s reasonable disbursements are to be paid by CCDHB. Leave
is reserved.
Cull J
3
0
1