Mitchell v Privacy Commissioner
[2017] NZHC 569
•2 November 2017
IN THE HIGH COURT OF NEW ZEALAND WELLINGTON REGISTRY
I TE KŌTI MATUA O AOTEAROA
TE WHANGANUI-Ā-TARA ROHE
CIV-2017-485-458 [2017] NZHC 569
UNDER THE Judicature Amendment Act 1972 section 4 IN THE MATTER OF
an application for Judicial Review
BETWEEN
KERRYN MITCHELL Applicant
AND
PRIVACY COMMISSIONER Respondent
Hearing: 16 October 2017 Appearances:
K Mitchell self-represented applicant
J Foster and N Walker for respondentJudgment:
2 November 2017
JUDGMENT OF CULL J
[1] In late 2015, Ms Mitchell complained to the Privacy Commissioner (the Commissioner) about two separate disclosures of her personal information by the Department of Corrections (Corrections) to the Police. The Commissioner decided to investigate the complaint under Part 8 of the Privacy Act 1993 (the Act) on the basis it raised a possible interference with privacy in respect of privacy principle 11 (limits on disclosure of personal information) and rules 10 and 11 of the Health Information Privacy Code 1994 (the Code).
[2] Ms Mitchell seeks to judicially review the decision of the Commissioner to limit his investigation of her complaint. Ms Mitchell submits the scope of the investigation should have been wider into all the various privacy principles she
believes were breached.
MITCHELL v PRIVACY COMMISSIONER [2017] NZHC 569 [2 November 2017]
[3] The Commissioner opposes the application and argues it is meritless. The Commissioner submits he did not err in law when deciding to limit the scope of his investigation. The statutory scheme limits the Commissioner’s jurisdiction to investigating complaints that appear to be an interference with privacy and Ms Mitchell has not raised any factual foundation to support her claim that there were possible interferences in relation to other privacy principles.
[4] The key issues to determine in this proceeding are whether the Commissioner’s decision to limit the scope of his investigation was an error of law, or that he failed to examine mandatory considerations, took into account irrelevant ones, breached Ms Mitchell’s natural justice rights or made an unreasonable decision.
Factual background
[5] In late 2015, Ms Mitchell complained to the Commissioner about two separate disclosures of her personal information by Corrections to the Police. The first disclosure was in relation to 47 pages of PC01 forms containing Ms Mitchell’s information requests. The second disclosure was the release of a psychological report written for the Parole Board.
[6] The Commissioner decided to investigate Ms Mitchell’s complaint in relation to disclosures by Corrections under Part 8 of the Act. The investigation was limited to whether there was a possible interference with Ms Mitchell’s privacy in relation to privacy principle 11 (limits on disclosure of personal information)1 and rules 10 and
11 of the Code, which relate to the limits on the use and disclosure of health information. Ms Mitchell did not indicate any dissatisfaction with the Commissioner’s decision as to the scope of the investigation at the time the decision was made or during the investigation process.
[7] The Commissioner and Ms Mitchell discussed the complaint and the scope of the investigation on 3 November 2015. The Commissioner gave his preliminary
1 The privacy principles are found in Privacy Act 1993, s 6.
conclusions to Ms Mitchell on 10 December 2015, with the opportunity for
Ms Mitchell to respond. Ms Mitchell responded on 15 December 2015.
[8] The Commissioner concluded that there had not been any privacy breaches and issued a certificate of investigation to this effect on 22 December 2015. In relation to the disclosure of the PC01 forms, the Commissioner determined that the disclosure, at the request of a judge, was permitted under an exception to principle
11, as it was necessary for the conduct of court proceedings. In relation to the disclosure of the psychological report, the Commissioner determined that this was permitted as an exception to rule 11 of the Code, as it was reasonable for the police to have this information to manage Ms Mitchell’s release back into the community.
[9] The investigation was formally closed to enable Ms Mitchell to take proceedings in the Human Rights Review Tribunal (the Tribunal).2
[10] On 25 February 2016, Ms Mitchell commenced proceedings in the Tribunal against Corrections. Corrections challenged the Tribunal’s jurisdiction to consider Ms Mitchell’s claims of alleged breaches of privacy principles that were not considered by the Commissioner (principles 3–6 and 8–10). Ms Mitchell advised the Tribunal she intended to review the decision made by the Commissioner to limit his investigation and she filed this current application on 6 June 2017.
[11] On 30 June 2017, Thomas J stayed the proceedings in the Tribunal, pending the outcome of the current judicial review application.
Ms Mitchell’s position
[12] Ms Mitchell argues the Commissioner acted unlawfully, unreasonably and unfairly by failing to undertake a full and thorough investigation and issuing the proper documentation (certificate of investigation to the Tribunal). This means,
Ms Mitchell says that she is unable to bring proper proceedings in the Tribunal.
2 Under s 83(a) of the Privacy Act 1993 an aggrieved person may bring proceedings before the Human Rights Review Tribunal where the Commissioner is of the opinion that the complaint does not have substance or ought not to be proceeded with.
[13] Ms Mitchell alleges that the disclosure of her private information by Corrections interfered with principles 3–6 and 8–11. However, the Commissioner only investigated principle 11 and did not refuse to investigate the complaint for any of the reasons provided in s 71 of the Act.3 Further, the Commissioner did not give any reasons why the other privacy principles were not investigated even though Ms Mitchell wanted a thorough investigation.
[14] Ms Mitchell claims the following grounds of judicial review:
(a) Error of law: the Commissioner’s decision was materially influenced by legal error, in using rules 10 and 11 of the Code instead of investigating the breaches of privacy principles outlined by Ms Mitchell. These rules did not apply to Ms Mitchell.
(b)Failure to take into account mandatory considerations: the Commissioner consolidated Ms Mitchell’s two complaints and did not investigate any interference in relation to the Police, only Corrections. The Commissioner also failed to consider the relevant privacy principles.
(c) Taking into account irrelevant matters: the Commissioner considered the rules of the Code and not the relevant privacy principles. The Commissioner also failed to ask Ms Mitchell for context and reasons and went off on his own tangent. The Commissioner was motivated by an improper purpose, namely, his own interpretation of the complaints.
(d)Breach of natural justice/procedural unfairness: the Commissioner is restricting Ms Mitchell’s access to the Tribunal because of a flaw in the process of issuing certificates of investigation and the lack of information that claims that are not investigated by the Commissioner
cannot be pursued in the Tribunal.
3 I note here that s 71 of the Privacy Act 1993 applies to where a Commissioner “may” decide to
take no action on a complaint and is discretionary.
[15] Ms Mitchell seeks two declarations as relief: that the Commissioner failed to investigate her complaint properly and thoroughly and that if the Commissioner does not fully investigate the privacy principles then there is a jurisdictional barrier in bringing proceedings in the Tribunal.
Privacy Commissioner’s position
[16] The Commissioner opposes Ms Mitchell’s application on the grounds it is meritless. The Commissioner notes there is only one key issue in this appeal, whether the Commissioner erred in law in determining the scope of his investigation.
[17] The Commissioner submits he did not err in law when deciding to limit the scope of his investigation. The statutory scheme limits the Commissioner’s jurisdiction to investigating complaints that appear to be an interference with privacy and Ms Mitchell has not raised any factual foundation to support her claim that there were possible interferences in relation to other privacy principles. The Commissioner is not required under the statutory scheme to investigate all the principles raised in a complaint, only those actions that are or appear to be an
interference with privacy.4 The Commissioner did so in this case and there is no
error of law.
[18] Second, the Commissioner submits his decision was open to him on the facts of Ms Mitchell’s complaint; it was not unreasonable and it was not procedurally unfair. The principles and rules investigated were relevant in the present case. The decision was not procedurally unfair as the Commissioner made it clear which principles were being investigated and why and Ms Mitchell was provided numerous opportunities to comment on this. This, the Commissioner says, is sufficient under the statutory scheme and the decision was not unreasonable in the Wednesbury sense
or on any standard.5 The Commissioner notes as an expert decision-maker, he must
be granted considerable latitude in determining the most appropriate course of action to assess complaints and investigate the most relevant issues, as guided by the
statutory scheme.6
4 Privacy Act 1993, ss 66, 67 and 69.
5 Associated Provincial Picture Houses Ltd v Wednesbury Corp [1948] 1 KB 223 (CA).
6 Citing Attorney-General v Mair [2009] NZCA 625 at [56]; and Donnelly v Waitangi Tribunal
[19] Finally, the Commissioner identifies that even if there was an error of law, any remedy is discretionary. A remedy should be denied given the lack of gravity of the error. Ms Mitchell still has a right to be heard in the Tribunal and it does not follow that she will be prejudiced in substance if the Tribunal considers fewer principles. Further, Ms Mitchell has available alternative avenues of challenge, namely, making a complaint to the Ombudsman about the Commissioner’s decision, which is a preferable remedy in most cases involving the Commissioner’s decisions.
Relevant law
Judicial review
[20] Judicial review is part of the supervisory function of the Court which ensures public power is exercised according to the law.7 It is primarily concerned with examining procedural compliance, not the substance of the decision itself, when assessing whether a decision should be allowed to stand.8 In X v Bovey, MacKenzie J reiterated the difference between a judicial review and an appeal:9
An application for judicial review is not an appeal against the challenged decision. The function of the Court is to review the lawfulness of the decision making process, not the merits of the decision itself. In reviewing the lawfulness of the decision making process, the Court operates within a framework of quite well developed but flexible principles about categories of situations in which the Court may intervene.
[21] The grounds relied on by Ms Mitchell in this application are error of law, failure to take into account mandatory considerations, taking into account irrelevant considerations, breach of natural justice and unreasonableness.
[22] Any error of law must be material, that is, “one which may well have altered the ultimate decision”.10 This can arise, for example, where a decision maker has
applied a gloss to a statutory test, or asked him or herself the wrong question.11
HC Wellington CIV-2009-485-2614, 1 March 2010 at [30]. The Commissioner notes that while his role is not that of a court or tribunal in the same sense as the Waitangi Tribunal, his specialised expertise in privacy law is analogous.
7 Mercury Energy Ltd v Electricity Corporation of New Zealand Ltd [1994] 2 NZLR 385 (PC).
8 Aorangi School Board of Trustees v Ministry of Education [2010] NZAR 132 (HC) at [8].
9 X v Bovey [2014] NZHC 1103 at [4].
10 Astrazeneca Ltd v Pharmaceutical Management Agency HC Wellington CIV-2011-485-2314,
22 December 2011 at [73].
11 Matthew Smith New Zealand Judicial Review Handbook (Brookers, Wellington, 2011) at 709.
[23] Mallon J in Berryman v Solicitor-General explained the approach taken to claims a decision maker failed to take into account relevant considerations as follows:12
A person with a statutory power must exercise that power within perimeters set by the statute. The statute may require or permit (expressly or by implication) that the decision maker take into account certain considerations (these are referred to as “the relevant considerations”). The weight the decision maker places on a relevant consideration is a matter for the decision maker. This means that failing to take into account the required (or mandatory) relevant considerations is a ground of judicial review but failing to have “sufficient regard” to relevant factors is not.
[24] The requirement of natural justice involves a duty on the decision maker to act in good faith and fairly listen to both sides, including that the parties be given adequate notice and opportunity to be heard.13
[25] A finding of unreasonableness, based on Wednesbury principles, will be made where a decision is so unreasonable that no sensible person could have made it.14
Something must be overwhelmingly wrong with the decision.
Privacy protection and investigation powers
[26] The purpose of the Privacy Act is to promote and protect individual privacy, by establishing principles about the collection, use and disclosure of personal information; providing access for individuals to their information held by public agencies; and providing for the appointment of the Commissioner to investigate complaints about interferences with individual privacy.15
[27] The twelve information privacy principles are at the heart of the Act and contained in s 6. The principles regulation collection (principles 1–4), storage and security (principle 5), access (principle 6), correction and accuracy of information (principles 7 and 8), use of information (principles 9 and 10), limits of disclosure of
private information (principle 11) and the use of unique identifiers (principle 12).
12 Berryman v Solicitor-General [2008] 2 NZLR 772 (HC) at [84].
13 Laws of New Zealand Administrative Law (online ed) at [58].
14 Wednesbury Corp, above n 5.
15 Privacy Act 1993, preamble.
[28] The Commissioner may also issue a Code of Practice that may modify the application of any one or more of the information privacy principles by prescribing standards and exempting any action from any such principle.16 These Codes have the same legal status as the information privacy principles, namely, failure to comply with a code is deemed to be a breach of an information privacy principle.17 The Health Information Privacy Code is one of these.
[29] In this case, the Commissioner considered rr 10 and 11 of the Code were relevant to his investigation. Rule 10 prescribes limits on the use of health information and r 11 prescribes limits on its disclosure.
[30] Under Part 8 of the Act, the Commissioner has the function of investigating complaints about actions appearing to interfere with the privacy of an individual. The relevant provisions outline:
(a) Section 66: when an action is an interference with the privacy of an individual, namely where there has been a breach of a principle or code and the action has or may cause loss, detriment, damage, injury, significant humiliation, significant loss of dignity, or adverse effects on the individual’s rights or interests.
(b)Sections 67 and 68: that any person may make a complaint to the Commissioner alleging an interference and the process that must be followed to make a complaint.
(c) Sections 69–71: the functions of the Commissioner (investigate, act as a conciliator and take such further action as is contemplated by the Act), when an investigation may be commenced and the action to be taken (or not) on receipt of a complaint.
(d)Sections 72–72C: provide for consultation with and referral to other statutory bodies when appropriate.
16 Section 46.
17 Section 53.
(e) Section 73: the processes required by the Commissioner before investigating, namely, to inform the complainant of any intention to investigate and the details that are the subject matter of the investigation, with the individual the subject of the investigation having a right to reply in relation to the subject matter of the investigation.
(f) Section 74: the Commissioner must use best endeavours to secure a settlement.
(g)Sections 75–77: the Commissioner must conduct the investigation with due expedition and the processes to be followed after the conclusion of an investigation.
(h)Section 90: addresses the conduct of investigations and provides a wide discretion to the Commissioner to hear or obtain information and make such inquiries as seen fit. It is not necessary for the Commissioner to hold any hearing and no person is entitled as of right to be heard by the Commissioner, except the person to whom the investigation relates (under s 73(b)).
Discussion
[31] The issue at the heart of Ms Mitchell’s judicial review application is her concern that the Commissioner, as the “gatekeeper” to the Tribunal, failed to properly issue a certificate of investigation with all of the relevant privacy principles, to enable Ms Mitchell to bring proceedings on the breaches of s 6 of the Act, not the Code. Ms Mitchell claims this causes a jurisdictional issue for her, as the Privacy Commissioner investigated information privacy principle 11, with reference also to rr 10 and 11 of the Code, but no other breaches as alleged in her complaint. By deciding to consolidate Ms Mitchell’s complaints in respect of the disclosure and use of her personal information by Corrections to the New Zealand Police, Ms Mitchell submits that the investigation miscarried significantly, by only investigating one agency and not both.
[32] The privacy principles which Ms Mitchell believed were breached numbered
3, 4, 5, 6, 8, 9, 10 and 11. Those privacy principles were named in Ms Mitchell’s second letter to the Commissioner, dated 5 October 2015, in which she complained about the disclosure of a psychological report written by Mr Britton to police on
10 December 2014. The first letter dated 19 September 2015 complained about the disclosure of the 47 page PC01 form to police on 31 August 2015.
[33] The Commissioner decided that these two complaints would be merged and, as the investigator Mr Stephen deposed to the Court, it is the Commissioner’s role to identify which privacy principles may have been breached from the information provided from the complainant. There is no requirement on the complainant to identify the relevant principles. As Mr Stephen explained, when making the assessment of what principles may be relevant to a complaint, the Office of the Commissioner considers them all, regardless of whether or not the complainant has referred to any.
[34] The Commissioner’s powers to investigate under the Act and relevant codes of practice are very broad. Under s 69 the Commissioner may investigate any action that is or has the appearance of being an interference with the privacy of an individual. This includes relevant privacy principles and codes of practice. The Commissioner may initiate an investigation himself or upon the complaint of an individual. Under ss 70 and 71, however, the Commissioner has a wide discretion to refuse to take no further action when a complaint is made.
[35] Under s 71(3), in any case where the Commissioner decides to take no action or no further action on a complaint, he shall inform the complainant of that decision and the reasons for it. In the present case, the Commissioner did investigate Ms Mitchell’s complaint, but only in relation to the principles and rules he considered appropriate, as is available under s 69.
[36] It is important to address Ms Mitchell’s concerns about the gatekeeper role of the Commissioner, in confining the jurisdiction of the Tribunal. Both the High Court and the Human Rights Review Tribunal have reinforced that ss 82 and 83 of the Act provide a deliberate legislative “filtering” mechanism that applies before cases can
be bought to the Tribunal.18 The critical question for the Tribunal however is whether the Commissioner has in fact conducted an investigation into the matters that are to be the subject of a hearing in the Tribunal, not question the way in which the Commissioner carries out his statutory responsibilities.19
[37] The more recent decision of Director of Human Rights Proceedings (NKR) v Accident Compensation Corporation, the Tribunal warned against an overly narrow and rigid technical approach to the exercise of the Tribunal’s powers under s 105 of the Human Rights Act 1993.20 The Tribunal specifically had regard to the certificate by the Privacy Commissioner and placed this construction on it:
[37] We do not, however, wish to leave the impression that the Part 8 statutory provisions relating to the investigatory process are to be narrowly and rigidly construed. Nor we do intend to suggest that certificates from the Privacy Commissioner are to be given a narrow and technical construction. This would be inconsistent with the purposive interpretation of the Act mandated by s 5 of the Interpretation Act 1999. It would also be inconsistent with s 105 of the Human Rights Act (incorporated into the Privacy Act by s
89 of that Act):
105 Substantial merits
(1) The Tribunal must act according to the substantial merits of the case, without regard to technicalities.
(2) In exercising its powers and functions, the Tribunal must act— (a) in accordance with the principles of natural justice; and (b) in a manner that is fair and reasonable; and
(c) according to equity and good conscience.
[38] Given the nature of Ms Mitchell’s complaint and the Commissioner’s investigation under principle 11 and rr 10 and 11 of the Code, there is ample scope, in my view, for the Tribunal to properly consider the merits of the disclosure of Ms Mitchell’s health information and whether the actions of either Corrections or the receipt of such information by the Police, breached principle 11 or overstepped the
limits on the use and disclosure of her health information.
18 Waugh v New Zealand Association of Councillors Inc HRRT 5/2002, 17 March 2003 at [20(c)];
and Edwards v Capital and Coast District Health Board [2016] NZHC 3167 at [43].
19 Edwards, above n 18, at [44]; and Waugh, above n 18, at [31(b)].
20 Director of Human Rights Proceedings (NKR) v Accident Compensation Corporation [2014] NZHRRT 1.
[39] I do not consider that the Tribunal is limited in its review of the merits and the statutory provisions make it plain that the Tribunal must not have regard to technicalities but act in accordance with the principles of natural justice and act fairly and reasonably. I do not consider that the Tribunal is confined in its review of the merits to only the principle identified by the Commissioner, if the facts engage an alternative or additional privacy principle. That is a matter for the Tribunal, in considering the substantial merits of the case.
[40] I am unable to find error in the Commissioner’s investigation, by his decision to consider the principles and rules that he believed were most relevant to Ms Mitchell’s complaint. I also am unable to find that the Commissioner took into account irrelevant considerations or failed to take into account mandatory considerations.
[41] The Commissioner communicated his decision to Ms Mitchell and asked for her comments in relation to the complaint, scope of the investigation and his preliminary conclusions. I can find no breach of natural justice. The Commissioner’s decision to limit his investigation is open to him under the statutory scheme. There is no breach of natural justice where the Commissioner decides that the appropriate principle for the circumstances of the case is principle 11.
[42] The standard of Wednesbury unreasonableness is a high one.21 There is nothing in the Commissioner’s investigation which reaches the threshold of unreasonableness. To so qualify, the actions of the Commissioner have to be so irrational or egregious, that no reasonable person could find them acceptable.
[43] Both Ms Mitchell and the Commissioner submit that Ms Mitchell has other options if her appeal is disallowed, such as seeking a reconsideration from the Commissioner or pursuing a complaint to the Ombudsman. Ms Mitchell has also indicated that she could seek a further investigation in relation to the other privacy principles from the Commissioner. Ms Mitchell is of course free to exercise those options, but on the current proceedings and on the complaint presently before the
Tribunal, I am unable to uphold Ms Mitchell’s claim for judicial review. I can find
21 Wednesbury Corp, above n 5.
no error in the Commissioner’s investigation, nor do I accept that the Tribunal is restricted in its review of the merits of Ms Mitchell’s complaint.
[44] During the course of the hearing, Ms Foster for the Commissioner alleged that Ms Mitchell had falsified a copy of her letter dated 15 December 2015, which was included as Exhibit C to her initial affidavit dated 7 June 2017. Ms Mitchell satisfied me that the missing page was part of the original letter, which was sent by the Prison incorrectly. There is no substance to any allegation that Ms Mitchell falsified the exhibit.
Result
[45] Ms Mitchell’s application for judicial review is dismissed.
Cull J
3
3
0