R v Alsford
[2017] NZSC 42
•29 March 2017
ORDER PROHIBITING PUBLICATION OF THE JUDGMENT AND ANY PART OF THE PROCEEDINGS (INCLUDING THE RESULT) IN NEWS MEDIA OR ON THE INTERNET OR OTHER PUBLICLY AVAILABLE DATABASE UNTIL FINAL DISPOSITION OF TRIAL. PUBLICATION IN LAW REPORT OR LAW DIGEST PERMITTED. IN THE SUPREME COURT OF NEW ZEALAND
SC 12/2016
[2017] NZSC 42
BETWEEN THE QUEEN
Appellant
AND
GREGORY JOHN ALSFORD
Respondent
PRIVACY COMMISSIONER
Intervener
Hearing: 16 June 2016 Court:
Elias CJ, William Young, Glazebrook, Arnold and OʼRegan JJ
Counsel:
M J Lillico and P D Marshall for Appellant
J H M Eaton QC and F E Geiringer for Respondent
J C Edwards (Privacy Commissioner) with J M HaywardJudgment:
29 March 2017
JUDGMENT OF THE COURT
AThe appeal is allowed. The evidence obtained from the searches conducted on 19 December 2012 is admissible at trial.
BOrder prohibiting publication of the judgment or any part of the proceedings (including the result) in the news media or on the internet or other publicly available database until final disposition of the trial. Publication in a law report or law digest permitted.
R v GREGORY JOHN ALSFORD [2017] NZSC 42 [29 March 2017]
REASONS
William Young, Glazebrook, Arnold and O’Regan JJ [1] Elias CJ [103]
WILLIAM YOUNG, GLAZEBROOK, ARNOLD AND O’REGAN JJ
(Given by Arnold J)
Table of Contents
Para No. The appeal [1] Background [5] Power consumption information [14] Were the police required to seek the power consumption data by
way of a production order?
[18] Was there compliance with the Privacy Act? [30] Use of power consumption information in applications [47] Conclusion [73] 2010 search [75] Conclusion [100] Decision [102]
The appeal
[1] Like Marwood v Commissioner of Police, this appeal raises questions concerning the use of improperly obtained evidence in contexts other than the criminal proceeding in the course of which the evidence was acquired.1 We gave a results judgment on 26 October 2016 allowing the appeal.2 These are our reasons.
[2] The information at issue was obtained as a result of an unlawful search and was ruled inadmissible in an earlier criminal proceeding following the balancing process required by s 30 of the Evidence Act 2006.3 Consequently, that earlier prosecution of the respondent, Gregory Alsford, based on the information could not proceed. The police used the same information several years later when applying for a production order in respect of Mr Alsford’s mobile phone data in the context of further possible offending. Having obtained apparently incriminating texts, the
1 Marwood v Commissioner of Police [2016] NZSC 139, [2017] 1 NZLR 260.
2 R v Alsford [2016] NZSC 140.
3 Police v Alsford DC Christchurch, CRI-2010-009-6053, 17 September 2010 [Alsford admissibility judgment (DC)].
police then obtained search warrants in respect of several properties owned by Mr Alsford. The search warrant applications simply mentioned that Mr Alsford had been charged previously, without any detail. Information obtained as a result of the production order and the search warrants led to Mr Alsford facing the current drug charges. One of the issues in the appeal concerns the effect of the police using the information that had earlier been ruled inadmissible in this way.
[3] The other issue in the appeal concerns the use by the police of power consumption data provided by electricity supply companies. The data, which was “personal information” in terms of s 2 of the Privacy Act 1993, was provided voluntarily in response to requests from the police. This raises the question of the relationship between the information privacy principles found in s 6 of the Privacy Act and the prohibition on unreasonable search and seizure in s 21 of the New Zealand Bill of Rights Act 1990 (NZBORA).
[4] We emphasise that this aspect of the appeal does not deal with situations where information is obtained by police as a result of physical searches of premises, nor does it deal with situations in which information is protected by other principles, such as legal professional privilege or commercial confidentiality. This judgment must be understood against that background.
Background
[5] The essential facts can be stated briefly. In September 2012, the police received information by way of an anonymous call on the Crime Stoppers telephone line that a person called “Greg” was cultivating cannabis in the garage of a two storey, weatherboard property at 1/21 Pannell Avenue and that he had bypassed the power meter using his skills as an electrician. The caller provided a physical description of “Greg” and said that he had a female partner and two children.
[6] On the basis of this information, the police conducted further investigations. These showed that Mr Alsford was the sole director of the company that owned the Pannell Avenue property; that the company’s postal address was 116 Baker Street, a property owned by Mr Alsford and Ms Jeanette Alsford; that two cars parked at the Pannell Avenue property were registered in Mr Alsford’s name; that Mr Alsford was
the landline subscriber for the Pannell Avenue address; that Mr Alsford fitted the physical description given by the informant; and that the police had searched the Baker Street property in 2010 and had found there a cannabis growing operation, which Mr Alsford admitted he had established. Mr Alsford had been charged as a result of the 2010 search, but the case did not proceed as the search was held to have been unlawful, and the evidence obtained from it was ruled inadmissible.4
[7] The police then sought information concerning electricity usage at the Pannell Avenue and Baker Street properties from the relevant electricity supply companies, on a voluntary basis. The information requested was provided and showed that the electricity consumption at the Pannell Avenue property was uniform throughout the year (rather than being higher in the colder winter months) and was below the national average and at the Baker Street property was much lower than the national average.
[8] On the basis of this information, Detective Sergeant Simpson applied on 1 November 2012 for a production order under s 71 of the Search and Surveillance Act 2012 requiring the production of Mr Alsford’s mobile phone records.
[9] The 14 page application included the information provided by the Crime Stoppers informant, the information from the various police inquiries following the Crime Stoppers call, information relating to the 2010 search (including Mr Alsford’s admission that he had set up the cannabis operation and the fact that the search had been ruled unlawful and the prosecution dismissed), and detailed information about power consumption at the two addresses. The application explained the relevance of the power consumption figures by noting that high intensity discharge lights were commonly used in hydroponic cannabis growing operations and this increased electricity consumption, so that cannabis growers often bypassed their electricity meters both to avoid detection and to reduce costs.
[10] The production order was granted. Some of the text messages obtained pursuant to this order indicated that the user of the phone was involved in drug dealing. In light of this further information, Detective Simpson applied for warrants
4 Alsford admissibility judgment (DC), above n 3.
to search the properties at 1/21 Pannell Avenue, 116 Baker Street and another address associated with Mr Alsford. The Detective summarised the information relied on for the purpose of the Pannell Avenue application as follows:
·the Crimestoppers information refers to Greg who is known to be cultivating cannabis at his home address of 1/21 Pannell Avenue and is said to have bypassed his meter.
·that Gregory ALSFORD is an electrician and has the knowledge to bypass his meter.
·that the electricity consumption is low and consistent with being bypassed.
·that [Mr Alsford] was previously charged with having a substantial indoor cannabis grow at 116 Baker Street in 2010.
·that the subsequent text messaging evidence supports the Crimestoppers information.
The warrant applications were granted and the warrants were executed. The police discovered cannabis growing operations at both the Pannell Avenue and Baker Street properties. Mr Alsford’s fingerprints were found on items that had been used for cultivating cannabis at the Baker Street property.
[11]Mr Alsford was then charged with eight counts of cannabis-related offending
– cultivation, possession for the purpose of sale, supply and knowingly permitting premises to be used for cultivation. He sought to have the evidence obtained as a result of the execution of the search warrants excluded. This was on the basis that:
(a)The evidence obtained as a result of the unlawful 2010 search should not have been used to support the application for the production order. Without that evidence, there was not a sufficient basis for the issue of a production order.
(b)Without the text message evidence obtained from the production order, there was an insufficient evidentiary basis for the issue of the search warrants.
(c)In addition, the power consumption data was inaccurate and/or misleading and should not have been used in the applications for the production order and the search warrants.
(d)Consequently, the search warrants were unlawful and the evidence obtained as result of their execution should be excluded.
[12] In a detailed judgment, Judge Neave held that the evidence had been obtained improperly and excluded it.5 On appeal, the Court of Appeal upheld this decision, by a majority.6 This Court granted leave on the following points:7
(a)whether the electricity records were improperly obtained from the electricity suppliers;
(b)whether the Court of Appeal was correct to hold that the evidence that had earlier been excluded as improperly obtained (that is, the evidence produced by the 2010 search) could not be relied upon in the applications; and
(c)whether, if improperly obtained, the evidence presently at issue should be admitted under s 30(2)(b) of the Evidence Act.
[13] We will begin our consideration with the power consumption information, before turning to the use of the evidence resulting from the illegal search in 2010.
Power consumption information
[14] There are three issues in relation to the power consumption information, namely:
(a)
Were the police required to utilise the production order process to obtain the information rather than making requests under the Privacy Act?
5 R v Alsford [2015] NZDC 3489 [Alsford (DC)].
6 R v Alsford [2015] NZCA 628 (Ellen France P, French and Winkelmann JJ) [Alsford (CA)].
7 R v Alsford [2016] NZSC 21.
(b)If not, were the releases of the information valid in terms of the Privacy Act?
(c)How do the answers to these questions impact on the production order and search warrant applications in fact made?
[15] Before dealing with these questions, however, we should note two points. First, the Privacy Commissioner, Mr John Edwards, was granted leave to intervene on this aspect of the appeal. We acknowledge the considerable assistance we have derived from his submissions.
[16] Second, Mr Eaton QC submitted that, at the hearing before Judge Neave in the District Court, the issue of the lawfulness of the requests for the power consumption information was not fully argued because all of the relevant information as to the basis of the police requests to the power companies was not available. Judge Neave noted that the police had not provided the relevant information but decided that he had sufficient grounds to resolve the case without it.8 Mr Eaton submits that, as a result, there have been no findings of fact on the nature of the police requests or whether the power companies concerned undertook any analysis of their obligations under the Privacy Act. Moreover, he submitted, the Court of Appeal did not find it necessary to resolve the issue.9
[17] Despite the deficiencies in the evidence, we consider that we are able to address the issues in relation to the power consumption data. This is because, as we explain in more detail below, we consider (in disagreement with the Chief Justice) that the decisive issue is not whether the power consumption records were obtained consistently with the Privacy Act but whether they were obtained as a result of an unreasonable search, contrary to s 21 of NZBORA.10 Whether there was a “search” depends upon whether the consumption data was information in respect of which Mr Alsford had a reasonable expectation of privacy. If the there was a reasonable expectation of privacy in relation to the data, it would have been obtained as a result
8 Alsford (DC), above n 5, at [54].
9 Alsford (CA), above n 6, at [57] per Ellen France P.
10 Section 21 of the New Zealand Bill of Rights Act 1990 provides that “Everyone has the right to be secure against unreasonable search or seizure”.
of a search and the question under s 21 would then be whether the search was reasonable or not.
Were the police required to seek the power consumption data by way of a production order?
[18] Prior to the enactment of sub-pt 2 of pt 3 of the Search and Surveillance Act, there was no production order regime generally available to police to facilitate the investigation of criminal offences.11 In their 2007 Search and Surveillance Powers report, the Law Commission recommended the introduction of such a regime.12 The Commission conceived of the production orders as an “alternative to search warrants”,13 with the same essential requirements.14 The Commission specifically rejected having a lower threshold than applied to search warrants, such as reasonable grounds to suspect that the information sought would assist in the investigation of an offence.15
[19] The perceived benefit of the production order process over the search warrant process was that it would be less disruptive – the agency concerned would be required to produce the specified information rather than having to allow the police to search through its business or other records to find the information needed. Because a production order would be directed at a particular person or entity rather than at a particular place, the police would not need to specify where they believed the information sought was kept. Overall, the availability of the production order process would make the investigative process more efficient.16 The Commission envisaged that the production order process would be available to obtain material such as business records, utility use data or telephone records.17 Given this legislative background, and the reference to “utility use data” in particular, counsel for Mr Alsford argued that the police ought to have used the production order process to obtain the power consumption data.
11 There were specific regimes in particular contexts: see, for example, the Serious Fraud Office Act 1990, s 9.
12 Law Commission Search and Surveillance Powers (NZLC R97, 2007) at [10.22] and recommendations 10.1–10.5.
13 At [10.26].
14 At [10.24].
15 At [10.26].
16 At [10.18].
17 At [10.25].
[20] We consider that the enactment of the production order process was intended simply to provide a less intrusive alternative to the use of search warrants, as is indicated by both the legislative history and the fact that similar tests apply in respect of production orders and search warrants, rather than to prevent the police from obtaining information voluntarily (provided they do so lawfully). In particular:
(a)Section 6 of the Search and Surveillance Act provides that a search warrant may be issued where there are reasonable grounds (a) “to suspect that an offence … punishable by imprisonment has been committed, or is being committed, or will be committed” and (b) to believe that the search will find evidential material relating to the offence at a particular place.18
(b)Section 72 provides that a production order may be issued where there are reasonable grounds (a) “to suspect that [a qualifying] offence has been committed, or is being committed, or will be committed” and
(b) to believe that the documents sought are evidential material in relation to the offence and are, or will be, in the possession or control of the person against whom the order is sought.
Statements in the House by the responsible Minister, Hon Judith Collins, during the passage of the Search and Surveillance Bill19 confirm that production orders were intended to be an alternative to search warrants.20
[21] We think it significant in this context that Parliament has not, despite the existence of the search warrant process, prohibited consent searches by the police where they do not have sufficient information to obtain a warrant. Rather, it has
18 Section 6 requires reasonable suspicion in relation to the commission of an offence and reasonable belief in relation to evidential material being found in a particular place. There is a question, which we leave open, whether this bifurcated approach was intended to change the approach under s 198 of the Summary Proceedings Act 1957. In addition, we note that the term “evidential material” is defined in s 3 of the Search and Surveillance Act 2012 in a way that appears to include not only inculpatory but also exculpatory material. This is consistent with the recommendation of the Law Commission: see above n 12, at [3.27] and [3.35]–[3.39]. Again, however, we leave the point open.
19 Search and Surveillance Bill 2009 (45).
20 See (7 March 2012) 678 NZPD 970; (20 March 2012) 678 NZPD 1115; and (22 March 2012)
678 NZPD 1246.
recognised that the police may carry out consent searches (whether or not they have grounds to obtain a warrant) but has regulated them. Such searches are provided for in ss 91–96 of the Search and Surveillance Act. Section 91 provides:
91 Application of rules about consent searches
Sections 92 to 95 apply in respect of consent searches undertaken by an enforcement officer in circumstances where a power of search by an enforcement officer to which this Part applies or any provisions of this Part apply (whether a warrantless power or a power able to be conferred by a search warrant) could be exercised if the officer held a particular belief or suspicion.
The effect of this provision is that a consent search may be undertaken in accordance with ss 92–95 even though the officer undertaking it does not have the suspicion or belief necessary to obtain a search warrant. This is made clear by the Law Commission, which specifically rejected introducing a “reasonable grounds” requirement for consent searches.21
[22] It appears that the consent search provisions were introduced to meet problems that were perceived to result from the police having an unrestricted ability to conduct consent searches (despite the existence of the warrant process). The effect of the provisions is to restrict the circumstances in which such searches can be conducted lawfully, by setting out the purposes for which a consent search may be conducted and by establishing pre-conditions for a valid consent.22 The existence of the consent search provisions suggests that Parliament did not see the enactment of the production order process as necessarily restricting the ability of the police to obtain information voluntarily.
[23] There is the complication in this case that the information sought by the police from the power companies concerned a third party, Mr Alsford, even though the records were, in a formal sense, the companies’ records and their compilation and retention were necessary to the companies’ commercial operations. There are several decisions of the Court of Appeal which have accepted that the police may obtain what can fairly be described as customer information from service providers
21 See Law Commission, above n 12, at [3.67]–[3.70].
22 See Law Commission, above n 12, at [3.65] and [3.75]–[3.83].
on a voluntary basis. One example is R v Thompson,23 which we discuss later in these reasons.24 Another is R v Harris.25 There the defendants were charged with drug offences, money laundering and social welfare fraud. They challenged pre-trial rulings that the evidence of a former bank officer of some of their banking transactions, and further evidence obtained under warrant, was admissible at trial. The bank officer’s observations had initiated the police investigation and subsequent prosecution. The argument for the defendants was that evidence from the former bank officer would breach the Financial Transactions Reporting Act 1996, which was a complete code and prohibited reporting other than in accordance with its terms.
[24] The Court rejected the defendants’ argument. It held that the common law position continued to apply. While banks owed a general duty of confidence to their customers, there were limits to that duty. These included circumstances where the bank had a duty to the public to disclose or where the bank’s interests required disclosure. The Court went on to say:26
… there is no confidence preventing the disclosure of iniquity … . It is significant that in the present case the bank accounts themselves were the vehicles for the offending – namely money laundering. Even in the absence of legislation there would be a power and perhaps even a duty to consider and respond to police questions about that.
The Court considered that the police were free to seek relevant information from banks “at least in the absence of any reason to believe that the disclosure would be unlawful”.27 It concluded:28
… the bank would appear to be completely within its rights under the law as it was before the enactment of the 1996 Act to respond to police inquiries on the basis that it has reasonable grounds to suspect that a customer may be involved in serious criminal activity. Its freedom to take that action has in no way been limited by that Act. On the contrary, the purpose of the legislation is to emphasise those rights or freedoms by supporting them with obligations.
23 R v Thompson [2001] 1 NZLR 129 (CA).
24 See below at [51]–[52].
25 R v Harris [2000] 2 NZLR 524 (CA).
26 At [10].
27 At [10].
28 At [13].
[25] A further case is R v Cox.29 In the course of investigating suspected drug offending, the police advised a mobile phone operator that they would be seeking call data and text messages in relation to several phone numbers associated with the appellants. The operator advised that they would supply the past call data and texts in response to a search warrant and future call data and texts in response to a call data warrant. The operator said that, in the meantime, it would “pre-load” the particular numbers, that is, the operator would store all texts to and from those numbers rather than deleting them within a 32 hour period in accordance with their usual practice. The operator provided the relevant information to the police both before and after the police had obtained call data and search warrants. One of the issues raised by the case was whether there were any legal restrictions on the right of the operator or the police in relation to the collection and release of the text data.
[26] The Court considered whether the actions of the operator and the police involved breaches of (i) confidentiality obligations; (ii) the Privacy Act; and (iii) s 21 of NZBORA, and concluded that they did not. For the purposes of s 21, the Court was prepared to treat what had occurred as a search but held that, in the particular circumstances, the search was not unreasonable. The Court noted that under the law as it then stood the ability of the police to obtain information by statutory processes was not clear and then said:30
The relevant information was in the possession of Vodafone. Vodafone, as a good corporate citizen, should cooperate with the police and assist the police with legitimate enquiries. In circumstances where the police obtain a call data warrant, Vodafone could fairly conclude that there was a legitimate basis for the police operation. This would therefore fairly alleviate confidentiality concerns which might otherwise have discouraged Vodafone from co-operating with police.
[27]
In deciding that the search was reasonable, the Court distinguished its earlier decision in R v H.31 In that case, a director of a fishing company was charged with offences under the Secret Commissions Act 1910, on the basis that he corruptly gave money to an agent for the Ministry of Agriculture and Fisheries (MAF), as a reward for favours to the company. The director had instructed the company’s accountant to make certain payments to the agent. The accountant became suspicious and29 R v Cox (2004) 21 CRNZ 1 (CA).
30 At [66].
31 R v H [1994] 2 NZLR 143 (CA).
contacted MAF. MAF laid a complaint with the police, who arranged for the accountant to provide them with company files and photocopies of company documents. He did so over a period of about 20 months. The Court accepted that it was arguable that the accountant had not breached his obligation of confidence to his employer as the public interest required disclosure.32 However, given the lengthy period over which the supply of documents occurred, the Court considered that there was no practical or other impediment to the police obtaining one or more search warrants to obtain them. In effect, the police had deliberately refrained from obtaining a warrant when they could have done so.33 Applying the then current prima facie exclusion rule, the Court excluded the evidence on the ground that it had been obtained by an unreasonable search.
[28] Our purpose in referring to these authorities is simply to show that New Zealand courts have accepted that service providers may legitimately provide some customer information to the police voluntarily, at least in some circumstances. We are not to be taken as necessarily approving the relevant reasoning in all the cases, which must now be read against the background of subsequent legislative developments such as the enactment of the Search and Surveillance Act. But we do think it significant that in both R v Cox and R v H, the central feature of the Court’s analysis was s 21 of NZBORA. We will return to this aspect following our discussion of the Privacy Act.
[29] We conclude, then, that the introduction of the production order process in the Search and Surveillance Act was not intended to limit the ability of the police to obtain information such as power usage data voluntarily, provided they do so lawfully. This brings us to the next issue, namely whether there was compliance with the Privacy Act.
Was there compliance with the Privacy Act?
[30] We begin by describing the relevant parts of the Privacy Act. First, “personal information” is defined in the Act to mean “information about an identifiable
32 At 148–149.
33 At 149.
individual”.34 Obviously, this is a definition which captures a wide range of information “from the very sensitive to the seemingly banal”, as Mr Edwards put it. Although there may be a question whether power consumption data falls within it given that such data relates to a particular place rather than a particular person, we will proceed on the basis that the data is “personal information” in the sense that it indicates the power consumption at a place owned and occupied by identifiable individuals.
[31] Second, s 6 contains a number of privacy principles applying to agencies holding or dealing with personal information. Four are of particular relevance here – principles 1, 2, 4 and 11:
(a)The effect of principle 1 is that the police may not collect personal information about a person unless (i) it is collected for a lawful purpose connected with a police function or activity and (ii) the collection of the information is necessary for that purpose.
(b)Principle 2(1) requires that an agency collecting personal information collect it directly from the person concerned. However, principle 2(2) goes on to say that an agency need not comply with this requirement in a number of specified circumstances, one of which (principle 2(2)(d)(i)) is that non-compliance is necessary to avoid prejudice to the maintenance of the law by any public sector agency (the wording of the exception is identical to that in principle 11(e), which we quote below).
(c)The effect of principle 4 is that an agency may not collect personal information by means that are unlawful or, in the particular circumstances of the case, are unfair or unreasonably intrusive.
(d)Finally, principle 11 provides:
34 Privacy Act 1993, s 2.
An agency that holds personal information shall not disclose the information to a person or body or agency unless the agency believes, on reasonable grounds,—
…
(e)that non-compliance is necessary—
(i)to avoid prejudice to the maintenance of the law by any public sector agency, including the prevention, detection, investigation, prosecution, and punishment of offences; or
(ii)for the enforcement of a law imposing a pecuniary penalty; or
…
(iv) for the conduct of proceedings before any court or tribunal (being proceedings that have been commenced or are reasonably in contemplation); …
Besides appearing in principle 2(2)(d), the exception in principle 11(e) also appears in principle 3(4)(c), which deals with advising individuals of the collection of their personal information, and in principle 10(c), which deals the use of personal information by the holding agency.
[32] Principles 2(2)(d) and 11(e) are, in effect, different sides of the same coin. Under principle 2(2)(d), the police may request personal information about a person from an agency holding such information provided that the requirements in the exception are met; under principle 11(e), the holding agency may supply the requested information to police provided that the exception’s requirements are met.
[33] Two features of the language of the exception require emphasis in the present context. The first is that an agency may not gather personal information indirectly (principle 2) or disclose personal information (principle 11) unless it believes on reasonable grounds that non-compliance with the relevant principle is necessary for one of the specified purposes. Focussing on principle 11(e), this implies that the requesting agency must provide the holding agency with sufficient information to enable it to reach a reasonably-based view about whether or not the information is required for an authorised purpose. On this basis, it would not be sufficient for the
police simply to request information without giving any indication of why it was sought – as Mr Eaton submitted, the mere fact that police request information will not meet the threshold. On the other hand, as Mr Edwards noted, requiring the police to disclose the detail of an investigation to an agency holding sought-after information may compromise the investigation and may itself involve further disclosure of personal information. We return to this issue when discussing the facts of the present case.
[34] The second feature is that the authorised purposes in the exception are broadly stated. They refer to avoiding “prejudice to the maintenance of the law by any public sector agency”. They then go on to include within that broad principle, avoiding prejudice to “the prevention, detection, investigation, prosecution, and punishment of offences”. Focussing again on principle 11(e), the references to “the maintenance of the law” and to avoiding “prejudice to”, together with the breadth of the included purposes, particularly prevention, detection and investigation, are relevant to the nature of the reasonable grounds test that the holder of the information is required to meet to justify disclosure. They suggest that the test – belief on reasonable grounds that non-compliance is necessary – is a relatively low one. The language (particularly the reference to “detection”) also suggests that a holding agency would be justified in providing personal information to the police even where the police did not have sufficient grounds to obtain a warrant or a production order. So, for example, if the police request personal information at the early stages of an investigation, they may not be able to say much more by way of justifying the request than that they are investigating a particular offence and that power consumption records may be relevant to the investigation, with some indication as to why they are relevant. In short, what is required is an indication of why the police are requesting the information. We observe that information obtained by police from a holding agency will still be subject to the provisions of the Privacy Act in the hands of the police.
[35] We do not consider that the use of the word “necessary” means that the police must indicate to the holding agency why they are seeking the information informally rather than by means of a formal process such as a production warrant. In the case of an investigation, for example, it is up to the police to determine what investigatory
tools are available to them in light of the then current state of their investigation. If they decide to seek information voluntarily rather than by way of a formal process, on the approach we adopt they will face the risk that they will be found to have acquired the information by means of a “search”, which will then engage s 21. We do not think that a holding agency is in a position to make any sensible assessment of the reasons why the police have chosen one investigatory mechanism over another. That does not mean, of course, that the protection afforded to a holding agency by principle 11(e) will necessarily apply where it hands over sensitive personal information in response to a request from the police. In those circumstances, not only will there be a “search”, but the holding agency (and the police) may also be in breach of the privacy principles, depending on the particular circumstances.
[36] There is a third point to be made about principle 11. By virtue of s 7 of the Privacy Act, nothing in principle 11 derogates from any statutory provision that authorises or requires personal information to be made available or regulates the manner in which personal information may be obtained or made available. The provisions of the Search and Surveillance Act provide an obvious example.
[37] Finally in relation to the Privacy Act, we note that the privacy principles do not, for the most part, create rights that are enforceable through the courts. Rather, the Act contains its own enforcement mechanisms. This is made clear by s 11, which provides:
11 Enforceability of principles
(1)The entitlements conferred on an individual by subclause (1) of principle 6, in so far as that subclause relates to personal information held by a public sector agency, are legal rights, and are enforceable accordingly in a court of law.[35]
(2)Subject to subsection (1), the information privacy principles do not confer on any person any legal right that is enforceable in a court of law.
[38]
The fact that the privacy principles do not create rights that are enforceable through the courts (apart from the exception noted in s 11(1)) does not mean that35 Principle 6(1) gives individuals the right to find out from agencies whether they hold personal information about them and, if so, to have access to that information.
breaches of those rights are irrelevant in a court setting, however. The privacy principles may affect the interpretation of the Search and Surveillance Act given that the Act’s purpose is “to facilitate the monitoring of compliance with the law and the investigation and prosecution of offences in a manner that is consistent with human rights values” by (among other things) providing rules that recognise the importance of rights and entitlements affirmed in other legislation including the Privacy Act.36 Further, in some circumstances a breach of a privacy principle may be relevant to the assessment whether evidence has been obtained unfairly in terms of s 30(5)(c) of the Evidence Act37 or to the balancing process to be carried out under s 30(2).
[39] Two points should be noted about this possibility, however. First, there is a need for caution given (a) the breadth of the term “personal information”, which, as we have said, covers information from highly personal to insignificant; and (b) the range of possible breaches, which will cover the spectrum from minor to significant. So the nature of the personal information at issue and the particular way in which the privacy principles were breached will be important. Second, even where the information at issue is personally sensitive and the breach of the privacy principles is serious, those circumstances may add little to the s 30 analysis, given the approach to police accessing of personal information which we outline later in these reasons.
[40] Accordingly, while we accept the possibility that the fact that personal information was obtained in breach of the privacy principles will be relevant under s 30, we think it unlikely that it will be of any independent significance in many instances. This is because what will be significant to the s 30 assessment is the nature of the conduct at issue rather than the fact that it constitutes a breach of the privacy principles. For the sake of completeness, we should also note that compliance with the privacy principles does not eliminate the possibility that the information at issue may be found to have been improperly obtained for the purpose of s 30. Again, we do no more than identify the possibility.
36 Search and Surveillance Act, s 5.
37 The effect of s 11 of the Privacy Act is that information obtained in breach of the privacy principles would not, for that reason alone, be unlawfully obtained in terms of s 30(5)(a) of the Evidence Act 2006. However, if the police obtained information in a way that was for some other reason unlawful (for example, pursuant to an invalidly issued production order), they would have obtained the information unlawfully in terms of principle 4.
[41] Turning to the facts of this case, the police requested power consumption records from three electricity supply companies in relation to the Pannell Avenue and Baker Street properties. A request to Contact Energy was made on a form entitled “Request for information under the Privacy Act 1993”, a request to Genesis Energy was made by email under the Privacy Act and a request to Meridian Energy was made on a form headed “Request for Information under the Official Information Act 1982”. In terms of the reasons for the requests:
(a)The Privacy Act request form addressed to Contact Energy said:
Intelligence has indicated that cannabis is possibly being grown at these addresses.
In fact, the request related to only one address, namely 1/21 Pannell Avenue.
(b)The email request under the Privacy Act to Genesis Energy said:
To assist Police with an investigation we are currently undertaking, information is sought in relation to the following addresses/persons.
The request related to the Pannell Avenue address.
(c)The request to Meridian Energy, misdescribed as an Official Information Act request, said that the police were investigating alleged criminal activity and that “intelligence has indicated that cannabis is possibly being grown at this address”. The address identified was the Baker Street address.
[42] There can be no sensible expectation that the police will outline in detail the course of their investigations to date in justifying a request to an agency such as an electricity supplier. That may compromise the investigation and/or involve the disclosure of other personal information (although such disclosure by the police may itself be justified under principle 11(e)). The police do not have to meet the same standard as would be required when they seek a search warrant or production order, and the holding agency cannot be expected to act as a judicial officer would on such an application. Nevertheless, the Act contemplates that an agency disclosing
personal information will have to justify the disclosure if a complaint of unjustified disclosure is made.38 This supports the view that the requirement for reasonable grounds is a meaningful one, and indicates that any disclosure request should contain sufficient information to enable the holding agency to form a view about whether there are reasonable grounds to believe that disclosing the information is necessary to avoid prejudicing an investigation. In principle, this will require the police to indicate briefly the perceived link between the suspected offence and the power consumption records.
[43] In the present case, two of the requests noted that the police were investigating whether cannabis was being grown at the relevant addresses. Given that the electricity supply companies were likely well aware of the link between power consumption and cannabis growing operations from their general experience,39 that advice was probably sufficient to allow the companies to conclude that there were the necessary reasonable grounds (although obviously it is preferable that the link be spelled out even if the police think the recipient understands it). In other situations, however, it will be necessary for the police to give a brief indication of why the information sought is relevant to the offence being investigated.
[44] The email request to Genesis Energy under the Privacy Act simply said that the police were investigating an offence. That statement was too general to enable the electricity supply company concerned to reach a view about whether or not there were reasonable grounds to believe that disclosure was necessary to avoid prejudice to the investigation. Further detail should have been given. Accordingly, the release of the power consumption data by this company was not justified in terms of principle 11(e). However, this breach does not necessarily mean that the police obtained the information in breach of principle 4.40 The information was not obtained by means that were “unlawful” in terms of principle 4, given the effect of
38 Privacy Act, pt 8.
39 Given the possibility of illegal bypass of meters, power companies are potentially victims in the case of large scale cannabis growing operations. In his production order application, Detective Simpson described discussions with an investigator from Genesis Energy, who discussed the significance of the power consumption figures and noted the possibility that the meters were being bypassed.
40 See above at [31](c).
s 11 of the Act.41 Nor do we consider that the information was obtained by means that were, in the circumstances, “unreasonably intrusive”.
[45] As to whether the information was obtained by means that were “unfair” for the purpose of principle 4, it might be argued that because the breach of principle 11(e) resulted from the failure of the police to provide sufficient information about the reason for the request, they obtained the information by unfair means. We do not accept that, however. The police were entitled to ask for the information: objectively, their request was justified; if they had given a brief explanation of the type given in support of the other requests, the electricity company would have been entitled to conclude that they should supply the information under principle 11(e). In these circumstances, we do not see the police failure leading to non-compliance by the particular company as constituting unfair means. Moreover, even if the information was unfairly obtained in terms of principle 4, that would not necessarily mean it was unfairly obtained for the purpose of s 30(5)(c) of the Evidence Act.
[46] To the extent, then, that one of the power companies did not have sufficient justification to release the data it released on the basis of the information supplied by the police, we conclude that there was a breach of the Privacy Act. But what, if any, impact does that have?
Use of power consumption information in applications
[47] The applications for the production order and the search warrants referred to the power consumption data, at least some of which was obtained inconsistently with the Privacy Act. Given that the privacy principles do not confer legal rights enforceable in the courts, the fact that some of the power consumption data was obtained in breach of the privacy principles does not mean that it was unlawfully obtained in terms of s 30(5)(a) of the Evidence Act. Nor, standing alone, does it necessarily mean that the data was unfairly obtained in terms of s 30(5)(c). As in R v H and R v Cox, the critical question is whether the data was obtained as a result of an unreasonable search or seizure in terms of s 21 of NZBORA. To answer this
41 See above at [37].
question, it must first be determined whether there has been a “search”, and that depends on the nature of Mr Alsford’s privacy interests in the information at issue.
[48] In Hamed v R, Blanchard J concluded that there would be a search where the information-gathering activity “invades a reasonable expectation of privacy”.42 The Judge identified two elements to the inquiry: whether the person affected had such an expectation in fact and whether the expectation was one that society is prepared to regard as reasonable. The Judge noted that this was consistent with the approach adopted by the Supreme Court of Canada in R v Wise.43 Although it is not entirely clear, there appears to have been majority support for Blanchard J’s approach on this point.44
[49] By contrast, Tipping J took a broader view of what constitutes a search. He considered that the word “search” in s 21 had its ordinary sense of “consciously looking for something or somebody”45 and did not consider that the “reasonable expectation of privacy” test was helpful in this context.46 He did, however, say that if a search had occurred, reasonable expectations of privacy, and the level of such expectations, would be relevant to the question whether the search was unreasonable in terms of s 21.47 Ultimately, then, the difference between Blanchard and Tipping JJ does not relate to the relevance of reasonable expectations of privacy to a s 21 analysis but to the point at which they become relevant.
[50] While there is some academic support for Tipping J’s approach,48 we will proceed on the basis of the approach expounded by Blanchard J, which was accepted by both parties in argument before us and appears to reflect the approach adopted by the Law Commission in its Search and Surveillance report.49 When applying that
42 Hamed v R [2011] NZSC 101, [2012] 2 NZLR 305, at [163] and following. See also R v Ngan [2007] NZSC 105, [2008] 2 NZLR 48 at [103]–[120], where McGrath J took a similar approach to the meaning of “search”, although the case was argued on the assumption that there was a search: see Tipping J at [41].
43 R v Wise [1992] 1 SCR 527.
44 See the discussion in Lorigan v R [2012] NZCA 264, (2012) 25 CRNZ 729 at [15]–[22].
45 Hamed, above n 42, at [220].
46 At [223].
47 At [223].
48 Chris Gallivan and Justin Wall “Hamed: s 21 BORA” [2012] NZLJ 85 at 86; and Andrew Butler and Petra Butler The New Zealand Bill of Rights Act: A Commentary (2nd ed, LexisNexis, Wellington 2015) at [18.9.4]–[18.9.6].
49 Law Commission, above n 12, at [2.32] and following.
test, we will proceed on the assumption that Mr Alsford had, subjectively, an expectation of privacy in relation to the data.50 Despite that assumption, however, we are satisfied that such an expectation was unreasonable in relation to the data at issue, as we now explain.
[51] The data at issue was simply aggregate monthly power usage data. In the context of a pre-trial appeal, a Full Bench of the Court of Appeal held in R v Thompson that the police were entitled to ask a power supply company for information about power supplies to a particular address, and the power company was entitled to supply that information.51 The police had received an anonymous tip that cannabis was being grown at a particular property. The police made an enquiry of the local power supply company and received advice that the electricity consumed at the premises was very high and would not be considered normal. This and other information formed the basis for an application for a search warrant in relation to the address. The police discovered a cannabis growing operation in the course of executing the warrant.
[52] The Court of Appeal dealt with various issues, only one of which is presently relevant. In relation to the advice about power consumption, the Court said that it was not unlawful for the police to ask for and obtain information from the power supply company:52
… that limited disclosure for law enforcement purposes and the use of that information by the detective constable in seeking a search warrant … came squarely within exception (e) of Principle 11 of the Privacy Act 1993.
The Court did not specifically address the question whether obtaining the information amounted to a “search” for the purposes of s 21 of NZBORA, although that section was relevant to other issues in the appeal.53 However, the logic of the decision is that s 21 was not engaged.
50 The terms of supply between a service supplier and its customers may be relevant to the question whether a particular customer has an expectation of privacy in relation to his or her data.
51 R v Thompson, above n 23.
52 At [54]. It is implicit in this holding that the Court considered the power consumption data to be “personal information” within the meaning of the Privacy Act.
53 Scott Optican “What is a “Search” under s 21 of the New Zealand Bill of Rights Act 1990? An Analysis, Critique and Tripartite Approach” [2001] NZ L Rev 239 criticises the Court of Appeal for failing to address this issue, but expresses the view that the power consumption information “is minimally intrusive and reveals nothing of a truly personal nature”: at 249 and 269–270.
[53] It may be that the Court of Appeal in Thompson considered that information obtained consistently with principle 11(e) could not, for that reason, have been obtained as a result of an unreasonable search. That view was taken in R v R.54 The defendant was charged with murder and sexual violation. GPS data placed him at the location where the victim had last been seen. The data had been collected by the Department of Corrections as a result of electronic monitoring which had been imposed on the defendant as a condition following his release from prison for other serious offending. The police initially sought the data from Corrections on a voluntary basis because they were concerned about the victim’s safety and were aware that the defendant had been in the general area where the victim had disappeared. Later data provided by Corrections led to the discovery of the victim’s body. Both the High Court55 and the Court of Appeal56 held that the disclosure of the GPS data for this purpose was permitted by s 15A(2)(b) and (c) of the Parole Act 2002 as it was one of the purposes for which the data was collected.
[54] Relevantly to the present case, the defendant had argued that the police had obtained the GPS data in breach of s 21 of NZBORA and that the data was obtained unfairly because it was obtained in breach of the privacy principles. In considering the preliminary question whether the police request for the GPS data was a “search”, Winkelmann J in the High Court applied the reasonable expectation of privacy test.57 She expressed the view that reasonable expectations of privacy in relation to personal information could be determined by reference to the Privacy Act.58 The Judge said:59
I take the approach that if [the Privacy Act] allows for the sharing of the information in a particular circumstance, and that circumstance applies, the sharing of the information will not amount to a search. It follows, on the particular facts of this case, that the questions of whether there has been an unreasonable search and whether the evidence has been obtained unfairly by breach of the privacy principles will be determined by reference to the same matters.
54 R v R [2015] NZHC 713; and R (CA201/2015) v R [2015] NZCA 165.
55 R v R, above n 54, at [67]–[70].
56 R (CA201/2015), above n 54, at [29]–[32].
57 R v R, above n 54, at [62].
58 At [63].
59 At [63].
As an alternative to its argument based on s 15A(2)(b) and (c) of the Parole Act, the Crown had argued that the release of the information was permitted by privacy principle 11(e). Winkelmann J accepted that submission. She said:60
The disclosure of the information was necessary for the detection, investigation and prevention of an offence. The situation may have been different if the Police were not dealing with such an urgent situation. I expressly leave open the possibility that in some cases it may be unreasonable for the Police to rely on this exception to obtain the private information. In some circumstances it may be that proceeding to obtain information in this way without a warrant is not necessary to avoid prejudice to the maintenance of the law. Those may be circumstances where there is not the same degree of urgency in obtaining the information.
The Court of Appeal agreed with this analysis.61
[55]
The scope of reasonable expectations of privacy has been considered by the Supreme Court of Canada in a number of cases, four of which we now briefly discuss. In R v Plant,62 the Supreme Court held that power consumption data63 does not attract a reasonable expectation of privacy. The facts of Plant have some similarity to those in the present appeal. The police received a Crime Stoppers tip-off that cannabis was being grown at a house in a particular vicinity. The police identified the house and obtained details of the power consumption at the address for the preceding six months. They then compared the consumption figures with those of two other comparably-sized homes and found that they were four times the average of the other two over the same period. Two officers then went to the property and knocked on the door. When no one answered, they went round to the backdoor. The officers noticed that the basement windows had an opaque covering and that there was an outside vent. They sniffed at the vent, but smelt nothing. Looking inside the vent, they saw that it had been stuffed with plastic.64 They left when one of the residents arrived. On the basis of the tip-off, the power consumption data and their observations at the house, one of the officers obtained a search warrant. When they executed the warrant, the police found a cannabis growing operation. Mr Plant appealed his conviction.60 At [77]. (Italics in original).
61 R (CA201/2015) v R, above n 54, at [33]–[35].
62 R v Plant [1993] 3 SCR 281.
63 It is not clear from the judgments in the case how detailed the information was, that is, whether it consisted of monthly aggregate usage figures as in the present case or was more detailed.
64 The Court described this as a “perimeter search”.
[56] The Supreme Court was required to address a number of issues, including whether the power consumption records were protected by s 8 of the Canadian Charter of Rights and Freedoms (the Canadian equivalent of s 21 of NZBORA). Writing for the majority,65 Sopinka J said that the purpose of s 8 was “to protect against intrusion of the state on an individual’s privacy” and went on to say that the limits on state action were determined “by balancing the right of citizens to have respected a reasonable expectation of privacy as against the state interest in law enforcement”.66 Sopinka J held that the test for a determination under s 8 was whether the information seized was of a personal and confidential nature.67 The Judge said that it was necessary to apply a contextual approach when answering this question:68
Consideration of such factors as the nature of the information itself, the nature of the relationship between the party releasing the information and the party claiming its confidentiality, the place where the information was obtained, the manner in which it was obtained and the seriousness of the crime being investigated allow for a balancing of the societal interests in protecting individual dignity, integrity and autonomy with effective law enforcement.
The Judge went on to say:69
In fostering the underlying values of dignity, integrity and autonomy, it is fitting that s. 8 of the Charter should seek to protect a biographical core of personal information which individuals in a free and democratic society would wish to maintain and control from dissemination to the state. This would include information which tends to reveal intimate details of the lifestyle and personal choices of the individual. The computer records investigated in the case at bar while revealing the pattern of electricity consumption in the residence cannot reasonably be said to reveal intimate details of the appellant’s life since electricity consumption reveals very little about the personal lifestyle or private decisions of the occupant of the residence.
Sopinka J considered that the nature of the relationship between the appellant and the supplier could not be characterised as confidential, nor could the transaction
65 Sopinka J delivered the judgment of himself and Lamer CJ, La Forest, Gonthier, Cory and Iacobucci JJ.
66 At 291.
67 At 293.
68 At 293. From the early days of the New Zealand Bill of Rights Act, the New Zealand Court of Appeal also emphasised the need for a contextual or situational approach to s 21: see the discussion in Optican, above n 53, at 245–247.
69 At 293.
records.70 The Judge said that because it was possible for members of the public to enquire about power consumption at particular addresses, the information at issue was publicly available.71 Moreover, as the police were able to obtain the information online by agreement with the power supplier, the acquisition of the records did not involve intrusion into places ordinarily considered to be private.72
[57] The minority Judge, McLachlin J, agreed that the critical issue was whether there was a reasonable expectation of privacy in relation to the records,73 but disagreed concerning the application of the principle to the facts. The Judge considered that power consumption records were “capable of telling much about one’s personal lifestyle, such as how many people lived in the house and what sort of activities were probably taking place there”.74 McLachlin J did not accept that the information was available to the public,75 but noted that if it had been, she may have come to a different conclusion as to whether there was a reasonable expectation of privacy.76
[58] Later decisions of the Supreme Court of Canada illustrate the scope of the reasonable expectation of privacy test in this context. In R v Tessling, the Court held unanimously that there was no reasonable expectation of privacy in the heat profile of a house obtained from an aeroplane by way of an infrared camera, so that the profile was not obtained as a result of a “search”.77 The profile led the police to believe that Mr Tessling had a cannabis-growing operation and he was charged and convicted accordingly.
[59] In R v Gomboc a majority of the Supreme Court held that information about patterns of power consumption, produced by a digital recording ammeter installed on a power line going into Mr Gomboc’s home by an electricity supply company at the
70 At 294.
71 At 294.
72 At 295.
73 At 301.
74 At 302.
75 While the police could access the database containing the power consumption records, McLachlin J held that they could do so only by reason of a special arrangement and that there was no evidence that the information was publicly accessible: at 302 and 303.
76 At 303.
77 R v Tessling 2004 SCC 67, [2004] 3 SCR 432.
request of the police, did not infringe a reasonable expectation of privacy.78 This was despite the fact that the ammeter allowed cyclical high usage patterns to be recorded that were strongly suggestive of cannabis growing operations. On the basis of this and other information the police had obtained a search warrant, which revealed the existence of a cannabis-growing operation in Mr Gomboc’s home.
[60] There were two majority judgments. Deschamps J delivered the principal judgment.79 She concluded that several factors weighed against finding a reasonable expectation of privacy in the power consumption data. In particular, no reliable inference could be drawn from the information provided80 about the occupants or their activities inside the house apart from the possibility of a cannabis growing operation, so that the information was remote from the protected “biographical core” of personal information.81 Less importantly, in the particular circumstances of the case, the legislative scheme permitted disclosure of customer information to authorities investigating offences82 and the supply company had a legitimate interest in obtaining the data itself as it was a potential victim of electricity theft.83 In her concurring judgment, Abella J noted that the cyclical usage pattern produced by the ammeter led to a strong inference that that a cannabis growing operation was taking place in the residence. Because this was information about an activity occurring inside the home, it was presumptively information in respect of which individuals were entitled to expect privacy.84 However, Abella J concluded that the legislative scheme was decisive and that Mr Gomboc could not reasonably expect privacy in relation to his power consumption records when the law provided that such information could be disclosed to police without his consent (he having made no request for confidentiality).85 The minority, McLachlin CJ and Fish J, agreed with
78 R v Gomboc 2010 SCC 55, [2010] 3 SCR 211.
79 Deschamps J delivered the judgment of herself and Charron, Rothstein and Cromwell JJ;
Abella J delivered a separate concurring judgment for herself, Binnie and LeBel JJ; and McLachlin CJ delivered the minority judgment of herself and Fish J.
80 A single line graph showing power usage on a daily basis over five days: see the appendix to the decision at 279.
81 At [43].
82 The Alberta legislation provided that a customer could request confidentiality for customer information, in which case such information could not be provided to anyone including the
police; in the absence of a confidentiality request, however, the information could be provided to the police for investigatory purposes. Mr Gomboc had not requested confidentiality.
83 At [42]–[43].
84 At [79]–[82].
85 See, for example, at [72]–[73] and [82].
Abella J that the information attracted a privacy interest but disagreed that the legislative scheme was decisive.86
[61] Finally, in Spencer v R the Supreme Court held unanimously that the police, who were investigating offences involving child pornography, had conducted a “search” when they requested an internet service provider to provide subscriber information (name, address and phone number) associated with a particular IP address.87 The police relied on the information to obtain a search warrant to search the home of Mr Spencer’s sister (with whom Mr Spencer lived) and seize Mr Spencer’s computer. A search of Mr Spencer’s computer revealed many child pornography images and videos. Mr Spencer was convicted on counts of possessing child pornography and making it available over the internet.
[62] The Supreme Court held that the police did not have lawful authority to conduct the search (that is, obtain the subscriber information matching the IP address) but went on to hold that the evidence should not be excluded,88 so that his convictions stood. Delivering the judgment of the Court, Cromwell J considered that Mr Spencer had, subjectively, a reasonable expectation of privacy in the subscriber information, which could “readily be inferred from his use of the network connection to transmit sensitive information”.89 Moreover, he concluded that this expectation was reasonable in light of the nature of the privacy interests at stake and the relevant contractual and regulatory framework.90 In assessing the relevant privacy interests, Cromwell J considered not simply what information was sought from the internet service provider (the subscriber information) but also what access to that information was capable of revealing about the particular individual. The police had requested the subscriber data so that they could link a specific individual to specific on-line activities. This engaged a “high level of informational privacy”.91
[63] To summarise, the question whether there is a reasonable expectation of privacy in personal information has both subjective and objective elements. The
86 See summary at [105].
87 Spencer v R 2014 SCC 43, [2014] 2 SCR 212.
88 Under s 24(2) of the Canadian Charter of Rights and Freedoms.
89 At [19].
90 At [52]–[66].
91 At [51].
objective component asks whether the subjective expectation of privacy held by the person involved is an expectation that society is prepared to recognise as reasonable. The court’s approach to the determination of that question is a contextual one, requiring a consideration of the particular circumstances of the case. On the Canadian authorities, these circumstances could include:92
(a)the nature of the information at issue;
(b)the nature of the relationship between the party releasing the information and the party claiming confidentiality in the information;
(c)the place where the information was obtained; and
(d)the manner in which the information was obtained.
The reasonable expectation of privacy is directed at protecting “a biographical core of personal information which individuals in a free and democratic society would wish to maintain and control from dissemination by the state” and includes information “which tends to reveal intimate details of the lifestyle and personal choices of the individual”.93
[64] We consider that this approach provides an appropriate framework for analysis in the New Zealand context in a case such as the present. It follows that we do not agree with the approach taken in R v R that if information is obtained consistently with the privacy principles, in particular principles 2(2)(d) and 11(e), there will be no “search”.94 This suggests that these privacy principles effectively confer on the police a power to obtain information. However, the principles do not create any such power – in combination, they allow the police to seek personal information other than directly from the person involved and allow (but do not compel) an agency to release information to police provided the statutory pre-conditions are met. Whether a police request for information amounts to a “search” will depend on whether it relates to personal information in respect of
92 These are the factors identified by Sopinka J for the majority in Plant: see above at [56].
93 See above at [56].
94 R v R and R (CA201/2015) v R, both above n 54.
which there is a reasonable expectation of privacy, which depends on a consideration of factors such as those identified at [63] above. If there is a reasonable expectation of privacy in the information, there will be a search and the question will become whether the search is unreasonable. In circumstances of exigency such as applied in R v R, the search (the voluntary provision of information) may not be unreasonable. But where there is time to obtain a production order or search warrant, the search may well be unreasonable.95 If there is no reasonable expectation of privacy in the information, there will be no search for the purpose of s 21 and the issue will simply be whether the requirements of the exception in principles 2(2)(d) and 11(e) are met. If they are, that will be the end of the matter. If they are not, then the question will be whether there is any issue of unfairness under s 30; if there is, a proportionality analysis will be required.
[65] As previously noted, we are assuming that the subjective element is met in the present case, so that our focus is on the objective element. In addressing the objective element, we have regard to the context, in particular to the nature of the information obtained, the circumstances in which it was obtained and the nature of Mr Alsford’s arrangements with the power supply companies.
[66] First, dealing with the nature of the information obtained, the power companies provided what the police described as billing information, that is, the power consumption figures for each billing month, with an indication whether the monthly figure was an estimate or was based on a reading. There was no breakdown of usage within the month, simply an aggregate figure. Although generally relevant to the investigation into whether Mr Alsford was running a cannabis growing operation, the data in the form obtained did not reveal intimate details of Mr Alsford’s lifestyle and personal choices. This is not to say that that power consumption data could never reveal such details,96 simply that this power
95 There is a further difficulty with the reasoning in R v R, which is that it requires the holding agency to determine whether there are circumstances of urgency which make it “necessary” that the information be provided. As previously noted, we do not consider that it was intended that a holding agency should consider both the reasons for the request (in terms of an investigation, for example) and the justification for obtaining the information by request rather than by warrant or production order.
96 Some types of smart meter may collect power consumption data in a way that does reveal intimate details of a person’s lifestyle and other choices.
consumption data did not. This supports the view that any subjective expectation of privacy was unreasonable.
[67] Second, looking at the circumstances in which the information was obtained, the information was gathered and held by three commercial entities for business purposes. They provided it to the police when requested to do so. Although the data provided related to residential properties owned by Mr Alsford or entities associated with him, it was the companies’ data, collected for legitimate commercial reasons, and no search of the properties was required to obtain it. While this does not necessarily mean that there could be no reasonable expectation of privacy in the data, it does mean that the special protection recognised in respect of a person’s home is not engaged directly.97 Moreover, the companies had a direct interest in providing the information to the police, in the sense that large scale cannabis growing operations often involve the theft of electricity as a result of meters being bypassed. While this possibility was not raised in the police requests to the supply companies, it is clear from the evidence that at least one of the companies, Genesis Energy, was well aware of potential theft of electricity in this situation.98 Overall, this consideration also tends to support the view that there was no reasonable expectation of privacy.
[68] Third, there is the nature of the arrangements between the power supply companies and Mr Alsford. Contractual terms of supply may contain provisions relevant to the supply of customer information to third parties and so are relevant to whether or not there is a reasonable expectation of privacy. The existence of contractual provisions permitting disclosure will not necessarily be determinative, however, and the caution expressed by Deschamps J in Gomboc must not be overlooked. In the course of addressing the relationship between the supply company and its customers in that case, Deschamps J said:99
97 This is subject to the qualification expressed above at n 96, that there might be a reasonable expectation of privacy if the power consumption data was collected or broken down in a way which revealed the intimate details of the occupants’ lifestyle in their home.
98 We do not agree with the Chief Justice (below at [189]) that a company’s self-interest in detecting theft of its electricity by a customer is irrelevant to the operation of the privacy principles. We do not think it can seriously be suggested that a power company which suspects electricity theft by a customer cannot report that to the police without breaching the privacy principles.
99 Gomboc, above n 78, at [33].
That [the supply company] was at liberty to disclose the information weighs heavily against giving the asserted expectation of privacy constitutional recognition. However, in view of the multitudinous forms of information that are generated in customer relationships and given that customer relationships are often governed by contracts of adhesion (while noting that in this case Mr. Gomboc was at liberty to prevent the disclosure but did not elect to do so), there is every reason for proceeding with caution when deciding what independent constitutional effect disclosure clauses similar to those [in issue] may have on determining a reasonable expectation of privacy.
Cromwell J, delivering the judgment of the Supreme Court in Spencer, reaffirmed these points.100
[69]In the present case, all three power supply companies had privacy policies:
(a)The Contact Energy policy said that the company would “keep your personal information secure and it’ll be held by us in our customer database in accordance with the Privacy Act 1993 and as set out in our energy supply agreement”.101 When outlining the circumstances in which personal information would be disclosed, the policy referred to releasing personal information in various circumstances including “if we’re legally required to”.
(b)The Genesis Energy policy said that the company held information “in accordance with the Privacy Act 1993 and in particular, the Privacy Principles contained in that Act”. It went on to say that the company would not disclose personal information to third parties “except in accordance with the strict exceptions contained in the Privacy Act, or where authorisation has been given by you for that disclosure”.
(c)
The Meridian Energy policy said the company would collect personal information but would not use or disclose it “except for purposes set out in this privacy policy, or as allowed by the Privacy Act”. Later the policy stated that information might be disclosed “if we believe that
100 Spencer, above n 87, at [54].
101 We were not provided with a copy of the energy supply agreement, so we do not know whether it contained relevant clauses and, if so, what they provided.
the … disclosure is reasonably necessary to assist a law enforcement agency”.
[70] All three policies stated that personal information would be held in accordance with the Privacy Act and referred to the possibility of disclosure – the Contact Energy policy to disclosure if legally required, the Genesis Energy policy to disclosure in accordance with the Act and the Meridian Energy policy to disclosure to law enforcement agencies. The latter two policies, then, identified the possibility that customer information could be disclosed in accordance with the Privacy Act, which includes principle 11(e). However, the statement in the Contact Energy policy that the company would release information “if we’re legally required to” is problematic. The Privacy Act does not require those holding information to comply with police or other requests for information, even legitimate requests.102 More importantly, the “if we’re legally required to” language may well suggest to a reasonable consumer that the company would release customer information only in response to a production order or a search warrant, which is not what happened in this instance.
[71] The fact that two of the policies contemplated disclosure in accordance with the Privacy Act might suggest that Mr Alsford’s expectation of privacy in his customer data was not “reasonable”, at least in circumstances where there was compliance with the Privacy Act’s requirements – he ought to have been aware that the information could be released. On the other hand, the fact that one of the policies suggests that disclosure would only be made pursuant to a production order or similar process points in the opposite direction. When these points are considered against the background that caution must be exercised when assessing the impact of customer contracts in this context, the nature of the contractual arrangements does not advance matters much, if at all.
[72] Overall, we consider that Mr Alsford did not have a reasonable expectation of privacy in the particular power consumption data at issue.
102 Law Commission Review of the Privacy Act 1993 (NZLC IP17, 2010) at [12.25].
Conclusion
[73]By way of summary:
(a)The enactment of the production order regime did not mean that the police were not entitled to ask the power suppliers to provide information as to power consumption at the properties on a voluntary basis.
(b)Whether the power consumption information was obtained consistently with, or in breach of, the Privacy Act may be relevant to whether it was obtained improperly in terms of s 30(5) of the Evidence Act and/or to the balancing process under s 30(2) but will not be determinative.
(c)Where the police seek information from service providers about customers on a voluntary basis, they must not infringe s 21 of NZBORA.
(d)In considering whether s 21 has been infringed, the first question to be determined is whether the information in issue was obtained as a result of a “search”. The answer depends first, on whether the person concerned in fact had an expectation of privacy in relation to the information and second, on whether any such expectation was reasonable. If it is determined that there was a “search”, the second question under s 21 arises – was the search “unreasonable”?
(e)We consider that Mr Alsford did not have a reasonable expectation of privacy in the particular power consumption information obtained in this case.
[74] The consequence is that the police were entitled to use the power consumption information, and any inferences that could fairly be drawn from it, in the applications for the production order and later the search warrants.
2010 search
[75] As we have said, the information obtained as a result of the illegal 2010 search was referred to in the application for a production order in respect of Mr Alsford’s mobile phone data. The texts obtained as a result of the production order were a substantial basis for the search warrant applications.103 Mr Eaton argued that because the 2010 search was unlawful and the information obtained from it was ruled inadmissible, the application for the production order should not have referred to it. If the production order through which the police gained access to the text messages was improperly obtained, it followed that the search warrants were also improperly obtained, given the significance of the text messages to those applications. Consequently, the information obtained as a result of the execution of the warrants was improperly obtained.
[76]There were four essential points to Mr Alsford’s submissions:
(a)The police were required to disclose the full circumstances of the 2010 search in the production order application.
(b)Such disclosure was necessary to enable the issuing officer to determine whether or not he or she would permit the police to rely on the information previously ruled inadmissible.
[165] Section 11 of the Privacy Act deals with the manner of enforcement of the principles:
11 Enforceability of principles
(1)The entitlements conferred on an individual by subclause (1) of principle 6,[193] in so far as that subclause relates to personal information held by a public sector agency, are legal rights, and are enforceable accordingly in a court of law.
(2)Subject to subsection (1), the information privacy principles do not confer on any person any legal right that is enforceable in a court of law.
[166] The limitation in s 11 sets up investigation and enforcement by the Privacy Commissioner under Part 8 of the Act as the primary means of direct enforcement of the information privacy principles. (An exception provided by s 11(1) is that disclosure of the information a public sector agency holds about an individual can be compelled through court action.194) I cannot agree however that the restriction on the manner of enforcement of the prohibitions on disclosure and collection of personal information means that non-compliance with the principles is not breach of the provisions of the Privacy Act. In my view, information obtained as a result of non-compliance which is not within an exception contained in the Privacy Act or is not authorised by another enactment (and saved by s 7) is unlawfully obtained and its admission as evidence may be challenged under s 30 of the Evidence Act.
[167] The scheme of enforcement under Part 8 of the Privacy Act envisages that “adequate remedy” for breach of privacy may be obtained outside the enforcement provisions of the Act.195 Where the resulting detriment through breach is the obtaining of evidence, it seems to me entirely preferable that any question of redress is assessed in the context of s 30. As the Privacy Commissioner pointed out in his submissions, it would be impractical to require a defendant to pursue a Privacy Act complaint before challenging the admissibility of evidence. As he said, “[t]he
193 Principle 6 gives an individual access to the personal information held by an agency.
194 Obtaining access to such information is important in the scheme of protections contained in the Act such as the entitlement to obtain correction provided by principle 7 and limits on the use to which an agency may put personal information about others or hold it on file under principles 8–10.
195 Privacy Act, s 71(1)(g).
statutory process has a uniform track and does not include urgent processing for complaints that have a bearing on other proceedings”.
[168] To the extent that the decision of the Court of Appeal in Wong-Tung suggests that, by virtue of s 11(2), the privacy principles “[do] not have the force of law”, 196 I would not follow it. Enforceability in the courts (as opposed to through the mechanism provided for redress in the statute) does not affect the obligations imposed by law on agencies which collect or disclose personal information.197 They are statutory obligations the agencies are required to observe. Although their breach may not found a direct cause of action in itself, s 11(2) does not justify or excuse the breach.
[169] There have been considerable developments in the years since 1995 (when Wong-Tung was decided) both relating to privacy in information and the need for protections and in relation to what constitutes a breach of s 21 of the New Zealand Bill of Rights Act.198 The major reforms of the Search and Surveillance Act have occurred since. Wong-Tung was also decided before s 30 of the Evidence Act was enacted to provide a framework for considering the common law discretion to exclude evidence. Section 30 requires evidence improperly obtained to be excluded unless exclusion is out of proportion to the impropriety.
[170] Where the admission of evidence obtained in breach of principles in the Privacy Act is sought to be excluded as improperly obtained in application of s 30 of the Evidence Act, it is not properly characterised as the “enforcement” of a legal right conferred by the privacy principles, within the meaning of s 11(2) and in
196 The statement in Wong-Tung was not material to the determination in that case because the Court took the view that there was no breach of principle 4 (the principle there in issue): R v Wong-Tung (1995) 13 CRNZ 422 (CA) at 426.
197 The Privacy Commissioner suggested that s 11(2) could be seen as limiting the provision of “civil remedies”, but “does not restrict the courts from applying or taking account of the Principles as an expression of privacy standards in criminal proceedings such as an assessment under s 30(5)”. As will be apparent, I take the view that a breach of the privacy principles in
obtaining evidence is directly within the scope of s 30(5)(a), even if it is also a matter to be taken into account in considering whether the evidence was unfairly obtained.
198 At the time Wong-Tung was decided, it was unclear whether something “intangible” (such as the information there obtained by a “telephone analyser”, which recorded details about calls) amounted to “search and seizure” for the purposes of s 21 of the New Zealand Bill of Rights Act. See R v Wong-Tung (1995) 13 CRNZ 422 (CA) at 426–427; referring to R v A [1994] 1 NZLR 429 (CA); and R v Barlow (1995) 14 CRNZ 9 (CA).
respect of which the Part 8 procedure is available.199 The policy of limited direct enforcement does not require non-compliance with s 6 to be ignored in considering admissibility of evidence under s 30 of the Evidence Act.
[171] The Privacy Commissioner’s submission that breaches of the information privacy principles should perhaps be considered under the unfairness limb of s 30(5)(c) was put forward on the basis that the law is as stated in Wong-Tung. I have explained why I do not think that decision can be maintained following the legislative reforms in the Search and Surveillance Act and the Evidence Act and why I take the view that s 11(2) does not itself constitute justification for breach of a principle. Since I also take the view that interference with privacy arises when evidence is obtained in breach of the principles (in what I would accept is relevant detriment and adverse effect on the individual’s interests), I do not agree that it is necessary here to have recourse to s 30(5)(c) rather than s 30(5)(a). In my view, evidence obtained by the police (an agency to which s 3 of the New Zealand Bill of Rights attaches) through breach of the privacy principles is obtained in breach of an enactment. I would accept in addition that it is also unfairly obtained because obtained contrary to the reliance the individual was entitled to place on the Privacy Act, in this case echoed by the contractual undertakings of the utility providers to comply with the Act.200
[172] It follows that I am unable to agree with the other members of this Court in their view that breach of the privacy principles is unlikely to be of “independent significance” under s 30 of the Evidence Act 2006, although it “will [possibly] be relevant under s 30”.201 In my view, breach of the privacy principles in obtaining evidence means that the evidence is “improperly obtained” because obtained in breach of an enactment.
199 A conclusion reached also by Lang J in R v Leone HC Auckland CRI-2007-004-18646, 27 April 2009 at [90].
200 Although contractual terms permitting disclosure to third parties could not be determinative of compliance with the statutory obligation, a contractual representation that personal information
will be protected and not disclosed except with the consent of the individual or in accordance with law is itself relevant to whether there was a reasonable expectation that the information would not be disclosed. The terms of the privacy policies adopted by the three utilities whose disclosure was in issue in the present case are set out in the reasons given by Arnold J above at [69]. All indicated the companies would disclose personal information only with the agreement of the individual or in accordance with the legislation.
201 Above at [40].
[173] Although I do not consider it is necessary to rely on the impropriety in the breach of the Privacy Act given the conclusion I reach on the use of the unlawfully obtained 2010 information, I mention for completeness that in another case, and depending on the context, breach of the principles of the Privacy Act may well not justify exclusion of evidence, in application of s 30(2) of the Evidence Act. Some guide to when breach of the privacy principles is such that exclusion of evidence obtained through the breach will be a proportionate response may be found in the enforcement provisions of the Privacy Act. Under s 66, enforceability by the Privacy Commissioner depends on whether there has been interference with privacy which entails not only breach of the privacy principles but loss, detriment or damage to the individual, adverse effect on rights, benefits, privileges or interests of the individual, or has resulted in or may result in significant humiliation, significant loss of dignity or significant injury to the feelings of the individual.
[174] In this scheme, while “significant” effect on feelings is necessary, any non-trivial detriment or adverse effect on rights or interests is treated by the statute as an interference with privacy justifying action by the Commissioner unless there is another adequate remedy. It is unnecessary for the purposes of disposition of this case to be definite. My tentative view however is that evidence improperly obtained through breach of the privacy principles which is not trivial will usually be an interference with privacy for which the appropriate remedy will be exclusion of evidence if it is justified by the balance required by s 30 of the Evidence Act. That seems to be consistent with Part 8 of the Privacy Act.
Compliance with the Privacy Act in obtaining the electricity consumption records
[175] The police requested the records relating to power consumption at Pannell Avenue and Baker Street from the three electricity suppliers, Genesis Energy, Meridian Energy and Contact Energy. Two of the requests referred to the Privacy Act. The request to Meridian was described as an Official Information Act 1982 request.
[176] I do not consider that the form of the request was material. What mattered was whether the basis for invoking the exception in principle 11(e)(i) was properly
made out. The requests were made on the basis of assertions by the police officer making them that:
(a)“intelligence has indicated that cannabis is possibly being grown at these addresses” (the request addressed to Contact Energy in relation to Pannell Avenue);
(b)“[t]o assist Police with an investigation that we are currently undertaking, information is sought in relation to [Pannell Avenue]” (the request to Genesis Energy); and
(c)the police were investigating an allegation of criminal activity and that “intelligence has indicated that cannabis is possibly being grown at [Baker Street]” (the request to Meridian Energy).
[177] Ellen France P queried whether the information provided to Genesis Energy by the police was sufficient to invoke exception (e)(i) to principle 11.202 The email request said only that the disclosure of personal information was sought “to assist Police with an investigation we are currently undertaking”. Although Ellen France P thought this email could be contrasted with the requests to Contact and Meridian Energy, I am not sure that the information provided to these companies was much improvement. It simply recorded that the personal information was required by the police for an investigation at the customer’s given address where “intelligence has indicated that cannabis is possibly being grown”. On the other hand, I do not think that what was called for was more detail about the intelligence the police had. Such information might well be information the police would properly be reluctant to provide and which the utility companies were not well-placed to assess.
[178] More importantly, there was no explanation of the need for the exception to non-disclosure, in the context of the availability of the judicial process of compulsion. The Search and Surveillance Act and its regulation of consent searches is also the context in which the exception for maintenance of law in principle 11(e)(i) falls to be interpreted and applied today. The requests provided no reason why a
202 R v Alsford [2015] NZCA 628 at [56].
refusal by the energy companies to disclose the information until they received a production order would have prejudiced the maintenance of law.
[179] Because there is no explanation of the need to provide the information under the exception to avoid prejudice to the maintenance of the law, I do not consider that the organisations who supplied the personal information could reasonably have held the belief that the provision of the information came within the (e)(i) exception to principle 11. I therefore consider that the information was supplied in breach of the legislation. The police actively facilitated the energy companies’ breach of their obligations under principle 11. As explained above,203 I consider that this amounted to collection of personal information by unfair means, a contravention of principle 4.
[180] It has been suggested here that there was insufficient information available to the police to make a successful application for a production order. If so, I think that circumstance demonstrates the wrongness of a broad interpretation of exception (e). It would permit easy evasion of the protections put in place for search under the Search and Surveillance Act wherever personal information is held by a third party. And it would avoid the policy of the Privacy Act in seeking to ensure as far as possible that those whose personal information is held by third parties and can be easily shared (as so much personal information is in the circumstances of today) are protected from undisclosed disclosure of it for purposes other than that for which it was provided unless the information is public or unless their consent is sought.
[181] As indicated, I consider that statements in some of the cases about the freedom of an agency holding personal information to act as a “good corporate citizen” in responding to requests by law enforcement agencies204 need reassessment in the light of the policies of the Privacy Act and the availability of orders under the Search and Surveillance Act with its policy of balancing law enforcement interests with human rights and rights of privacy.
[182] I do not think it accords with the importance placed by the legislation on privacy interests in personal information for the provision of information to be left to
203 Above at [146]–[147].
204 See, for example, R v Cox (2004) 21 CRNZ 1 (CA) at [66].
the choice of the agencies holding the information. That opens the door to uneven application of the law, as is illustrated in the present case. The telecommunication company required a production order before providing information about the respondent’s mobile phone use but the electricity providers passed it over on request. Unless there is some particular reason why obtaining a production order or search warrant is not practicable, I do not see that there is any “necessity” for the information to be provided as an exception to the general principle of non-disclosure save where there is statutory requirement. Such necessity is not shown simply by the request for the provision of the information by a law enforcement agency and its linkage with an investigation.
[183] Such interpretation of exception (e)(i) to principle 11 also means that a reasonable belief that the provision of the personal information is “necessary … to avoid prejudice to the maintenance of the law by any public sector agency, including the prevention, detection, investigation, prosecution, and punishment of offences” does not require a holding agency to make the sort of assessment required of judicial officers in making compulsory orders under the Search and Surveillance Act. That is not a task they are qualified to perform. Instead, it requires provision to them of reasons why there would be prejudice to the maintenance of law (including in the investigation of crime) if there is compliance with the Act. The reasons may be directed at why it would be prejudicial to the maintenance of law for orders under the Search and Surveillance Act to be sought. If that course is not taken, the effect is that the police will have a blanket exemption from compliance with the Act for the purposes of investigation of crime. I do not think that any such blanket exemption is consistent with the scheme of the scheme of the Search and Surveillance Act and the Privacy Act.
[184] In my view it was incumbent on the police, as the requesting agency, to identify why obtaining a production order or search warrant would prejudice the investigation. If the only available answer is that the police did not have sufficient basis for making an application for production order or search warrant, I cannot think that recourse to the “maintenance of the law” exception in the prohibition on disclosure in principle 11 could be available to avoid the safeguards imposed for compulsory disclosure. The view that the utility companies can choose to disclose
personal information by treating any request by the police to supply it (if linked to investigation of a particular offence) as sufficient to establish prejudice to “maintenance of law”, notwithstanding the general prohibition, is in my view inconsistent with the policies behind the regulation of “consent searches” under the Search and Surveillance Act.
[185] The Search and Surveillance Act makes it unlawful to undertake a search with the consent of someone who does not have authority to give it. I am of the view that on a purposive interpretation of the Privacy Act, collecting agencies do not have any authority to disclose personal information except in accordance with its provisions. The “consent” of the individual affected to disclosure envisaged by the scheme of the Privacy Act is otherwise illusory because it is obtained not from the individual affected but from someone who has no personal interest in the personal information.
[186] I have already indicated why I consider a general exception for requests by the police to assist in investigations would also diminish to vanishing point the elements of “necessity” and “prejudice” which are the conditions of the exception to principle 11. As a result, I consider that a law enforcement agency which procures disclosure of personal information by a holding agency in reliance on paragraph (e)(i) of principle 11 when there is no basis for doing so has collected that information “unfairly”, in breach of its obligations under principle 4. Such collection is also in breach of an enactment, providing the occasion for application of s 30 of the Evidence Act.
[187] The view taken by the other members of the Court that breach of the privacy principles does not render evidence obtained through the breach unlawfully obtained in terms of s 30(5)(a) of the Evidence Act leads them to identify the “critical question” for the appeal as being whether the information was obtained through unreasonable search or seizure, contrary to s 21 of the New Zealand Bill of Rights Act, and on the basis that it “invades a reasonable expectation of privacy” (the test for breach of s 21 suggested by Blanchard J in Hamed v R).205 The conclusion that
205 See above at [47]–[48]. See also Hamed v R [2011] NZSC 101, [2012] 2 NZLR 305 at [163] and following.
there was no reasonable expectation of privacy in the monthly power usage data is determinative of the appeal in relation to the information obtained from the electricity providers.
[188] I disagree with this approach. I consider it insufficiently recognises the legislative policies contained in the Privacy Act in relation to personal information and the scheme of that Act. They make disclosure and collection of personal information which breaches the principles of the Act unlawful. I consider the correct approach was not to assess whether the individual had any reasonable subjective expectation of privacy in the information, but to assess whether the collection and disclosure of information was in breach of the Privacy Act. Reasonable expectations of privacy may well have been important in any consequential determination by the Privacy Commissioner of remedy under Part 8 or in the balance required in excluding improperly obtained evidence under s 30, but they were not determinative of breach of the Privacy Act. In the case of personal information, disclosure and collection of information had to be justified in terms of the Act. Otherwise such disclosure and collection was unlawful and constituted “improperly obtained” evidence for the purposes of s 30(5)(a).
[189] I consider it is inconsistent with the purpose and scheme of protection in the Privacy Act to treat the personal information in issue here as if “the companies’ records”, even in a formal sense.206 The legislation makes it clear that it is personal information for the purposes of the Privacy Act and may not be disclosed by the utility company except in conformity with the Act. Nor indeed may it be used by the company collecting it except in the circumstances set out in principle 10, including where “the purpose for which the information is used is directly related to the purpose in connection with the information was obtained”.207 Any self-interest on the part of the company in detecting possible theft of electricity do not seem to me to bear on the obligations under the legislation.208
206 Compare above at [23].
207 Principle 10(e). Other exceptions are provided where the information is reasonably believed to be publicly available or that non-compliance is necessary to avoid prejudice to the maintenance of the law (mirroring the provision in principle 11(e)), or where it is necessary to avoid a serious threat (mirroring principle 11(f)).
208 Compare above at [67].
[190] For the reasons already indicated, I consider it is inadequate to conclude that “voluntary” collection and disclosure of personal information to the police is lawful if it complies with s 21 of the New Zealand Bill of Rights Act, as is the effect of the reasons given by the other members of the Court.209 The conclusion they reach is driven by the approach that “the decisive issue is not whether the power consumption records were obtained consistently with the Privacy Act but whether they were obtained as a result of an unreasonable search, contrary to s 21 of [the New Zealand Bill of Rights Act]”.210
[191] It is not open to the police to seek from third parties personal information held by them about individuals except in conformity with the provisions of the Privacy Act or after obtaining a production order or search warrant. Disclosure can be obtained with the consent of the individual affected or under the exceptions provided for in the Act. If consent is not forthcoming (or is not sought by the police), then I do not consider that the statutory scheme of the Privacy Act and the Search and Surveillance Act leaves scope for the utility companies to “volunteer” the personal information. If that means that “intelligence gathering” from third parties who hold personal information is inhibited in circumstances where the police have no sufficient belief to justify application for compulsory disclosure under production order or through search warrant, then that I consider is the consequence of the regulation of consent disclosure and the better balance sought to be achieved through the Search and Surveillance Act for privacy. I consider that case-law that predates the Search and Surveillance Act needs to be reassessed in light of that Act.
Section 21 of the New Zealand Bill of Rights Act
[192] Because I take the view that evidence obtained in breach of the Privacy principles is evidence improperly obtained within the meaning of s 30(5) of the Evidence Act, it is unnecessary for me to determine whether it was also improperly obtained because it constituted unreasonable search, in breach of s 21 of the
209 Above at [73]–[74].
210 Above at [17].
New Zealand Bill of Rights Act. I differ from other members of the Court who take the view, in application of the approach taken in Cox211 and R v H,212 that the “central” question is whether the evidence was obtained in breach of s 21 of the New Zealand Bill of Rights Act.213 I consider that the central question for the Court in considering the use of the electricity records was whether disclosure was in breach of the Privacy Act. Whether it was also a breach of s 21 of the New Zealand Bill of Rights Act was not a matter that was critical to the application of s 30(5). Rather, if also a breach of s 21 of the Bill of Rights Act, that circumstance would be material to the proportionality analysis required by s 30(2)(b) of the Evidence Act. That is because breach of a right recognised as fundamental makes it less likely that exclusion will be found to be “disproportionate”.
[193] I do not consider that the analysis of the appeal starts and ends with s 21 of the New Zealand Bill of Rights Act. In jurisdictions where there is no equivalent statutory prohibition on collection or disclosure of personal information, broadly defined, lawfulness may turn on matters of degree comparable to the s 21 proscription on “unreasonable search and seizure”. But some care needs to be taken in treating case-law from jurisdictions without an equivalent protection for personal information to that contained in s 6 of the Privacy Act as controlling of the circumstances in which evidence is obtained in breach of an enactment. Similarly, New Zealand case-law concerned with the application of s 21 of the New Zealand Bill of Rights Act does not seem to me to address the question whether there has been a breach of s 6 of the Privacy Act. I do not therefore find the decision of the Canadian Supreme Court in R v Plant214 to be as helpful as it is treated in the decision of the other members of the Court.215 Similarly, I do not accept the view taken by Arnold J for the majority that the Canadian decisions on the equivalent Charter provision to s 21 of the New Zealand Bill of Rights Act provide the correct framework for analysis in the New Zealand context of the effect of breach of the Privacy Act principles.216
211 R v Cox (2004) 21 CRNZ 1 (CA).
212 R v H [1994] 2 NZLR 143 (CA).
213 See above at [17] and [28].
214 R v Plant [1993] 3 SCR 281.
215 See above at [55]–[57] and [63]–[64].
216 Compare above at [63]–[64].
[194] That is not to say that the use of the material obtained through the search is not breach of s 21 of the New Zealand Bill of Rights Act as well as breach of the Privacy Act. The other members of the Court hold that the obtaining of the respondent’s electricity consumption records does not constitute an “unreasonable search” because conduct does not entail “search” unless it invades a “reasonable expectation of privacy”.217 I do not agree that “unreasonable search” is determined by whether it entails encroachment on a “reasonable expectation of privacy”. The reasonableness requirement in s 21 attaches to the search or seizure in issue. In any event, while I do not accept that protection of a reasonable expectation of privacy is the only purpose served by s 21 (a matter I adverted to in Hamed218), the scope of the protection provided by the Privacy Act must bear on what expectation of privacy in personal information it is reasonable for the individual to expect. Relevant too is the scheme of the Search and Surveillance Act, a reform proposed by the Law Commission in part to provide “clear statutory rules” that could be used to “guide” the interpretation and application of “the protean” concept of “reasonable expectations of privacy” in connection with s 21.219 The Law Commission recommended expansion of the search and seizure measures regulated by “detailed statutory provisions” to “guide the integration of reasonableness under section 21 in a number of contexts and ensure more complete protection of reasonable expectations of privacy”.
[195] The provisions of the Search and Surveillance Act based on the Commission’s report and referring explicitly to the balance struck between law enforcement and the privacy interests protected both under the New Zealand Bill of Rights Act and the Privacy Act point to congruence which is inconsistent with a narrow interpretation of “search” limited to information in which there is a reasonable expectation of privacy. Such interpretation would exclude much protected personal information. There seems to me to be no reason to constrain the meaning of “search” in this way. The balancing required by s 30 allows further consideration of all the circumstances and assessment of proportionality before evidence is excluded for breach of s 21. But the presumptive position that accords
217 Above at [47]–[48]; adopting Hamed v R [2011] NZSC 101, [2012] 2 NZLR 305 at [163] and following per Blanchard J.
218 Hamed v R [2011] NZSC 101, [2012] 2 NZLR 305 at [10]–[11].
219 Law Commission Search and Surveillance Powers (NZLC R97, 2007) at [2.49].
better with the scheme of the legislation seems to me to allow that the obtaining of personal information in breach of the provisions of the Privacy Act is unreasonable search under s 21.
Conclusion
[196] For the reasons given in paragraphs [104] to [130], I would dismiss the appeal and affirm the decision in the Court of Appeal.
Solicitors:
Crown Law Office, Wellington for Appellant Kearney & Co, Christchurch for Respondent
Office of the Privacy Commissioner, Wellington for Intervener
8
7
0