Access to a man's criminal record by a Department of Corrections employee at a Corrections office with which he had had no contact was a breach of privacy, the Office of the Privacy Commissioner has found.

The Office has released a case note which states that the man became aware that information from his file was disclosed to his ex-partner by the Corrections employee, who was known to her.

After the man complained to the Privacy Commisioner, the Department of Corrections confirmed that in fact two employees had accessed the man’s record without a legitimate work-related purpose. One employee had accessed the man’s record on two separate occasions.

"The department advised that it took such matters very seriously and conducted monthly audits of staff access to the system.  However, the department advised that no audits had taken place during the period when one staff member accessed the system," the case note says.

"We noted that the department was unaware that its employees had accessed the man’s record until his complaint was brought to their attention and a review was carried out by the Chief Privacy Officer.

"In our view, it was not sufficient just to have policies to safeguard information against unauthorised access. Agencies should also have processes in place to ensure that those policies were being followed. We found that there had been a breach of principle 5 of the Privacy Act 1993."

The Privacy Commissioner also accepted that there had been a breach of principle 11 as the Corrections employee did not have a legitimate reason to disclose information from the complainant’s record to his ex-partner. None of the exceptions to principle 11 applied.

The Privacy Commissioner took the view that the man had a reasonable expectation that his record would be securely stored by the Department and that it contained inherently sensitive information.

The Office found that the complainant had suffered stress and anxiety and that his feelings had been injured. It was guided by the decision Director of Proceedings v O'Neil [2001] NZAR 59 at [29]. It facilitated a settlement.