New Zealand Law Society - Social services agency stance impedes privacy breach resolution

Social services agency stance impedes privacy breach resolution

This article is over 3 years old. More recent information on this subject may exist.

A social service agency which caused unnecessary delays in resolving a privacy complaint left a woman feeling vulnerable and unimportant, the Office of the Privacy Commissioner says.

The agency's stance also derailed plans by the Office to call a compulsory conference.

In a case note, the Office says the woman complained to it after the agency posted a letter to her work address containing personal information about her and her family.

The woman’s employer had a policy to open any mail it received addressed to its employees. After opening the letter, the employer shared the contents with her colleagues and they used it to bully the woman.

The Privacy Commissioner says the social service agency knew about the employer’s policy of opening employee letters because it had made this mistake already; sending sensitive information about the same woman to the same address several years earlier

"After investigating the complaint, we found that the agency had breached principles 8 and 11 of the Privacy Act and caused the woman harm. This was an interference with the woman’s privacy. We considered it appropriate for the agency to make a settlement offer. We asked the agency to respond within 10 working days"

However, the agency responded 3 weeks later, saying it accepted the finding and planned to contact the woman within a week to arrange a time to make a formal apology.

After another 6 weeks this had still not happened and the Office of the Privacy Commissioner decided to use its compulsory conference powers in section 76 of the Privacy Act 1993.

While the agency responded with times and dates it said it was available, after three weeks, it raised some issues about its role in causing harm.

"This was a disappointing development. We would have expected the agency to raise these concerns when it first responded to our finding," the case note says.

While the Office of the Privacy Commissioner provided reasons for its views, the social services agency said it wanted to see further evidence of the woman's harm, wanted to ask her about it at the conference, and was not willing to discuss any financial settlement.

"We expect all parties to attend compulsory conferences prepared to resolve matters. A dispute about harm could cause the complainant more unnecessary distress. We decided that it wasn’t appropriate to have a conference while the agency took this stance," the Office says.

The woman answered a series of questions from the agency about her harm. She also agreed to show the agency medical evidence of her harm. It was only then that the agency offered an apology and financial compensation of $6,000.

"We acknowledge that agencies must be accountable for their funds, but in this case, we had repeatedly advised the social service agency that the woman was vulnerable and that delays in resolving this matter were making the harm she had experienced worse. Agencies need to keep this in mind and engage with us in a timely and meaningful way when working to resolve a complaint."