When is information your personal information? Does it include references to other people that just happen to be on a file with your name on it? These are the questions that the Human Rights Review Tribunal, and High Court of New Zealand have considered in the recent decisions in Taylor v Chief Executive of the Department of Corrections ([2018] NZHRRT 35 and [2019] NZHC 383).

We have received questions about the impact of these decisions, including whether they change the definition of ‘personal information’ under the Privacy Act. We have also been asked what the decision means for agencies dealing with principle 6 access requests where the information relating to an individual contains details of third parties, especially staff members.  

The High Court decision in Taylor noted that Mr Taylor’s personal information appeared on the same pages as details of Corrections officers. It held that the names of Corrections staff appearing in Mr Taylor’s file were not personal information about Mr Taylor and did not need to be disclosed under the Privacy Act because it was essentially administrative information. The Court said because of that finding, it did not need to reach a view about whether any of the withholding grounds applied.

Was it “mixed information”?

The decision also clarified when information might be considered “mixed information” (information about the requester and another party or parties). In this case, the information was not “mixed information” - and information about Corrections staff did not automatically become Mr Taylor’s information because it appeared on the same page as information about him. This was because the information was not intertwined. It was possible to distinguish and redact details about Corrections staff from the personal information about Mr Taylor without making the substantive content of the documents unintelligible.

Context is important

What the decision in the High Court does not do is represent a significant change to the definition of personal information or say that staff details can never be personal information about a requester. Rather, it points to factors for agencies to consider when cases involve information about the requester and other individuals. The basis for the appearance of staff names on a file needs to be assessed, and that the context of the interaction will help agencies to make this decision.

In other situations, the Court said, information can clearly be about more than one person, such as when there has been a comparison between the complainant and other individuals, or the name of an informant who had provided information about the complainant to a law enforcement or decision-making body.

Applying the definition of ‘personal information’ in light of Taylor

This decision highlights that the context is very important for an agency dealing with personal information:

“ultimately in this case… what is Mr Taylor’s personal information comes down to an examination of the particular information in the particular context.”

Taylor provides guidance when deciding whether third party information can be the information about a requester and can be treated as “mixed information” about more than one person:

• Is the information “essentially administrative” – does the name of the third party appear in connection with the requester’s information because they were carrying out an administrative function, or for some other reason?
• For example, the name of the person who prints emails in order to respond to an access request is administrative information. But the name of a staff member who browses someone’s file without good reason, and the number of times they accessed the file could be personal information of the person who the file belongs to, because that staff member is not undertaking a purely administrative function in the course of their regular employment. (That information could attract the protection of one of the withholding grounds contained in sections 27-29 of the Act.)
• Do the redactions render the communications unintelligible? Do the redactions remove a name and phone number on a document, or do they remove so many details that the information about the requester no longer makes sense? Information that is so intrinsically intertwined will generally be about both the requester and the third party or parties, as that level of connection will indicate either an interaction between the parties or another nexus which means the information is about them both.

Apply correct withholding grounds

If an agency determines that the names or details of other individuals are not the personal information of the requester, then the agency should not assess or withhold this information under the Privacy Act.

In those circumstances, if the agency is subject to the Official Information Act (OIA) they should consider the request under the OIA. The Ombudsman has released guidance on withholding staff names.

You can find a copy of the High Court decision here.

Image credit: RNZ

IPP6 - access, Human Rights Review Tribunal