A former nurse who waited five years to lodge a privacy complaint with the Privacy Commissioner had her request for judgement rejected by the Human Rights Review Tribunal (HRRT) in March 2020.[1]

Ms Watson was employed by Capital and Coast District Health Board (CCDHB) as a nurse. In May 2012, CCDHB requested Ms Watson’s medical information from Catalyst NZ Ltd (Catalyst), which was managing ACC claims for CCDHB at the time.

Ms Watson did not agree to Catalyst releasing her medical information to CCDHB, but they nonetheless passed it on. She became aware of this fact in March 2013 and, five years later in March 2018, she complained to the Privacy Commissioner.

Shortly after receiving the complaint we advised Ms Watson that we would not investigate it, due to the time that had elapsed since Ms Watson became aware of the breach.

Refusing to take action on a complaint

Under section 71(1)(a) of the Privacy Act 1993, the Commissioner has the discretion to refuse to take action on a complaint if, in the Commissioner’s opinion, the length of time that has passed since a complaint arose means investigating is no longer practicable or desirable.

While the Commissioner has the discretion to investigate complaints many years after they have occurred, we generally refrain from doing so for several reasons. Firstly, when years have elapsed since an incident that triggers a complaint, it becomes difficult for our investigators to collect evidence to determine the facts. It is also unfair to the respondents of complaints to raise matters and ask them to respond to events that happened years ago.

The Privacy Bill currently before Parliament contains a clause (cl 80(1)(e)) that specifically gives the Privacy Commissioner discretion to decline to investigate a complaint where the complainant has known about the matter for more than 12 months.

Following our decision, Ms Watson took her case to the HRRT.

Catalyst, now operating as Employers Mutual Limited (EML), applied to the HRRT to strike-out her claim on the basis that the Tribunal did not have jurisdiction, because the Privacy Commissioner had not investigated the matter (a requirement of the statute).

Tribunal hearing

Ms Watson maintained that even though her claim was not investigated by the Privacy Commissioner, it should still be within the Tribunal’s jurisdiction as it was a matter that had been raised with the Privacy Commissioner; this should be enough to meet the jurisdictional threshold.  

The Tribunal rejected this argument and struck out Ms Watson’s claim. They noted an aggrieved individual can only bring a claim in the Tribunal under the Privacy Act 1993 if:

• There has been an investigation by the Privacy Commissioner; or
• There has been an unsuccessful attempt at conciliation.

If a claim that is filed does not meet these criteria (set out in ss 82 - 83), the Tribunal cannot consider the case. If a claim is outside the Tribunal’s jurisdiction, it must be struck out under s 115A(1) Human Rights Act 1993.

See Re Tai Rakena (Rejection of Statement of Claim) [2017] NZHRRT 27 at [22]-[26] for a further discussion of this issue.

[1] Watson v Employers Mutual Limited (Strike-Out Application) [2020] NZHRRT 10].