Privacy principle 6 of the Privacy Act gives people the right to access their own personal information. With six weeks to go until the Privacy Act 2020 comes into force, it’s a good time to become familiar with the new refusal grounds under principle 6.

Generally, an organisation must provide access to the personal information that it holds about someone if the person in question asks to see it.

People can only ask for information about themselves. The Privacy Act does not allow you to request information about another person, unless you are acting on that person’s behalf and have written permission.

Under the current Act, an organisation may have good reasons to refuse access, such as if:

• another statute says that the organisation does not have to provide access, or
• one of the refusal grounds in sections 27-29 of the Privacy Act 1993 applies. These grounds include for example where the information would be an unwarranted disclosure of another person’s affairs; or where it involves evaluative material.

Under the Privacy Act 2020, the refusal grounds have been widened to include personal and public safety, and harassment.

New refusal grounds

The new refusal grounds have been added to better cater for situations in which releasing personal information can have a negative effect on someone else.

Organisations can now refuse to disclose personal information if releasing it would:

• create a serious threat to the health, safety or life of an individual, or to public health or safety, s49(1)(a)(i)
• create a significant likelihood of serious harassment to an individual, s49(1)(a)(ii)
• cause significant distress to a victim of an offence, s49(1)(a)(iii).

The new refusal grounds each have a high threshold before they apply, but they provide organisations with the means to find a balance in releasing information when there are other important interests at stake.

Protection of victims

The Law Commission recommended introducing this ground and noted concerns about offenders using the Privacy Act to access information about their victims.

An example provided to the Commission to explain the need to introduce this ground was a government department that released information to an individual who had allegedly offended against young girls. The individual then placed the information on a website, which distressed both the alleged victims and their families.

The Law Commission noted:

“The new ground for refusal is likely to be most relevant to victims of sexual offences or violent offences, but it could apply to any victim so long as disclosure of the victim’s information would be likely to cause significant distress, loss of dignity or injury to feelings. We think that this new ground for refusal would provide greater certainty to agencies, and would give appropriate recognition to the rights of victims.”

Harassment

The Law Commission defined harassment as repeated, unwanted contact with other individuals in ways that fall short of posing a physical danger to those individuals but that seriously detract from their quality of life.

This ground would only apply if there is a significant likelihood of harassment and if the harassment is serious in nature.

The Privacy Commissioner may provide guidance on this new provision, and the list of ‘specified acts’ in the Harassment Act could be of some assistance to agencies in deciding what constitutes harassment.

 For more information on the upcoming changes to the Privacy Act:

• Visit elearning.privacy.org.nz and sign up for “Privacy Act 2020.” It’s a short training module that gets you up to speed with the upcoming changes in less than 60 minutes.
• Go to privacy.org.nz and watch the 4-minute animated video explaining the changes.
• Go to privacy.org.nz and sign up for the Privacy Commissioner’s fortnightly newsletter.