New Zealand is generally an engaged country, and most of you reading this will be part of or will have been members of a club at some point. Whether it is a swimming, softball or rugby club or a miniature horse society, you will have been involved in one or know someone who is in one.

A common issue that arises is how those small clubs handle personal information.

Here’s a hypothetical. Let’s say Lucy makes a request for her personal information but Ethel, who is the chairperson of the Canasta Club, insists there is no need to comply with the request.

The difficult news for Ethel is that the club has obligations under the Privacy Act 1993 to provide Lucy with her personal information – for example, meeting records that may mention her and any other information.

Definition of personal information is wide

Personal information is any information which tells us something about a specific individual.

The information doesn’t necessarily need to name Lucy - she may be identifiable in other ways, like through her home address. All sorts of things can contain personal information, including notes, emails, recordings, photos and scans, whether they are in hard copy or electronic form.

This means that Ethel will need to think carefully and make an assessment about what personal information the club holds about Lucy.

In the unlikely event your club gets a letter from our office notifying you of a complaint made against your club, here are some key points to consider.

You’re not in trouble, so don’t panic

Say Lucy makes a complaint about the Canasta Club to our office because her request was not complied with. Here are two common scenarios where we may investigate.

Scenario 1 – Request for personal information

Our office needs to consider if Lucy’s right to access personal information had been interfered with. If Ethel failed to respond to Lucy’s request, we will contact the Club and ask it to either:

1. Give the information to Lucy directly if the club has no reasons for withholding the information, or
2. If the club is seeking to withhold Lucy’s information, it needs to explain which withholding grounds it is seeking to rely on (as set out in sections 27 to 29 of the Act).

This letter from our office will inform the Canasta Club that we have received Lucy’s complaint. The notification letter will set out the facts as Lucy has put to us, and identify why the complaint may raise issues under the Privacy Act.

The facts set out in the notification letter do not necessarily mean that our office is investigating the matter on those facts only. We’re also contacting the club to understand what has happened from its perspective.

The notification letter will also include a ‘statutory demand’. This means the club is required to provide any information it wishes to withhold to our office for review. We will then assess the information and determine whether the club is justified in withholding the information, or whether we think it should be released to Lucy (see sections 91(4) and 92 of the Privacy Act).

Scenario 2 – Collection, disclosure, security, and use of personal information

Lucy gave Ethel her email and mobile phone number, so Ethel can let her know about canasta in the local area. Lucy claims Ethel gave this information to Briony who rang Lucy to ask her to join her pyramid selling scheme. Lucy was annoyed Ethel had given her mobile phone number to Briony.

In this scenario, we would get in touch with Ethel to understand what’s happened, and to get her side of the story. We would then decide whether the club interfered with Lucy’s privacy.

Our office keeps things confidential

It is important to note that our office’s proceedings are privileged. This is set out in section 96 of the Privacy Act.

Section 116 also requires our office and its staff to maintain secrecy in respect of all matters that come to our knowledge in the exercise of our functions under the Act. These are obligations we take very seriously.

We therefore cannot pass on the information that the Canasta Club has about Lucy. If our office makes a finding the information should be given to Lucy, it is up to the club to do this.

Working with us is beneficial for your club

It is in the Canasta Club’s best interest to work with our office. We have no powers to force the club to provide the information to Lucy.

While our office’s recommendations are persuasive but not binding, we are here to try and assist you in meeting your obligations under the Privacy Act.

If we are unable to resolve the matter, Lucy has the right to go the Human Rights Review Tribunal.

Resolving the matter through our process means that Lucy is less likely to take the matter to the Tribunal. It also means that Lucy and Ethel can work towards mending their friendship and returning to the table to play a round of canasta.

We’re here to help you

We understand that whether playing petanque, softball or canasta, you’re not thinking much about how to keep Lucy’s personal information safe and secure, and it may be your first time dealing with our office.

If you have any questions, please don’t hesitate to ask us for help. It is not necessary to engage a lawyer. Our office is a dispute resolution focused agency - we are ultimately here to try and assist clubs to remedy a privacy issue and come to a resolution.

We also have guidance resources – such as our Priv-o-matic privacy statement generator and our AskUs FAQs - available on our website which you might find helpful.

Image credit: US airman kicks a rugby ball - Public domain.

complaints, IPP6 - access