We often get asked about how much a complaint is “worth” in settlement terms, by both complainants and respondents. To be honest, very few of our complaints settle for money. The resolution is usually non-financial, like the release of information or a decent apology.

However, we want to be helpful, and make sure our process is fair for both parties, and so we’ve put together some information on recent settlements under the Privacy Act.

As we have discussed before, our process is focused on resolving complaints but there is no easy formula for ‘valuing’ a complaint. In the past we have seen settlements including financial compensation, apologies, donations to social service agencies, arrangements for the installation of security systems, commitments to staff training, policy changes, and even a fruit basket, or restaurant vouchers. What the parties settle on is entirely up to them and will depend on a number of factors including the harm experienced by the complainant, the nature of the breach, and the willingness to resolve the complaint.

Harm

There are three kinds of harm under section 66 of our Act which can be considered when deciding whether someone’s privacy has been interfered with:

1. Specific damage – this could be financial loss, but could also include other forms of damage, such as loss of employment or physical injury;  
2. Loss of benefits – this is where the agency’s actions have adversely affected, or may adversely affect, the rights, benefits, privileges, obligations or interests of the individual; and
3. Emotional harm – where the action has resulted in, or may result in, significant humiliation, significant loss of dignity or significant injury to the individual’s feelings. Mere embarrassment or annoyance is not enough – any emotional harm needs to be ‘significant’.

The Tribunal

If no reasonable settlement is reached through our process, the complainant will be entitled to take their complaint to the Human Rights Review Tribunal. The Tribunal has the same monetary jurisdiction as the District Court, that is up to $350,000, and is able to award damages and compel parties to take action. It is worth noting however:

• there is currently a significant wait time to get a hearing,
• proceedings are generally public,
• there can be significant costs associated with the process, and
• you can have costs awarded against you if you are unsuccessful.

For these reasons, complaints generally settle for a ‘discount’ if settled before reaching the Tribunal.

Awards in the Tribunal vary substantially, and are fact-dependent. Again this makes it difficult to accurately assess what a complaint is ‘worth’ in money terms. In Hammond v Credit Union Baywide [2015] NZHRRT 6, the Tribunal reviewed recent awards and summarised:

[176] From this general overview it can be seen that awards for humiliation, loss of dignity and injury to feelings are fact-driven and vary widely. At the risk of over-simplification, however, it can be said there are presently three bands. At the less serious end of the scale awards have ranged upwards to $10,000. For more serious cases awards have ranged between $10,000 to about (say) $50,000. For the most serious category of cases, it is contemplated awards will be in excess of $50,000.

Most of the complaints we deal with are not factually similar to the case referenced above, but the comments are useful in setting out the current state of settlements in the Tribunal where there has been a serious interference with privacy. To reach the top band, there will usually have to be some very bad behaviour on the part of the respondent agency.  We haven’t seen any awards near that level since the Hammond decision.  

Other recent cases in the Tribunal that discuss harm include:

• Williams v ACC [2017] NZHHRT 26
• Taylor v Orcon [2015] NZHRRT 15.

Recent OPC settlements

Below is a summary of some recent settlements our Office has facilitated. As mentioned above, complaints that settle without having to go to the Tribunal usually do so for a “discount”. This is not a complete or comprehensive scale, but may help you understand what some other complaints have settled for.

• $17,000 where a government department disclosed a man’s address to his brother, who was about to be released from prison and against whom he had a protection order;
• $15,000 when, on three separate occasions, an agency failed to check the complainant’s updated address details and posted personal information to an outdated address;
• $14,000 where a DHB sent a patient’s medical records (concerning a termination of pregnancy) to her parent’s address after she had twice requested they update their records;
• $10,000 where a staff member of the agency inappropriately accessed the complainant’s sensitive health information;
• $8,000 where the respondent disclosed the complainant’s health information and details of follow up support that needed to occur to a large group of people;
• $6,000 where the respondent sent the complainant’s information to another patient due to an incorrectly addressed envelope;
• $6,000 where an agency twice sent sensitive information to a woman’s work address in the knowledge that the workplace had a policy of opening all incoming mail;
• $5,750 where the contact details of the complainant were disclosed to a third party who used this information to harass the complainant;
• $3,678 where a debt collector used a man’s information for a purpose other than the one they had collected it for, using it to contact his family and friends (the amount was a write-off of the debt he owed);
• $3,275 where a government agency collected a lot more information from a man than they needed over a number of years, and refused to provide him with its services unless he kept giving them the information;
• $3,000 where the details of an employment investigation into the complainant’s conduct were accessible to all staff in the organisation; 
• $2,200 where an agency failed to respond to an access request from an ex-employee, and also disclosed information about the man to their clients;
• $2,000 when a medical centre dropped a patient’s mental health records off to his letterbox but when he went to get them they weren’t in his box;
• $2,000 where an agency failed to take steps to stop their employee from looking up a woman’s file in their database and disclosing the information to people she knew;
• $2,000 where the respondent inadvertently disclosed the complainant’s personal information by sending her a letter in a windowed envelope which was then viewed by another person;
• $2,000 where a retail store posted a picture of a young girl online, wrongly accusing her of theft;
• $900 where an employer posted information about one of her employees on a Facebook group page, complaining about her work ethic and performance.

As you can see, there is a range, even for similar factual circumstances. It is important to provide evidence of real costs - such as doctor’s visits and counselling sessions - as well as a described experience of significant emotional harm. The threshold is high, and requires more than a fleeting feeling of upset or distress. This is information the respondent agency will have to consider in determining what they are able to offer.

It is important to remember that when you complain to our Office, it is very unlikely the outcome will be cash in your pocket. We only facilitate financial settlements where there has been a clear breach of a privacy principle and serious harm that has flowed from that breach. It’s also relevant to note that even where we have facilitated a settlement, we have no power to enforce it, if either party fails to uphold the agreement. In the unlikely event that happened, you’d need to seek independent advice.

Image credit: French warning sign via Pixabay

complaints, Human Rights Review Tribunal