As a result of a complaint, Police began an investigation into a woman who worked at a district health board. The complaint alleged that she may have accessed DHB health records in order to locate children who had been the victims of crimes committed by her brother.

In the investigation, Police disclosed sensitive personal information about the woman’s brother to the woman’s employer. The woman complained to our Office, and subsequently took her case to the Human Rights Review Tribunal, claiming there had been an interference to her privacy.

The matter had become a Police investigation after someone claiming to be the woman in a letter attempted to contact the children through the school they attended. The family were living at a secret address because they were fearful for their safety. Police suspected the woman might have tried to contact the children on behalf of her brother.

The police officer assigned to the investigation contacted the woman’s manager at the DHB where she worked. He disclosed detailed background information to the manager including information of the woman’s brother and his convictions for child sexual and physical abuse, and earlier convictions for possession of child pornography.

The police officer suspected the woman may have committed an offence under the Crimes Act 1961 - if she had inappropriately accessed the National Health Index (NHI) database through her role at the DHB to try and locate the family members.

The woman complained to our Office because the information disclosed by Police to her employer about her brother’s convictions had caused her hurt and humiliation. She said she should have been told first, and Police should have had a search warrant or production order to get her employer to look for evidence against her.

The DHB’s internal investigation showed the woman had not accessed the NHI or DHB databases.

Our investigation

The woman complained to us under principles 1-4 and 11 of the Privacy Act.

We found no breach of the collection principles (1-4). Neither did we find a breach of principle 11 which says an agency that holds personal information is able to disclose it in order “to avoid prejudice to the maintenance of the law by any public sector agency, including the prevention, detection, investigation, prosecution, and punishment of offences”.

After we found the woman had suffered no interference with her privacy, she took the case to the Tribunal.

Tribunal case

The woman claimed after the police officer had contacted her manager, she was subjected to further audits and was harassed by the manager. She withdrew from her friends and her drinking increased. She also gained weight, slept badly and suffered anxiety attacks at work. She later resigned from the DHB.

But the Tribunal noted the woman “did not impress as a witness. Unfortunately, she has become blind to any point of view other than her own. She hears only what she wants to hear and sees only that which she wants to see.” The Tribunal said it preferred the evidence given by the police officer and the woman’s manager.

Search warrant

The police officer testified that Police did not have enough information to obtain a search warrant or a production order, and this was why Police used the Privacy Act’s principle 11 to request evidence from the DHB.

The Tribunal agreed with the view of Police. It said if there was insufficient evidence to obtain a compulsory order, it would be absurd if Police were not able to rely on using the Privacy Act. The Act’s privacy principles were flexible enough for this kind of request to be made by law enforcement agencies.

Meaning of 'necessary'

The Tribunal found Police was able to satisfy the criteria needed to rely on the maintenance of the law exceptions and it considered the collection of the information was necessary for the purpose of maintaining the law. Like our Office, the Tribunal found no breach of the collection principles.

The Tribunal found Police had reasonable grounds to believe that disclosure of the brother’s offending, conviction and sentence was necessary because it gave the DHB the basis for agreeing to their request.

If the information was not provided, the DHB could justifiably have declined the request and this would also be in accordance with the Privacy Act. The disclosure of the woman’s connection to her brother, along with her brother’s offending, was necessary - and was not merely desirable or expedient.

The Tribunal dismissed the woman’s claim and upheld the original decision by our Office.

Image credit: Michael Kumm via Flickr

Read the full text of the decision.

Human Rights Review Tribunal, health, law enforcement