Privacy Act 2020

The Law Commission’s review of the Privacy Act noted the importance of protecting victims and concerns about offenders using the Privacy Act to access information about their victims.[1]

Under section 49(1)(a)(iii) of the Privacy Act 2020, an agency can refuse to provide access to personal information if the disclosure would:

include disclosure of information about another person who is the victim of an offence (or alleged offence); and
the disclosure would cause them significant distress, injury or loss of dignity.

This will apply to any access request the agency is dealing with after 1 December 2020.

This is a two-part test which must be met if an agency is going to rely on this withholding ground: (i) does the information relate to a victim and (ii) would the disclosure of the information cause them significant distress, injury or loss of dignity?

Privacy Act 2020 reference:

49. Protection, etc, of individual as reason for refusing access to personal information(1) An agency may refuse access to any personal information requested if —

(a) The disclosure of the information would —

(iii) include disclosure of information about another person who —

(A) is the victim of an offence or alleged offence; and

(B) would be caused significant distress, loss of dignity, or injury to feelings by the disclosure of the information

Who is a victim?

The definition of victim under the Privacy Act 2020[2] is the same as in section 8 of the Prisoners’ and Victims’ Claims Act 2005. Broadly this applies to:

The victim of an offence (or alleged offence), including a victim who suffers physical injury or loss or damage to property through that offence;
The parent or legal guardian of a child or young person who is the victim of an offence; and
An immediate family member of someone who dies or is incapable as a result of an offence.

However, parents and family members are not included in the definition of a victim if they were the alleged perpetrator.

Case Notes:

Case Note 300915

Case Note 279251

Will the disclosure cause them significant distress, injury or loss of dignity?

Significant distress, injury, and loss of dignity is a reasonably high threshold. When assessing whether disclosure would cause a victim harm to this level, some factors to consider include:

the identity of the requester, for example whether the requester is the perpetrator of the offence against the victim;
the nature of the information;
whether the information describes the experience from the victim’s perspective;
whether the information relates to the victims’ feelings or emotions;
whether the request made after the court process has ended. A victim would expect information to be released if it is necessary for the prosecution of the offence, but may be distressed by the prospect of the offender obtaining access to the information outside the parameters of that process;
the context of the request and whether the requester can or is likely to keep the information confidential; and
the victim’s views (or likely views) on release – would consultation on this point in itself be likely to cause distress or revictimisation?

Applying the refusal ground

Usually the release of “mixed information” about the requester and other individuals requires an assessment of whether disclosure of the information would be unwarranted in the circumstances, in other words a balancing approach of the interests of the requester and other individuals. For example, under section 53(b)[1] it can be relevant to consider whether the requester requires the information in order to be able to respond to an allegation or defend themselves

However, unlike section 53(b) this ground protecting the interests of victims does not involve a balancing exercise to determine whether the disclosure is unwarranted. Section 49(1)(a)(iii) only requires that the disclosure would cause significant distress to the victim. The motivation of the requester could be relevant to assessing whether release would distress or injure the dignity of the victim. However, even if the requester has a genuine need to see the information an agency could still refuse the request under s49(1)(a)(iii) if it would be significantly upsetting to the victim.

Other refusal grounds might apply

If the two-part test in section 49(1)(a)(iii) is not met, an agency can consider whether another refusal ground might apply instead. For example, the disclosure could be the unwarranted disclosure of the affairs of another individual (section 53(b)).

Form of releasing information if no refusal ground applies

If section 49(1)(a)(iii) or another ground does not apply and the agency is concerned about further distribution of the information, the agency might consider providing it to the requester in an alternative form, rather than providing them with a copy (e.g. giving an opportunity to view but not retain the information).

[1] The Law Commission noted concerns about this type of information being currency in prison, and offenders obtaining information relating to their offending and then posting it on the internet.

[2] This term is defined in the Act at section 49(2).

[3] This refusal ground in section 53(b) (unwarranted disclosure) was previously in section s29(1)(a) Privacy Act 1993.