21 Dec 2021, 09:00

A woman alleged to have made a threat against a utility company’s workers says she made repeated requests for her personal information to the company.

The utility company says it responded to her requests the best it could, and it regarded the subsequent repeated requests as frivolous and vexatious. The woman complained to the Privacy Commissioner.

The complaint

In her complaint to our Office, she said the company had provided her with some of information she had requested. She made repeated requests as she considered information to be missing from the company’s initial response.

The company refused these requests and advised her it regarded these repeated requests as frivolous and vexatious under section 29(1)(j) of the Privacy Act 1993 (section 53(h) of the Privacy Act 2020). It said it would not be entering into any further communications with her on this issue.

The woman disagreed with her requests being described as frivolous and vexatious. She had been accused of making a threat by two of the company’s contractors. It was a serious accusation which she said was false and unjust.

The woman continued to make requests for the information. The company declined to respond to these requests.

As part of her dispute, she had made four phone calls to the company. She requested transcripts and records of each of these calls. In addition, she also wanted a broad range of information about her communications with the company and its contractors.

Our investigation

The complaint raised issues under principle 6 of the Privacy Act. Principle 6 provides that individuals have a right to access information about themselves held by an organisation. But an organisation can refuse access on one of the withholding grounds listed in the Act.

Our Office contacted the company. It informed us the complainant had allegedly made a verbal threat to two of its contractors who were tasked with undertaking a repair on her property. The incident raised staff safety issues which were escalated to the company’s management.

The company said responding to the complainant had taken up a significant amount of time and resources for its staff. It had no other personal information about the complainant which it had not already sent to her. It sent us copies of the information it had already provided.

The company subsequently carried out an extensive review of its records and the information previously provided. In doing so, it identified two email discussions which had not been provided to the complainant.

It told our office it had not provided these emails earlier because it was about potential security issues involving its staff and contractors and the processes needed to deal with these – and these were not specific to the complainant. There had been no intention to hide these emails.

The company gave our office an assurance it would provide the complainant with a summary of the information it held about the incident which occurred at the woman’s property in which she was alleged to have threatened the contractors.

Final view

We advised the woman of the company’s assurance it would send her this information. We gave her an opportunity to comment on this approach of resolving her complaint.

The woman later contacted our office. She was unhappy with the summary she received from the company and wanted our office to ‘re-open’ its investigation. We advised her that our investigation had ended, and we would take no further action, however she had the option of taking the matter to the Human Rights Review Tribunal.

Comment

In situations where a requester repeatedly seeks a broad and extensive scope of personal information, this often reflects a breakdown in the relationship between the organisation and the individual over a specific issue. The resulting grievance can lead to a complainant casting a wider net for personal information of which only some will be relevant to the issue. They may be doing this to be deliberately vexatious, however, the requester may also have a legitimate and/or genuine basis for believing an agency has not fully complied with its obligations under principle 6 of the Privacy Act.

While a requester may present as difficult or vexatious, their motivations may not be and agencies should consider a requester’s underlying interests when responding to requests which it may find burdensome in terms of repetition, scope and/or size and endeavour to resolve the information requests, rather than prolong or inflame them.

Find out more about how agencies can deal with requests for large amounts of personal information and the limits of relying on section 53(h)