3 Feb 2023, 09:00

A woman made a request to a health agency for the access logs of her records. She said she was worried about people looking at her file who shouldn’t be doing so (employee browsing). The agency released the access log to the woman with the position titles of everyone who had looked at her file, and the dates of access, but withheld the names of the individual employees.

The woman sought a review of the agency’s decision to withhold the names of the employees from the access logs.

The complaint

In her complaint, the woman sought an access log for her records for a specified timeframe. The agency released an access log with only the positions of the employees and the dates they had accessed the woman’s records.

The agency withheld the names of the employees on the grounds that disclosure would create a significant likelihood of serious harassment of the employees (section 49(1)(a)(ii) of the Privacy Act 2020).

The law

This complaint raised issues under rule 6 of the Health Information Privacy Code 2020. Rule 6 of the Code mirrors principle 6 (but for health information held by a health agency) and states an individual is entitled to access health information that an agency holds about them unless a withholding ground contained in sections 49-53 of the Privacy Act 2020 applies.

Under section 49(1)(a)(ii) of the Act, an agency may refuse access to personal information requested if disclosure of the information would create a significant likelihood of serious harassment of an individual. This is a new withholding ground in the 2020 Act and implemented a recommendation by the Law Commission that agencies be allowed to refuse access in situations where the information may be used “to make repeated, unwanted contact with individuals in ways that fall short of posing a physical danger to those individuals, but that seriously detract from their quality of life.” Review of the Privacy Act 1993 (NZLC R123, 2011) at [3.76 – 3.78] and [R23].

For an agency to rely on this ground, it will have to meet two requirements: the likelihood of harassment created by disclosure must be significant, and this likely harassment would be serious. On the definition of harassment, our Office was guided by the Harassment Act 1997, specifically sections 3 and 4 of the Act which define harassment as a “pattern of behaviour directed against that other person that includes doing any “specified act” to the other person on at least two separate occasions within a 12 month period.” 

We also had regard to:

• Section 17 of the Harassment Act which provides that: “[a] specified act cannot be relied on to establish harassment for the purposes of section
  16(1)(a) if the respondent proves that the specified act was done for a lawful purpose”.
• Case law under the Harassment Act, including the recent decision of the High Court in Malcouronne v O’Neill [2021] NZHC 641 where Justice Clark said:

    [16] Findings of “specified acts”, regardless of their frequency, are not themselves determinative of a finding of a “pattern of behaviour” constituting harassment under the Act. In Munro v Collection House (NZ) Ltd the Court approached the interpretative exercise in the following way:

[34] The interpretation and application of that definition is coloured, first, by the expression “pattern of behaviour”, which implies “a regular and intelligible form or sequence discernible in certain actions or situations; especially one on which the prediction of successive or future events may be based.” It is coloured also by the object of the Act, which is to provide “greater protection to victims of harassment”, and by the ordinary meaning of “harassment”: “to trouble or vex by repeated attacks”. So, for example, merely stopping, or making contact with, a person twice within a period of 12 months would not usually be sufficient to constitute harassment which satisfies the first criterion of s 16(1) for the making of a restraining order.

[17] Similarly, the Court in Mooney v Wilkinson noted:

[27] The second and related point is that the definitions of “harassment” and of “specified act” contemplate the existence of a bright line between the actor (Person A, the harasser) and the person who is the unwilling object of Person A’s attentions (Person B, the harassed). Harassment is not intended to encompass what is essentially some form of dialogue and mutual contact between Persons A and B, however fractious that contact might be.

Our investigation

There is a relatively high threshold to meet before an agency can lawfully refuse access in reliance on this ground.  We sought further information or evidence from the agency to support its belief that there would be significant likelihood of serious harassment if the names of the employees were disclosed.

The agency, in its response to our Office, gave us further information demonstrating behavioural patterns in previous dealings with the woman which may have constituted harassment such as, attempting to contact employees via social media platforms, threats of self-harm, and repeated contact in a manner which caused significant discomfort and distress.

Based on this information, we reached a preliminary view the agency had a proper basis for its decision.  

We asked the woman for her comment on our preliminary view.  The woman wanted a copy of the information the agency had provided to our Office  in its’ response to the complaint, and evidence that harassment occurred.

As our Office is bound by secrecy under section 206 of the Act, we are not able to share information we have received from one party to the other party to a complaint. We therefore asked the agency to provide the woman with further information to explain its reliance on this withholding ground.   

In our endeavour to resolve the issue, we also asked the woman why she required the information. The woman told us she was concerned unauthorised employees were accessing her file. We explained this to the agency. The access log contained details of the team and position of the employees and the agency agreed it would provide these details and would work with the woman to raise any issues of unauthorised access based on the information she had and answer any other questions that came up.

The agency gave our Office an assurance any employee outside the allocated team did not and would not be able to access the file because of the security safeguards in place.

Final view

Having considered the woman’s feedback and further information provided by the agency, we concluded the agency had a proper basis to rely on section 49(1)(a)(ii) to refuse the request.  This was not a finding that the harassment had occurred, rather, based on the information we reviewed, and which the agency relied on to refuse access, we were satisfied that the agency had a proper basis for its belief that disclosing the individuals’ names to the woman would create a significant likelihood of serious harassment.

The woman was unhappy with our response and disagreed with our view.  We informed her of her right to bring proceedings in the Human Rights Review Tribunal if she wanted to pursue her complaint further.

Comment

The agency here had not communicated to the requester the reasons it was withholding the information when it first replied to her request (prior to the complaint to our Office).

Bearing in mind the obligations under section 46 of the Privacy Act to notify a requester of the reason for the refusal and the grounds in support of the reason for the refusal, an agency relying upon this ground should give requesters adequate information when responding, while noting the section 46(4) exceptions (disclosing the grounds would prejudice the interests protected by the grounds).

This might include giving requesters the reason an agency considers the particular ground applies, or a brief summary of the evidence it has relied upon when considering whether the ground applies.

There’s more information about responding to a request for personal information here.