19 Jun 2018, 09:00

The following is a summary of a Human Rights Review Tribunal decision which has since been overturned by the High Court. You can read the High Court decision here [1 October 2018]. The Court of Appeal decision is here [10 November 2020].

Summary

In Dotcom v Crown Law Office [2018] NZHRRT 7, the Human Rights Review Tribunal found that the Crown had interfered with Kim Dotcom’s privacy in declining the multiple, near identical, Privacy Act requests made to all Ministers and nearly every government department for all personal information held about him.

To remedy this privacy interference, the Tribunal made a declaration of interference with privacy, ordered the Crown to comply with the information Privacy Act requests (subject to the provisions of the Privacy Act 1993) and awarded damages of $90,000. 

In July 2015, Mr Dotcom’s lawyers made 52, near identical, information Privacy Act requests, seeking all personal information held about Mr Dotcom. The requests were made under urgency as the information was required for “pending legal action” (Mr Dotcom’s September 2015 extradition eligibility hearing in the District Court).  

Nearly all the various Crown agencies transferred their requests under s 39 of the Privacy Act to the Attorney-General (in practice the Crown Law Office). The Solicitor General responded on the Attorney-General’s behalf, declining all the requests under s 29(1)(j) of the Privacy Act on the basis they were vexatious and due to their extremely broad scope, included information that was trivial.

The Solicitor General said that it was apparent from the very broad and unfocused nature of the requests, and the request for urgency, that the requests were not genuine and were intended to disrupt the extradition hearing. 

The Attorney-General also declined the request for urgency because insufficient reasons had been provided.

The Attorney-General noted that, in the particular circumstances of the case, he considered in terms of s 39(b)(ii) of the Act that the information sought, to the extent it was held by other agencies, was more closely connected with his functions as Attorney-General and therefore it was transferred to his office.

Mr Dotcom did not apply for an adjournment of the September extradition hearing on the grounds that his information privacy requests had been declined.    

The Tribunal had to determine whether there was an interference with privacy as defined in s 66 of the Act including:

• whether the transfer of the requests to the Attorney-General was permitted under s 39; and whether there was no proper basis to decline the request under s 29(1)(j).

The background to the requests was the extensive, complex and overlapping litigation that had begun in January 2012 after extradition proceedings were commenced against Mr Dotcom and others.

The evidence

Mr Dotcom firmly denied the allegations in the Crown’s refusal letter that the requests were vexatious and not genuine and were in fact a litigation tactic and a fishing expedition. He denied that he had an ulterior motive to disrupt the litigation and the extradition hearing. 

The Tribunal found Mr Dotcom to be a persuasive, credible witness and described his evidence as clear, thorough and consistent. It accepted that Mr Dotcom had no ulterior purpose to the timing of the requests.

Transfer issue

In this case, the Crown relied on s 39(b)(ii) to transfer the requests, on the basis the information was more closely connected with the functions of the Attorney-General. As Crown Law had been leading the Crown’s litigation against Mr Dotcom for more than three years, it was best placed to decide whether the information was required urgently in the context of the litigation.

After a detailed analysis of s 39(b)(ii), the Tribunal found it could not be interpreted as permitting a transfer for the purposes put forward by the Crown, to obtain legal advice, or to coordinate the response to the request with the Crown’s litigation strategy. 

The Tribunal emphasised that it is the information to which the request relates that is the focus of the transfer exercise [para 96.5]. The person in the agency that has received the request must believe that the information is more closely connected with the functions or activities of another agency. 

The Tribunal considered that the connection must come from prior engagement (by way of function or activity) with the requested personal information. The connection cannot come from being a legal adviser to the agency or from giving legal advice in relation to the request or communicating a decision on the request.  

Here, the information to which the requests related was not more closely connected with the functions or activities of the Attorney than with the functions or activities of the transferring agencies. Further, the transfers occurred without a properly grounded belief by the transferors that the information to which the requests related was more closely connected with the functions or activities of the Attorney. 

The Tribunal considered the transfer issue to be peripheral to the more substantive issues and found it unnecessary to resolve the issue of whether the transfer was unlawful. The transfers had not been made by the 52 agencies to which the requests were made, but instead on instruction by the Attorney-General. There was insufficient evidence to support the claim of unlawfulness, as the Crown claimed privilege in respect of relevant exchanges between Crown Law and the agencies.  

The Tribunal found that, as the transfers were not made in accordance with the Act, the Attorney was not the lawful transferee under s 39(b)(ii) and accordingly had no authority as transferee to refuse to disclose the requested information. Accordingly, Mr Dotcom had established an interference with privacy in terms of s 66(2))b) of the Act – there being no proper basis for the refusal.   

The Tribunal rejected the Crown’s alternative defence that Crown Law was acting as legal adviser on behalf of the agencies; it was not disputed that the Attorney acted as transferee.

Whether the requests were vexatious

The Tribunal also considered the question whether, if the transfer was lawful, there was a proper basis for the decision that the requests be declined as vexatious under s 29(1)(i) of the Act. 

The Tribunal found Crown Law made an unfounded and unreasonable assumption that Mr Dotcom had made the requests to obtain an adjournment. The Tribunal found Mr Dotcom had amply satisfied them to the civil standard, that contrary to the assertion by the Crown, he had no ulterior motive in making the information privacy requests. The requests were entirely genuine and not intended to disrupt the extradition hearing.

The Tribunal noted the term “vexatious” is not defined in the Act. In considering the meaning, the Tribunal noted an agency is not well paced to determine what is “frivolous” or “vexatious” or “trivial”, as it is not aware of the personal circumstances of the requestor, or the use to which the information is to be put, or the potential relevance of the information to matters of interest to the requester. 

The Tribunal found [para 147.5 and 147.6]:

… s 29(1)(j) must be applied with caution, particularly in a case such as this where the parties are engaged in substantive litigation and senior courts have directed Mr Dotcom to use the Privacy Act because the information sought is not available in the highly confined and restricted context of an extradition application.

It must at least be possible to say that, looking at all the circumstances objectively, it is manifestly clear the request is frivolous or vexatious or the information requested is trivial. In making this evaluation, the person seeking access to his or her personal information is ordinarily to be presumed to be unaware of the nature and content of the personal information held.

Remedies

The Tribunal found there were no mitigating circumstances for the defendant to take into account when determining remedies, and it rejected the defendant’s criticisms of the plaintiff. The Tribunal granted all the remedies sought by Mr Dotcom.

The remedies were:

• a declaration that there was an interference with the privacy of Mr Dotcom in transferring the requests without legal authority to the Attorney-General, and in refusing the requests on the grounds they were vexatious. (The Tribunal found no reason to deny this remedy when the Crown was in clear breach of its obligations); and

• an order that the Crown agencies now comply with the requests sent by Mr Dotcom in July 2015, subject to provisions of the Privacy Act. (The Tribunal found that given the entitlement in principle 6 is a legal right, an order to perform is not ordinarily to be denied and saw no reason why it should be withheld here); and

• damages of $90,000 ($30,000 of loss of benefit and $60,000 for loss of dignity or injury to feelings). These are discussed separately below. 

Damages award

Loss of a benefit

The damages award included $30,000 for loss of a benefit.

In assessing this, the Tribunal relied on the case of Winter v Jans (HC Hamilton CIV 2003-419-854, 6 April 2004) that affirmed there must be a causal connection between the breach of the principle and the damages, but that causation may in appropriate circumstances be assumed or inferred. It was not necessary for the plaintiff to prove the withheld information would, if available, have meant a different result before the court or tribunal or on appeal (Proceedings Commissioner v Health Waikato Ltd (2000) 6 HRNZ 274).

On quantum, the Tribunal referred to the serious view the High Court has taken to refusal to provide personal information requested in the context of litigation (Health Waikato) that explicitly recognises a “bitterness which never completely dissipates”. The Tribunal noted that assessment of damages under the Act for loss of any benefit must be based on an objective assessment of the nature of the benefit that might reasonably have been expected to have been obtained but for the interference, the seriousness of the interference and surrounding circumstances.

The Tribunal noted the following factors that made Mr Dotcom’s case exceptional: 

• Mr Dotcom believed (correctly) that a wide range of government agencies had personal information about him:
• It has been acknowledged by the government that at least one such agency had unlawfully collected personal information about him (the GCSB);
• In these circumstances, it was understandable that Mr Dotcom wanted to monitor state agencies’ collection, use and storage of his personal information and have access to it. He wanted to be satisfied that he has most effectively deployed the information in defence of the extradition application and in pursuit of related litigation. 
• These benefits are of a substantial nature, their loss is serious, particularly as in the extradition context, the discovery process is limited and the Supreme Court has explicitly acknowledged the Privacy Act (and OIA) have a proper role to play in supplementing court-sanctioned disclosure regimes;
• The interference with privacy was uniform across a wide spectrum of 52 agencies. 

Given the exceptional nature of this case, the Tribunal considered the level of award in earlier High Court and Tribunal decisions provided “no useful guidance.” The Tribunal noted that awards in the Health Waikato and the Winter v Jans cases were somewhat dated and required recalibration (noting $5,000 in 2000 is now worth $7,317 before applying compound interest).

The Tribunal considered $30,000 properly recognised the nature of the benefits Mr Dotcom might reasonably have expected to have obtained, but for the interference with his privacy [para 242].

Loss of dignity, or injury to feelings

The damages awarded for loss of dignity, or injury to feelings, was $60,000 [para 254].

The Tribunal accepted Mr Dotcom as a credible witness who had “clearly and unambiguously” established loss of dignity and injury to feelings [para 247], as defined in Hammond v Credit Union Baywide [2015] NZHRRT 6, (2015) 10 HRNZ 66 at [170].

The Tribunal noted that anxiety and stress can be injury to feelings and the forms of harm in s 88(1)(c) of the Act may in appropriate cases be assumed or inferred. The Tribunal rejected Crown submissions that those occasions should be rare, noting: “It would result in otherwise cogent claims, such as the present, being wrongly discounted or dismissed” [para 248]. 

Mr Dotcom’s claim for a separate award against each defendant was rejected by the Tribunal [para 252].

The Tribunal considered Mr Dotcom’s loss of dignity and injury to feelings was substantial and that the upper end of the middle band in Hammondv Credit Union Baywide applied. In making that award, the Tribunal noted the unfounded stigmatisation of Mr Dotcom’s requests as being vexatious and not genuine, when in fact he had a very genuine pursuit of the truth and a desire for a fair hearing. That path took him to the Supreme Court, and then the High Court. In both courts he had been told, in effect, to use the Privacy Act.