This week, the Court of Appeal ruled in Dotcom v Attorney-General that the actions taken by dozens of public sector agencies (agencies) regarding requests for personal information (RPIs) under the Privacy Act 1993 were unlawful. A decision of the Court of Appeal in this context is unusual and should be read carefully.

In this article, we look at what Public Sector Agencies need to know going forward.

Background

In 2015, Kim Dotcom made requests of 52 different agencies for all personal information held by them. Each request sought the information on an urgent basis.

Nearly every agency then transferred the request to the Attorney-General. The requests were declined by the Attorney-General on the basis that the requests were vexatious and included information which was trivial, and that insufficient reasons for urgency had been provided.

The Court of Appeal’s judgment, finding that these actions were unlawful, provides helpful guidance on the interpretation of the Privacy Act generally, and specifically determines issues concerning transfers of RPIs to another agency, requests for urgency and grounds for refusing information requests.

Although this case determines issues under the Privacy Act 1993, all the relevant provisions in this case continue in the 2020 Act, which comes into force next month.

Agencies must follow strict processes when handling personal information requests

The Privacy Act is generally flexible. It sets out principles concerning how agencies collect, use, store, disclose and give access to personal information. But it expressly does not provide enforceable legal rights regarding these principles.

The one exception to this is where a person requests personal information from an agency. Where this happens, the person can enforce this request, or dispute the agencies’ handling of the request, in court.

From this, the Court determined that the normally flexible approach of the Act does not apply when an agency refuses a request for information or takes any procedural steps (such as transferring an information request) under the Act. The courts should determine any issues by applying orthodox principles of statutory interpretation.

The Court then addresses two questions:

• Transfers of requests - can a request for personal information under the Privacy Act 1993 be transferred by the recipient to another agency where:

1. The request seeks urgency;
2. The recipient is not in a position to sensibly assess the basis for the urgency; and
3. The transferee is the only agency who can assess the basis for urgency.

• Vexatious requests - is a request for urgency a relevant factor for an agency in determining whether to decline a request as vexatious?

Transfers of requests

Three points arise out of the judgment regarding transfers of requests.

First, an agency cannot consider a request for urgency when deciding whether to transfer the information request. Instead, an agency must consider the “information” sought, and whether that information is more closely connected with another agency. The request for urgency is not part of the information and whether the information is more closely connected to another agency.

Secondly, when deciding whether to transfer the request, an agency must follow the relevant statutory criteria and procedure carefully, and cannot merely decide whether there is anything to “preclude” a transfer.

Thirdly, the recipient agency can consult other agencies regarding the request. Here the requests sought urgency due to litigation the requestor was involved in. Instead of transferring the requests to the Attorney-General, the agencies could have consulted and sought advice from the Office or Crown Law.

Vexatious requests

Agencies can decline a request for information if the request is vexatious. Here, the Attorney-General determined the requests were vexatious due, at least in part, to the request for urgency.

According to the Court, when a person seeks urgency, the reasons advanced for the urgency can inform the decision-maker whether the request for information is vexatious. Hence the request for urgency itself could be a relevant factor in determining whether a request is vexatious.

However, agencies should tread carefully. The Court states that “the mere fact of a request for urgency would not alone be a proper basis for a refusal”, and further, that “it is difficult to conceive” how the mere fact of urgency could be a consideration for refusal. The Court’s message is if an agency wants to refuse a request on grounds of vexatiousness, it will need to provide more compelling reasons for doing so.

Get in touch

Please get in touch to discuss this judgment in more detail.

Contributors sam.hart@simpsongrierson.com