Office of the Privacy Commissioner · OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 6 5. Investigating a complaint From the “pink”

Office of the Privacy Commissioner

Procedures Manual:

Dispute Resolution and

Investigations

Updated August 2018

OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 2

Contents

Chapters

1. About this Procedures Manual ......................................................... 10

2. Overview of our complaints and investigations role ..................... 12

3. Receiving and screening complaints From when it arrives, to

when it lands on an IO’s desk .......................................................... 16

4. Promoting conciliation and settlement ........................................... 45

5. Investigating a complaint From the “pink” assessment form, to

making a decision .............................................................................. 55

6. After the investigation From notifying our decision, to closing

the file ................................................................................................ 79

Appendices .................................................................................................... 87

Appendix 1. Initial call checklist............................................................... 88

Appendix 2. Notification by email (cover email) .................................... 90

Appendix 3. Investigations Team Inbox ................................................. 95

Appendix 4. Checklists for conciliation and settlements ..................... 98

Appendix 5. Teleconferences ................................................................. 105

Appendix 6. Natural disasters ................................................................ 107

Appendix 7. Escalation Policy and Procedure ..................................... 109


Contents

All headings

1. About this Procedures Manual .......................................................................... 10

Purpose and contents of this Manual ................................................................ 10

Scope of this first section of the Manual ........................................................... 10

2. Overview of our complaints and investigations role .......................................... 12

Introduction ....................................................................................................... 12

Our investigative function ............................................................................. 12

Our “conciliator” function............................................................................... 12

The impact of our decisions: Legal and practical consequences .................. 13

Our complaints role in context: One of a range of tools for addressing non-compliance ............................................................................................ 13

Legal checkpoints: Key statutory and common-law rules ................................. 14

Act within the law .......................................................................................... 14

Customer focused approach ......................................................................... 14

Natural justice ............................................................................................... 14

Using our discretion ...................................................................................... 14

Secrecy and privileged information ............................................................... 14

Other legal rights and interests ..................................................................... 15

Learning the language: Some terms and abbreviations we use ....................... 15

3. Receiving and screening complaints From when it arrives, to when it lands

on an IO’s desk ................................................................................................. 16

Introduction: Key legal checkpoints .................................................................. 16

Our systems ................................................................................................. 16

Is the complaint within our jurisdiction? ........................................................ 16

Should we investigate the complaint? .......................................................... 17

Requirement to investigate ........................................................................... 17

Fielding complaints and forwarding them to the rostered Team Member ......... 17

Introduction ....................................................................................................... 17

Is it a complaint? ........................................................................................... 17

Administrative steps when a complaint first arrives: Channel by channel ......... 18


Flowchart: Fielding complaints and forwarding them to rostered Team

member ............................................................................................................. 20

Procedure for identification and notification of “Easy Access” complaints ........ 21

Step one ........................................................................................................... 21

Step two ............................................................................................................ 21

Step three ......................................................................................................... 22

Step four ........................................................................................................... 22

Step five ............................................................................................................ 22

Step six ............................................................................................................. 22

Initial screening by rostered Team member: Is this a complaint we can and should investigate? ....................................................................................... 23

Is it intended to be a formal complaint? ............................................................ 23

If it is a complaint, is it one we have jurisdiction to investigate? ........................ 24

People and bodies outside our jurisdiction ................................................... 24

Not a privacy problem ................................................................................... 26

Not “personal information” ............................................................................ 26

Facts incapable of amounting to a breach .................................................... 26

Harm ............................................................................................................. 26

Exclusions such as “domestic affairs” ........................................................... 27

If we have jurisdiction, should we decline to investigate under 71(1)? .............. 28

Our discretionary power ............................................................................... 28

Para (a): Length of time since the incident ................................................... 28

Para (b): Trivial ............................................................................................. 29

Para (c): Frivolous, vexatious, not in good faith ............................................ 30

Para (d): Individual doesn’t want action taken .............................................. 33

Para (e): Insufficient personal interest .......................................................... 33

Para (f): No use of Code’s complaints procedure ......................................... 34

Para (g): Other adequate means of challenge .............................................. 35

Notification requirements if we decline to investigate under 71(1) .................... 36

Exercising our discretion: Section 71 and our “gatekeeper” role ....................... 36

Referring a complaint or part of a complaint to other agencies ......................... 37

Referrals to Ombudsmen, Health and Disability Commissioner or IGIS ........... 37

When will a complaint “more properly” belong with the Ombudsmen? ......... 38

When will a complaint “more properly” belong with the Health and Disability Commissioner? ............................................................................ 39

When will a complaint “more properly” belong with IGIS? ............................ 39

Administrative processes with Ombudsman correspondence ........................... 40

Agreed protocols for transferring complaints .................................................... 41

Potential Transfer (from Ombudsman to OPC) ................................................. 41

Transfer ............................................................................................................ 41

Potential Transfer (OPC to Ombudsman) ......................................................... 41

Referrals to overseas privacy agencies ............................................................ 42

Which office? – Assigning to Wellington or Auckland ....................................... 42


Criteria for assigning complaints to a particular office ....................................... 42

Easy answers: Fixed rules for certain agencies ............................................ 42

Guidelines for all other cases ....................................................................... 42

Administrative steps after the complaint is assigned to an office ...................... 43

Who: the Team Secretary Wellington ........................................................... 43

Who: the Team Secretary for that office ....................................................... 43

Tasks: ........................................................................................................... 43

Which Investigator? – Assigning the complaint to an Investigator .................... 44

The decision: relevant factors ........................................................................... 44

Checking the Investigator’s assessment and investigation plan ....................... 44

Difficult callers ................................................................................................... 44

4. Promoting conciliation and settlement .............................................................. 45

Overview ........................................................................................................... 45

Our Settlement Target .................................................................................. 45

Conciliation and settlement: Our statutory obligations and powers ................... 46

Power to encourage a settlement ..................................................................... 46

Obligation to promote settlement if a complaint has substance ........................ 46

What does the “best endeavours” standard require of us? ........................... 47

Promoting conciliation from the outset .............................................................. 47

Tools we can use to try to reach a settlement ................................................... 48

There are several tools we can use to promote settlement of a complaint: .. 48

1. First teleconference with the complainant and respondent ....................... 48

2. Case management conference ................................................................. 48

3. Power to call compulsory conference ....................................................... 48

Settlements and “party autonomy”: It’s up to them ........................................... 48

Assessing the potential for a settlement ........................................................... 49

Giving guidance to the parties and managing expectations .............................. 49

Specific settlement measures ........................................................................... 50

Giving guidance on financial settlement amounts ............................................. 50

Guidance from Tribunal awards .................................................................... 51

Preparing for a settlement conference .............................................................. 51

Process issues .................................................................................................. 51

Preparing the parties for the conference ........................................................... 52

Preparing yourself ............................................................................................. 52

Drafting a settlement agreement ....................................................................... 52

Each conciliation or settlement conference will be different, and the needs of the parties will vary. This means the level of involvement required from the Investigator in helping the parties draft an agreement will depend on a case by case assessment of their relationship with each other, their relative vulnerability, and their general ability to clearly and accurately express themselves. Some further questions to consider: ............................................. 53


5. Investigating a complaint From the “pink” assessment form, to making a

decision ........................................................................................................ 55

The framework for your investigation ................................................................ 55

Key legal checkpoints ....................................................................................... 55

Notification ......................................................................................................................... 55

Respondent’s right to respond ..................................................................................... 56

Promoting conciliation and settlement ....................................................................... 56

Investigating with “due expedition” (proper speed)................................................ 56

Respondent’s right to be heard before any “adverse comment” ....................... 56

Tailoring the process to the particular case ...................................................... 56

Investigating with proper speed (“due expedition”) ........................................... 57

What does the “due expedition” rule require of us? .............................................. 57

Keeping control of the investigation process ........................................................... 57

Breach and harm: Investigating them concurrently ........................................... 57

Burden of proof ................................................................................................. 58

Settlem .............................................................................................................. 59

Completing the Complaint Assessment form (“The pink”) ................................. 60

Summary .......................................................................................................... 60

Purpose of the Complaint Assessment form ..................................................... 60

What information to include on the form ........................................................... 60

The most important thing is being clear with parties about what we are doing and what they can expect. ............................................................................ 61

Investigating vs enquiries/conciliation: Telling the difference ............................ 61

The boundary between preliminary enquiries and investigating ....................... 61

Conciliating vs investigating .............................................................................. 62

Identify the complainant and person alleged to be aggrieved ........................... 62

Notification: Telling the parties you’re going to investigate ............................... 63

Form of notification: In writing ........................................................................... 64

Using the notification template letters ........................................................................ 64

Notification by email ........................................................................................................ 64

What amounts to “notification” .......................................................................... 64

Notification must be precise .......................................................................................... 64

Notifying individual respondents as well as the principal agency ...................... 65

Why it’s important to get it right ................................................................................... 66

Triggers for notifying individual respondents as well as the principal agency ................................................................................................................................ 66

What we have to tell the individual ............................................................................. 66

Case conferences ............................................................................................. 67

An early case conference is a default step ....................................................... 67

Purpose of a case conference .......................................................................... 67

Format for case conference .............................................................................. 67

Was there a breach? – Key questions, principle by principle ............................ 68

Principle 1 – Purpose of collection.............................................................................. 68


Principle 2 – Source of the information ..................................................................... 68

Principle 3 – What the person must be told when information is collected from them ........................................................................................................................... 68

Principle 4 – Manner of collection ............................................................................... 68

Principle 5 – Storage and security .............................................................................. 69

Principle 6 – Access ........................................................................................................ 69

Principle 7 – Correction .................................................................................................. 70

Principle 8 – Checking accuracy and so on before use ....................................... 70

Principle 9 – How long information may be held for .............................................. 70

Principle 10 – Limits on using information for different purpose ........................ 70

Principle 11 – Limits on disclosure ............................................................................. 71

Principle 12 – Unique identifiers .................................................................................. 71

Was there harm? .............................................................................................. 71

Has the complainant suffered harm? ................................................................ 71

Did the breach cause the harm? ....................................................................... 72

What standard of evidence should a complainant provide in relation to harm? 72

Inviting comment from the parties: When and how ........................................... 73

Key points ......................................................................................................... 73

The “adverse comment” rule: Its scope and effect ............................................ 73

Summary ............................................................................................................................ 73

Scope of the “adverse comment” rule: What statements does it apply to? .... 74

What makes a comment “adverse”? .......................................................................... 74

Discharging our obligation under the “adverse comment” rule: What we have to do ......................................................................................................................... 74

Setting a timeframe for a written response ....................................................... 75

Public-law fairness: What it requires ................................................................. 75

Discontinuing under section 71 ......................................................................... 75

Discontinuing an investigation under section 71(1) ........................................... 75

“Undesirable or unnecessary”: Discontinuing under section 71(2)) .................. 76

Examples ............................................................................................................................ 76

Notification requirements if we discontinue ....................................................... 77

File management and record-keeping .............................................................. 77

Corresponding with the parties ......................................................................... 77

Managing your own filing system ...................................................................... 78

Record-keeping and maintaining the file ........................................................... 78

Maintaining the Objective metadata .................................................................. 78

Nine month file review....................................................................................... 78

6. After the investigation From notifying our decision, to closing the file .......... 79

Introduction: Key legal checkpoints .................................................................. 79

Notifying the result ........................................................................................................... 79

Obligation to use best endeavours to secure a settlement ................................. 79

Referrals to the Director ................................................................................................. 80


Reporting misconduct or breaches of duty............................................................... 80

Notifying the result of our investigation ............................................................. 80

Presenting your findings to the parties: How to write a sound and persuasive opinion .............................................................................................................. 80

Issuing a Certificate of Investigation to the complainant ................................... 80

What is a Certificate of Investigation? ....................................................................... 80

When to issue a Certificate of Investigation ............................................................. 81

Using our template for the certificate ......................................................................... 81

Guidance on using the template and completing the certificate ........................ 81

Obligation to promote settlement if complaint has substance ........................... 83

Referrals to the Director of Human Rights Proceedings ................................... 83

Overview ........................................................................................................... 83

Failure to settle – a statutory precondition for referral ....................................... 84

Our criteria for referral....................................................................................... 84

Is the case ready to go to the Director? ............................................................ 84

Case notes on referral ...................................................................................... 85

Closing the file .................................................................................................. 85

It is essential that in every case the Investigator asks “what can others learn from this case?” and considers avenues to distribute those messages, such as a case note or blog post. The Communications team can help with this. Remember, up to now, all of your energy, training and judgement has helped two people: the complainant and the respondent. With help from the Communications team, you could now influence thousands of people. ............ 85

When a file will be closed .................................................................................. 85

Procedure for closing the file ............................................................................ 85

Reporting misconduct and breaches of duty ..................................................... 86

Further action: Other tools for addressing non-compliance .............................. 86

Types of further action ...................................................................................... 86

APPENDICES ................................................................................................... 87

Appendix 1. Initial call checklist ........................................................................ 88

Appendix 2. Notification by email (cover email) ............................................... 90

Covering email – Form and content .................................................................. 90

Creating a template for the covering email ....................................................... 91

Using an email template ................................................................................... 93

Appendix 3. Investigations Team Inbox ........................................................... 95

Responsibility .................................................................................................... 95

Purpose ............................................................................................................ 95

Assignment ....................................................................................................... 95

“Actioned Folder” .............................................................................................. 96


Access to the inbox ........................................................................................... 96

Mailing from the inbox ....................................................................................... 97

Appendix 4. Checklists for conciliation and settlements ................................... 98

During the investigation .................................................................................... 98

During the investigation (continued) ................................................................. 99

Before the settlement conference ..................................................................... 99

Before the settlement conference (continued) ................................................ 100

During the settlement conference ................................................................... 100

During the settlement conference (continued) ................................................ 101

After the settlement conference ...................................................................... 101

After the settlement conference (continued) ................................................... 102

Checklist for written settlement agreements ................................................... 103

Agreements that are intended to be legally binding and enforceable ............. 103

Agreements not intended to be legally enforceable (for example, protocols of behaviour or future interactions) .................................................. 103

Appendix 5. Teleconferences ......................................................................... 105

The Language Line process ........................................................................... 105

The caller indicates they need an interpreter – check which language is needed. ...................................................................................................... 105

Getting disconnected during a teleconference ................................................ 106

Appendix 6. Natural disasters ......................................................................... 107

Appendix 7. Escalation Policy and Procedure ................................................ 109


1. About this Procedures Manual

Purpose and contents of this Manual

The purpose of this Procedures Manual is to help to:

ensure that our work is lawful

provide certainty and consistency in our administrative processes

preserve our “institutional memory” by recording the knowledge and experience we’ve

accumulated in the last two decades

reinforce and support our investigations staff in exercising their statutory discretion

The Manual does this by setting out:

the key statutory requirements or legal checkpoints for the complaints and

investigations scheme

best-practice guidelines where there aren’t specific statutory requirements

guidance to our investigations staff in exercising their discretionary powers under the

Privacy Act

our internal administrative processes for handling complaints and investigations.

Scope of this first section of the Manual

This first section of our Procedures Manual covers our complaints and investigations role

under Part 8 of the Privacy Act.

Subsequent sections of this Manual may cover other areas of our work, including topics

such as: litigation, breach notifications, information matching, and processes for

developing codes of practice.


Marking a shift to more flexibility in managing complaints

This section of our Procedures Manual also reflects a shift in some of our

investigation processes, towards a more flexible approach that allows our

investigations staff to tailor the process to the needs of resolving each case.

This more proactive case-management approach is consistent with the

considerable autonomy and discretion that the Privacy Act gives the

Commissioner in responding to and investigating complaints.

This more flexible approach is also in line with changes in case-

management in the New Zealand courts, away from a strict standardisation

of procedural steps and towards more customisation and more proactive

management by judges and court officials.


2. Overview of our complaints and

investigations role

Introduction

The Privacy Act provides the Privacy Commissioner the role of receiving, investigating and

conciliating complaints about privacy.

What the Act says: Section 69, Investigation of interference with privacy of

individual

(1) The functions of the Commissioner under this Part shall be –

(a) to investigate any action that is or appears to be an interference with the

privacy of an individual:

(b) to act as conciliator in relation to any such action:

(c) to take such further action as is contemplated by this Part.

(2) The Commissioner may commence an investigation under subsection (1)(a)

either on complaint made to the Commissioner or on the Commissioner’s own

initiative.

Our investigative function

In general the Privacy Act doesn’t provide detailed procedural requirements for our

investigations. Instead, there are a relatively small number of key mandatory requirements

or legal checkpoints – such as the requirement to formally notify the parties before any

investigation. The Act gives the Commissioner and the OPC staff (acting as his delegate) a

significant amount of autonomy and discretion in carrying out investigations, as well as a

discretionary power to decline to investigate if certain grounds exist.

Our “conciliator” function

Our conciliation function under section 69(1)(b) is supported by some significant powers

and obligations aimed at helping the parties come to a resolution without our office having

to investigate, or investigate fully and reach a determination.

The Act emphasises the parties’ autonomy in deciding whether to settle the complaint and

how to settle it. Regardless of whether the Commissioner thinks it’s in the wider public


interest that the case go to the Human Rights Review Tribunal we can’t refer a case on to

the Director of Human Rights Proceedings if the parties have agreed to settle. Our

conciliation role is discussed in detail in chapter 4, “Promoting conciliation and settlement”,

at page 44.

The impact of our decisions: Legal and practical consequences

Although the Commissioner has no power in respect of investigations to make binding

rulings and provide remedies such as compensation, our decisions do affect the legal

rights of complainants and respondent agencies further down the path. If we decline to

investigate a complaint for lack of jurisdiction (see page 23), or using our section 71

discretion (page 28), the complainant will not have access to the Human Rights Review

Tribunal. While our decision to decline to investigate can’t be taken to the Tribunal it is

subject to review by the Ombudsmen or to judicial review in the High Court.

In this way we have something of a gatekeeper role, directly limiting access to judicial

decision-makers who can provide remedies. In general, however, we exercise that

gatekeeper role in an expansive, rather than a restrictive way. Although we must be careful

that the limited resources of our office aren’t wasted on complaints that are incapable of

succeeding or that are an abuse of process, the thresholds for rejecting a complaint on

those grounds are appropriately set quite high: see chapter 2, “Receiving and screening

complaints”, from page 23.

Our complaints role in context: One of a range of tools for

addressing non-compliance

Investigating Officers need to bear in mind that investigations of individual complaints is

only one of the means established by the Privacy Act for addressing breaches of the

privacy principles.

If, for example, our initial assessment of a complaint or enquiry or investigation of a

complaint finds there’s been a breach but no harm, this does not exhaust our statutory

functions. Not everyone that brings a matter to this office is wanting to pursue a formal

complaint under Part 8 of the Act. We need to think of the range of options that are

available in these situations, whether that is a report to the Minister, a case note or

contacting an industry body.

We have a number of other options for addressing systemic or otherwise significant

privacy problems within a particular agency or type of agency.

Whatever action we take, we can amplify that effect through our policy engagement and

through the work of our Communications team. Conveying a message to stakeholders or

the wider public enables us to have a much greater influence.


Legal checkpoints: Key statutory and common-law rules

Below are some key legal rules and principles that provide a framework for all actions and

decisions in our complaints and investigations role.

The other chapters of this Manual also set out other, more specific legal checkpoints that

apply at certain stages of the investigation process – see for example at page 55 of the

“Investigating a complaint” chapter.

Act within the law

Don’t exceed the power given by the Privacy Act or interpret its provisions

unreasonably.

Customer focused approach

Don’t assume either the complainant or the respondent will have knowledge of our

process.

Don’t try and interpret facts in order to fit a Privacy Act complaint.

Do try and work out what the complainant and respondent are trying to achieve and

help direct them the most appropriate place for that.

Do try and manage expectations about what we can and cannot do.

Natural justice

Give people a reasonable chance to have a say, and listen to them.

Give clear reasons for our decisions and actions.

Significant discussions with a party over the telephone should be followed up with a

letter putting it in writing.

Using our discretion

The processes we follow shouldn’t be so rigid that we fetter our discretion under the

Act.

But at the same time be as consistent as possible. Our decisions should be consistent

with the Commissioner’s earlier interpretations of the law and of established judicial

authority – and if we do change our mind, we need to acknowledge the change and

carefully justify the change with clear reasons.

Secrecy and privileged information

Maintain the secrecy of all information and matters that come to your attention during

your work, unless we need to disclose the information to fulfil the purposes of the Act

(section 116).


Protect privileged information (section 96(4)). Make sure that privileged information we

receive as part of an investigation remains privileged. We can see it, but no-one else

should.

Other legal rights and interests

Take into account other rights and interests, including:

important human rights and social interests that compete with privacy, such as the

general desirability of the free flow of information and the right of government and

business to achieve their objectives in an efficient way (section 14(a))

New Zealand’s international obligations, and general international guidelines relevant

to privacy (section 14(b), (c))

rights protected under the New Zealand Bill of Rights Act 1990, such as freedom of

expression

rights under Te Tiriti o Waitangi.

Learning the language: Some terms and abbreviations we

use

“Corro” is the “Complaints Correspondence” mailbox in Objective (it’s found under

Utilities/Mailbox)

An “enquiry”, depending on the context, can be used in the everyday sense of a

simple request for information or advice, but we also use it in a special internal

administrative sense to mean a communication that we treat as an “Enquiry” rather

than as a complaint to be investigated – for example, a complaint that we don’t have

jurisdiction to investigate or that we decide not investigate on one of the grounds in

71(1). See the discussion on the following pages about how we distinguish a

“complaint” from an “enquiry”.

“Objective” is our complaints management software.

A “prov” is an informal term we sometimes use internally to mean a provisional view

that a complaint has substance and that we communicate to the respondent agency.

(We also sometimes use it as a verb – as in “I then prov’d the complainant”). In our

correspondence we refer to it as a “preliminary view”. Internally we sometimes also

use the term “PV”.


3. Receiving and screening complaints From when it arrives, to when it lands on an IO’s

desk

What this chapter covers

This chapter explains:

the key legal checkpoints that apply when we receive and screen

complaints

the process for receiving complaints and forwarding them to a Team

member for initial screening

initial screening by the rostered Team member to determine whether

the complaint is one that we can and should investigate

when a complaint should be referred to another agency such as the

Ombudsmen

assigning a complaint to one of our two offices, and the relevant factors

for this decision

assigning a complaint to a particular Investigator, and the relevant

factors.

Introduction: Key legal checkpoints

Our systems

We must have a good system for receiving and considering communications that

might be complaints.

Is the complaint within our jurisdiction?

Do we have jurisdiction? That is, is the communication an allegation of an action or

omission that is, or appears to be an interference with privacy? (section 67)


Is the complaint about something that falls more properly within the jurisdiction of the

Ombudsmen, the Health and Disability Commissioner, the Inspector-General of

Intelligence and Security, or an overseas privacy agency? (sections 72 – 72C)

Should we investigate the complaint?

If we do have jurisdiction, consider whether there are grounds under section 71(1) for

deciding not to investigate the complaint.

If a ground exists, decide whether to exercise the discretion under 71(1) to decline to

investigate.

Requirement to investigate

If we have jurisdiction over the complaint and none of the grounds in section 71(1)

exists, we must investigate it (section 70).

Fielding complaints and forwarding them to the rostered

Team Member

Introduction

The Office of the Privacy Commissioner receives a range of complaints, enquiries and

other communications from the public, and through a range of different channels, such as

email, online complaint or old-fashioned mail.

This section explains our systems for ensuring that all these communications are recorded

and actioned in the appropriate way. It explains who monitors the relevant channel and first

handles the communication, and what administrative steps they must take.

Is it a complaint?

Although many of the communications we receive are clearly intended to be complaints,

and are also clearly within our jurisdiction to accept and investigate, others may have a

murkier status – for example:

some will be intended as complaints but nevertheless fall outside our jurisdiction

because what they allege is incapable of being a privacy breach – these we record

administratively as “Enquiries”

some communications may begin in a less certain way as apparently just an enquiry

but, after clarification with the individual and consultation between the Enquiries

Officer and the rostered Team member, are then processed as a complaint and

assigned to an Investigator.

The processes set out below provide a framework for ensuring that all communications

that may be complaints are given proper attention and processed in the appropriate way.


Administrative steps when a complaint first arrives: Channel by

channel

This section explains, for each channel through which a complaint may arrive, which staff

member will first field the complaint, and what they should do with it:

How it arrives Who first fields

it

What they do with it

Post or fax This could be either a letter or a hard copy of our complaint form

Administration Officer Wellington

Scan the complaint

Load the PDF of the scanned complaint into Objective (into the “Complaints Correspondence” mailbox)

Give the original hard copy of the complaint to the Team Secretary Wellington.

After these complaints have been assigned to an office by the rostered team member, the Wellington Team Secretary will:

make up the Wellington files, and

send the Auckland complaints to the Auckland Team Secretary in the overnight bag.

Online complaint form Administration Officer Wellington

Load the complaint into Objective (“Complaints Correspondence” mailbox).

Email to “Enquiries” Enquiries Officer The Enquiries Officer who fields the complaint will:

if it is clearly a complaint, forward it to the rostered team member

if it could be a complaint rather than an enquiry, consult with the rostered team member and their manager

If the email will be treated as a complaint, the rostered team member will then load the complaint into Objective.

Email to “Investigations”

The rostered team member

Load the complaint into Objective (“Complaints Correspondence” mailbox)


How it arrives Who first fields

it

What they do with it

Email to individual IO’s address

If the IO has dealt with that complainant before, the complainant may send their complaint to the IO’s individual email address.

The Investigating Officer

The IO forwards the email to the rostered team member.

The rostered team member loads the complaint into Objective (“Complaints Correspondence” mailbox).

Complaint to Orb website

We log into the Orb Website and move any correspondence there into our system by email

The rostered team member

The rostered team member loads the complaint into Objective (“Complaints Correspondence” mailbox)

Transferred by another organisation

We can have complaints referred to us by the Ombudsman, the HDC or IGIS. These will usually come to us via email after an initial consultation with a Team Manager

One of the Team Managers, or General Counsel

The team manager will load the complaint into Objective (“Complaints Correspondence” mailbox)

Who’s the rostered Team member today?

To find out which Team member is currently rostered on, check with your

own Team Manager.


How we get the complaint

Who first handles the complaint

Flowchart: Fielding complaints and forwarding them to rostered

Team member

Online complaint form

Email to individual IO

Email to “Investigations”

Orb website

Email to “Enquiries”

Enquiries Officer

Consults with rostered

Team Member

as needed

Automatically

forwarded

Post or fax

Administration

Officer

Initial

screening

by

rostered

Team

Member

The Investigating Officer

Rostered Team Member monitors

the “Investigations” inbox

Administration

Officer


Complaints can be oral

Complaints do not have to be in writing (section 68(1)). We can’t therefore

insist to a complainant that they must put their complaint in writing before

we can accept it.

However, the Act also says an oral complaint must be put into writing as

soon as practicable, and that we have to give the complainant “such

reasonable assistance as is necessary in the circumstances” to enable

them to put it in writing (section 68(2), (3)).

Procedure for identification and notification of “Easy

Access” complaints

Step one

The investigator or team manager on incoming correspondence identifies an “easy access

IPP/HIPC/CRPC 6” complaint and flags it as such in the “unallocated files” by writing

“EASY ACCESS 6” on an electronic sticky note.

For a file to be considered “easy access”, it will need to fulfil the following criteria:

There has been a specific, sufficiently detailed request for information (so it is clear what we would be notifying on).

There is a copy of the request on file, or a copy of the response from the respondent which makes it clear the request has been made

The request was made more than 20 working days ago

Adequate contact details for both the complainant and the respondent have been provided

There are no “red flags” (e.g. repeat complainant, obvious mental health issues, or any other matters that would make early notification without speaking to the complainant undesirable).

Step two

Secretary, Investigations (Auckland)/Team Secretary, Investigations (Wellington) will

identify the easy access files in their complaints inbox by the “EASY ACCESS 6” sticky

note, and:

Make up the electronic and physical complaint file

Complete the metadata

Draft notification letters for both complainant and respondent

Take the file to a team manager.


Step three

A team manager allocates the complaint file to an investigator and provides the file to the

investigator immediately, flagged as an “EASY ACCESS 6” file, with the draft of the

notification letters enclosed.

Step four

The investigator, within two working days:

Completes the pink

Reviews the draft notification letters, making any amendments they feel are necessary,

Confirms with Corporate Services that the notification letters can be sent to the complainant and the respondent.

Step five

Corporate Services sends the notification letters to the complainant and the respondent

once approved by the investigator, and files the copies in the Objective file, and the

physical complaint file.

Step six

The investigator manages the file from that point forward.


Initial screening by rostered Team member:

Is this a complaint we can and should investigate?

When we first receive a communication, we need to:

establish whether the person intends it to be a complaint under the Privacy Act

decide whether it’s a complaint we have jurisdiction to investigate.

If we do have jurisdiction, we then need to decide whether we should decline to investigate

it using our discretion under section 71(1), if one of the grounds in that provision applies.

This section of the Manual gives guidance about each of those stages.

Is it intended to be a formal complaint?

It’s important to remember to ask the obvious questions – such as “Do we in fact have a

complaint here?” – rather than simply assume that we do. It’s possible that although the

person thinks their privacy has been interfered with, they don’t in fact want to file a formal

complaint, or haven’t yet decided what they want to do.

They may not realise that their one-paragraph email to “Enquiries”, written in haste and

irritation, could potentially trigger a formal investigation of the relevant business or

government agency under the Privacy Act. They may simply want us to know what

happened, or perhaps they simply want to vent some irritation and frustration. If you think

there’s doubt about this, confirm with the sender – preferably by phone as soon as

possible.

It’s up to the individual whether they want to formally complain or not. We can explain how

the complaints and investigations scheme works, but it’s not our job to persuade or

discourage them complain.

A note on terminology: “Complaints” and “Enquiries”

At the OPC the word “enquiry” can be used in two different ways:

Everyday sense – Sometimes it’s used in the everyday sense of

asking for information or advice

Special internal, administrative sense – Sometimes we use it in a

specialist way internally to mean any communication to the OPC that

we decide not to investigate as a complaint, either because we don’t

have jurisdiction (for example, because there is no potential privacy

breach even if the person’s claimed facts are true) or because we

decided not to investigate on one of the grounds under section 71 – for

example, the complaint is brought too late.

This means that something that on the face of it is a complaint may in fact

be dealt with, as an “enquiry”, even though the person concerned thinks it’s

a complaint.


On the other hand, a communication that may seem to be just a request for

information or advice may in fact become a complaint that we investigate,

as we get more details from the individual – for example, an email to

“Enquiries” asking simply what a person’s privacy rights are in a particular

situation.

Alternatively, it could be a “notification”, where someone just wants to let us

know something. No matter what it is, we still have to figure out what, if any,

of our available tools we can best apply to it.

Even if it is clear the individual has suffered no harm, and therefore can’t

make a complaint under Part 8, the complaint may disclose something we

might want to draw to the respondent’s attention to improve compliance, or

to the government’s attention. We might want to initiate an “own-motion

inquiry”.

If it is a complaint, is it one we have jurisdiction to investigate?

People and bodies outside our jurisdiction

Not an “agency”

We won’t have jurisdiction to investigate the complaint if it concerns a person or body that

is not an “agency” within the terms of section 2 of the Privacy Act.

What the Act says: Section 2(1)

“agency means any person or body of persons, whether corporate or unincorporate,

and whether in the public sector or the private sector; and, for the avoidance of doubt,

includes a department ….”

The definition then continues with a lengthy list of exclusions. Note that there are

organisations that don’t fall within the definition of “agency” for the purposes of their

interactions with the public, but are “agencies” in relation to the personal information they

hold on their employees. For example, we can’t investigate complaints about courts or

tribunals in relation to judicial functions (section 2(1), definition of “agency”, para (b)(vii),

(viii)). That exclusion covers judges and court/tribunal officials – but it doesn’t cover other

people in a court or judicial context, such as lawyers or witnesses. For the application of

this exclusion to registrars and other courts officials, see Ministry of Justice v S (High

Court, Wellington, CIV-2005-485-1138, 7 Apr 2006 – available at

www.nzlii.org/nz/cases/NZHC/2006/357.pdf).

You may need to determine whether the respondent body or individual is a “tribunal” under

the Act. The term “tribunal” essentially refers to statutory bodies with a judicial function

(Director of Human Rights Proceedings v Catholic Church for New Zealand [2008] 3 NZLR

216. To determine, however, whether a body is acting judicially as a “tribunal” rather than

http://www.nzlii.org/nz/cases/NZHC/2006/357.pdf


administratively is not always easy. The key distinction is whether the activity is more

judicial than administrative and takes into account a number of factors set out in the

leading case, Trapp v Mackie [1997] 1 All ER 489 (HL).

Case Note 232848 [2012] NZ PrivCmr 3 (June 2012)

Case Note 209125 [2009] NZPrivCmr 9 (May 2009)

Case Note 92895 [2008] NZPrivCmr 11 (August 2008)

Tribunal decisions L v W (unreported Decision No CRT 9/98 5 June 1998)

Clearwater v Accident Compensation Corporation (Decision No 02/04 HRRT

56/02, 23 February 2004 relying on Kuipers v Accident Compensation

Corporation (CRT Decision No 23/99, 10 August 1999)

High Court decision (upholding the Tribunal) Commissioner of Inland Revenue v B [2001] 2

NZLR 566

Our limited jurisdiction over intelligence organisations

What the Act says: Section 57, “Intelligence organisations”

“Information privacy principles 2, 3, and 4(b) do not apply to information collected by

an intelligence and security agency.”

Our jurisdiction over intelligence and security agencies – that is, the Security Intelligence

Service and the Government Communications Security Bureau – excludes complaints

under principles 2, 3, and 4(b).

See also the specific exception in IPP10(2) that allows an intelligence and security agency

to use personal information for a secondary purpose and the exception in IPP11(fa) that

permits the disclosure of personal information by any agency that believes on reasonable

grounds that the disclosure is necessary for an intelligence and security agency to perform

any of its functions.

Parallel jurisdiction with IGIS?

When we do have jurisdiction to investigate a complaint, check if the

complaint “more properly” belongs with the Inspector-General of

Intelligence and Security. Usually complaints about access and correction

“more properly” belong to the Office of the Privacy Commissioner, but other

complaints may require consultation with IGIS before deciding where they

“properly belong”. The statutory process in these cases is explained at

page 39 of this Manual.

For more information see: Intelligence and Security Act amendments to

https://privacy.org.nz/news-and-publications/guidance-resources/intelligence-and-security-act-amendments-to-privacy-act-faqs/


Privacy Act: FAQs

Not a privacy problem

Sometimes a complainant will present us with a problem that, on the face of it, doesn’t

concern the Privacy Act. Don’t assume this must be a privacy problem simply because

they’ve contacted our office. It could be, for example, that they’re approaching a number of

government agencies and complaints bodies with their problem and we’re just one of them.

As always you should make sure you have all the details of the complaint and that you’re

clear about what the person is alleging. But our job is not to try to find a way to fit every

complainant’s problem into the Privacy Act scheme, even those that don’t seem to involve

privacy issues. If the complainant’s problem doesn’t involve a possible interference with

privacy, then we won’t be able to help them – other than giving them some guidance about

who else may be able to help.

On the other hand, if their problem does appear to involve privacy, remember it’s not their

responsibility to frame their complaint in terms of the specific rules and structure of the

Privacy Act scheme – that’s our job. A complainant doesn’t have to cite a specific privacy

principle or rule for us to be able to accept their complaint. If they believe their privacy has

been interfered with, and the alleged facts are capable of being an interference within the

terms of the Act, it’s then our job to investigate and establish whether their complaint has

substance (subject to our discretion to decline to investigate under section 71).

Not “personal information”

We will not have jurisdiction to investigate the complaint if:

the information in question is clearly corporate information, not information about an

individual, or

the information is not about an identifiable individual

However, if there’s any doubt about those questions, we should accept the complaint. The

question of whether it’s personal information should be determined as part of our

investigation.

Facts incapable of amounting to a breach

We won’t have jurisdiction if, on the facts alleged by the complainant, the action or

omission complained of is incapable of amounting to a breach of any information privacy

principle or rule – for example if the complainant says the information-holder hasn’t

responded to their information privacy request but the 20 working day limit hasn’t yet

expired.

Harm

Although harm is a necessary element for any actions that are an interference with privacy

under s 66(1), (harm not being required for actions that are interferences with privacy

https://privacy.org.nz/news-and-publications/guidance-resources/intelligence-and-security-act-amendments-to-privacy-act-faqs/


under s 66(2)), that doesn’t mean that we should refuse to accept a complaint for

investigation simply because the complainant hasn’t specifically alleged any harm in their

complaint.

If, on the face of it, the alleged action or omission is capable of having caused harm, we

should accept the complaint for investigation. Whether the person has in fact suffered any

harm will then be one of the issues for your investigation to determine.

You should also not reject a complaint merely because the complainant has alleged what

appears at first sight to be only a low level of harm – for example, they say they felt

embarrassed. Here, it will be a matter for our investigation whether the harm suffered

meets the statutory threshold of “significant humiliation, significant loss of dignity, or

significant injury to the feelings of that individual” in section 66(1)(b)(iii). You shouldn’t

assume that the harm suffered is incapable of meeting that threshold.

However, there may be some cases where on the facts alleged by the complainant it is

clear that no harm was, or could have been, suffered by the complainant. In those cases

we have no jurisdiction to investigate, as the action or omission is incapable of being an

interference with privacy (unless their complaint concerns principle 6 or 7). An example

might be where the complaint is that an agency sent out a completely innocuous email

without using the BCC (blind copy) function.

An early open ended conversation with the complainant might well help you to establish

whether the complaint is likely to meet the harm threshold.

Exclusions such as “domestic affairs”

What the Act says: s56 Personal information relating to domestic

affairs

(1) Nothing in the information privacy principles applies in respect of—

(a) the collection of personal information by an agency that is an individual; or

(b) personal information that is held by an agency that is an individual,—

where that personal information is collected or held by that individual solely or

principally for the purposes of, or in connection with, that individual’s personal, family,

or household affairs.

(2)The exemption in subsection (1) ceases to apply once the personal information

concerned is collected, disclosed, or used, if that collection, disclosure, or use would

be highly offensive to an ordinary reasonable person.

If the privacy principles are clearly excluded in this case – for example, by the section 56

“domestic affairs” exclusion – then we should reject the complaint for lack of jurisdiction. If,

however, there is doubt, we should accept the complaint for investigation. It could be

unclear whether the particular facts come within the exclusion, or it could be that the

interpretation of the exclusion is still legally uncertain.


For example, if it’s possible the “domestic affairs” exclusion wouldn’t apply to the complaint

because of the “highly offensive” qualification added to section 56 in July 2015, this should

be investigated.

If we have jurisdiction, should we decline to investigate under

71(1)?

Our discretionary power

Section 71(1) gives us a discretion to decline to begin an investigation if, in our opinion,

one of the seven grounds set out in that subsection exist.

(Section 71(1) can also be used to discontinue an investigation that has already begun:

see page 75.)

The words that begin section 71(1) and provide our discretion are as follows:

The Commissioner may in his or her discretion decide to take no action or, as the case

may require, no further action, on any complaint if, in the Commissioner’s opinion, –

Para (a): Length of time since the incident

(a) the length of time that has elapsed between the date when the subject matter of

the complaint arose and the date when the complaint was made is such that an

investigation of the complaint is no longer practicable or desirable

Key questions here will include:

Are we still practically able to investigate the complaint? It may be that the

evidence we need or the people we need to talk to are no longer available, or that the

passing of time will have made memories less reliable. As the phrase “no longer

practicable” in para (a) makes clear, this limb is intended to address where there are

simple practical difficulties with trying to investigate because of the time that has

passed.

Why has the complaint been made only now? Have the facts only just come to the

complainant’s attention – or have they simply sat on the issue when they could in fact

have come to us earlier? The phrase “no longer … desirable” in para (a) is broad. It

allows us to decline to investigate if we think that in this case the complainant

shouldn’t be allowed to use the complaint process and put the relevant agency to the

expense and stress of an investigation into old events, including if events have moved

on.

- However, remember that the complainant may have been aware of some key

facts but not others. For example, they may have been aware there was a

breach, but the harm may only have just come to their notice.


- They may also have had a good reason for not complaining earlier – for

example, they may have been making serious efforts to try to resolve the

problem through negotiation or other methods. It will depend on the particular

case.

We will therefore not apply any absolute time limit but will look at all the circumstances. For

example:

We may decide not to investigate a complaint if the relevant incident was 12 months

ago and the complainant could have complained earlier.

We may decide to investigate if the incident was some years ago but the information

has only just come to the complainant’s knowledge.

In all cases, clearly document your reasons. We might have to defend your decision to the

Ombudsman, or in judicial review.

Case notes 219105 (2011)

Tribunal decisions DAS v Department of Child Youth and Family Services,

No 45/04, HRRT 47/03, 10 Sep 2004

Para (b): Trivial

(b) the subject matter of the complaint is trivial

Look at all the circumstances

Whether the subject matter of the complaint is trivial will depend on all the circumstances

of the particular case. For example, though the information may appear to us to be trivial, it

may be particularly relevant for the complainant’s own purposes, and therefore be

significant in that context.

The threshold for invoking para (b)

We should be cautious about invoking para (b) to decide to not investigate or to

discontinue an investigation.

Sometimes, clarifying the complaint with the complainant may show their real concern was

something other than any alleged breach – like heavy-handed or unresponsive treatment.

In those cases, it may arguably be appropriate and a tidy result to decline to investigate

under the “trivial” limb. But remember that we’re in the business of dispute resolution, and

telling a complainant their problem is “trivial” may get in the way of a practical resolution,

causing them to dig their heels in and seek vindication for complaining in the first place.

Try to look at it from the complainant’s point of view. Although it might seem a minor matter

to us, remember they’ve gone to the trouble of making a complaint. If they’ve also been

treated poorly by the agency, this is likely to be a significant piece of the context for the


purposes of trying to resolve the complaint. Generally it will be better, if possible, to decline

to investigate on some basis other than the “trivial” ground.

If, for example, it’s become clear that the complainant isn’t in fact alleging any breach, then

it would generally be appropriate to decline for lack of jurisdiction. If on the other hand this

only becomes apparent after notification, you could invoke section 71(2) – that further

action is unnecessary or undesirable.

Para (c): Frivolous, vexatious, not in good faith

(c) the complaint is frivolous or vexatious or is not made in good faith

Overview

The Ombudsmen have published a helpful summary of the case-law on “frivolous or

vexatious”. Translating that summary to the privacy complaints scheme, we will be justified

in rejecting a complaint as frivolous or vexatious if the complainant is clearly abusing the

rights granted by the scheme, rather than exercising those rights in good faith.

As that summary indicates, the three concepts in para (c) – “frivolous”, “vexatious” and “not

made in good faith” – partially overlap and to some extent circle back on each other.

A high threshold

In general, the threshold for declining to investigate on those grounds is a high one.

Dealing with an application to have someone declared a vexatious litigant, the High Court

said:

“[B]ecause of the impact upon rights of access it is proper for the Court to be

reluctant to make an order unless the grounds are clearly made out….”

A-G v O’Neill [2008] NZAR 93 at [101]

However, in proper cases our discretion here serves an important purpose. In O’Neill the

High Court continued, quoting from Attorney-General v Jones [1990] 1 WLR 859 (CA):

“[t]here must come a time when it is right to exercise that power, for at least two

reasons. First, the opponents who are harassed by the worry and expense of

vexatious litigation are entitled to protection; secondly, the resources of the

judicial system are barely sufficient to afford justice without unreasonable delay

to those who have genuine grievances, and should not be squandered on those

who do not.”

http://www.ombudsman.parliament.nz/system/paperclip/document_files/document_files/245/original/part_2a_administrative_reasons_for_refusing_official_information_requests.pdf?1344201714


Below is some more specific guidance on the individual terms in para (c).

“Frivolous”

Its everyday meaning = “Not having any serious purpose or value” (Concise Oxford

Dictionary)

The threshold for declining to investigate on this ground is a high one. To strike out a

case as “frivolous”, the courts have said that the pleading must be “so clearly

frivolous that to put it forward would be an abuse of the process of the court”

(Young v Holloway [1895] P 87 at 90).

Comments by the New Zealand courts echo the theme of abuse of process:

“A proceeding is frivolous if it trifles with the Court’s processes.”

Koyama v NZLS [2015] 3 NZLR 29 (HC)

“The claims by [the parties] are frivolous. The parties are using the pleadings to

direct insults at each other. This proceeding is not being used to uphold interests

which the law of torts sets out to protect.”

Deliu v Hong [2011] NZAR 681 (HC) at 687

"The proceeding cannot be described as frivolous or vexatious. There is a

genuine attempt to resolve issues in the High Court ….”

NZLS v Deliu [2015] 2 NZLR 224 (HC)

However, for a complaint to be rejected as “frivolous” on the basis that it’s an abuse of

process it’s not necessary for the complaint to be completely untenable: “This decision

that the pleadings are frivolous does not turn on whether [the parties] have tenable

causes of action for their claims, although that is a relevant consideration.” (Deliu v

Hong at 687)

“Vexatious”

Its everyday meaning = “Causing annoyance or worry” (Concise Oxford Dictionary)

A “vexatious” complaint is one that no reasonable person could properly treat as

having been made in good faith (Norman v Matthews [1916-1917] All ER 696).

The test is therefore an objective one, in that it focuses on what a reasonable person

would think of the complaint – not on the subjective view of the complainant on the

merits of their case (they may well believe it’s an important complaint made in the

public interest), and also not the subjective view of the Investigating Officer (who may

have a long history of frustration with this particular complainant).

Remember that under s71(1)(c) it’s the complaint that must be vexatious, not the

complainant. Just because someone has previously made a number of possibly time-

consuming complaints, even ones that could themselves be called “vexatious”, that

doesn’t of itself mean their next complaint can automatically be rejected as vexatious.


It depends on the nature of the current complaint, considered in light of the

surrounding circumstances.

On the other hand, those surrounding circumstances can include the complainant’s

conduct and their purpose in bringing the complaint, and therefore you’re entitled to

take those factors into account.

The O’Neill High Court decision gives some relevant guidance here – though you

need to remember it involved an application to have someone declared a vexatious

litigant. The string of vexatious cases Mr O’Neill had taken to the Human Right Review

Tribunal had included, for example, a claim that he’d been discriminated against by

the use of Latin phrases in legal submissions in another matter. The High Court

summarised:

“Mr O’Neill’s proceedings are generally characterised by meritless claims, often

directed at individuals for no reason other than they have made decisions

adverse to Mr O’Neill. There is also the pattern, often apparent in claims by

vexatious litigants, of the extension of proceedings to take in an increasing circle

of potential defendants including the Chair of the Tribunal, members of the

Tribunal, and Ministers of the Crown.” [95]

Again, the threshold for declining to investigate on the “vexatious” ground is a high

one. A complaint will not be vexatious simply because we have previously found the

particular complainant to be difficult, or we think the current complaint is a minor one.

A complaint can be a vexatious one even though it discloses “the germ” of a legitimate

complaint (A-G v O’Neill [2008] NZAR 93 at [43]).

Cases where the “vexatious” ground may be relevant can include, for example, where

we’ve already dealt with one or more complaints from the same person based on

basically the same allegations (see Koyama v NZLS [2015] 3 NZLR 29 (HC)).

“Not made in good faith”

The everyday meaning of “good faith” = “Honesty or sincerity of intention” (Concise

Oxford Dictionary)

Although “vexatious” and “good faith” are related concepts, “vexatious” relates mainly

to the complainant’s intention in making the complaint – that is, are they doing it

simply to cause annoyance and worry? By contrast, “good faith” relates more to

whether their action in bringing the complaint is done honestly. A complaint not made

in good faith might include, for example, where a complainant already knew that the

matter had been settled, or where they knew they had in some way contributed to the

breach they’re complaining about.


Para (d): Individual doesn’t want action taken

(d) the individual alleged to be aggrieved does not desire that action be taken or, as

the case may be, continued

This ground may be relevant where:

the relevant individual (who potentially may be someone other than the complainant)

informs us that they no longer want to continue

we’ve informed the complainant that their complaint is unlikely to succeed (for

example, because an exemption clearly applies) and that if we don’t hear back from

them we’ll assume they don’t want to pursue the complaint any further.

Para (e): Insufficient personal interest

(e) the complainant does not have a sufficient personal interest in the subject matter

of the complaint

The Privacy Act allows someone to make a complaint even if they’re not the person whose

privacy has allegedly been interfered with. However, that jurisdictional opening is subject in

turn to our discretion to reject a complaint under 71(1)(e) if we don’t think it’s appropriate to

investigate.

Here are some key factors to consider:

Practical obstacles? – Does the fact that the complainant isn’t the individual affected

present practical difficulties for investigating the complaint? It may be that we simply

can’t get all the facts we need from the complainant.

Systemic issues? – Does the complaint raise a systemic problem or an issue of

public interest? This may argue for us investigating compared with an allegation of

what appears to be an isolated or very specific breach.

Another stake in the game? – Does the complainant have some other kind of

interest in the issue that they would like to further through the privacy complaints

process? For example, are they a political player? Although they may be complaining

in good faith about what is, in the wider sense, a legitimate concern, we may decide

it’s not appropriate for the complaints scheme to be used in this way, given that the

scheme is focused on providing individuals with a means of protecting their own

privacy interests and autonomy. The following is an example of that kind of complaint:

“Highly politicised and publicised” – Example of 71(1)(e) in action

In 2014, in the wake of the publication of Nicky Hager’s Dirty Politics, we

declined to investigate a complaint from the Green Party into the alleged


disclosure by the Minister of Justice of a public servant’s contact details and job

title to the blogger Cameron Slater.

In the Commissioner's blog of 26 August 2014, he explained our decision:

“The Privacy Act is fundamentally concerned with the preservation and

promotion of individual autonomy. It protects the right of an individual to

determine, or at least influence, the extent to which their personal information is

placed into the public domain and becomes the subject of public discussion.

“That purpose would not be served if we were to investigate a complaint in a

highly politicised and publicised environment that is neither on behalf of, nor

supported by, the affected individual.”

Para (f): No use of Code’s complaints procedure

(f) where—

(i) the complaint relates to a matter in respect of which a code of practice

issued under section 46 is in force; and

(ii) the code of practice makes provision for a complaints procedure, –

the complainant has failed to pursue, or to pursue fully, an avenue of redress

available under that complaints procedure that it would be reasonable for the

complainant to pursue

In the vast majority of cases it will be reasonable to expect the complainant to have used

the Code of Practice complaint process first.

Cases where we may still accept the complaint can include the following:

Urgency – If there is immediate and ongoing harm, it may not be reasonable to

expect the complainant to wait for the agency’s internal complaints process to run its

course – for example, if information had been posted online.

Complaint-handler is the problem – if the complainant has found that the person

who handles the complaints process at the agency was directly involved in the alleged

breach, it may be reasonable for the complainant to come to us first. Here the agency

itself isn’t a safe place for the complainant to take their problem. This may be more

likely to happen with smaller agencies – a GP’s office for example – whereas large

agencies will be more likely to have a separate complaints team.

Of course, if the complainant has approached the agency and the agency hasn’t

responded within a reasonable time, then para (f) won’t apply – especially if the agency

hasn’t met its own stated timeframes for responding.

https://www.privacy.org.nz/blog/wrong-tree/


Not using the agency’s complaints process in non-Code cases

We have a limited statutory basis for declining to investigate where the

complainant hasn’t first complained to the agency itself and a Code of Practice

doesn’t apply. These cases would be unlikely to be captured by para (g) (see

below), which generally applies to judicial or other external fora that can

provide a remedy or appeal, rather than to an agency’s internal complaints

processes. It may be that we can refer the complainant to industry-specific

schemes such as the Banking Ombudsman or Utilities Disputes Ltd.

In more extreme cases, and depending on the nature of the complaint, we may

be able to decline on the basis that the complaint is "vexatious" (see para (c)

above).

In these cases, while we may find it difficult to decline to investigate, you

should strongly urge the complainant to approach the agency first. Emphasise

to them that this is likely to be the fastest and most effective of getting the

result they want. You should give them maximum assistance, perhaps even

providing them with details for the privacy officer or other contact person at the

agency. Tell the complainant that their problem isn’t addressed within a certain

time, they should let us know.

Once we’ve explained this to complainants and equipped them as much as

possible to pursue the problem with the agency, complainants are almost

always happy to do this.

Para (g): Other adequate means of challenge

(g) there is in all the circumstances an adequate remedy or right of appeal, other

than the right to petition the House of Representatives or to make a complaint to

an Ombudsman, that it would be reasonable for the individual alleged to be

aggrieved to exercise

Other relevant remedies or appeal rights that may be relevant here include:

complaining to the Human Rights Commission, if the complaint is fundamentally about

discrimination rather than privacy

impending civil or criminal proceedings that will provide the complainant with an

opportunity to apply for access to information earlier denied to them

Case notes No 211597 (2010)

when there’s a complaints or disciplinary body for that particular sector or profession

that can deal adequately with the complaint – for example, complaints against

healthcare providers, against banks covered by the Banking Ombudsman scheme, or

against lawyers.

Case notes No 93953 (2007)


Tribunal decisions Lehmann v Radioworks, No 31/04,

HRRT 8/02, 5 Aug 2004

What is the complaint really about?

Remember – where a complaint does not relate to concerns about privacy at all, then we

have no jurisdiction. We do not need to invoke the discretion under section 71(1) in those

cases. In cases where we have parallel jurisdiction with some other agency, you will need

to ask: What is this complaint really about? Is it mostly about privacy or mostly about

something else? For example, if it’s a complaint about a bank, is it mostly about privacy

and information, or is it really a banking dispute?

Many disputes we receive complaints about contain only a very small privacy element.

We should explain to the complainant in these cases that there is another complaints

agency that’s better placed to deal with their dispute than us, and that we’ll most likely just

muddy the waters if we get involved. The complainant may be unaware of the other

agency and its jurisdiction and be happy to redirect their complaint to a more appropriate

place.

The complainant can come back

If we decline to investigate under para (g) on the ground that a court or other agency has

jurisdiction to deal with the complainant’s problem, we should tell the complainant that this

doesn’t prevent them coming back to us with a complaint if the other process doesn’t

provide the remedy they’re seeking for their privacy issue.

This doesn’t mean we put their complaint on hold. Administratively there’s no difference to

when we decline on other grounds: we close the file as normal. However, we should

assure the complainant that this does not prevent them making a complaint about the

issue in the future.

Notification requirements if we decline to investigate under 71(1)

If we decide under section 71(1) not to investigate the complaint, we must inform the

complainant of this and also give him or her reasons (section 71(3)). The reasons should

set out clearly why the particular ground for declining to investigate applies. This

notification should be in writing. The effect of us declining to investigate is that the

complainant cannot go to the Human Rights Review Tribunal. The complainant can ask us

to reconsider our decision to decline to investigate.

If we still decline to investigate, we should notify the complainant of his or her right to

complain to the Ombudsman.

Exercising our discretion: Section 71 and our “gatekeeper” role

If we decide to investigate a complaint and notify the parties accordingly, this has

significant consequences for the question of access to the Human Rights Review Tribunal.

It means that whatever the outcome of our investigation, the complainant will be able to


take a case about the matters we investigated to the Tribunal. The respondent will

therefore be exposed to the Tribunal’s jurisdiction, whatever our investigation finds. This

means that we must think carefully about the scope of our investigation.

Our decision about whether to investigate under a particular principle is not subject to

review by the Tribunal, although the parties can challenge the process we followed by

going to the Ombudsmen. (See further the discussion of the significance of notification in

DHRP [NKR] v ACC [2014] NZHRRT 1, HRRT No 002/2012.)

“Keeper of the keys”

The Tribunal has said that, if we decline to investigate under section 71(1): “… then

that is the end of the matter. To that extent the Privacy Commissioner is the keeper of

the keys to the gate through which aggrieved individuals must pass in order to come to

the Tribunal.”

DAS v Department of Child Youth and Family Services

No 45/04, HRRT 47/03, 10 Sep 2004

However, although the statutory scheme may in this way make us a “gatekeeper” to the

Tribunal, we do not take as our default that protecting respondents from the Tribunal’s

jurisdiction is more important than giving complainants access to it – or in other words, that

it’s better to keep people out than to let them in. In general we exercise our gatekeeper

role in an expansive rather than restrictive way. As the above discussion indicates, the

thresholds for rejecting a complaint for lack of jurisdiction or under section 71 are

appropriately set quite high.

Referring a complaint or part of a complaint to other

agencies

Referrals to Ombudsmen, Health and Disability Commissioner or

IGIS

Sections 72 – 72B

If it looks like the complaint, or part of the complaint, belongs more properly with the

Ombudsmen, the Health and Disability Commissioner or the Inspector-General of

Intelligence and Security, then we must:

consult with the relevant agency without delay (“forthwith”)

decide what to do

refer the complaint, or the relevant part of it, to the other agency without delay if we

think it belongs there


notify the complainant that we’ve done this.

What the Act says: Section 72, “Referral of complaint to Ombudsman”

(1) Where, on receiving a complaint under this Part, the Commissioner considers

that the complaint relates, in whole or in part, to a matter that is more properly

within the jurisdiction of an Ombudsman under the Ombudsmen Act 1975 or the

Official Information Act 1982 or the Local Government Official Information and

Meetings Act 1987, the Commissioner shall forthwith consult with the Chief

Ombudsman in order to determine the appropriate means of dealing with the

complaint.

(2) As soon as practicable after consulting with the Chief Ombudsman under

subsection (1), the Commissioner shall determine whether the complaint should

be dealt with, in whole or in part, under this Act.

(3) If the Commissioner determines that the complaint should be dealt with, in whole

or in part, under the Ombudsmen Act 1975 or the Official Information Act 1982 or

the Local Government Official Information and Meetings Act 1987, the

Commissioner shall forthwith refer the complaint or, as the case requires, the

appropriate part of the complaint to the Chief Ombudsman to be dealt with

accordingly, and shall notify the complainant of the action that has been taken.

[Sections 72A and 72B, which deal with referrals to the Health and Disability

Commissioner and the IGIS respectively, follow the same structure and wording as

section 72.]

When will a complaint “more properly” belong with the Ombudsmen?

A complaint or part of it will, or may, fall more properly under the Ombudsmen’s jurisdiction

in the following cases:

Official information – it is mainly about official information, rather than personal

information

Administrative action – it is mainly about the reasonableness of some administrative

action by a government body or official – for example, if the complainant is unhappy

with the substance of a particular decision or with how they were treated.

Sometimes complainants (or their lawyer or advocate) may seek to cloak a challenge to a

decision or process under Principle 8 arguments, particularly in the immigration context.

We should be wary of that kind of complaint. On the other hand, we must be careful that

we do not miss a valid Principle 8 complaint by too hastily transferring a complaint to the

Ombudsmen.

In some cases it may be appropriate for our office and the Ombudsmen to run parallel

investigations, where we deal with the privacy aspect and they deal with the other aspect,

and with the two offices keeping in touch during our investigations.


However, our two investigations will often be working to two different statutory timelines.

Further, this will require the complainant to deal with two different investigating agencies.

Usually, however, it will be better for just one agency to deal with the complaint, according

to the nature of the complaint and which agency can best address it.

Sometimes a complainant may want to have two separate investigations –

it may make them feel their complaint is more important, or they may

genuinely believe it will deal more comprehensively with their concerns. In

these situations, however, sections 72 to 72B give us the power to say no,

and to refer their complaint on to the other agency.

When will a complaint “more properly” belong with the Health and Disability

Commissioner?

Examples of where a complaint will or may more properly belong with the HDC include:

Physical privacy – complaints about physical or bodily privacy rather than the privacy

of health information. For example, a complainant may be unhappy about a doctor not

closing the curtains of a cubicle before a physical examination, and they may have

complained to us assuming that we have jurisdiction over complaints about physical

privacy under the Code of Health and Disability Services Consumers’ Rights.

Ethical obligations & competence – a complainant alleging a breach of the privacy

principles by a doctor or other health professional may be mainly concerned about the

health professional’s competence in relation to their ethical obligations around

patients’ privacy and information. If the complainant’s concern is not mainly about the

consequences of the breach for them, about any harm, but rather with the doctor’s

ongoing conduct, then it may be more appropriate to have the case dealt with by the

Health and Disability Commissioner.

When will a complaint “more properly” belong with IGIS?

The IGIS provides oversight of the activities of the New Zealand Security Intelligence

Service (NZSIS) and the Government Communications Security Bureau (GCSB). Those

two agencies have wide-ranging powers that can affect the privacy of individuals, and the

role of the IGIS includes ensuring that those powers are used lawfully and appropriately.

The IGIS has substantial powers to access documents and information held by the SIS

and GCSB.

Privacy complaints to the Privacy Commissioner about the SIS and GCSB may therefore

be more properly within the IGIS’s jurisdiction when they involve broader issues relating to

those agencies’ surveillance and information-gathering activities.


Administrative processes with Ombudsman correspondence

Formal consults: Forward these to the General Counsel, cc Litigation secretary. Flag

email red and leave in Inbox so that the Litigation secretary can store in Objective. No

further action required.

Informal consults: Respond and file in Objective under Informal Consultations (File

Plan/Ombudsmen Consultations/Informal Consultations/appropriate Year – then create a

file divider under appropriate year and name – Year-month-day, Informal Consult, Name/s

of parties).

If the Ombudsman (OOTO) has chosen to consult informally, they are pretty sure of the

privacy interest and are only asking us to confirm it. If you do not agree with their

assessment or do not have enough information to make up your mind, you can ask them to

defer to a formal consult.

Potential transfers: Review to confirm there is personal information and the OOTO has

identified it. Check Objective to make sure we don’t already have a duplicate complaint.

If we already have a complaint or enquiry file on the same matter:

Add OOTO correspondence to existing file and advise OOTO no transfer is

required as we already have it and either the complaint it awaiting allocation to an

investigator, or if we are not investigating briefly explain the steps taken (eg we

have told the complainant to contact the agency directly first).

If we don’t have a complaint or enquiry file:

Advise OOTO to transfer or partially transfer the complaint. Drag your response

out of your “Sent” items and into the OOTO corro folder. Flag the emails with your

own colour and leave in the Inbox until the formal transfer arrives (usually within a

day or two). When OOTO sends formal transfer letters, attach all relevant

correspondence to a new email yourself and then add to Incoming with the usual

naming convention: [Year-month-day Name of Complainant (received by OOTO

corro)].

If OOTO proposes or agrees to a joint investigation:

Ensure complainant and respondent contact details are provided. If not, ask for

them

Add relevant correspondence to Incoming – include note that it is a joint

investigation/led by OOTO.

If it isn’t personal information and we don’t agree to the transfer:

Treat as an enquiry from OOTO. Create an enquiry file for correspondence. Use

the name of the OOTO investigator and the name of the complainant in the Enquiry

file so they are searchable with “attempted transfer”.


Agreed protocols for transferring complaints

The Ombudsman and OPC have agreed upon protocols to transfer complaints. Those

protocols are outlined below:

Potential Transfer (from Ombudsman to OPC)

Subject line: ‘Potential Transfer’ – Our case reference – name of the complainant

Body of email:

Name of complainant

Name of agency

Identify whether: Decision on information request OR Other potential interference with privacy

Date information request made to agency (if an information request)

Date complaint made to Ombudsman

Brief description of the complaint/information at issue

OOTO contact

OOTO team

The email will be sent to OPC’s general email address: [email protected].

Timeframe for responding: we hope OPC would be in a position to respond to emails within

3 working days or so (our reporting target for complaints outside jurisdiction is to close

within 1 month of receipt).

Transfer

OPC would respond to the Ombudsman’s ‘Potential Transfer’ email, advising whether we

accept the file or not. If OPC agrees to the transfer, the Ombudsman will draft up the

standard transfer correspondence. This correspondence will be sent by email to OPC’s

general email address: [email protected].

It would be helpful for the subject line of the email to contain the term ‘Transfer’, the case

reference and the name of the complainant.

Potential Transfer (OPC to Ombudsman)

Subject line: ‘Potential Transfer’ – OPC case reference – name of the complainant

Body of the email:

Name of complainant

Name of agency

Identify whether: Decision on information request OR Other potential Ombudsman Act complaint (ie, administrative act or decision of a scheduled agency

Date information request made to agency (if an information request)

mailto:[email protected]



Date complaint made to OPC

Brief description of the complaint/information at issue

OPC contact

OPC team

The email will be sent to the Ombudsman’s general email address:

[email protected]

Timeframe for responding: we would hope the Ombudsman would be in a position to

respond to emails within 3 working days or so.

Referrals to overseas privacy agencies

The Privacy Act reference: section 72C

If it looks like the complaint belongs more properly with an “overseas privacy enforcement

authority” (defined in s 72C(4)), like the Australian Information Commissioner, then:

we may consult with the overseas agency about this

after any such consultation we must decide where the complaint should be dealt with

if we think it belongs with the overseas agency, and if both the agency and the

complainant agree, we may refer the complaint, or part of it, to the overseas agency.

Which office? – Assigning to Wellington or Auckland

Who makes the decision:

The rostered Team member

Criteria for assigning complaints to a particular office

Easy answers: Fixed rules for certain agencies

Complaints about the Government Communications Security Bureau (GCSB) or the

New Zealand Security Intelligence Service (SIS) are dealt with in Wellington, and by

OPC staff who have security clearance.

Complaints about Auckland District Health Board (ADHB) or Auckland Council are

dealt with by our Auckland office.

Guidelines for all other cases

For other cases there are no set rules for which complaints go where, but here are some

factors to consider:

If the complainant has a current complaint, or has had other complaints arising from

the same facts, it may be best to deal with the new complaint in the same office (and

probably by the same Investigator).



If the respondent is based in Wellington or Auckland it may be best to assign it to the

relevant office, as it will be easier for the Investigator to meet with the respondent if

they want to do this – for example, if it’s a small medical centre in suburban Auckland,

send it to Auckland; if it’s Wellington City Council, send it to Wellington)

If the respondent is a large public-sector agency like the Police, MSD or Corrections,

then ensure that complaints about that agency are split evenly over time between

Wellington and Auckland.

Take into account the current workload of each office.

For some specific complainants it may be better to assign their complaints to the office

where they don’t live.

Administrative steps after the complaint is assigned to an office

Who: the Team Secretary Wellington

Tasks: After these complaints have been assigned to an office by the rostered Team

member, the Team Secretary Wellington will make up the Wellington files and send the

Auckland complaints to the Team Secretary Auckland in the overnight bag.

Who: the Team Secretary for that office

Tasks:

Open an electronic file in Objective (these are ordered alphabetically by complainant

name), drop the complaints documents into that file, and complete the file metadata

Open a hard-copy file

Send an acknowledgement letter to the complainant and a copy of the Information

Sheet

- The Acknowledgement letter templates are found at:

Acknowledgement letter (NEW)#2.obr

Acknowledgement letter - with letterhead (NEW)#5.obr

- The Information Sheet is found at:

Information Sheet for Complaints (Feb 2016)#2.obr

- The Assessment form (pink) 2015 is found at:


Assessment form (pink) 2015#2.obr

- The Closing Coversheet for Files form (pink) 2015 is found at:

Closing Coversheet for Files.obr

Put an Assessment form (pink) on the file electronic and physical files.

Put a Closing Coversheet for Files (pink) on the electronic and physical files.

Give the hard-copy file to the Team Manager for assigning to an Investigator.

Which Investigator? – Assigning the complaint to an

Investigator

Who makes the decision:

The Team Manager in the office to which the complaint is assigned

The decision: relevant factors

the Investigator’s current workload

the Investigator’s particular experience and specialist knowledge

whether the Investigator already has complaints against that agency

whether the Investigator already has complaints from that complainant

whether there is any conflict of interest that could affect the Investigator’s suitability for

the particular complaint.

Checking the Investigator’s assessment and investigation plan

When they assign the complaint to an Investigator, the Team Manager will note on the

Complaint Assessment sheet (“the pink”) whether they want to review it once the

Investigator has completed it.

Usual practice in both offices is for the Team Manager to check the completed “pink”

so that they can review the Investigator’s assessment of the complaint and their

investigation plan.

Difficult callers

Our policy “Escalation Policy and Procedure applies [see Appendix 7].


4. Promoting conciliation and

settlement


This chapter has guidance for Investigators about:

our statutory obligations and powers in relation to promoting

conciliation and settlements between complainants and respondents

assessing the potential for a settlement

providing guidance to the parties about possible settlement outcomes

preparing for settlement conferences

drafting settlement agreements.

Overview

One of our key statutory functions is to act as “conciliator” in relation to anything that is or

appears to be an interference with privacy (section 69(1)(b)).

We are therefore always trying – before, during and after any investigation – to reach a

resolution of the complaint through some form of settlement.

We need to be very clear with the respondent about what we are doing and why, including

addressing questions they may have about whether settling implies the matter has

substance.

OUR SETTLEMENT TARGET:

We aim to settle 50 percent of all complaints


Conciliation and settlement: Our statutory obligations and

powers

Power to encourage a settlement

Consider whether settlement may be possible, either after considering the complaint alone,

or after the respondent has come back to us in writing. If we think it may be possible, we

may use our “best endeavours” to achieve a settlement (section 74).

What the Act says: Section 74, “Settlement of complaints”

Where it appears from a complaint, or any written response made in relation to a

complaint under section 73(b)(ii), that it may be possible to secure a settlement

between any of the parties concerned and, if appropriate, a satisfactory assurance

against the repetition of any action that is the subject matter of the complaint or the

doing of further actions of a similar kind by the person concerned, the Commissioner

may, without investigating the complaint or, as the case may be, investigating the

complaint further, use his or her best endeavours to secure such a settlement and

assurance.

Obligation to promote settlement if a complaint has substance

After the investigation, if we’ve concluded that the complaint has substance, we must use

“best endeavours” to try to achieve a settlement, and we may try to get an assurance from

the respondent against any repetition (section 77).

What the Act says: Section 77, “Procedure after investigation”

(1) Where the Commissioner, after making any investigation under this Part, is of the

opinion,—

(a) in the case of a complaint, that the complaint has substance, the

Commissioner shall use his or her best endeavours to secure a settlement

between any parties concerned and, if the Commissioner considers it

appropriate, a satisfactory assurance against the repetition of any action

that was the subject matter of the investigation or the doing of further

actions of a similar kind by the person concerned; or

(b) in any other case, that the matter ought to be proceeded with, the

Commissioner shall use his or her best endeavours to secure such an

assurance as is referred to in paragraph (a).


What does the “best endeavours” standard require of us?

The High Court has treated the “best endeavours” standard as being the same as

“reasonable endeavours” (see below).

“A best endeavours obligation is a substantial one, reflecting the importance that the

legislation attaches to settlement, but it also recognises that there is no single correct

approach. There is much room for subjective judgement about how and when to

promote settlement, and each case depends on its facts. … I think it appropriate to

approach the issue by asking, as [the Commissioner] invited me to do, whether a

reasonable Commissioner could have conducted herself as the Commissioner did

here. That approach assumes that best endeavours is synonymous with reasonable

endeavours, which need not be correct, but the assumption favours the Commissioner

and I do not think anything turns on the distinction.”

Henderson v Privacy Commissioner [2010] NZHC 554 at [98]

The High Court found in that case the Commissioner did not use best endeavours to settle

the complaint, and could not have reasonably concluded that she was unable to secure a

settlement when it was referred to the Director of Proceedings. The Commissioner had

failed to advise the respondent of both an invitation to settle and a substantive settlement

offer made by the complainant, and did not consider calling a compulsory conference

under s 76.

Promoting conciliation from the outset

As the High Court noted in the Henderson case, the scheme of the Privacy Act’s

complaints provisions requires us, from the very beginning of the complaints process, to be

proactive in trying to resolve the complaint through conciliation.

“… the Commissioner must be alert to the possibility that the parties may be willing to

settle at an early stage, before the complaint has been investigated and before the

Commissioner is able to offer any guidance on the merits; an obligation to promote

conciliation and settlement arises at the outset.”


In line with that principle, we place a lot of emphasis on early complaint resolution and

settlement. Our aim is to settle complaints, if appropriate, after we’ve made an initial

assessment and contacted the parties to clarify the issues.

In particular, a key question the Investigator will need to ask of the complainant very early

on is what would resolve the complaint for them.


Tools we can use to try to reach a settlement

There are several tools we can use to promote settlement of a complaint:

1. First teleconference with the complainant and respondent

2. Case management conference

3. Power to call compulsory conference

The Privacy Act gives us the power, under s 76, to call a compulsory conference of the

parties, in order to try to resolve the dispute.

We do not invoke this power when we convene a case conference at the start of an

investigation. Case conferences are held (usually by telephone) to clarify the issues in a

dispute and work out a process and timetable for our investigation. There should usually

be a case conference within two weeks of our notification of the start of the investigation.

For more about case conferences, see page 67 of this Manual.

What the Act says: Section 76, “Compulsory conferences”

(1) The Commissioner may call a conference of the parties to a complaint by—

(a) posting to each of them a notice requesting their attendance at a time and

place specified; or

(b) such other means as is agreed to by the parties concerned.

(2) The objectives of the conference shall be—

(a) to identify the matters in issue between the parties; and

(b) to try to obtain agreement between the parties on the resolution of those

matters.

(3) Where a person fails to comply with a request under subsection (1) to attend a

conference, the Commissioner may issue a summons requiring the person to

attend a conference at a time and place to be specified in the summons.

(4) Section 159 of the Criminal Procedure Act 2011 applies to a summons under this

section as if it were a witness summons issued under that section.

Settlements and “party autonomy”: It’s up to them

It’s up to the complainant to decide what will resolve their complaint. We can make

suggestions – such as an apology, a change in the respondent’s processes, or

compensation – but we can’t require a complainant, or a respondent, to agree to any

particular settlement.


If after the investigation we conclude that the complaint has substance, we’re then required

by the Privacy Act to use best endeavours to secure a settlement, even if we think it would

otherwise be appropriate to refer the case to the Director of Human Rights Proceedings:

see page 83 of this Manual.

“The legislation … recognises party autonomy, in that the parties may settle a

complaint and the Commissioner must encourage them to do so, whether or not [the

Commissioner] sees the complaint as a good opportunity to establish a precedent.”


Assessing the potential for a settlement

Complaints tend to be much easier to settle at this early stage and there is often a real

willingness to resolve them on the part of both sides. Generally, complaints about access

requests are the most amenable to resolution at this stage, but most types of complaints

are potentially open to being settled early on.

In particular, an early settlement may be possible if the complaint is similar to one we have

previously investigated. We can explain to the parties the outcome of that complaint and

then, depending on that outcome, the complainant may tell us they don’t want to continue

or the respondent agency may realise they have to accept liability and try to settle.

Some complaints simply won’t be amenable to early settlement, even if the complaint itself

seems to be a relatively minor matter.

This can depend on various factors, but often the indicators would include:

a complaint where the parties’ views and expectations are at opposite ends of the

spectrum

a complainant with unrealistic expectations about the level of a monetary settlement

a respondent that is unwilling to accept and recognise a breach.

Giving guidance to the parties and managing expectations

The Investigator’s role includes managing the expectations of both sides in order to

achieve a resolution that is acceptable to both. This process may include telephone

diplomacy and negotiation, or face-to-face conciliation where the Investigator meets with

both parties or meets with each of them separately.

The Investigator should have an overview of what would be a reasonable outcome in the

context of the parties’ expectations. We’re not obliged to support any unreasonable

expectations that a party might have.


It’s appropriate at all points of the process to provide the parties with reality checks about

the effect of the law, the limitations of our process, and the potential consequences if a

complaint isn’t resolved through our process.

Specific settlement measures

Settlements will often include:

an apology

an assurance that the breach won’t be repeated

a promise to take action, like training staff and adopting privacy policies

money, goods, services or other remediation

an agreement to release information.

However, although those are common types of settlement outcomes, we’ve also seen a

wide and creative range of measures over the years – for example, flowers, gift baskets

and, in one case, an overseas holiday for the complainant and their partner. It’s a matter of

what will resolve the complaint for the particular complainant and respondent. (See Roth at

PVA74.5 of Privacy Law and Practice for examples of settlements.)

The power of an apology

It’s hard to overstate the significance that an apology can often have for

complainants. If given in good faith and taken by the complainant to be

genuine, it can go a very long way to resolving a dispute for them, by

demonstrating to the complainant that their problem has been taken

seriously and that the respondent agency will take real steps to prevent any

repetition.

Giving guidance on financial settlement amounts

Although conciliation usually doesn’t involve a financial settlement, we’re often asked by

the parties what would be an appropriate financial settlement for a particular complaint.

We don’t give detailed guidance, as conciliation is about the parties’ deciding what will

resolve the complaint for them. It’s also in the nature of privacy breaches that they vary

widely, depending on the particular case, so it’s difficult to assign a dollar figure to any

particular breach. However, we can give the parties examples of specific settlements and

the type or level of breach or harm in each case.


The amount of any settlement, or the specific settlement outcome if it’s a

non-monetary settlement, will be included in the Objective metadata for

each complaint.

Guidance from Tribunal awards

Awards in the Human Right Review Tribunal will give some guidance about appropriate

settlement awards. You can read a useful 2015 LawTalk article about Tribunal awards,

including a table of awards from 2012 to 2015, at:

www.lawsociety.org.nz/lawtalk/issue-879/the-human-rights-review-tribunal,-

employment-institutions-and-the-adequacy-of-remedies

For a useful discussion of Tribunal awards and relevant principles, see Hammond v Credit

Union Baywide [2015] NZHRRT 6.

Preparing for a settlement conference

Be absolutely clear about where we are with the complaint. Have we completed our

investigation? Are we satisfied we have all the information we need? Or are we still open

minded, and prepared to investigate further? Is the process designed to elicit information

for our investigation (eg the level and nature of harm).

Here are some other questions for you to consider when you’re preparing for a settlement

conference:

Process issues

Does the conference need to be in person, or would by phone be just as good or

better?

Are there any barriers to communication? Do we need an interpreter or other

assistance?

Does the complainant need a support person? Will the numbers on each side of the

table be equal?

Is the venue neutral and mutual? Are there breakout rooms? Will there be tea, coffee,

water? Is parking available?

Have you allowed plenty of time for the meeting? Better to book three hours and finish

early than run out of time drafting an agreement.

http://www.lawsociety.org.nz/lawtalk/issue-879/the-human-rights-review-tribunal,-employment-institutions-and-the-adequacy-of-remedies

http://www.lawsociety.org.nz/lawtalk/issue-879/the-human-rights-review-tribunal,-employment-institutions-and-the-adequacy-of-remedies


Preparing the parties for the conference

Are the parties and you the Investigator all in agreement about what is in dispute?

Would it be useful to prepare a statement of agreed facts and details before the

conference?

Do the parties have a shared understanding of the purpose of the meeting?

Have the parties each been sent an “expectation” letter? (These letters should set out:

the date, time and venue for the meeting; who will attend; the purpose of the

conference; what will happen at the conference; some ground rules for how it will run,

like taking turns to speak and not interrupting.)

Does the respondent have authority to settle?

Is the respondent ready to talk about policies or procedures?

Does the complainant need to bring evidence of harm?

Preparing yourself

What approach will you use for the conference? Is one person going to lead the

conversation or will you use some alternative model?

Do you know the file frontwards and backwards?

Have you looked at similar complaint settlement outcomes?

Can you use case notes or tribunal decisions to guide the parties towards each other?

Do you have a draft settlement agreement ready to go?

Do you have all the evidence needed to make a finding or reach a settlement?

You can also find a more detailed checklist in Appendix 3 of this Manual

(see page 95). This covers: preparing for the conference, the process at the

conference itself, and tasks to be done after the conference.

Drafting a settlement agreement

It is important that a settlement agreement between the parties is clear, covers all of the

issues, and accurately reflects what both parties want. The checklist below includes some

guiding principles to help ensure that settlements facilitated by the Investigator are

effective.

Agreements should be “SMART”:

Specific

Measurable


Achievable

Relevant

Time-bound.

Some key questions for ensuring the agreement is “SMART”:

Are the parties correctly identified?

Does the agreement only contain relevant information?

Is the agreement dated?

Is the agreement signed?

Each conciliation or settlement conference will be different, and the needs of the parties

will vary. This means the level of involvement required from the Investigator in helping the

parties draft an agreement will depend on a case by case assessment of their relationship

with each other, their relative vulnerability, and their general ability to clearly and

accurately express themselves. Some further questions to consider:

Who is responsible for drafting the agreement?

- the conciliator?

- the advocates?

- the parties themselves?

Should the agreement be witnessed by the conciliator?

Will there be any follow-up by the conciliator after the agreement has been signed?

Appendix 3 includes a further checklist for settlement agreements – see

page Error! Bookmark not defined., “Checklist for written settlement

agreements”. This is broken down for agreements that are intended to be

legally enforceable and those that are not (protocols of behaviour or future

interactions for example). We have no role in enforcing settlement

agreements, nor does the Human Rights Review Tribunal. Rather,

settlement agreements are enforceable as contracts.

54

Notify the result of the investigation (s 75)

Consider referral to DHRP if no settlement (s 77(2))

Must try to settle if complaint has substance (s 77(1)(a)

May try to settle complaint (s 74)

Ask agency for comment if you find a breach (s 120)

Notify the parties before investigating (s 73(b))

Investigate with “due expedition” (s 75)

Key legal checkpoints for your investigation: Before, during and after

Investigation begins

Investigation ends

File is closed

Determine if complaint has substance


5. Investigating a complaint From the “pink” assessment form, to making a

decision


This chapter of the Manual provides Investigators with guidance in carrying

out an investigation, including:

the overall framework for investigations, including the key legal

checkpoints and our investigative approach given that statutory context

completing our internal Complaint Assessment form (the “pink”)

the boundary between making preliminary enquiries and investigating

notifying the parties that we intend to investigate

case conferences

guidance around the issues of breach and harm

when to invite comments from the parties, including the “adverse

comment” rule

discontinuing an investigation under section 71

file management and record-keeping.

The framework for your investigation

Key legal checkpoints

Notification

As soon as practicable after we decide to investigate, notify the complainant and

respondent of this and explain what our investigation process is going to be (section

70(2), 73).


Respondent’s right to respond

Provide the respondent agency with an opportunity to give a written response to the

complaint within a reasonable time (section 73(b)(ii)).

Promoting conciliation and settlement

Consider whether settlement may be possible - both before and after you get a

response from the respondent agency.

If we think it may be possible, we may use “best endeavours” to settle the complaint

(section 74).

Investigating with “due expedition” (proper speed)

Conduct the investigation with “due expedition” (section 75).

Respondent’s right to be heard before any “adverse comment”

If you find that the complaint has substance, you must give the respondent a chance

to respond to this before you reach a final view and notify the parties under

(section 120).

Tailoring the process to the particular case

The Privacy Act gives investigators a significant amount of autonomy in handling

complaints. Rather than a large number of detailed procedural rules, there are instead a

relatively small number of significant legal checkpoints and boundaries – such as the

requirement to formally notify the parties before any investigation (see above,

“Introduction: Key legal checkpoints”).

Subject to those checkpoints and boundaries, our Investigators are empowered to make

enquiries and reach conclusions about whether there has been an interference with

privacy. The Commissioner expects them to exercise discretion, to tailor their investigation

to what is needed to resolve the particular case, and to seek guidance from senior staff

when necessary.

Although the Investigator should tailor the process to the needs of resolving the particular

complaint, there should be some default steps in the process. For example, a case

conference should normally be held by telephone early on to clarify the disputed issues

and work out a process and timetable for our investigation.


Investigating with proper speed (“due expedition”)

What the Act says: Section 75

Where any investigation is made following a complaint, the Commissioner shall

conduct the investigation with due expedition ….

What does the “due expedition” rule require of us?

In everyday language, “due expedition” means we should investigate with something like

“proper speed” or “appropriate speed”. (“Expedition” is defined in the Concise Oxford

Dictionary as “promptness or speed”, and “due” is defined as “proper; appropriate”.)

Clearly, our obligation here includes avoiding unnecessary delays. It implies that, in any

particular case, there must be a reason for each action or step in our investigation process,

including where the investigation effectively halts because we’ve invited a written response

by a certain date. (For more guidance on this point, including on applying the “adverse

comment” rule in section 120, see page 72 of this Manual.)

Keeping control of the investigation process

It’s important that, as the Investigator, you take and keep control of the investigation. You

should ensure that the parties respond in good time and keep to timetables set at case

conferences.

But you also need to be aware of the administrative realities for large agencies – a

response from them may need to go through four different sign-off levels before it can get

to us.

The existence of the statutory “due expedition” requirement may sometimes provide a

useful lever to use against respondents who drag their feet in providing information or

comment. You can emphasise to them that the law requires our investigations to happen

within a reasonable time.

Breach and harm: Investigating them concurrently

When you investigate whether there has been an interference with privacy and harm is a

necessary element, you should investigate the two necessary elements concurrently:

Did the respondent agency breach an information privacy principle or rule?

Has the complainant suffered harm as a result of that breach?

In the past we have sometimes separated these two inquiries – that is, we enquired about

harm only if we’d first concluded that there’d been a breach. At that point we would write to

the complainant telling them we’d found a breach and asking what harmful consequences

they’ve suffered.


Instead, where harm is a necessary element we should always have a conversation about

harm as early as possible. This ensures we have the information we need to form a full

view on the complaint early in the investigation. The complainant may need to supply

evidence later to back up the nature and quantum of the remedy.

Burden of proof

The Act requires the Privacy Commissioner to form an opinion on whether the complaint

has substance, including whether an available exception excuses any breach. The Act

doesn’t assign any evidentiary burden to a particular party, and the High Court has held

specifically that the respondent does not have the burden of establishing that an exception

applies (see Henderson v Privacy Commissioner [2010] NZHC 554).

However, if we ask a respondent agency for evidence of their assertion that an exception

applies, but they refuse to engage with us or don’t give us the information, we’re entitled to

form a conclusion on the basis of the information we have. If in that case we find that the

alleged action or omission did occur, but we have insufficient information to conclude that

an exception applies, then we are entitled to conclude that there has been a breach.


Settlem

Case conference, 2 weeks after

notification (s 76) Settlement

Flowchart

Complete the Complaint

Assessment form (“the Pink”)

Finding: Complaint has

substance

Assess facts & parties’ responses;

Form a view

Finding: Complaint doesn’t

have substance

Investigation: Fact-finding &

gathering information

Assess response,

form a final view

Give the respondent a chance to comment

in writing (s 120)

Parties provide information as agreed

at case conference

Phone the complainant to tell

them your finding

Notify your decision (s 75)

Close the file

Notify parties of start of investigation

(s 73)

Contact parties to clarify complaint as

necessary

Notify your decision (s 75)

Close the file

Complainant has further comments / information to add

Complainant has no further comments / information to add


Completing the Complaint Assessment form (“The pink”)

Summary

When a complaint is assigned to an Investigator, their first step is to complete our internal

Complaint Assessment sheet – informally, we usually call this “the pink”.

Purpose of the Complaint Assessment form

The purpose of completing the pink Complaint Assessment form is to:

record an initial summary and assessment of the complaint

develop and record a plan for investigating the complaint

provide the Team Manager (and, in the most complex cases, the Privacy

Commissioner and the Assistant Commissioner (Policy & Operations)) with an

opportunity to review the assessment and investigation plan and test the Investigator’s

intended approach.

What information to include on the form

Summary of the complaint – Include the basic facts of the complaint, including any

relevant dates, and what the complainant is unhappy about. In general, a 5-10 line

summary of the complaint will be appropriate here, so that the Team Manager, more

senior managers, and any other investigative staff who work on the complaint later on

will be able to see a brief but reasonably complete summary of what it’s about. A

single sentence will usually not be enough here.

Relevant principles – Identify the principles or rules to be applied. If these are

agreed to by the Team Manager, these should then be reflected in the notification

letter, and they will ultimately determine the Tribunal’s jurisdiction.

Investigative plan – Propose what investigative action you think is appropriate. For

example, do we need more information? If so, what information? Or is the complaint

ready for notifying the respondent agency? This is also a useful place to record any

early thoughts about settlement opportunities.


Just what do you think you’re doing –

Preliminary enquiries, or an investigation?

If you’re an Investigator making preliminary

enquiries about a complaint, be careful that your enquiries

don’t slide over into investigating whether there has in fact been

an interference with privacy in this particular case – particularly when you’re

making early phone contact with the respondent. Remember we have an

important statutory obligation to formally notify the respondent and

complainant before we begin any investigation.

The following section explains what does and what doesn’t amount to

“investigating” a complaint.

The most important thing is being clear with parties about what we are doing and what they can expect.

Investigating vs enquiries/conciliation: Telling the

difference

Because we have a statutory obligation to notify the parties before we start any

investigation, it’s important to be clear about exactly what does and what doesn’t amount

to “investigating” a complaint.

The boundary between preliminary enquiries and investigating

Whenever we receive a complaint, the rostered Team member may need to make some

preliminary enquiries as part of their initial screening of the complaint, to find out whether

it’s within our jurisdiction and to establish whether we can and should decline to investigate

(see page 21). After a complaint goes to an Investigator, the Investigator may also still

need to make some enquiries before they can investigate, as certain gaps or uncertainties

may have become apparent when they completed the Complaint Assessment form (“the

pink”). The Investigator will also be looking to see if the complaint can be resolved.

The preliminary enquiries may therefore include:

clarifying with the complainant exactly what they’re alleging, including what harm, if

any, they claim to have suffered

finding out exactly who the respondent is, and whether they’re an “agency” within the

terms of the Privacy Act

finding out what practical outcome the complainant wants


finding out from both the complainant and the respondent about their willingness – or

not – to settle the complaint.

However, you are likely to be verging into an investigation if you:

invite a response from the respondent about the substance of the complaint

assess comments from the respondent about the substance of the complaint

seek and receive information from a third party who may know something about the

relevant incident.

You will need to apply careful judgment in pursuing any of these steps. Generally, it is not

good practice to carry out any of those actions without first formally notifying the

respondent agency in writing that we’re going to investigate. The risk is that if you go

ahead without notifying the respondent agency, we may been in breach of our statutory

requirements.

Conciliating vs investigating

Early discussions with the two sides for the purpose of trying to resolve the dispute are

central to our role. Here we’re carrying out our statutory function as a conciliator

(section 69(1)(b)), as opposed to our investigator function (69(1)(a)).

However, it’s important to make it clear in your discussions with the parties that at this

point you’re not in fact investigating, and that both sides will be formally notified in writing

before we begin any investigation.

In particular, you should be clear when talking to the respondent that you’re not asking

them to respond to the substance of the complaint, and are merely asking the two parties

to settle the complaint between themselves at this stage. The purpose here is to say to the

respondent, in effect:

“This is what the complainant is saying has happened, and this is what they want.

Is it possible to resolve this between you?”

These early attempts at dispute resolution can be very productive. It may be the agency

has simply overlooked responding to the complainant and is eager to fix this. Or it may be

that they’re less than eager but will nevertheless begrudgingly give the complainant what

they want now that they’ve received a phone call from our office.

Identify the complainant and person alleged to be aggrieved

Before notifying, it is important to identify if the complainant is also the person alleged to be

aggrieved. The person alleged to be aggrieved does not have to be the complainant. It is

an important point to clarify, as both the complainant, the person alleged to be aggrieved

and the person to whom the investigation relates (the respondent) must be notified.

“Because s 73(b) requires the Privacy Commissioner to inform the person to whom the

investigation relates of details of the complaint or the subject matter of the investigation, the

Commissioner must necessarily first identify the complainant and the person alleged to be

aggrieved (if that person is not also the complainant) because at the complaint stage the


complainant and the individual alleged to be aggrieved do not have to be the same person

(though they often are). It is also possible for a complainant who is making a complaint on

behalf of the person alleged to be aggrieved to be at the same time an aggrieved person in

his or her own right. This would most commonly occur where, for example, one spouse or

partner might lodge a complaint on behalf of him or herself as well as the other partner; or

where a parent or guardian makes a complaint in his or her own right but also on behalf of his

or her child or guardian.

While conceptually it is not difficult to envisage a circumstances in which a person may at the

same time be a complainant for a third party as well as a person aggrieved, care must be

exercised to ensure the difference in roles is given due recognition throughout the statutory

process in Part 8. In particular:

Section 73(b)(i) and (ii) necessarily require that the person to whom the investigation

relates not only details of the complainant but also who the complainant is and if the

complainant is different to the individual alleged to be aggrieved, the identity of the

allegedly aggrieved individual. Otherwise, the person to whom the investigation

relates is not given adequate “details of the complaint” or, as the case may be, the

“subject matter” of the investigation.

If the person making the complaint and the third party are both persons aggrieved,

the person to whom the investigation relates is entitled to have this particularised so

that the opportunity to be heard mandated by ss73 and the other provisions of Part 8

is an effective opportunity to deal with both complaints.”

Edwards v Capital and Coast DHB (Strike-Out Application) [2016] NZHRRT 20, [63].

Notification: Telling the parties you’re going to investigate

Who does this:

The Investigator handling the complaint. In complaints involving principle 6, this may be

done by the Team Secretary.

What the Act says: Section 73, “Proceedings of Commissioner”

Before proceeding to investigate any matter under this Part, the Commissioner –

(a) shall inform the complainant (if any), the person to whom the investigation

relates, and any individual alleged to be aggrieved (if not the complainant), of the

Commissioner’s intention to make the investigation; and

(b) shall inform the person to whom the investigation relates of –

(i) the details of the complaint (if any) or, as the case may be, the subject

matter of the investigation; and

(ii) the right of that person to submit to the Commissioner, within a reasonable

time, a written response in relation to the complaint or, as the case may be,

the subject matter of the investigation.


Form of notification: In writing

You must notify the respondent in writing. Although the Privacy Act doesn’t specifically

require notification to be in writing, you are required to do this as a matter of internal

administrative practice.

This creates a clear written record that the respondent agency was notified, and exactly

what they were notified of. This may be significant if the complaint leads later to Tribunal

proceedings and the respondent agency disputes the Tribunal’s jurisdiction on the ground

that they were not properly notified of the complaint and our investigation into it.

Written notification can be by letter or email, but in either case the correspondence must

be saved into Objective.

Using the notification template letters

Template letters for notifying the parties can be found at:

- Notifications.obr

Notification by email

We notify major agencies by email and would encourage investigators to email respondent

agencies where practicable.

We have a standard covering email that we send, and the notification letter is sent as an

attachment to that email. The covering email is included as Appendix 2 of this Manual (see

page 90).

What amounts to “notification”

Your notification letter to the respondent agency should:

tell them that a complaint has been made

tell them who the complainant is and, if the complainant is different to the individual

alleged to be aggrieved, the identity of the allegedly aggrieved individual

tell them what events we are investigating

tell them what privacy principles, or Code of Practice rules, are involved

ask them to respond in writing to the complaint

give them a reasonable time to respond to the complaint.

Notification must be precise

It’s not sufficient to inform the respondent in general terms that you’re investigating an

allegation against them of an interference with privacy. You must tell the respondent


precisely what actions or omissions the complaint relates to, including which privacy

principles or code rules may apply.

If after the respondent is notified our investigation reveals that a different – or additional –

principle or rule is relevant, then you must notify the respondent again under section 73(b).

Again, this must tell them they have the right to make a written response within a

reasonable time, and you must then consider that response (see DHRP [NKR] v ACC

[2014] NZHRRT 1, HRRT No 002/2012, at [29], [30]).

You should make sure that this further notification is made in separate correspondence. If

you combine a new notification with other matters, such as a preliminary view, it increases

the risk the issues will be lost or confused.

Notifying individual respondents as well as the principal agency

For more detailed guidance on this issue, see our Practice Note:

Notification (November 2014). The Practice Note also includes a suggested

wording for the notification letter.

It is for us to determine the appropriate respondent on a complaint. Usually, a respondent

organisation will be the best agency to notify. However, from time to time it may be

appropriate for us to also notify an individual employee, member or agent. It is important

that we identify this early and make an appropriate decision about whether to notify an

individual in addition to an organisation. Our decision will have an impact on the

complainant’s ability to take proceedings against these agencies later. Whatever our

decision on the appropriate respondent, we must ensure that it is made very clear to the

complainant at the outset.

If you are in doubt about what to do, please seek further advice from your Team Manager

or from General Counsel.

The Human Rights Review Tribunal has ruled that if we don’t notify the individual, that

person can’t be a respondent in any later Tribunal proceedings.

“… no action can be taken by an aggrieved individual [against an individual employee]

unless the employee … has been the subject of an investigation as contemplated …

under s 82(1)(a).

We are not willing to accept that a person who has not been given notice that he or

she is personally at risk in an investigation, before the investigation is carried out, can

be said to have been the subject of that investigation. …


We are not willing to regard employees of an agency that is investigated as falling

within s 82(1)(a) of the Act just because they happen to have been the employees who

were (at least to some extent) involved in the matter.”

Duffy v Drury No 30/09, Ref no HRRT 33/08, at [16], [17], [20]

(See also DHRP [NKR] v ACC [2014] NZHRRT 1, No HRRT 002/2012 at [29])

Why it’s important to get it right

Failing to notify the respondent so that Tribunal proceedings can’t be taken against

them may be unfair to the complainant, denying them a remedy they would otherwise

be entitled to.

The Privacy Act regime can be brought into disrepute if technical legal issues allow

people to get away with privacy breaches.

It may mean significant inefficiencies and delays in the legal process – for example,

the Director of Human Rights Proceedings may already have spent significant time on

the file, or time in the Tribunal may be taken up with debates about jurisdiction.

Triggers for notifying individual respondents as well as the principal agency

Factors alerting us that we may need to also notify an individual include:

cases of employees browsing through the employer organisation’s databases, or other

intentional misuse or unauthorised access

where the organisation may be able to argue it did all it reasonably could to avoid a

breach

where the actions complained about were those of a contractor (here there may be

questions about the scope of the contract, and whether and to what extent the

contractor was acting as agent)

where the respondent is a “fragile” company – that is, there’s a risk this agency will

rearrange its ownership or go out of business to try to avoid litigation (for example,

there’s a history of ownership changes due to insolvency or other risk factors).

What we have to tell the individual

Your notification letter to the individual respondent should:

tell them that a complaint has been made

tell them what events we are investigating

tell them what privacy principles, or Code of Practice rules, are involved

tell them that they may be personally liable

ask them to respond in writing to the complaint

give them a reasonable time to respond to the complaint.


Case conferences

An early case conference is a default step

There should usually be a case conference involving the

complainant, the respondent and the Investigator within two

weeks after notification of the start of the investigation.

Purpose of a case conference

The purpose of a case conference is to ensure all parties have:

a clear and common understanding of process and of the timing for various steps in

the process, and

equivalent expectations of each other and of the Office of the Privacy

Commissioner.

A case conference may also help to clarify the disputed issues, and enable parties to work

out how to resolve the issues.

However, in large part a case conference is a timetabling exercise. The conference may

establish that, for example, by a particular date the complainant will provide the

Investigator with additional information, by a particular date the respondent agency will

give the Investigator the result of its internal review of the relevant incident, and that by a

particular date the Investigator will make his or her decision.

The case conference is therefore not intended to achieve a resolution of the complaint by

itself, although the Investigator should be alert to any possibility of that happening. Instead

it’s intended to work out a path to resolving it. Each party should leave the conference with

a clear understanding of the investigation process, and also some sense of ownership of it.

A case conference is different from a “compulsory conference”. These are called under our

statutory power in section 76, and their main objective is to try to resolve the dispute. (For

compulsory conferences, see page 48 of this Manual.)

Format for case conference

Case conferences will normally be by telephone. However, we can – and increasingly will –

use video-conferencing technology to hold case conferences.

You may find it helpful to go through some of the information in the Initial Call Checklist

with the parties at the start of the case conference, to remind the parties about the nature

of your role and key aspects of the complaints and investigation processes: for this

checklist, see Appendix 1 of this Manual, at page 88.


Was there a breach? – Key questions, principle by

principle

Here is a list of some of the questions you may need to ask in relation to each privacy

principle.

Principle 1 – Purpose of collection

Was any information collected?

What was the purpose of collecting the information?

Is the purpose unlawful? (For example; was information collected for the purpose of

discriminating under the Human Rights Act?)

Is the purpose connected with a function or activity of the agency?

Is the collection necessary to achieve the purpose?

Principle 2 – Source of the information

Was any information collected from someone other than the individual?

If so, do any of the exceptions apply?

Does the agency have a belief on reasonable grounds, as is necessary for each

exception?

Principle 3 – What the person must be told when information is collected

from them

Was the information in fact collected? It may be that the information was sought but

not collected (see AB v ACC [2002] HRRT 17).

Was the information collected directly from the complainant?

What was the complainant told about the purpose of collecting the information?

If the complainant wasn’t notified at the time the information was collected, were they

told as soon as practicable afterwards? (See principle 3(2))

Principle 4 – Manner of collection

Was any information collected?

Were the means unlawful?

- Is the action regulated by law?

Were the means unfair?

- For example, was the complainant misled about the purpose, the intended

recipients and so on?


Were the means unreasonably intrusive?

- Consider whether the circumstances justified the means in this case.

Note: Principles 1 to 4 don’t apply to unsolicited information. However,

once an agency holds information, even if unsolicited, the information is

subject to the principles about storage, accuracy, use and disclosure

(Principles 5 and 8 – 11).

Principle 5 – Storage and security

What type of information does the agency hold? Is it particularly sensitive information?

What sorts of security steps are reasonable for that type of information? For example,

is special staff training necessary?

Did the agency take those reasonable steps?

Does the agency have policies, procedures or training programmes in place? Were

they followed in this case?

Principle 6 – Access

Did the agency respond within 20 working days, and was the response a decision on

the request?

Did the agency comply with the procedural requirements in Part 5?

If information was withheld, was it legitimately withheld under any of section 27 to 29?

Was a charge levied? (Public-sector agencies cannot charge: section 35). If it’s a

private agency, was the charge reasonable? (See section 35(5), and HIPC, clause 6)

Access complaints: Check the requested information yourself

If information has been withheld, you must obtain the

information from the respondent agency and review the

information yourself, to establish whether it’s been withheld

justifiably. In these cases you can’t just take the agency’s word for it.


Principle 7 – Correction

Did the complainant ask for information to be corrected?

If yes, what was the agency’s response?

If the agency refused to make the change sought, has the complainant prepared a

statement to be attached to the information?

Principle 8 – Checking accuracy and so on before use

Has the agency taken steps to ensure that the information is accurate and so on

before using or disclosing it?

Were the agency’s steps reasonable in the circumstance? (Note that the agency will

not necessarily be in breach merely because it held or used incorrect information.)

Is the complaint about a process or decision, rather than the information itself?

“The language of Principle 8 makes it clear that the more serious the potential

consequences of using the personal information held by the agency, the greater the

degree of care which must be exercised before the information is used.” (emphasis in

original)

Taylor v Orcon Ltd [2015] NZHRRT 15, No 022/2014, at [46]

Principle 9 – How long information may be held for

Does the agency still hold the information?

Does it have a lawful purpose for continuing to hold the information?

Principle 10 – Limits on using information for different purpose

What was the purpose for which the information was collected?

Has the individual authorised it being used for another purpose?

Does an exception apply?

Is there a directly related purpose?

- For a purpose to be “directly related” to the original purpose it must have an

uninterrupted and immediate relationship to the original purpose: see Director

of Human Rights Proceedings v Crampton [2015] NZHRRT 35 at [86] to [92]

and Boyce v Westpac New Zealand Ltd [2015] NZHRRT 41 at [60]


Principle 11 – Limits on disclosure

What was disclosed?

Who was it disclosed to?

Did the recipient already have the information?

When, why, how and where was the information disclosed?

Are there witnesses? Can they provide any useful further information about what

happened?

- If you’re interviewing a witness, you need to be careful not to disclose

information yourself unnecessarily – don’t tell the witness everything you

know. However, sometimes you will need to disclose information to get

information.

If information was disclosed, does an exception apply?

Principle 12 – Unique identifiers

Has the agency assigned a unique identifier to the complainant?

Has the agency required or used another agency’s unique identifier to identify the

complainant?

Was there harm?

In cases where harm is a necessary element for any interference with privacy, you’ll need

to ask:

has the complainant suffered any harm?

was the breach (if there was one) a contributing cause of the harm?

Has the complainant suffered harm?

If there has been a breach of principles 1 – 5 or 8 – 12, there will be an interference with

privacy only if the complainant has suffered a type of harm described in section 66(1)(b)

(see below).

In those cases, we will therefore need to get the complainant to tell us what harm has

resulted, or may result, from the alleged breach.


[As well as a breach, section 66(1) requires the following for an interference with

privacy to exist:]


(b) in the opinion of the Commissioner or, as the case may be, the Tribunal, the

action –

(i) has caused, or may cause, loss, detriment, damage, or injury to that

individual; or

(ii) has adversely affected, or may adversely affect, the rights, benefits,

privileges, obligations, or interests of that individual; or

(iii) has resulted in, or may result in, significant humiliation, significant loss of

dignity, or significant injury to the feelings of that individual.

Did the breach cause the harm?

The breach must have caused the harm. However, it doesn’t have to be the only cause, or

even the main cause, of the harm – it simply has to be a contributing or material cause.

The Tribunal on harm and causation:

Was the breach a “contributing or “material” cause?

“Given these factors a plaintiff claiming an interference with privacy must show the

defendant’s act or omission was a contributing cause in the sense that it constituted a

material cause. The concept of materiality denotes that the act or omission must have

had (or may have) a real influence on the occurrence (or possible occurrence) of the

particular form of harm. The act or omission must make (or may make) more than a de

minimis or trivial contribution to the occurrence (or possible occurrence) of the loss. It

is not necessary for the cause to be the sole cause, main cause, direct cause, indirect

cause or ‘but for’ cause. No form of words will ultimately provide an automatic answer

to what is essentially a broad judgment.”

Taylor v Orcon Ltd [2015] NZHRRT 15, No 022/2014, at [61]

What standard of evidence should a complainant provide in relation to harm?

1. Threshold: low standard to pass initial threshold for harm. What is the ‘vibe’?

2. Quantum: medium – high standard to justify quantum. A respondent will need to be

able to justify the expenditure to shareholders, senior management or Ministers.

Therefore the evidence is needed to support a claim – particularly when it is a large

amount.)


Inviting comment from the parties: When and how

Investigators need to exercise judgement about whether it’s necessary to invite a written

response from a party on a particular issue. This shouldn’t be a standard, reflex step

whenever we, for example, first come to a view about whether a complaint has substance.

Instead you’ll need to consider the needs of the particular case, and what the Act and the

principles of public-law fairness require in that situation. This section of the Manual gives

guidance on these questions.

Key points

In general, you should invite a written response only if:

you need more information, or

you’ve made assumptions and you need to check that these assumptions are correct,

or

you anticipate making an adverse comment about that party.

If we’ve found that a respondent agency has breached the Privacy Act the statutory

“adverse comment” rule will require us to present this to them in writing as a provisional

view and to invite them to respond in writing within a reasonable time.

If we’ve reached a view that a complaint doesn’t have substance, the “adverse comment”

rule doesn’t apply. However, public-law principles of procedural fairness and natural justice

mean that we should usually phone the complainant to tell them we’ve come to this view.

Notifying a “prov” view

We have updated our practice around notifying a preliminary view. If we

have found an interference with privacy, then the “adverse comment” rule

requires us to give the respondent a chance to comment in writing before

we notify a final view. That rule does not require us to give a complainant a

separate opportunity to comment in writing. However, the investigator

should contact the complainant to let him or her know our opinion as that is

good practice and consistent with principles of natural justice.

The “adverse comment” rule: Its scope and effect

Summary

In the context of our investigations function, the effect of the statutory “adverse comment”

provision is that we must give a respondent a reasonable time to respond in writing if, after


investigating a complaint, our view is that the respondent has breached a privacy principle

or rule.

Usually the “adverse comment” rule won’t require us to give a complainant a similar

opportunity if we’ve found their complaint doesn’t have substance.

What the Act says: Section 120, “Adverse comment”

“The Commissioner shall not, in any report or statement made pursuant to this Act or

the Crown Entities Act 2004, make any comment that is adverse to any person unless

that person has been given an opportunity to be heard.”

Scope of the “adverse comment” rule: What statements does it apply to?

The scope of the adverse comment rule includes notifications, under section 75, of the

result of an investigation. This means that an Investigator cannot notify the parties of a

finding that the respondent has breached a privacy principle or rule unless the respondent

had been given the opportunity to respond to this potential finding.

The rule also applies to:

publishing general reports and case notes (section 13(2))

reports to the Prime Minister (section 13(1)(p), (r))

public statements about privacy issues (section 13(1)(h))

our Annual Report (section 24)

reports of a breach of duty or misconduct (section 80).

What makes a comment “adverse”?

A comment will not be “adverse” to someone simply because it goes against their interests

or rejects an allegation or legal argument that they’ve put forward:

A finding that a respondent agency has breached a privacy principle or rule is an

adverse comment.

A finding that a complaint has no substance is not of itself an adverse comment

against the complainant.

However, some additional or more specific comment about an unsuccessful

complainant could be an “adverse comment” – for example, if we told them we

believed they had intentionally lied to us.

Discharging our obligation under the “adverse comment” rule: What we have

to do

To discharge the “adverse comment” obligation, we should:

notify the party in writing of our provisional finding, including giving reasons for it


invite them to respond in writing

give them a reasonable time to respond – this should usually be 20 working days.

Setting a timeframe for a written response

Always ask for responses to be provided by a certain date. We usually say it should be

20 working days from the date of our letter.

Sometimes complainants will stress about this time limit. However, there is no statutory

requirement to respond within a particular period – this is an administrative matter for us,

and it’s therefore fine to give them an extension.

Any extension should, however, be for no more than a reasonable time. We can’t keep

files open indefinitely.

Public-law fairness: What it requires

Public-law principles of procedural fairness or natural justice require that our findings must

have a reasonable basis. Our investigation processes must therefore be reasonable, and

usually this will require us to inform the relevant party of our findings and the reasons for

them, and to give them a chance to comment (see Roth, Privacy Law and Practice, at

PVA75).

However, those natural justice steps don’t have to follow an inflexible format that is formal

and time-consuming. Usually formal written correspondence and a set response date won’t

be necessary – unless the statutory “adverse comment” rule also applies, as it will where

we’ve found a breach (see above). This means that, where we’ve found that a complaint

has no substance, it will usually be sufficient to have a phone conversation with the

complainant where we explain our decision and ask if they have any further to add in

response.

This will be a matter for the Investigator’s discretion. It will depend on the particular

complaint and complainant. You’ll need to consider whether the process has been fair to

both parties and whether the finding you’ve come to is sound.

Discontinuing under section 71

Discontinuing an investigation under section 71(1)

As well as being available before an investigation, section 71(1) can also be used to

discontinue an investigation after it has begun. The different limbs in 71(1) are discussed

from pages 28 to 34 of this Manual.

It may be that the further enquiries made during the investigation have shown that it’s

appropriate to discontinue on one of those grounds.


Also, section 71(1)(d) may come into play if the complainant decides not to pursue the

dispute (“the individual alleged to be aggrieved does not desire that action be taken or, as

the case may be, continued”). It may be that they’ve simply changed their mind. Or it may

be that they’ve decided not to pursue it in response to guidance from us that their

complaint, although within our jurisdiction, is unlikely to succeed because it’s covered by

an exception or we’ve made a finding on a similar case.

“Undesirable or unnecessary”: Discontinuing under section 71(2))


… the Commissioner may in his or her discretion decide not to take any further action

on a complaint if, in the course of the investigation of the complaint, it appears to the

Commissioner that, having regard to all the circumstances of the case, any further

action is unnecessary or inappropriate.

Examples

Section 71(2) may be invoked if, for example:

the complaint is settled

the complainant fails to respond to our routine investigative enquiries and the deadline

we gave the complainant for this has passed (in that case section 71(1)(d) may also

justify discontinuing the investigation)

the agency has made the complainant a reasonable offer but the complainant has

rejected it

resolving disputed facts would be difficult and time-consuming and to little advantage,

or resolving the facts may not even be possible at all.

Case notes 207201 (2010)

25347 (2003)

Notification under section 73 a precondition for using 71(2)

Section 71(2) can’t be used to discontinue an investigation and close the

file if the parties haven’t been notified under section 73 that there is going to

be an investigation. This is because section 71(2), unlike 71(1), only applies

after an investigation has already begun (“… if, in the course of the

investigation of the complaint …”).


Notification requirements if we discontinue

If we decide under section 71(1) or (2) to take no action or no further action, we must

inform the complainant of this and also give him or her reasons (section 71(3)).

You should do this in writing.

File management and record-keeping

Corresponding with the parties

Acknowledge all incoming mail.

If you’re writing to a prisoner, place the letter in a sealed envelope with a covering

letter to the prison manager, asking the manager to forward the sealed letter to that

prisoner. We have a template for these covering letters.

- Letter to prison manager.obr

These internal documents give some guidance on wording your letters:

- Complaints Style Guide.obr

Don’t copy correspondence from one party to the other

Sometimes we are asked by one party for a copy of correspondence

that we’ve received from the other party. We deny these requests,

relying on sections 55(e) and 116.

You should instead simply summarise the substance of the relevant

allegations and arguments from the first party. Here you should be careful

about exactly what you relay to the other party. For example, it would be

counterproductive to report a lengthy tirade from a complainant to the

respondent agency, where they might be making outrageous allegations.

Similarly, it would not be helpful to report to a complainant seeking access

to health information that the health provider believes that the complainant

has a personality disorder that makes them obsessive. Even if this is true,

it’s not relevant to the question of whether the complaint has substance,

and therefore not relevant to our investigation.


Managing your own filing system

Investigator’s are responsible for managing their own filing systems, including their

own reminder system for when a file is due to be reviewed or when a response is due.

Record-keeping and maintaining the file

During your investigation you must keep a record of all incoming and outgoing

correspondence, both on the hard-copy file and on the Objective file. Ideally, you

should file any correspondence on the Objective file immediately – this will ensure that

the Team Manager is looking at the most up-to-date version of the file.

All telephone conversations are to be entered on the files on the day of the call.

Sometimes it’s useful to do a file note explaining why you’ve followed a particular line

of inquiry. This would help any staff member subsequently assigned to the file to know

what information you were trying to get and why.

Maintaining the Objective metadata

The Investigator is responsible for updating the metadata for the complaint in Objective.

This includes, for example:

ticking the checkbox for the date of notification

which principles have been notified

noting whether personal contact with each party has been achieved

noting if the contact person for the respondent changes

noting the amount of any financial settlement

transferring custody of the file when it closes.

Nine month file review

OPC seeks to resolve all complaints as quickly as possible and will ensure all

investigations are completed within 12 months of receipt. Where an investigation has been

underway for nine months, the Commissioner will be briefed on the particular complaint

with a view to assisting the investigation to be completed within 12 months.


6. After the investigation From notifying our decision, to closing the file


This chapter covers:

the key legal checkpoints

notifying the parties of the result of the investigation

our obligation to promote settlement if we’ve found that the complaint

has substance

referring complaints to the Director of Human Rights Proceedings

closing the file

reporting significant misconduct or breaches of duty

taking further action to address non-compliance with the Privacy Act.

Introduction: Key legal checkpoints

Notifying the result

As soon as practicable after the investigation is finished, we must tell the complainant

and respondent what the result of the investigation, and about any further action we

propose to take. (Section 75)

Obligation to use best endeavours to secure a settlement

If we concluded that the complaint has substance, we must use our “best

endeavours” (reasonable efforts) to secure a settlement (section 77(1)).

We may also seek an assurance from the respondent that the breach won’t be

repeated (section 77(1)).


Referrals to the Director

Consider referring the complaint to the Director of Human Rights Proceedings if we

can’t achieve a settlement (section 77(2)).

Reporting misconduct or breaches of duty

We must report any significant breaches of duty or misconduct to the appropriate

authority (section 80).

Notifying the result of our investigation

What the Act says: Section 75, “Parties to be informed of result of

investigation”

… the Commissioner … shall inform the parties concerned, as soon as reasonably

practicable after the conclusion of the investigation and in such manner as the

Commissioner thinks proper, of the result of the investigation and of what further

action (if any) the Commissioner proposes to take in respect of that complaint.

Presenting your findings to the parties: How to write a sound and

persuasive opinion

An opinion/final view will be sound if it:

is based on correct information

addresses all relevant matters

is logically organised, and

correctly and clearly applies the law.

If there is any doubt about the facts or there are gaps in the story, go back to the parties

and clarify the facts.

Issuing a Certificate of Investigation to the complainant

What is a Certificate of Investigation?

We provide Certificates of Investigation to complainants so that they can potentially bring

proceedings to the Tribunal themselves. The Certificate provides evidence that the Privacy

Commissioner investigated their complaint, and therefore that the Human Rights Review

Tribunal has jurisdiction to hear their case.


The concept of a Certificate of Investigation is the creation of OPC in conjunction with the

Tribunal. It is an administrative document not an obligation under statute. It gives the

Tribunal confirmation that the Commissioner has investigated certain matters and of the

result of the investigation.

“For the assistance of the Tribunal and to ensure clarity as to what ‘action alleged’ has

been investigated by the Privacy Commissioner, the Commissioner issues a

Certificate of Investigation particularising the subject of the investigation. It is this

certificate which potentially sets the boundary of the Tribunal’s jurisdiction. The

certificate does not have any statutory basis and in that respect is informal and is

capable of challenge.”

DHRP [NKR] v ACC [2014] NZHRRT 1, No HRRT 002/2012, at [33]

When to issue a Certificate of Investigation

You will issue a Certificate of Investigation if either:

we have investigated the complaint and decided not to refer it to the Director of Human Rights Proceedings, or

we began an investigation but in the course of it decided to close the matter under section 71(2).

A certificate can only be issued if we have notified the respondent and, therefore,

investigated the complaint.

Using our template for the certificate

You will find a template for the certificate at:

HRRT Certificate#3.obr

Guidance on using the template and completing the certificate

Subheadings on the

form

Instructions

Complainant Include

the complainant’s full name

our reference number

Respondent Full name of the individual or organisation


Subheadings on the

form

Instructions

Matters investigated State the facts briefly, including

the relevant dates (for the incident, request, disclosure and so on)

the respondent’s actions – including, for example, withholding grounds that they relied on, or steps they took to make sure a correction statement was properly placed, or unjustified delays

Principle(s) applied Set out each principle or other breach of the Act that

has been notified and investigated. (It’s useful to

present them in the form of numbered points or bullet

points.)l

Commissioner’s opinion: Include the date of the opinion here.

Application of

principle(s)

For each of the principles investigated state the

outcome – that is, breach or no breach. Make sure

that the numbers and outcomes correlate between

here and the “Principle(s) applied” section.

Don’t give reasons for the opinion. These are not

required.

Adverse consequences Using the same numbering as above and in the

“Principle(s) applied” section, state whether harm has

been found and, if harm was found, which of the three

potential harms applies. If harm is not required (IPP 6)

state “Not applicable”.

Don’t give reasons for the finding. These are not

required.

Interference with privacy State whether there was an interference with privacy.

Again, use the numbering from the “Principle(s)

applied” section.

Don’t give reasons for the finding. These are not

required.


Obligation to promote settlement if complaint has

substance

After the investigation, if we’ve concluded that the complaint has substance, we must use

“best endeavours” to settle (section 77).

The High Court has treated the “best endeavours” standard as being the same as

“reasonable endeavours” (Henderson v Privacy Commissioner [2010] NZHC 554 at [98]).

See page 45-46 of this Manual for the text of section 77 and an extract from the High

Court’s decision.

Referrals to the Director of Human Rights Proceedings

Overview

If we’ve found an interference with privacy but we’ve been unable to achieve a settlement,

we may refer the complaint to the Director of Human Rights Proceedings, so that they can

decide whether to take action in the Human Rights Review Tribunal.

What the Act says: Section 77(2), “Procedure after investigation”

(2) If, –

(a) in the circumstances referred to in section 74, the Commissioner is unable

to secure such a settlement and assurance as is referred to in that section;

or

(b) in the circumstances referred to in paragraph (a) or paragraph (b) of

subsection (1), the Commissioner is unable to secure such a settlement

and assurance or, as the case may be, such an assurance as is referred to

in either of those paragraphs; or

(c) in any case to which section 74 or subsection (1) applies, it appears that

the action that was the subject matter of the complaint or, as the case may

be, the investigation was done in contravention of such an assurance as is

referred to in that section or that subsection, given on a previous occasion,

or that any term of such a settlement as is referred to in that section or that

subsection, reached on a previous occasion, has not been complied with, –

the Commissioner may refer the matter to the Director of Human Rights

Proceedings for the purpose of deciding whether proceedings under section 82

should be instituted against the person against whom the complaint was made or

in respect of whom the investigation was conducted.


Failure to settle – a statutory precondition for referral

Section 77(2) allows us to refer a complaint to the Director only if we’ve been unable to

achieve a settlement.

Regardless of whether we think it would be desirable for the Tribunal to set a precedent on

this issue, we must try to achieve a settlement if we’ve concluded after investigating that

the complaint has substance. Only if we’re not able to do this can we then refer the

complaint to the Director.

“The legislation … recognises party autonomy, in that the parties may settle a

complaint and the Commissioner must encourage them to do so, whether or not she

sees the complaint as a good opportunity to establish a precedent.”


Our criteria for referral

We may decide to refer the complaint to the Director if it involves the following factors:

seriousness of the issue

continuing harm

an impact on a larger number of people

unreasonable conduct by the respondent

an opportunity to set a precedent in respect of a novel or significant issue of law.

We may decide not to refer the complaint if:

it involved an information request and the information has now been provided

there are no systemic issues or major concerns, or any systemic issues or concerns

have now been addressed by the agency

the complainant hasn’t suffered a loss for which a remedy is required.

Is the case ready to go to the Director?

We will refer a complaint to the Director only if we have already developed the case to an

advanced stage. Although we do not have to provide the Director with a complete case,

the Investigator should be confident that there’s enough evidence to found a case in the

Tribunal.

Specifically, before we can consider a case for referral the Investigator should have:

established a clear factual chronology


established that the evidence the Director will need will be available – the Investigator

should know that the necessary witnesses will be available and should know what

they’ll say.

Case notes on referral

No 71808 (2006) – local residents and a property developer

No 89271 (2007) – daughter’s photo from school holiday programme

No 92895 (2008) – court employee disclosed info to the ex-partner of a man who had

contacted the court about making an ex p application

No 204595 (2009) – couple complained about their accountant

Closing the file

It is essential that in every case the Investigator asks “what can others learn from this

case?” and considers avenues to distribute those messages, such as a case note or blog

post. The Communications team can help with this. Remember, up to now, all of your

energy, training and judgement has helped two people: the complainant and the

respondent. With help from the Communications team, you could now influence thousands

of people.

When a file will be closed

A complaint file will be closed when:

the complaint is settled, or

we’ve completed our investigation and formed a final view that there has, or hasn’t,

been a clear interference with privacy, or

we’ve discontinued our investigation (see page 75).

Procedure for closing the file

When you close the file you will need to:

complete the closing coversheet

update the Objective metadata with the settlement figure (if this applies).


Reporting misconduct and breaches of duty

What the Act says:

Section 80, “Commissioner to report breach of duty or misconduct”

If, during or after any investigation, the Commissioner is of the opinion that there is

evidence of any significant breach of duty or misconduct on the part of any agency or

any officer or employee or member of an agency, the Commissioner shall refer the

matter to the appropriate authority.

Further action: Other tools for addressing non-compliance

Types of further action

A warning letter

Monitor the agency

Approach the Chief Executive, the Minister, or an industry association

Education for the agency or industry

Transfer the matter to another investigating agency

Public comment (naming, media release, blog, Privacy News, social media comment)

Naming the respondent: https://www.privacy.org.nz/about-us/transparency-and-

accountability/opc-policies/naming-policy/

https://www.privacy.org.nz/about-us/transparency-and-accountability/opc-policies/naming-policy/

https://www.privacy.org.nz/about-us/transparency-and-accountability/opc-policies/naming-policy/


APPENDICES


Appendix 1. Initial call checklist

Office of the Privacy Commissioner – Introductory Discussion

Checklist

Complaint number: Complainant’s name:

Date of conversation: Investigator:

The role of the investigating officer Completed

1. Investigator is independent, neutral, not an advocate for either party

2. Investigator’s role is to communicate between parties to help them try and reach a resolution

3. Investigator has no decision making power

4. Investigator cannot disclose information it receives from one party to the other party and our communications are not personal information you can request. It is the respondent agency’s responsibility to provide information directly to the complainant – we cannot pass information between parties

Complaint process

5. Explain the three stages of the process:

a. Facilitation and (telephone) case conference b. Investigation c. Preliminary and final view

6. The complaint can be settled at any time during the process

7. The complainant can withdraw the complaint at any stage

8. If the complainant accepts an offer from the respondent it is in full and final settlement of the complaint

9. Our final views are persuasive but not binding. If the complainant wishes to pursue the matter they may do so in the HRRT

10. Check the complainant has received the information sheet (if this hasn’t been sent already, send a copy to complainant along with any other relevant information sheets or brochures)


Introductory Discussion Checklist (continued)

11. The timeframe for looking into your complaint can vary. It can depend on the parties willingness to resolve the matter, information needed, whether experts are required, whether the Commissioner’s ruling is needed. We try to finish most investigations within six months

12. Discuss confirmation of complaint

Contact details

13. Check contact details – eg:

a. Check the spelling of the complainant’s name b. Do you have all the necessary contact details? c. Is there a best time or way to contact the complainant? d. Is it ok to leave a message on the phone?

Note: highlight on file if any contact details are to be kept CONFIDENTIAL

14. Check the complainant is entitled to bring the complaint

15. Confirm the complainant has your name and contact details

16. Tell complainant when you next plan to be in contact with them


Appendix 2.

Notification by email (cover email)

Covering email – Form and content

We have been trialling notification by email for a number of agencies. We have a standard

covering email that we send, and the notification letter is sent as an attachment to that

email.

Below is the text of that covering email:

[Subject line] Notification of Privacy Act Complaint from X – C/reference

Dear X

Please find attached a notification letter to your agency about a complaint we have

received from _______________.

As agreed, we will not send you a hard copy of this letter (but are happy to do so

upon request).

Please acknowledge receipt of this notification as soon as possible, and:

Give us your reference number (if any); and

Provide the name of the contact person at your agency who is available to liaise

as necessary with our Investigator responsible for this complaint: [name of

Investigator and phone number and email address]

Please note that a response to the complaint itself is due by

____________________.

I welcome the opportunity to discuss it with you at your earliest convenience.

Sincerely/Kind regards,

[Insert your signature here]

For steps on how to create a template for the covering email, see the

following pages.


Creating a template for the covering email

You can either save the above text for the covering email somewhere and copy and paste it each

time, or else you can set this up as a template in Outlook using the instructions below:

Creating a new email template

1 Copy the standard covering email text (see above) into a new email. You can also complete

the subject line with standard text and, if you wish, apply a tag to the email (e.g. “High

Importance”). Emails created from a template will inherit everything you create in the

template.

Add your signature block to the end of the email, if you haven’t got Outlook to automatically

add it to new emails.

2 Click on File/Save As. Then:

In the Windows Explorer window, click on the down arrow beside the “Save as type”

field and select “Outlook Template”.

Give your template a name in the File name field – e.g. “Email for notification letter”

Click on Save

Once you have saved your email as a template, you can close the email.

See the screenshot below.


Creating a new email template (continued)


Using an email template

3 In the Home tab in Outlook, click on New Items/More Items/Choose Form.


Using an email template (continued)

4 In the Choose Form window:

Click on the down arrow beside the Look In field and select “User Templates in File

System”.

Double click on the template you want (or click on the template you want, then click on

Open).

A new email will be created for you using the template you’ve chosen. It will be pre-populated

with your specified content (including any tags you might have applied e.g. “High Importance”).

Use the new email as you would any other email.

OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 95 95

Appendix 3.

Investigations Team Inbox

Responsibility

Every investigator and team secretaries should check the inbox regularly for

correspondence concerning their own complaint files.

Responsibility for clearing the inbox (correspondence not related to active investigation

files) sits with the investigator on the incoming roster (“the rostered team member”).

The roster should be in each team member’s calendar and shared with corporate services

and enquiries officers.

Purpose

The investigations team inbox is for receiving correspondence concerning investigations

files and can be used by both internal and external correspondents.

It can be used by complainants to submit new complaints, or by investigators who would

(for whatever reason) prefer that parties to a complaint do not have their personal email

address.

It will also be used by the team secretaries to send correspondence on complaint files that

have not been assigned for investigation yet.

Assignment

Each team member has been assigned a colour category within the inbox e.g. Riki - black.

When a new email enters the inbox the rostered team member will review the

correspondence and decide who is best placed to deal with it. The rostered team

member will then mark the correspondence in the appropriate person’s colour and forward

the email to them (‘the assignee’).


The rostered team member will leave the original email in the inbox for the assignee to file

in Objective.

If the rostered team member enters into any correspondence with the sender of the email

(without having created a file in Objective for it) they should drag the sent email into the

inbox so that the assignee can file all relevant emails in Objective. The inbox is grouped by

the title of the email, so that multiple emails on the same topic group together.

Once the assignee has received an email for response from the rostered team member it

is their responsibility to go into the inbox and retrieve the original for filing. It is then also

the assignee’s responsibility to move all assigned emails to the ‘Actioned’ sub-mailbox so

that the rostered team member knows these have been dealt with. Flagged emails should

be filed in Objective within three days.

IMPORTANT: If a team member, not acting in the “rostered team member” capacity,

accesses the inbox, PLEASE mark any emails you read (not already assigned) as

‘unread’, so that the assigner knows that these are yet to be dealt with. Do not read

emails and leave them “read” so the rostered team member doesn’t notice them.

“Actioned Folder”

Emails should not be moved into the actioned folder by anyone but the rostered team

member, or by a team member who has filed the email in Objective. Emails older than 3

months in the actioned folder may be permanently deleted.

Access to the inbox

Only the investigations team and corporate services may have access to the mailbox.


Mailing from the inbox

If you reply to an email in the inbox directly ensure that either your signature block or your

name is at the bottom of the email so that the recipient knows which member of the team

has replied.

If you are using the [email protected] email address to send correspondence

to an external recipient please ensure you put the complaint reference number in the

subject line.



Appendix 4.

Checklists for conciliation and

settlements

During the investigation

Task Completed Date

Ensure parties understand the complaints process and how

settlement conference fits within that – explain this at the outset

of the investigation if the possibility of a settlement conference is

highlighted in the pink or becomes clear once initial response has

been received

Ensure parties understand how the law applies to the complaint –

make it clear what principles/rules are engaged and why.

Also ensure parties understand what issues that we do not have

jurisdiction to consider and why

Get information from both C and R as to their view of the

complaint and attempt resolution without making a determination

where possible

Ensure parties understand OPC current assessment of complaint

–

send a preliminary view and discuss this view with both parties over the phone (where possible)

Ensure that all relevant information about the breach is obtained from R and that C’s harm is provided to R in advance

Ensure that C knows R’s position on the complaint

Ensure that all parties are aware of what C is seeking to resolve, and that both have realistic expectations about the likely outcome

Review feedback from both parties


During the investigation (continued)

Review complaint with Investigations Team and consider whether

there are any other options for resolution that have not been

attempted. If not, get a clear understanding of OPCs position on

the complaint (conduct any necessary research and be ready to

form a final view if necessary)

TM and Investigator to review file and decide if settlement

conference appropriate (consider facts, parties, likelihood of

resolution, resources and whether there are any special

requirements of the parties to be aware of e.g. security/panic

buttons or two OPC staff for any difficult behaviours)

Discuss whether both parties are open to the possibility of

settlement conference

Get approval from AC for settlement conference

Before the settlement conference

Task Completed Date

Get agreement from parties as to the time, date, location, format,

needs and attendees. Advise both parties who will be attending,

including a support person for C if desired, any additional OPC

staff members (including appropriate support for Investigator if

required) and ensure that the appropriate technical experts/levels

of delegation from R are attending

Confirm details with AC and get assistance from support staff to

book meeting rooms and make travel arrangements

Confirm in writing for both parties once all details finalised.

Advise that if for any reason they are unable attend, they must let

the Investigator know as soon as possible

Review the file again with TM and prepare for settlement

conference (ensure all of the above steps are properly

completed and that we have all of the relevant information, have

completed the investigation and have formed a preliminary view)

Investigator to call both parties separately and ensure they are

prepared for the settlement conference and know what to expect


Before the settlement conference (continued)

Provide documents to parties in advance - agenda, relevant law,

case notes and case law and allow time to review and comment

TM to call both parties separately the day before the settlement

conference to ensure understanding of the process and focus on

resolution

Take the file with you (if it can be done securely) and ensure that

you have the address and contact details for the venue, and

contact details for both parties

Arrive at the venue early to ensure meeting room is set-up

appropriately

During the settlement conference

Task Completed Date

Welcome and introduce parties

Explain at the outset:

Thank parties for attending, acknowledge it has been done voluntarily, explain the benefits of a voluntary resolution and acknowledge how difficult it may be (especially for C)

Acknowledge there may be difficult material discussed and that this should be done with respect, and that anyone can ask for a break at any time

Set out the format for the settlement conference

Encourage content and involvement that will aid resolution (not a forum for testing evidence or credibility)

Encourage constructive communication (no interrupting when others are speaking, no blame etc.)

Encourage a range of possible resolution options that are based on needs and interests

Prepare parties for potential to compromise

Phones off

Confidentiality requirement

Explain how this process differs from OPC making a final determination and what the outcome could be if it is not resolved

Anything else required in introduction that is relevant to the complaint (OPC view of the complaint, summary of relevant principles etc.)


During the settlement conference (continued)

Ask C to start by explaining the complaint from their perspective

and what they are seeking to resolve their complaint

Clarify issues as required and confirm that C has had an

opportunity to express everything they wanted to

Ask R to continue by responding to C and explaining its view of the

complaint

Clarify issues as required and confirm that R has had an

opportunity to express everything it wanted to

Set out OPC view of any disputed issues (if required or it will

assist)

Allow C a chance to respond

Move into focusing on resolution (can be done in a variety of ways)

Take notes of relevant points throughout

Bring parties together at conclusion, summarise agreed outcomes,

thank parties for their participation and agree on next steps

Draft and complete Settlement Agreement if possible

After the settlement conference

Task Completed Date

Make a detailed file note about the discussions including any

agreed outcomes

Call both parties to debrief and confirm understanding

If resolved at settlement conference :

Draft Settlement Agreement for TM approval (if not done during

settlement conference which is preferable where possible) and

finalise any agreed outcomes

Send Settlement Agreement to R for approval and then send to C

for signature(send two copies to C if they also want an original)


After the settlement conference (continued)

C to send completed Settlement Agreement straight to R. R to sign

and send a completed copy to OPC and C, and arrange for

implementation of any agreed outcomes

Review complaint and close file

If not resolved at settlement conference :

Debrief with TM and AC

Agree on next steps in the investigation (if any)


Checklist for written settlement agreements

Agreements that are intended to be legally binding and

enforceable

Does the agreement fulfil all the elements of contract?

Does it follow the SMART principles: Specific, Measurable, Achievable, Relevant,

Time-bound?

In particular:

Are the parties correctly identified? Yes

Is the agreement signed by all relevant parties? Yes

Is the signatory for the respondent/s authorised to sign? Yes

Is the agreement dated? Yes

Does the agreement contain only relevant information? Yes

Does the agreement contain irrelevancies? No

Do any clauses contain hypotheses? No

Are there any contingent clauses? No

Do any clauses depend on the consent or actions of third

parties?

No

Agreements not intended to be legally enforceable

(for example, protocols of behaviour or future interactions)

Is the agreement:

- Clear?

- Explicit?

- Certain?

- Robust?

- Capable of being monitored?

Are there specific consequences if protocols are not observed?

How will breaches be dealt with?

Is the agreement to be supervised, and, if so, by whom?


Are there to be scheduled follow-up meetings?

Has the agreement been signed and dated?


Appendix 5.

Teleconferences

The Language Line process

The caller indicates they need an interpreter – check which language is needed.

Language Line provides interpreters for the following languages:

Amharic

Arabic

Assyrian

Bengali

Bosnian

Cantonese

Cook Island

Maori

Croatian

Dari

Farsi

Filipino

French

German

Gujarati

Hindi

Japanese

Khmer

Korean

Kurdish

Lao

Mandarin

Māori

Myanmar

Nepali

Niuean

Pashto

Portuguese

Punjabi

Russian

Samoan

Serbian

Sinhalese

Somali

Spanish

Tamil

Thai

Tokelauan

Tongan

Tuvaluan

Ukrainian

Urdu

Vietnamese

Press “Conf” button (Conference) is displayed at bottom of screen. Press “OK”.

Dial 0800 000 260. Give your name and business unit and the region of the call. Give

the required language (and specify the gender of the translator, if necessary).

You will then be put through to the interpreter. Introduce yourself and give a brief

background, and explain what telephone equipment you are using.

Press the “OK” button to connect the original caller to the conference call.


Getting disconnected during a teleconference

Occasionally you may lose the connection with one or both of the parties during a

teleconference. It’s a good idea to let the parties know beforehand what they should do if

this happens:

Suggest they call the 0800 line if they get disconnected.

The next best option would be to email you, provided you have easy access to your

email during the teleconference, and you know how to turn off the email send-delay.


Appendix 6.

Natural disasters

In the event that a natural disaster affects either the Auckland or Wellington offices of OPC

with the effect that the Affected Office (“AO”) is unable to function as normal, the following

should occur where necessary:

Internal communication

Management shall ensure that all OPC staff are updated with any details relating to

the welfare and wellbeing of colleagues. All OPC staff are to be kept updated with

the status of the AO and any alternate arrangements for work. Where possible

periodic meetings (by VC or teleconference) shall be arranged to ensure that staff in

both offices are able to maintain quality communication with each other.

External communication

An agreed OPC response for stakeholders shall be prepared so that information

about the AO and any change in normal business shall be communicated

consistently, particularly when the Unaffected Office (“UO”) receives queries by

phone or email.

Postage

The physical mail shall be re-directed to the UO where corporate services will scan

the mail to Objective and where appropriate send the link by email to the Investigator

(where one has been allocated), the Investigation inbox (to consider whether a

complaint) or to the Enquiries inbox. The physical mail for the AO shall be kept in an

allocated cupboard for distribution to the AO when business returns to normal.

Enquiry (0800) line

The enquiry line shall be transferred to the UO. A replacement roster shall be drafted

by the UO as soon as practicable for the staff available to answer enquiry calls

(where possible accommodating break times).

Complaint files

Where it is not possible to provide safe and secure storage of physical complaint files

at the AO or at any temporary office space occupied by the AO, those files shall be

secured at an alternate storage facility as soon as possible or alternatively sent to the

UO for storage. Any new physical complaint files shall be sent to the UO for

temporary storage. The UO shall allocate storage space for such files.

Unallocated complaint files


The physical unallocated complaint files shall be transferred to the UO. The files

shall be managed, in the first instance, by the Team Manager in the UO.

Security files

Any security related (SIS, GCSB) complaint files which are transferred to the

Auckland office where Wellington is the AO, shall be held in secure storage by the

General Manager of the Auckland office (as no Auckland staff have sufficient security

clearance).


Appendix 7.

Escalation Policy and Procedure

The following policy applies when any staff member at the Office of the Privacy Commissioner (OPC) receives aggressive contact from a complainant, a respondent or a member of the public. As the majority of our contact is over the telephone, this policy is primarily aimed at telephone communications, however, it can be adapted to apply to contact in writing or in person. It is important for all staff to remember that their health and safety is paramount. They have a number of options available to them, to ensure that any difficult calls are handled safely and efficiently. These options should be applied as appropriate (and after discussion with your manager in most cases). However, the preference is to exhaust the first options (least restrictive) before we move onto the final options (most restrictive). It is also important to note that often, a caller’s circumstances will change. So, if we have decided to restrict the caller in a certain way on one occasion or for one particular complaint, we need to regularly review this decision to ensure we are being fair and accessible to everyone.

Name the offensive behaviour and ask the caller to stop – tell the caller that you do not appreciate them “swearing at you” or “threatening you” etc and ask them to stop. Refer to the Process for Terminating Calls at the end of this Policy for scripting you may find useful. It is important that you specifically name the behaviour you find offensive, and ask the caller to stop. If that does not work, and the behaviour continues:

Place the call on hold - tell the caller first that you are doing this, and then take the time that you need to speak with a team member, gather your thoughts or plan your next move. This may also give the caller time to calm down.

Terminate the call if the offensive behaviour continues – see below Process for Terminating Calls.

Escalate the call to a Manager – this option should be used if the caller asks to speak with a manager, or if you think they might benefit from it. It is important that you do not tell the caller you are transferring them to a manager until you have permission to do so (e.g. your manager may not be available, they may need time to prepare for the call etc.). Alternatively, if your manager is not available to take the call at the time, tell the caller that they will receive a call back by close of business the next working day. It can also help to ask what number the caller would like us to use, and if there is any time in particular that they are not available (but do not lock your manager into calling back at a specific time as this is not always possible). In certain extreme cases, you may also agree with your manager that they are the best person to handle any further contact from this person.


If the offensive behaviour continues after using the above options -

Discuss with your Manager about placing restrictions on certain callers – for example, if a complainant calls your direct dial five times a day, your manager may advise them that they can only speak with you at 10:00am on a Tuesday, or that you will not be returning any voicemail messages from them until after a certain date (when you are expecting further information). Options to consider:

o Caller to be told they can only speak with you at a certain time. o Caller to be told you will not respond to any messages until after a particular date.

You can remind them if they do call despite receiving this advice, and end the call quickly.

o Caller is not to have direct contact with you in future, but any messages will be returned by your manager.

o Caller can be transferred to our 207 extension for a message to be recorded (refer below Process for Transferring to Extension 207).

You and your manager will need to discuss the best way to advise the

caller if you decide to use any of these options, and it would be a good

idea to follow up any discussion in writing.

Decline to take any further telephone calls from this caller and/or request that any further contact with the OPC is made in writing – see the attached Practice Note on Blocking Telephone Contacts.

Discuss other alternatives with your team members, Manager and the Assistant Commissioner (Policy and Operations) – for example, if the caller has made a complaint about the OPC to another body (such as the Ombudsmen or the Human Rights Commission), we could ask that any further contact with the OPC be made by that body.

Remember the importance of debriefing after any difficult calls.

Process for Terminating Calls

If a caller is being verbally abusive towards you, tell them that verbal abuse will not be tolerated, and that if the behaviour continues you may be required to terminate the call.

Use the following termination warning - “I’m sorry but I don’t think we can discuss your concerns while you are speaking this way. Unless we can discuss this calmly I will have to terminate the call”.

It may also be helpful to name the behaviour, for example, “I do not think we can discuss your complaint while you are swearing at me. If you cannot stop using offensive language, I will have to terminate the call”.

If the caller still displays difficult behaviour, remind them that you have already asked them to stop speaking to you that way. Tell them that you are terminating the call and that another staff member (usually your manager) will call them back.


Make sure you tell your manager about any terminated calls as soon as possible. They will need to decide who will be calling back (if anyone), whether other staff members need to know, or whether any further action is required.

Process for Transferring to Extension 207

Where a caller is unable for whatever reason to write to us, or if they display difficult behaviour and the above options have been exhausted, you can offer the option of leaving a message with details of their enquiry or complaint on a dedicated answer phone line.

Use the following script – “I am finding it difficult to speak with you while you are

(name the behaviour). If you would like to continue speaking with me, I need you

to calmly explain your Privacy Act issue and give me time to respond. If we can’t

discuss this calmly, I will transfer you to another extension, where you will be able

to leave a message with the details of your complaint”. Note – this script will need to

be modified where the caller is not difficult, but wants to use this option for another

reason.

If caller does not allow you to continue the conversation – “As we can’t discuss this

matter calmly, I will now transfer you to another extension. Please listen to the

recorded message and follow the instructions provided”.

The recorded message then states – “You have reached the Office of the Privacy

Commissioner’s complaints and enquiries message service. You will now have

five minutes to provide us with a brief summary of your complaint or enquiry.

Please include your name and contact details, and the name and contact details of

the person or organisation you have concerns about. If you have contacted the

person or organisation about your concerns already, please also provide details of

their response. We will review your message and contact you to discuss the next

steps”.

If you use this option, email your MANAGER immediately, so that they can arrange for

the message to be cleared. Currently, the Assistant Commissioner (Policy & Operations)

and the Team Secretary, Wellington have access to the voicemail.

Practice Note: Guidance on taking action to block offensive callers

This practice note is to assist staff in the best practice for blocking offensive or belligerent

telephone behaviour from callers to the office. It is directed at telephone calls only but the

general principles can be modified and applied to other forms of communications with our

office.


Background

Our processes allow for a variety of contact points into the office to facilitate an efficient

and easy complaint process. Contact can be made by letter, email, fax or phone and

individuals are entitled to request an appointment to meet with a member of staff.

Having interaction with the office is a statutory right and we are obliged to provide

appropriate communication options. A particular contact option is a privilege and not a right

and personal contact may be withdrawn if the individual abuses the right through

belligerent, offensive or abusive behaviour. At the very least we would accept written

communications on the understanding that it would not be considered if it was abusive or

offensive.

Aggressive and abusive threats to a staff member over the telephone are never

acceptable. It is appropriate to end telephone calls of this nature. Our usual practice

applies; that is to warn the caller that the behaviour is unacceptable and that if it persists

the call will be terminated.

In the case of phone contact we are able to block callers who are belligerent, abusive or

offensive. This practice note sets out the action that we all need to adhere to when

blocking such a caller.

A very useful practice manual dealing with unreasonable conduct is “Managing

Unreasonable Complainant Conduct – A Manual for Staff and Management”, NSW

Ombudsmen. 2nd Edition, May 2012. It can be accessed at:

http://www.ombo.nsw.gov.au/__data/assets/pdf_file/0004/3568/GL_Unreasonable-

Complainant-Conduct-Manual-2012_LR.pdf

Our Practice

Where a caller has displayed belligerent, abusive or offensive phone behaviour it is

appropriate to consider withdrawing the ability to contact OPC by phone. Abusive or

offensive behaviour is usually self-evident on the face of the contact. Belligerence would

include behaviour that is overly aggressive, argumentative, repetitive or confrontational.

Such behaviour might also result in the efficient administration of the office being

significantly affected. Where the phone manner of an individual is concerning to staff the

following steps are to be taken:

At an early stage the caller is to be put on notice that a continuation of the type of behaviour may result in the privilege of using the phone being withdrawn.

If the concerning behaviour continues the incident/s are to be brought to the attention your immediate supervisor.

At all times the incident in which the behaviour is demonstrated needs to recorded fully and accurately in the OPC file.

If you are aware that other staff members are being confronted by the behaviour, accurate records of those incidents are also to be captured on the file.

http://www.ombo.nsw.gov.au/__data/assets/pdf_file/0004/3568/GL_Unreasonable-Complainant-Conduct-Manual-2012_LR.pdf

http://www.ombo.nsw.gov.au/__data/assets/pdf_file/0004/3568/GL_Unreasonable-Complainant-Conduct-Manual-2012_LR.pdf


Only after discussion with your supervisor, the caller may be officially put on notice that if the behaviour continues all calls will be blocked. This notice may be given in person on the phone, by email or by letter. The warning can be made by the staff member or the supervisor. The warnings are to be recorded on or copied to the OPC file.

If the behaviour continues beyond the official notice, a brief report is to be generated for referral to the General Manager who will arrange for the caller to be blocked. That report shall include sufficient details to enable the General Manager to identify the caller’s telephone number. The General Manager will act as an additional scrutineer of the process.

NOTE: Many of these types of callers contact our office in the context of complaints. It is

not unusual for a wide variety of staff within the office to be exposed to these people. It is

important that when you become involved in a cycle of abusive or worrying calls that you

consult widely with your colleagues to ensure that all incidents are known and captured. In

most instances it would be appropriate that the operational staff (investigations and policy)

manage the process envisaged by this practice note.

As these incidents develop, a record of the memo to the General Manager and any other

record of action taken shall be aliased or copied into the general Objective file named

“Banned Blocked and Abusive Individuals” under Complaints/04 Summary Reporting –

Complaints/Complaints Reports.

Documents

Office of the Privacy Commissioner · OFFICE OF THE PRIVACY COMMISSIONER PROCEDURES MANUAL: DISPUTE RESOLUTION AND INVESTIGATIONS 6 5. Investigating a complaint From the “pink”