Skip to Content, Skip to Navigation
Advertisement

Safeguard OSH Solutions - Thomson Reuters

Safeguard OSH Solutions - Thomson Reuters



Accident Compensation Cases

O'Neill v Accident Compensation Corporation (HRRT, 22/05/06)

Judgment Text

DECISION 
Mr R D C Hindle Chairperson, Dr D W McKean Member, Ms J Binns Member
[1]
At some point before June 2003 Mr O'Neill was asked by the first defendant (“the ACC”) whether he would be willing to take part in a survey that was to be carried out in relation to claims managed in the ACC's Medical Misadventure unit. The survey was to be conducted by the proposed second defendant (“BRC”). 
[2]
The letter informing Mr O'Neill of the proposed survey said that he would be contacted by telephone in due course, and that when contacted he would be able to decline to take part if he did not want to do so. BRC then contacted Mr O'Neill. He declined to take part in the survey. He later sought access to all personal information held about him by BRC. As a result, he discovered that the ACC had already conveyed a number of items of personal information about him to BRC, including not just his name and telephone number but also things like his claim ID number, his personal ACC ID number, his gender, ethnicity, accident date and other details. Mr O'Neill considers that it was not necessary for the ACC to convey so much information about him to BRC, if all that BRC was to do in the first instance was to contact him to see whether he would be willing to take part in the survey. 
[3]
On 30 May 2003 Mr O'Neill wrote to the Privacy Commissioner to complain. His letter makes it clear that his complaint was made against both the ACC and BRC. 
[4]
On 1 September 2005 the Assistant Privacy Commissioner wrote to Mr O'Neill. The relevant part of her letter reads: 
“I note that you asked the Commissioner to investigate BRC's actions as well as those of ACC. It does not appear that we opened a file with BRC as the respondent to your complaint. I have considered whether it would be appropriate to do so. 
… it is my view that pursuing BRC as respondent to this complaint will not achieve anything. While it is clear that BRC received information from ACC, it appears most likely that ACC chose to supply that information to BRC, rather than BRC specifically asking for it (e.g., the claim number). If this is the case, BRC would not have ‘collected’ the information since it would have been unsolicited. Therefore Principles 1 — 4 would not apply to it, and therefore they would not be in breach of the Act. 
You also indicated that BRC complied with its Privacy Act obligations to provide you with access to personal information which it held. 
While I understand your objection to BRC's involvement in this situation, therefore, I propose not to pursue the matter formally against BRC. If an agency is at fault under the Act, that agency would be ACC rather than BRC. ”
[5]
Whether the assumption that BRC did not ask for the information it was given by ACC was justified or not, the consequence of this approach was that the Privacy Commissioner did not notify BRC of Mr O'Neill's allegations. Nor did she take any steps in relation to BRC that she regards as having been an investigation of the complaints against BRC, or make an attempt to conciliate the claim under s 74 of the Act. 
[6]
Her investigation of ACC's position, on other hand, lead her to form the opinion that the disclosure of information by ACC to BRC amounted to a breach of Rule 11 of the Health Information Privacy Code 1994 (“the Code”). She was not, however, persuaded that the disclosure was one that had caused Mr O'Neill any sufficient harm to establish an interference with his privacy. 
[7]
Mr O'Neill filed this proceeding in the Tribunal on 6 December 2005. He named the ACC as first defendant. It seems to be accepted that we have jurisdiction to deal with that part of his claim. However Mr O'Neill also named BRC as a proposed second defendant. The ACC, BRC and the Privacy Commissioner all take the position that we do not have jurisdiction in respect of that part of the claim, because BRC is not a “ … person … in respect of whom an investigation has been conducted … ” under Part 8 of the Privacy Act (see s 82(1)(a) of the Act). It follows, they submit, that BRC does not fall within the category of a person in respect of whom proceedings under s 83 of the Act can be brought. The submissions refer to cases such as Waugh v New Zealand Association of Counsellors Inc (HRRT Decision 9/03; 17 March 2003) and Henry v McCarthy (HRRT Decision 12/04; 16 April 2004)
[8]
It was agreed at a case management conference in this matter on 7 February 2006 that the issues thus raised would be determined by the Tribunal on the basis of the submissions and materials that were then to be filed, and without a viva voce hearing. We make the point because, as the Tribunal's analysis in Steele v Department of Work and Income (HRRT Decision 12/02; 21 October 2002) shows, the issue of whether or not there has been an investigation in any case is ultimately one of fact. Furthermore, no particular formalities are required. A matter can be said to have been “investigated” even though (for example) no investigating officer was appointed: see generally para's 39 to 47 of the decision in Steele (supra). 
[9]
We do not have a full copy of the final opinion issued by the Privacy Commissioner, but an extract was quoted in the submissions filed on her behalf in the present case. Evidently her final opinion reads in part: 
“Given there is no evidence to suggest any wrongdoing by BRC, I do not consider it necessary or appropriate to open a complaint against BRC. The actions you have complained about (the release of information about you) have been investigated in this complaint. Further investigation against BRC itself is unnecessary. ”
(our emphasis).
[10]
The use of the words “ … further investigation against BRC … ” is a little ambiguous. Nonetheless in the context we take the Privacy Commissioner to have been confirming that she had not investigated Mr O'Neill's complaint against BRC, and that she did not intend to do so in future. And, as we have indicated, in her submissions to the Tribunal on the issue Ms Evans made it clear that the Privacy Commissioner has not even taken the step of notifying BRC of the allegations. Certainly on the information before us the Privacy Commissioner does not regard herself as having commenced an investigation against BRC. In these respects the present case differs significantly from the situation that was considered in the Steele case
[11]
Mr O'Neill has made it clear that he complained about BRC to the Privacy Commissioner, and that he very much wanted her to investigate BRC. But there is nothing to persuade us that the Privacy Commissioner has ever commenced such an investigation. In the circumstances we find that there has not been any investigation by the Privacy Commissioner in respect of the complaint against BRC. It follows that we do not have any jurisdiction to deal with the part of Mr O'Neill's claim that is directed at BRC. That part of the claim must be dismissed. We make an order accordingly. 
[12]
The submissions filed by the parties also addressed a second point, namely whether BRC was simply the agent of the ACC, so that it should not be seen as having any status in the matter that can or ought to be distinguished from the ACC. The argument referred to s 3(4) of the Act, and cases such as Buxton v ACC (CRT Decision 34/00, 6 December 2000) and S v P (1998) 5 HRNZ 610Has Cases Citing which are not known to be negative[Green] . There was also reference to the contract under which BRC was engaged by the ACC. We were not shown a copy of the document, although various parts of it were quoted or referred to in the submissions. We add that on this issue the Privacy Commissioner's position was at odds with that of the ACC. 
[13]
We suspect that the topic may yet be relevant to an assessment of ACC's position under Rule 11 of the Code, as well as the present argument that BRC ought not to be a party to this proceeding. Given that it seems to us clear that we do not have any power to deal with any separate claim brought against BRC in any event, we do not find it necessary to decide this point at this stage. Indeed we think it would be wrong to do so on the limited information that we presently have. 
[14]
Aside from that, Mr O'Neill has made his disappointment about the Privacy Commissioner's failure to investigate matters against BRC clear. But it is not for us to say whether her decision not to investigate the complaint against BRC was, or was not, a proper exercise of her powers under the Act. We have no general power to review the actions of the Privacy Commissioner. This point has already been made many times (e.g., Steele, supra, at para 43) including in several cases in which Mr O'Neill has been involved — see, e.g., O'Neill v Health & Disability Commissioner (HRRT Decision 2/03, 12 February 2003 at para [13]), O'Neill v “The Health & Disability Commission” (HRRT Decision 4/03, 12 February 2003 at para 6) and O'Neill v Privacy Commissioner (HRRT Decision 14/04, 16 April 2004 at para [9]). 
[15]
This decision does not prevent Mr O'Neill from pursuing the part of this claim that is directed against the ACC. But since this is a claim under Rule 11 of the Code it follows that Mr O'Neill will have to establish that the disclosure (if that it what it was) of information by ACC to BRC has caused him to suffer adverse consequences of one or more of the kinds set out in s 66(1)(b)(i) to (iii) of the Act. 
[16]
There is nothing in the claim before us that would begin to suggest that Mr O'Neill has suffered harm of any of the kinds contemplated by ss 66(1)(b)(i) or (ii) of the Act. It seems likely that the only basis for the claim is a suggestion that there was harm of one or more of the kinds identified in s 66(1)(b)(iii), i.e., involving some loss of dignity, humiliation or injury to feelings. But we note that in each of these respects Mr O'Neill will have to show that the harm he suffered was of a significant kind. 
[17]
There is nothing in the papers we have seen that begins to approach that threshold. It is also clear that Mr O'Neill did not put anything before the Privacy Commissioner which might have persuaded her that his case meets the s 66 threshold. 
[18]
We acknowledge that Mr O'Neill may yet be able to adduce some evidence on the issue of harm. But unless and until that happens, the claim has no prospect of success. 
[19]
In the circumstances we direct: 
[a]
Mr O'Neill is to file an affidavit or affirmation within 28 days of the date of this decision to set out the facts and circumstances on which he relies to establish that he has suffered harm of any one or more of the kinds listed in s 66(1)(b) of the Act arising out of the disclosure (if that is what it was) of the information at issue by the ACC to BRC. Assertions which are not solemnised in a manner that complies with the Oaths and Declarations Act 1957 will not be accepted; 
[b]
Until Mr O'Neill's evidence on the issue of harm is received, no further steps are to be taken in the matter save in respect of the issue of costs (which is dealt with below); 
[c]
If and when Mr O'Neill's evidence is received we will evaluate it to see whether it justifies a decision to allow the claim to proceed, or whether it is appropriate to strike the claim against the ACC out at this stage on the basis that it is clearly untenable; 
[d]
If the ACC wishes to make any submissions in that regard it must do so within 14 days after receiving any evidence to be filed by Mr O'Neill. 
[20]
We invite submissions in respect of costs in connection with this decision according to the following timetable: 
[a]
Any application for costs (together with any supporting materials) to be filed and served within 28 days of the date of this decision; 
[b]
Any reply (together with supporting materials) to be filed and served within a further 14 days; 
[c]
The Tribunal will deal with the issue of costs on the papers without any viva voce hearing. 
[21]
In summary: 
[a]
The claim against the proposed second defendant BRC is dismissed; 
[b]
Mr O'Neill must file an affidavit or affirmation within 28 days of the date of this decision to set out the facts and circumstances on which he relies to establish that he has suffered harm of any one or more of the kinds listed in s 66(1)(b) of the Act arising out of the disclosure (if that is what it was) of the information at issue by the ACC to BRC. The issue will then be dealt with according to the timetable set out at para [19] above; 
[c]
The question of costs in connection with the issues that are determined in this decision are to be dealt with in accordance with the timetable set out at para [20] above. 

From Accident Compensation Cases

Table of Contents