Briefing for Elected Members of Local Authorities

Soon a new crop of councillors will be taking their seats in chambers up and down the country, eager to serve their community to the best of their ability.

Clause 21 of the 7th Schedule of the Local Government Act 2004 says that at the first meeting of a local authority following the election, the chief executive has to call a meeting. Things that need to be attended to at that meeting include:

(a)    the making and attesting of the declarations required of the mayor (if any) and members under clause 14; an

(b)   the election of the chairperson (if any) and the making and attesting of the declaration required of the chairperson under clause 14; and

(c)   a general explanation, given or arranged by the chief executive, of—

(i)    the Local Government Official Information and Meetings Act 1987; and

(ii)    other laws affecting members, including—

(A)    the appropriate provisions of the Local Authorities (Members’ Interests) Act 1968; and

(B)    sections 99105, and 105A of the Crimes Act 1961; and

(C)    the Secret Commissions Act 1910; and

(D)    the Securities Act 1978; and

Councils will already be planning these, and instead of offering to help at vast expense, and travelling up and down the country as I have on previous occasions, I’ve decided to grant all local authorities a licence to use my PowerPoint presentation to help structure their meeting. Hopefully some will be more adept at presentations than I am, and will be able to make the slides look more attractive (I asked Twitter if they would help, but no one volunteered). So here they are, for you to use if you find them useful.  Let me know fi you see any errors or omissions, or would like any more information about the contents. Good Luck!


The Henry Inquiry, Privacy and the Law

I had been meaning to stay out of this unfolding story, partly because it is so highly politicised  and partly because new factoids have been dribbling out and then spun in different ways by different actors every day.

There are also a number of different ways of approaching the story. Peter Dunne has been accused of double standards because he made a stand for the privacy of his communications with a journalist, but has supported a modified GCSB Amendment Bill. These are quite different things.

Then there are the multiple opportunities for eyebrow raising at the press for their sudden defence of privacy standards, after decades of antipathy, when one of their own is affected (although to be fair, the media has rallied around privacy as a cause in the last 18 months, since the ACC affair touched such a nerve).

There are without doubt, important constitutional issues associated with freedom of expression and the separation between Parliament, and the Executive. The right of journalists to move about the parliamentary precinct and carry out their business without oversight by or the approval of the Executive has never really been questioned, but is now bought into close relief.

But what of the law? What remedies might Peter Dunne, and/or Andrea Vance have in all this? Everyone has an opinion about the ethical, moral and political implications, but what is the legal position?

Someone asked me today whether Sir Geoffrey Palmer was correct when he said Andrea Vance would not even have been able to get copies of her own phone records from the Parliamentary Service , and I said surely that was not the case. But when I went back to it …. it’s not that straight forward!

So – I got it wrong, and now I want to try and atone.

To the start.  David Henry was given terms of reference for his inquiry. Here they are

First question.  Is the inquiry subject to the Privacy Act? “Agencies” are subject to the Privacy Act.  Various sorts of commissions of inquiry and committees of inquiry are exempt from the definition of agency, but David Henry’s doesn’t fit those exemptions, so he is an agency, and he is subject to the Privacy Act.

He asked for, and collected a whole lot of personal information. Is that consistent with the Privacy Act? Yes. there seems to be some debate about what he asked for and what he didn’t, but lets assume he did ask for Peter Dunne’s and Andrea Vance’s emails, and telephone records. The Privacy Act says he is only allowed to collect information necessary to carry out his lawful functions, he should get it from the person concerned (where practicable) and he should not do so by unlawful or unfair means.

When you look at the terms of reference, it is clear that he had a lawful purpose to ask for all information which might have helped him establish how Andrea Vance got an early copy of the Kitteridge report. Peter Dunne refused him access to some of his emails, therefore it was not practicable to get them from him directly, and the same goes for Andrea Vance, therefore no breach of the “collection” principles.

Whatever information he received, he was entitled to use for the purposes for which he collected it.  I haven’t seen anyone suggest he leaked information to Winston peters or anyone else, so it seems he only did what he was asked to do. Therefore there is nothing to suggest a breach of the Privacy Act.

It remains open for people to say he shouldn’t have asked for or collected information revealing a journalist’s movements or sources (if he did), but there was nothing in law preventing him from doing so.

David Henry had no powers to compel anyone to give information, so it was open to anyone to say “get stuffed” as Peter Dunne did, and live with the consequences.

Without any power to compel the production of information, David Henry needed to rely on the cooperation of other parties.  In order to cooperate in the absence of any legal obligation to disclose, Ministers, Parliamentary Service and others needed some authority to hand over information to the inquiry.

If an agency that is subject to the Privacy Act voluntarily hands over personal information, they need to be satisfied that doing so is consistent with the purposes of collection, is authorised by the individual concerned, or is necessary for the maintenance of the law (or one or two other exceptions).

The Parliamentary Service held copies of emails, and of security card records of both Peter Dunne and Andrea Vance. All of that is personal information. But the Privacy Act does not apply to the Parliamentary Service (except in a limited sense, relating  personal information about employees). Therefore, however you feel about what they should have done, giving all the information to the inquiry, even emails, could not be a breach of the Privacy Act, so no remedy for Dunne/Vance. There might be  a Privileges Committee inquiry, changes to procedures, or even to Standing Orders, but in respect of the Parliamentary Service, no one gets to claim a cent.

Any other options? Well, it seems that the Department of the Prime Minister and Cabinet (which is of course a department of state, meaning public servants, and quite different from the Prime Ministers Office, which is staffed by political appointees) provided secretariat services to the Henry inquiry.

In that capacity, they received details of emails and phone records from the Parliamentary Service, in order to pass on to the inquiry. DPMC is definitely an agency to which the Privacy Act applies, so if they received that personal information from Parliamentary Service, could they be liable?

Probably not. First thing, it seems they would have received that only on their capacity as supporting the inquiry, therefore passing the information on would have been the purpose for which the collected it, therefore not in breach of the Act. Then there is s.3(4) of the Privacy Act:

For the purposes of this Act, where an agency holds information—

(a)solely as agent; or

(b)for the sole purpose of safe custody; or

(c)for the sole purpose of processing the information on behalf of another agency,—

and does not use or disclose the information for its own purposes, the information shall be deemed to be held by the agency on whose behalf that information is so held or, as the case may be, is so processed.

Finally, if the emails were received by DPMC and/or the inquiry but not read or used, as has been claimed there would not have been (according to case law) a disclosure.  Disclosure needs someone to see it.

Did I say finally? Well no – here it is.  To bring a complaint under the Privacy Act, Peter Dunne and/or Andrea Vance would have to show that they had suffered some actual loss or damage, or significant injury to feelings, or significant loss of dignity or humiliation.  ON the facts available at the moment, they would fail because however righteous their current indignation, it is not caused by the disclosure or use of personal information.

The Privacy Act is not going to help.  Clearly the media and MPs and parliamentary officials  are going to want to ensure that clear boundaries are established delineating the legitimate use by the executive or its agents of parliamentary information, but the legal options for the parties here seem to me to be nil. The tort of privacy will not work, because there has not been a “public disclosure of private facts”.

This is primarily a political, rather than a legal matter, and does not engage legal remedies.  Constitutional issues, such as the relationship between the media and the Parliamentary Service, and between them and the Executive when inquiries of this nature obviously have legal issues at their core, and much should be learned from these events, but no one is going to win a lawsuit in this thing.

An Alternative to Defamation? Stephenson v NZDF redux

While Jon Stephenson is considering his options after his phyrric victory against the New Zealand Defence Force, here’s another one.

Stephenson did not get a verdict in his defamation case against NZDF, despite the fact they conceded he had been at the base he said he had been at and did interview the commander as he reported.

He might be thinking that Voltaire’s fate awaits him if he pursues the defamation claim “I was never ruined but twice; once when I lost a lawsuit and once when I won one.”

There could be a cheaper option. It didn’t occur to me at first, because mostly defamation cases are bought against the news media, and they aren’t subject to the Privacy Act, but a very learned colleague made the suggestion that Stephenson could pursue a claim under the Privacy Act. And he could!

Information privacy principle 8 is one of my favourites, for its elliptical drafting, and layered multi clause qualifications, however if you can get past all the commas and conditions, its application to Stephenson’s case is obvious:

An agency that holds personal information shall not use that information without taking such steps (if any) as are, in the circumstances, reasonable to ensure that, having regard to the purpose for which the information is proposed to be used, the information is accurate, up to date, complete, relevant, and not misleading.

Let me unpack that for you.  NZDF is an agency.  They used personal information about Jon Stephenson. It was wrong.  Stephenson suffered harm (not the least being the legal fees expended in obtaining the NZDF concessions).  Did they do anything more than a kneejerk denial of Stephenson’s claims? Did they check with the Commander, with the base, did they ask Stephenson? If they did none of those, they can’t really claim to have taken “all reasonable steps” to check that the information they based their press release on, was accurate. Slam dunk?

Torture in the neighbourhood – We cannot look away

So stupid.  An instinctive act of dumb that lead to one of the most shameful and powerless moments of my life.

There I was, passing a couple of bucks over the counter at a cinema in downtown Lima when a hand whipped out, grabbed the notes, and disappeared out into the street.

I gave chase.

It was 1987 and the Police were on strike.  The army were filling in.  I ran past a platoon of them, pursuing the petty criminal down a dark sidestreet. I stopped.  It wasn’t worth it. It was only a couple of bucks, and I was heading into dangerous unlit territory.

But behind me was the sound of a dozen or more soldiers’ boots.  For them the equation had been simple.  A gringo, in hot pursuit of a street urchin.  No doubt about who the guilty party was, and an opportunity to showcase law and order in a filthy, lawless and disorderly city.

They stopped beside me, shouldered their weapons, and started firing down the street over the head of my erstwhile pursuit, heedless of the safety of the curious onlookers peering over their balconies.

I shouted at them to stop, and tried to get them to abandon the chase, but some line had been crossed, and now I was committed.  I had to accompany them to identify the offender.

At the end of the street the soldiers entered a still open commercial building, and searched floor by floor until a quivering teenager was plucked from a hiding place on the top floor.  He was presented to me to identify, and being unfamiliar with the grave consequences of such moral choices, I chose the truth instead of the lie that would have spared him what followed.

He was thrown into the back of an armoured personnel carrier.  I was ordered in after him with my companion.  We had seats.  He crouched on the floor where he was repeatedly struck with a chain, and had his head bashed against the thick steel interior plating.

At the army barracks some distance away (where the hell were we? we had no idea – we just knew that it was a long way from where we were supposed to be, that it was close to curfew, and that we were in the company of heavily armed, ill-disciplined sadistic soldiers) the “suspect” was subjected to a further interrogation, which meant the same questions delivered behind a screen from where we were, punctuated only by the sounds of rifle butts and fists on flesh, followed by cries of pain and denials, and accusations about lying gringos.

After a time, the young offender was bought out, paraded in front of us dressed only in his filthy Y-fronts, into which he had secreted the snatched bills.  He was bruised and shaken and his face swollen, and tearstained. Anxious to get back across town before the breach of curfew would render us open to the same treatment, I gingerly accepted the crumpled notes from the proud soldier who had overseen their recovery. I mumbled “gracias”. “De nada.” he replied, “Es nuestro trabajo”; It’s our job.

When you witness a breach of human rights you feel soiled, and powerless.  You feel scared that if you speak up you could be for the same treatment. But if you do not you are diminished. And those that carry out such acts are emboldened.

We should condemn the actions of those that beat these men in Fiji, and should as individuals and as a nation demand that the Fiji Government investigate and hold the perpertrators to account. We should not look away.









They aint called “private servants” – why public servants get less privacy.

A couple of weeks ago the chief executive of the New Plymouth District Council wrote a piece for the Taranaki Daily News entitled “Why we keep our counsel”.

It’s a rare example of a public official publicly defending and justifying a decision to refuse to release information.  Obviously feeling that the criticism from interest groups (“ducking” inquiries, “playing the privacy card”, and of “bureaucratic stealth”) were unfair and ill-informed, she has taken the time to explain some of the difficult balances that have to be made by someone in her position between accountability to the community, and responsibilities to staff and others, and the ability of Council to get stuff done.  She should be applauded for her openness and recognition that her community does deserve an explanation when it is necessary to keep information from them. I don’t want to detract from that – but she’s also got it wrong in a couple of respects.

In particular, she implies that her obligations as a “good employer” trump Council’s obligations under the Local Government Official Information and Meetings Act (LGOIMA).  The opposite is true.

More significantly, it is a misstatement to say that the LGOIMA requires a council to withhold information to protect the privacy of employees.  

The Act (like its central government counterpart, the OIA) allows but never requires the withholding of information in order to protect privacy.  There will be occasions when that will justify withholding information about staff, but that is always subject to the need to balance the public interest in releasing the information.  If a chief executive released information about staff, in good faith under the LGOIMA, or OIA, they would be be protected from any liability, including for a breach of privacy by ss. 41 and 48 respectively.

The Ombudsman has just released a report reaffirming the position that an employee’s name, associated with work they are undertaking in their official capacity should not typically be withheld on privacy grounds In that case the Sunday Star Times asked Pharmac for documents about a decision to fund a drug.  When they received them the names of staff involved in the decision had been deleted.  The Ombudsman found:

The names of officials should, in principle, be made available when requested. All such information normally discloses is the fact of an individual’s employment and what they are doing in that role. Anonymity may be justified if a real likelihood of harm can be identified but it is normally reserved for special circumstances such as where safety concerns arise. 

I don’t want to be too harsh on the chief executive of the NPDC, because her opinion piece does not say what information the paper had sought.  You would not expect for example to receive all warnings, or performance plans of staff or the like, and a decision to prefer privacy over publicity in such a case would normally be entirely proper.

However it is surprising how prevalent misconceptions are about the OIA & LGOIMA generally, and in particular about the status of staff under the freedom of information Acts.  In 2005 I wrote a paper about the divergence between the apparently accepted legal position, and the increasing practice of withholding staff members’ names, whether or not there was anything particularly private  about them.  That paper was published in the New Zealand Law Journal, and you can read it here   

If you are in local government, and would like to learn more about how to keep up with the myriad of laws affecting the information you hold, click here, and if you are a public servant in central government, and want to avoid the public opprobrium heaped on ACC, MSD and the Ministry of Education (among others) last year, click here

Privacy You Can Bank On

Y’know what?  The Privacy Act doesn’t protect you as much as you thought it did!  For a whole bunch of reasons.  First, it is subservient to other laws, second, people who collect your personal information get to write their own rules, third, in some cases it offers less protection of personal information than what was the case before it came along.

Banking is one of those areas.  Here’s an interesting article reporting on the practice of banks routinely handing over personal information to the Police without a warrant  

How do they do that?  Well the part of the Privacy Act that says agencies aren’t allowed to disclose personal information says “unless they believe on reasonable grounds that the disclosure is necessary for the maintenance of the law”.

But do not fear!  All this means is that when you complain to the Privacy Commissioner about a bank disclosing your personal information to the Police, the bank can put its hand on its heart (*choke*) and say “I believed on reasonable grounds that there was an exception to information privacy principle 11, and therefore we are not liable”, and the Privacy Commissioner might go away.

The bank’s problem however, does not.  I had a case like this a few years ago, when a bank let one of its staff take transaction information of one of its customers into a judicial hearing about a dispute between the employee and the customer.  The bank took advice and maintained that its actions were not a breach of the Privacy Act because the disclosure was “necessary for the conduct of proceedings”, which is yet another exception to the “do not disclose” rule.

I told the bank I didn’t care about that, because we weren’t going to take a Privacy Act complaint, we were going to sue them for breach of confidence.

The relationship between a banker and a customer has been known to the common law as being of a strictly confidential nature for centuries.  Nothing in the Privacy Act affects that duty of confidence, or the right of a customer to sue where that duty is breached.

Of course a customer couldn’t sue for breach of confidence if the bank was complying with a court order, like, I dunno, a warrant, so banks that decide just to cooperate on the sayso of Police without some proper judicial oversight are taking a real chance.

I don’t think banks should necessarily force the Police to get a warrant where the Police are desperately trying to locate a missing person and need to know whether the account has been active during the period of absence, but banks really do need to be a little more cautious than the NZ Herald article and Privacy Commissioner imply they are being.

Oh – by the way, my client in the case I mentioned above got a very handsome settlement for the disclosure that was not a breach of the Privacy Act.




Worried about Hell Pizza? Help is on the way – the Law Commission’s New Media Bill

The Law Commission has reported on its “New Media” brief  This has been reported as the “cyber-bullying” report, and has generated a bit of commentary on the desirability of legislating against hurtful speech

The Law Commission has drafted a Bill for the Government called the Communications (New Media) Bill.  At 39 clauses, its pretty short, and nearly half of those sections will be split out to become Privacy Act, Harassment Act,  Summary Offences Act, Crimes Act and Human Rights Amendment Bills.

Yes the idea of prohibiting and punishing speech which causes emotional distress is there, and critics are right to be wary of such a vague intrusion into online discourse. But there hasn’t been much discussion of the mechanics.  There’s the “approved agency” (which looks very much like the “insert “NetSafe” here” clause).  When designated, the approved agency will help resolve problems and disputes, liaise with schools and ISPs.  This might include requesting take-downs of offensive material.  Ultimately they can refer matters to the tribunal.

The tribunal will be chaired by a District Court Judge, and make any one or more of the following orders:

(a) an order requiring that material specified in the order be taken down from any electronic media:

(b) an order to cease publishing the same, or substantially similar, communications in the future:

(c) an order not to encourage any other person to engage in similar communications with the complainant:

(d) a declaration that a communication breaches a communication principle:

(e) an order requiring that a factually incorrect statement in a communication be corrected:

(f) an order that the complainant be given a right of reply:

(g) an order to apologise to the complainant:

(h) an order requiring that the author of a particular communication be identified.

Those orders can be made against the defendant, and ISP, a “website host”, or any other person.

In carrying out its functions the agency and tribunal will have to take into account 10 “Communication principles”.  What are these?

Principle 1

A communication should not disclose sensitive personal facts about an individual.

Principle 2

A communication should not be threatening, intimidating, or menacing.

Principle 3

A communication should not be grossly offensive to a reasonable person in the complainant’s position.

Principle 4

A communication should not be indecent or obscene.

Principle 5

A communication should not be part of a pattern of conduct that constitutes harassment.

Principle 6

A communication should not make a false allegation.

Principle 7

A communication should not contain a matter that is published in breach of confidence.

Principle 8

A communication should not incite or encourage anyone to send a message to a person with the intention of causing that person harm.

Principle 9

A communication should not incite or encourage another person to commit suicide.

Principle 10

A communication should not denigrate a person by reason of his or her colour, race, ethnic or national origins, religion, ethical belief, gender, sexual orientation, or disability.


I was pretty surprised that they did not begin with a positive statement of freedom of expression, as guaranteed under the NZ Bill of Rights Act.  Sure, later in the BIll it says that the Tribunal needs to take freedom of expression into account, but isn’t it a bit strange to have 10 completely negative principles? Every one of them tells of something a communication “should not” do.

Lets look at each one.

Principle 1 is not new, in that it repeats the fundamental principle in the Privacy Act.  But it goes way further.  First, the Privacy Act does not apply to the news media “in relation to their news gathering and dissemination activities“.  Secondly, later on the Bill significantly reduces the Privacy Act exemption from information held in ones personal, domestic or family capacity.  Thirdly, the Bill also later waters down the “publicly available publication” exemption from the prohibition on using or disclosing personal information.  Under current law, if I disclose personal information contained in a publicly available publication, it cannot be a breach of the Privacy Act.  Under the Bill, you could be liable for disclosing material from a publicly available publication unless you can prove that “in the circumstances of the case it would not be unfair or unreasonable to use the information“.

It is hard to argue against Principle 2‘s prohibition against threatening intimidating or menancing communications.  That proposal simply updates existing law to reach modern communications.  But aren’t those offences that are the domain of the Police?

Principle 3‘s subjective “grossly offensive” test could force a rethink of Hell Pizza’s marketing strategy, but what else might it catch?

Principle 4‘s prohibition on indecent or obscene communications simply aligns communications with a range of other publications, and does not really materially change the landscape.

Likewise, Principle 5 ensures that harassing communications are subject to the  same sanctions as other forms of harassment.

Principle 6 pretty much reprises defamation (without the troublesome need to prove the subject’s reputation or standing in the community has been harmed as a result).

Principle 7 codifies the common law against breach of confidence, and might in fact afford a more accessible remedy than the court proceedings now required.

Principle 8 extends the prohibition against causing “harm” to those who incite another to send a harmful message. It requires an intention to cause on the part of the inciter to cause the harm to the third party, so is quite a high threshold, and therefore not necessarily objectionable. However what does it mean that this is a “principle”.  To me, a prohibition against an intentional act, is either an offence, or it is not. It seems an odd construction.

Few would argue against Principle 9‘s prohibition against incitement to suicide.  But again, should or need something so obviously criminal be described as a mere “principle”? Should such complaints about content be the subejct of “resolution”, and subjected to the jurisdiction of a tribunal, or referred directly to the Police?

Principle 10 too, brings into the realm of “communications” the restrictions already present in the Human Rights Act.  

The Tribunal will be able to make rulings where it finds these principles have been breached, and that the breach has caused or is likely to cause significant harm.

Lots more analysis will be required of how these principles are enforced against ISPs website maintainers and bloggers however I suspect KiwiBlog, WhaleOil, and others whose online presence generates content and comments which sometimes crosses the line from robust might well be pondering the cost of moderating and monitoring, to avoid the cost of interventions by the Tribunal and “approved agency”, and wondering whether this might have a chilling effect on their and their audience’s freedom of speech.

The Government will respond to the Law Commission’s recommendations, and then we can all tell the Select Committee whether they’ve got the balance right.  Based on experience from a range of other complaint based organisations, my pick would be that the “approved agency” and Tribunal will have an enormous caseload, very quickly.  And the complainants will include the group intended by the policy makers, the vulnerable and their families and advocates, but they will have to fight their way past the axe grinders, the lobby groups and political interests presented with a new, cheap, and readily accessible forum for advancing their grievances and personal hobby horses.