Parents, whānau, and staff members will sometimes ask the school for information held about a person or an event. Requests for information are often made by a person in dispute with the school, and schools can also face requests for information from the media.
The Privacy Act 2020 (covering personal information) and Official Information Act 1982 (‘OIA requests’ for information held by the school) set out specific rules and requirements for how such information requests are to be managed. It is important that the school complies with these legal requirements.
The Human Rights Review Tribunal (the Tribunal) has recently highlighted the consequences a school board could face if it is found not to have complied with the Privacy Act in responding to a request for information.
Facts
In this case, the parents, who were in dispute with the school, made three information requests to the Board under the Privacy Act.
The parents were dissatisfied with the Board’s responses to these requests, and filed a claim in the Human Rights Review Tribunal. They said the Board had interfered with their privacy by refusing to provide the personal information they had requested, and sought significant financial compensation.
Human Rights Review Tribunal
In determining the parent’s claim, the Tribunal first had to assess whether the Board had responded to the requests for personal information in accordance with the Privacy Act. In this instance the Board had failed to meet its legal obligations.
In brief, the Tribunal found that the Board had failed to comply with the statutory timeframes for responding to the first and second requests, and therefore did not comply with the Privacy Act.
The Board’s subsequent refusal to provide information under the parent’s third request, on the basis that the parents would not meet with the Board, also breached the Privacy Act. The Tribunal noted that the Privacy Act sets out the specific grounds on which an information request can be refused, and not attending a meeting was not a valid reason.
The Tribunal finding that the Board had not complied with the Privacy Act in respect of all three requests, is not, however, the end of the inquiry. A failure to comply with the Privacy Act only gives rise to a remedy if it results in an ‘interference with privacy’.
The finding that the Board had not complied with the statutory timeframe in respect of the first two requests, meant the Board was deemed to have refused to make the personal information available. In relation to the third request, the Board had explicitly refused to make the information available. The Tribunal considered that there was no proper basis for the Board to refuse to provide the personal information and therefore, there had been an interference with the parent’s privacy and they were entitled to a remedy.
Remedies
The parents were awarded a total of $25K in damages for ‘humiliation, loss of dignity and injury to feelings’ as a result of the Board’s failures to comply with its obligations under the Privacy Act.
Key takeaways
Considering and responding to requests for information can be difficult and time consuming, but they do need to be taken seriously. In some instances you may need to take advice before responding. This will support you, especially if you are having to search through extensive records about issues which caused stress at the time, and will minimise risk of further issues arising. You will need to check, for example, that you are not breaching anyone else’s privacy when releasing information.
While this case focused on non-compliance with the Privacy Act, it is important that requests under the Official Information Act are taken just as seriously. A request for access to information does not have to specifically mention the relevant legislation for the rules to apply. The Office of the Ombudsman has advice about managing requests which appear ‘frivolous, vexatious, and trivial,’ but the threshold for refusing OIA requests is quite high. Being annoying or inconvenient is not, on its own, a good reason to refuse a request.
Your school’s privacy officer has specific duties under the Privacy Act, and must be familiar with the Act’s requirements. This includes working to ensure the school complies with the Act, so it is important that all staff understand their obligations.
Any information which has been collected and/ or recorded might be accessible under a request for information. There are some grounds on which information can be withheld, such as if it is legally privileged, but you are unlikely to be able to withhold a file note or email simply on the basis that its contents are unhelpful to you. It is wise to be cautious about what is put in writing in the first place, and to check that records are factual and appropriate.
If the information exists, and a request is made, you may have no option but to disclose.