Employee requests for information can be used to delay investigations
It has been just shy of three years since the Privacy Act 2020 came into force, replacing the 1993 legislation of the same name. The Act provides for, amongst other things, enhanced obligations and consequences for employers dealing with information requests and privacy breaches more generally.
We have seen that the information request provisions of the Act are being used by some employees in the course of disciplinary and investigation processes, presumably to delay and create risk for the employer rather than as a means to obtain assurances as to the protection of their privacy.
This approach is not unheard of, as it was used often under the previous legislation. In this article, we examine this recurring issue and ways to mitigate risk.
Broadly speaking, the Act governs the collection, storage, use, disclosure, access and correction of “personal information” by “agencies” through various Information Privacy Principles (IPPs) and sections of the Act. The key terms are, of course, “personal information” and “agency,” which are defined as:
The two terms are intentionally broad. Really, any information that directly identifies, or identifies by reasonable inference, an individual is considered personal information. Any party that has collected or holds that information is considered an agency.
Another article could feasibly be written on the requirements of the IPPs and the Act as to collection, storage, use, disclosure, and correction of personal information. For the purposes of this article, however, we focus on how the Act governs access to personal information. To summarise:
The reason for providing a pathway for individuals to access their personal information is sound. The information is about them and they should have access equal to the agency that holds it. While most individuals will utilise the access pathway for genuine reasons that are consistent with the purposes of the Act, we often see instances where requests are made for other motives.
The most common example occurs during an employer-run investigation or disciplinary process. During that process, the employee that is the subject of the investigation or process may request information under the Act, often about matters that have nothing to do with the subject of the process the employer is running. Concurrent to making the request, the employee may refuse to engage in the employer’s process until they have received their requested information.
The above approach puts the employer in a difficult position – whether it continues the process (and deals with the information request separately) or halts until it has met the employee’s demand. Related to this question, other risks can often be front-of-mind for employers:
The effect of such a request is disarray and often delay. It somewhat shifts the focus from being solely on the employee, to now shining on the employer as well. The prescriptive nature of the Act can often trip employers up when faced with this issue.
The first and most important way to mitigate risk is to take care when recording information, be that in emails, texts, notes or anything else written. The guiding principle is that any information about an individual is accessible. There are, however, limited exceptions to that principle. For example, if information is genuinely evaluative and is provided in confidence, it may be withheld.
As to dealing with a request for information during an employer-run process, there is no blanket “correct” approach. Employers can, however, make the issue easier for themselves:
Approaching the request as above will assist where the request is broad and covers a wide range of information. Generally, the majority of the requested information will not be relevant to the employer-run process, so separating that aspect of the request out early is essential. Separation, however, only ensures that the employer can proceed with the process. It does not mean the employer is absolved from actually addressing the request.
An employer can extend the timeframe for responding to a request. There is no absolute limit to how long an extension can be for, but it is generally common sense how long assessing a request will take. When considering an extension, think about the amount of information sourced, the potential storage areas for that information and the internal resources to collate and review information. If it is likely that a large extension is necessary, it is entirely reasonable to write to the employee and offer them the opportunity to refine their request. If the employee is keen to obtain their information sooner, they will be motivated to make their request more specific.
Finally, employers need to be mindful about what they provide to employees in response to a request. Any information that concerns other individuals may well be necessarily withheld or redacted, otherwise risking unwarranted disclosure of someone else’s personal information. Further, any privileged or commercially sensitive information may also need to be withheld.
Matt Hutcheson is an associate specialising in employment law and health and safety at Duncan Cotterill in Auckland.
