Privacy law is one situation where employers and business owners can find themselves in a lot of trouble unexpectedly quickly.

Privacy can be the perfect storm because:

• The law is complicated,
• Easy to break, and
• Easy for someone to complain about.

The Office of the Privacy Commissioner was created by the law to investigate privacy breaches, undertake prosecutions where appropriate, and generally provide education and other resources relating to privacy.

Somebody whose privacy has been breached does not need to prepare legal proceedings or hire a lawyer to ma ke a claim for them.  They can simply contact the Privacy Commissioner who can do all the heavy-lifting.

Almost every person and business is covered by the Privacy Act, and should be particularly careful to ensure that they comply with its requirements.  These requirements are fairly numerous and detailed, but not especially hard to meet providing that you exercise a little care and prior attention.

• The requirements of the Privacy Act are too many and too detailed to discuss in this summary.  However we can advise that:
• Any information that you collect or otherwise hold about an individual is covered by the Privacy Act.
• There are rules around how that information can be collected, how it must be stored or disposed of, what it can be used for, who it can be disclosed to, and when the person it’s about can have access to that information or request that it be corrected.
• Any breaches of these requirements may be a breach of the person’s privacy and could lead to them making a complaint against you to the Privacy Commissioner.

A complaint to the Privacy Commissioner is only the first step.  If the Privacy Commissioner thinks that the situation is bad enough or if the individual is not satisfied with the result of the investigation, a claim may be made in the Human Rights Review Tribunal.

This should be concerning to you for a number of reasons; the two biggest reasons are that:

• Defending a complaint in the privacy commission will be time consuming and stressful for you;
• If you have legal representation (which is highly recommended) this will be a cost to you; and
• If nothing else, responding to a complaint will take you away from your core business; and
• If a complaint goes to the Tribunal there is a risk that an award of compensation could be made against you if you are found to have breached the person’s privacy.

One common mistake

There are a lot of ways that you could breach the Privacy Act.  One of the most common is by failing to respond to a request for information within the time limit.

If somebody requests access to their information you are required to provide copies of that information as soon as possible, but at least within 20 working days off the request.

If you don’t, this is something that could be the subject of a privacy complaint. While this is not necessarily terribly serious it does put you at a disadvantage and mean that you are in the position of having to explain yourself to a government agency.

Conclusion

Keeping ahead of privacy law is partly understanding your obligations, partly taking advance steps to ensure that you have privacy policies and procedures in place for your business, and partly responding to information requests or complaints in an appropriate way.

If you require assistance with any of these or have been contacted by the Privacy Commissioner about a complaint, we would be happy to consult with you to ensure that your business is not at risk.