Hammond v Credit Union Baywide  NZHRRT 6
The Human Rights Review Tribunal (HRRT) has in Hammond v Credit Union Baywide put significant value ($168,000) on the right not to have personal information disclosed to others. The decision is significant for the compensation awarded for humiliation, loss of dignity and injury to feelings, which, at $98,000 more than doubles the previous highest award under the Privacy Act, and for demonstrating that information is not necessarily "fair game" just because it has been placed on Facebook.
In 2012, Ms Hammond posted on Facebook a photo of a birthday cake she made for a friend. Both were former employees of Credit Union Baywide (NZCU Baywide). The cake had been iced with the words “NZCU FUCK YOU” and another expletive. Ms Hammond had set her privacy settings so that only her Facebook friends could access the photo. However, NZCU Baywide "unreasonably pressured" a junior employee, who was a Facebook friend of Ms Hammond's, to log into her account so that NZCU Baywide could obtain a screenshot of the photo. NZCU Baywide then disseminated the photo to its staff, recruitment agencies, and others, warning them not to employ Ms Hammond. It also contacted her current employer, encouraging him to fire Ms Hammond and saying that it would not process referrals from Ms Hammond, which would financially cripple that company.
Ms Hammond alleged NZCU Baywide had breached Information Privacy Principles (IPP) 1-4 (collection of personal information), and IPP 11 (disclosure of personal information), and that these breaches resulted in actionable harm (as defined in section 66 of the Act, and including significant humiliation, loss of dignity and injury to feelings).
The HRRT did not determine whether IPPs 1-4 had been breached because such breaches would not have resulted in actionable harm under section 66.
But the HRRT did conclude that NZCU Baywide had breached IPP 11 by contacting Ms Hammond’s employer, recruitment agencies and a human resources company, and sending them the photo, warning them against employing Ms Hammond, as well as emailing all NZCU Baywide staff about the Facebook post, her resignation and other related issues. NZCU Baywide apologised but the apology was considered "mechanical" and insincere.
In holding that those breaches caused harm under section 66, the HRRT found that NZCU Baywide's actions were intended to ensure that Ms Hammond would be unable to find employment in the region (or would at least find it very difficult) and her employment at her new place of work would be terminated. That caused economic loss to Ms Hammond, and she also suffered significant humiliation, loss of dignity, and injury to her feelings.
Ms Hammond was awarded a total of $168,000 in damages:
- The most notable part of the award covers humiliation, loss of dignity and injury to feelings. The HRRT noted that compensation for that type of harm could be loosely placed in three bands.
- At the bottom end, damages ranged from $5,000 to $10,000; the middle band ranged from $10,000 to $50,000; and serious harm would lead to compensation above $50,000. Ms Hammond's case was "severe" and justified an award of $98,000.
In addition to the damages award, the HRRT also ordered that NZCU Baywide be restrained from continuing or repeating the interference, that it send a retraction to the agencies and persons it sent warnings or comments to, that it delete the screen shot from its records, and that it apologise (properly) to Ms Hammond.
The HRRT noted that the case was "extraordinary". The decision too is important for a number of reasons:
- It sets a new high water mark for damages under the Act, while expressly disavowing any element of punishment or disapproval being incorporated in that award.
- It confirms that the Act applies to social media in the ordinary way. Thus, those collecting information from sources like Facebook must treat it with as much consideration as other information.
- It remains to be seen how significant privacy settings will prove in such cases. Ms Hammond's privacy setting was referred to several times but the importance of that setting was not expressly addressed. Clearly, however, the right to privacy is not waived merely by posting information online, at least where some control over that information is maintained through privacy settings.
Finally, the case serves as yet another warning of the damage that poor privacy management can do to a business. As the HRRT noted:
had NZCU Baywide paused for a brief moment to consider its obligations under the Privacy Act it would have been deflected from the high-handed and impulsive reaction which has led to the infliction of serious harm not only on Ms Hammond but also on itself, its staff, its image and reputation.
No doubt the size of the award, and the significant media publicity that has surrounded it, will information privacy an increased profile in the minds of the public and should encourage agencies to take real care in how they hand that information.
The case can be accessed here.
BACK TO TOP
This publication is intended only to provide a summary of the subject covered. It does not purport to be comprehensive or to provide legal advice. No person should act in reliance on any statement contained in this publication without first obtaining specific professional advice.