A recent case note from the Privacy Commissioner has highlighted the difficult balancing act that employers face when dealing with requests from complainants for information about employment investigations.
In this case, a former employee requested a copy of a draft investigation report into allegations of bullying that she had made against her manager. The employer provided the report but withheld some information that it believed necessary to protect the privacy of others, including the manager. The former employee sought a full copy of the report and took her case to the Privacy Commissioner.
After reviewing the case, the Privacy Commissioner determined that "most of the draft report's content was about the complainant" and consequently that "all personal information about the complainant should be released to her".
Why did the Privacy Commissioner make this decision?
The starting point is that under Principle 6 of the Privacy Act individuals are entitled to access all information that is about them. When it comes to complainants in the employment setting, much of the information gathered in response to their complaint will usually be considered personal information about them (even when it is also information 'about' another person). The complainant's right to access in such cases is therefore strong, with only limited grounds that might apply to allow information to be withheld.
What about the other privacy interests at play?
The challenge for employers is that investigation reports will never contain information that is just about the complainant. Investigation reports will invariably have mixed information from a number of sources, including information about the person who is the subject of the complaint and others such as witnesses. Employers therefore have to walk a careful line, as they will owe duties of privacy (and usually good faith) to all of these people, not just the complainant.
The law does, however, provide some flexibility. In particular, section 29(1)(a) of the Privacy Act enables employers to withhold personal information from a complainant if sharing that information would involve an "unwarranted disclosure of the affairs of another individual".
When will sharing information with the complainant amount to an unwarranted disclosure of another employee's affairs?
While there is no one size fits all, the types of factors that an employer might take into account when determining what information from a report can be shared include:
- What those involved were told in the first place: This factor was particularly important in this case, as the Privacy Commissioner focussed on the fact that the complainant had been told when discussing the Terms of Reference that she would have an opportunity to see the report (after privacy concerns had been addressed). The report itself had also stated "the respondent and complainant would have a full opportunity to comment on the draft report…".
Similar considerations were also deemed important in a previous Human Rights Review Tribunal decision, where the Tribunal highlighted that the employer's own policy explicitly stipulated that the complainant would have "an opportunity to rebut the defences" raised by the person complained about.
These cases demonstrate how important it is to be clear with all of those involved about what might happen to the information that is being gathered as a part of an employment investigation. This may already be addressed in an employer's policies but should also form part of the initial discussions that occur with those involved.
- How sensitive the information is: Regardless of what someone has been told at the outset of an investigation, when faced with a request an employer will always need to consider how sensitive the particular information being requested is. For example, information about another employee's personal circumstances, while relevant to the investigation, will often have a high privacy interest, such that it may become unwarranted to share that particular information with the complainant.
- What harm might occur if the information is shared: Connected to the above, the employer will also need to consider what harm might occur if certain information is shared. If, for example, the person who the information is about is unwell and sharing may put them at risk of harm, then this may well tip the balance, such that it will become unwarranted to share that information with the complainant.
The recent case note also indicates that certain factors are not likely to be sufficient in and of themselves to justify withholding information from a complainant. In particular, the Privacy Commissioner noted that in this case neither the fact that the draft report's findings were critical about the manager nor that he was not available to be consulted about the disclosure were sufficient reasons to justify withholding.
Want to know more?
The team at Buddle Findlay will soon be running a workshop on privacy issues in employment investigations. If you're interested let us know by emailing lisa.mccuish@buddlefindlay.com and we will keep you in the loop.
