Under the Health and Safety at Work Act 2015, employers and workers have an obligation to ensure that workplace bullying is adequately addressed. Employers must, so far as reasonably practicable, ensure the health and safety of workers in the workplace. This includes having a workplace free of bullying. And employees must take reasonable care of the health and safety of themselves and take reasonable care not to adversely affect the health and safety of others.
All this includes taking steps to ensure there are robust workplace bullying, harassment and discrimination policies in place to prevent such behaviour in the workplace. And if a complaint is made and an investigation is necessary, the employer needs to understand what information it is and is not entitled to disclose to the parties involved.
If an employee is dissatisfied about the way their personal information is being handled by their employer, the employee may make a complaint to the Privacy Commissioner. An employee may make a complaint that one or more of the 12 core information privacy principles established under the Privacy Act have been breached. These principles cover situations involving how personal information should be collected and handled, storage of personal information, disclosure of personal information and more. Broadly speaking, any complaint made to the Privacy Commissioner usually concerns wrongful holding, collection, use or disclosure of personal information, which makes the Privacy Act a particularly pertinent issue for employers to consider during workplace investigations.
When cannot an employer withhold information?
Information Privacy Principle 6, titled “Access to personal information” provides that individuals have the right to access information that employers (agencies) hold about them:
“Where an agency holds personal information in such a way that it can readily be retrieved, the individual concerned shall be entitled—
(a) to obtain from the agency confirmation of whether or not the agency holds such personal information; and
(b) to have access to that information.”
However, when employees request information relating to a bullying investigation they were involved in, the employer will need to consider whether there are any grounds to refuse this request. One ground for refusal relates to the need to balance the privacy interests of the individual who requested the information against the privacy interests of other people who were involved. In other words, as per s 29(1)(a) of the Privacy Act, the employer needs to determine if disclosing the information would involve the unwarranted disclosure of other people’s affairs.
In its recommendation, the Office of the Privacy Commissioner noted examples where agencies had refused to disclose an investigation report to an employee despite the fact that the terms of reference in the report provided that the complainant would receive a copy, and the report contained the employee complainant’s personal information. These reasons will generally be unjustified reasons for withholding a report, especially as information in the report about others can often be redacted. This point is illustrated by the Watson case.
Watson v Capital & Coast District Health Board  NZHRRT 27 was a Human Rights Review Tribunal (HRRT) case involving an employer which withheld personal information from a complainant. Ms Watson was a registered nurse employed by the Capital & Coast District Health Board (CCDHB) and lodged a harassment complaint against her line manager, Ms Slade. Ms Watson’s manager provided a response to the bullying allegations, which contained personal information about Ms Watson. Ms Watson then sought access to this response under principle 6 and contended that the CCDHB infringed her privacy rights by failing to disclose personal information held by the CCDHB which concerned her. The CCDHB argued that it could withhold this information on the basis that disclosure would have involved the unwarranted disclosure of Ms Slade’s affairs, pursuant to s 29(1)(a) of the Privacy Act. The issue, in this, case was whether the CCDHB justifiably refused to disclose the requested information.
The CCDHB had a workplace harassment prevention policy which detailed the process involved in disclosing information to the parties connected with the investigation, in the interests of procedural fairness and to permit the complainant to rebut Ms Slade’s response. However, the CCDHB did not follow its own process and refused to release information to which Ms Watson was entitled under its policy. The HRRT found that the CCDHB had interfered with Ms Watson’s privacy, ordering it to pay Ms Watson $10,000 for humiliation, loss of dignity and injury to feelings and $5,000 for loss of benefit due to the non-disclosure of personal information.
Another insufficient reason for withholding information relates to employers’ concerns about the information being released to social media or other forms of publication. The Office of the Privacy Commissioner stresses that this is an unjustified reason for withholding information under the Privacy Act. However, this concern could be resolved by releasing the information with conditions prohibiting the disclosure of the information, or by offering limited viewings of the information in a controlled environment.
When can an employer withhold information?
The Office of the Privacy Commissioner also gave examples of instances where it may be justified for an employer to withhold information from an employee.
One example is where the information in question has been compiled for, and only for, employment-related “evaluative” purposes, and where an express or implied promise has been made to the employee that their identity or information would remain undisclosed. Section 29(1)(b) of the Privacy Act provides that, “if the disclosure of the information or of information identifying the person who supplied it, being evaluative material, would breach an express or implied promise”, then the employer may justifiably withhold information.
“Evaluative information” is defined to be evaluative or opinion material compiled solely for the purpose of determining the suitability, eligibility, continuance in employment, promotion (and other employment-related purposes) of the individual to whom the material relates.
This means that if the information in the report was compiled solely for the purpose of investigating whether the alleged bully ought to continue in employment then it can be withheld. However, in most cases, the report will involve a collection of information about what actually happened and to investigate the bullying complaint, not just to determine if the alleged bully should continue in employment. This means it will be unlikely that most investigation reports can be withheld on this ground.
Key recommendations from the Privacy Commissioner’s Office:
Set clear terms of reference during a workplace bullying investigation — particularly about who will get access to the final investigation report, and when.
The complainant is entitled to know the outcome of their investigation as it concerns them, but not necessarily about all information pertaining to others.
Just because the information sought by the complainant also contains information about others does not mean that disclosure can be automatically refused.
The Office of the Privacy Commissioner has made clear in its recommendation that from a natural justice perspective, a complainant should be able to learn the outcome of their investigation. An employer should strive to keep the complainant informed about its progress throughout the investigative process.
In effect, the Privacy Act requires that in most cases those who make a workplace bullying complaint are entitled to know what was said about them by the alleged bully, witnesses or managers.
Employers can minimise the risks of the Privacy Commissioner’s involvement by implementing robust workplace policies around bullying and harassment, and ensuring the employer understands the privacy issues involved in the investigation process. Knowing when certain information can be disclosed during an investigation may make the difference between reaching a satisfactory resolution of privacy issues or being the subject of a privacy complaint to the Privacy Commissioner.
Information reproduced with permission of Wolters Kluwer