Employers beware: when does providing a reference become unauthorised disclosure of personal information?
The Human Rights Review Tribunal (HRRT) considers the importance of authorisation before disclosing personal information about an employee.
Director of Human Rights Proceedings v Katui Early Childhood Learning Centre Limited [2019] NZHRRT 55 provides an example to employers that references about employees should only be provided when the employer is aware it has express authority to do so.
The key issue that was considered in this case was whether the employer breached Privacy Principle 11 of the Privacy Act 1993 (Act) by discussing an ex-employee with a potential employer, and if so, whether there was an interference with the employee’s privacy that caused harm.
Background
Ms Gin-Cowan (GC) was employed at Katui Early Childhood Learning Centre (Katui) between May 2010 and February 2015. During GC’s employment with Katui there were a number of issues that arose between Katui and GC, resulting in multiple disciplinary meetings.
In January 2015 GC learnt of a job opportunity for a Centre Supervisor at Waatea Early Childhood Centre (Waatea), which is operated by Te Whare Wananga o MUMA (MUMA). GC interviewed for the position on 3 February 2015 with Ms Rangiheuea and Ms Greenwood. The next day GC returned to Waatea and signed an individual employment agreement (IEA) provided by Ms Greening for the position. The IEA was not signed on behalf of MUMA.
On the basis that GC understood she had accepted employment at Waatea, she resigned from her position at Katui on 5 February 2015. That evening MUMA requested a copy of GC’s curriculum vitae (CV), which GC hastily prepared and provided to MUMA. On GC’s CV she named a Katui employee, Erana Tahere, as her referee and provided Ms Tahere’s contact number as the telephone number for Katui.
Around 9 February 2015, Ms Rangiheuea of Waatea rang Katui and asked to speak with GC’s reference, Ms Tahere. Ms Smith answered the call and advised that Ms Tahere was away on sick leave, and that Ms Smith was the Acting Centre Manager. Ms Rangiheuea asked Ms Smith if she would provide a reference for GC. Ms Smith declined to provide a reference on the basis that she did not get on with GC. Ms Rangiheuea asked whether Ms Smith would re-employ GC, which Ms Smith answered no, and directed Ms Rangiheuea to speak with Katui’s owner, Mrs Matthews.
Ms Rangiheuea then rang Mrs Matthews. There is some dispute over what the conversation contained, however, Ms Rangiheuea said that Mrs Matthews described GC as unreliable, often late to work, and generally having unsatisfactory work habits.
GC attended Waatea on 9 February 2015 on the understanding that she would begin her new role that day. However, Ms Rangiheuea advised GC that her references had not been favourable and MUMA would not be proceeding with GC’s employment. Ms Rangiheuea also noted that, as far as Waatea was concerned, GC had not been hired.
GC brought a personal grievance against MUMA for unjustified dismissal, which the Employment Relations Authority found in GC’s favour. However, given that the IEA contained a three month trial period, the personal grievance was ultimately unsuccessful. On 26 March 2015, GC complained to the Privacy Commissioner about the disclosures that Katui made about her to MUMA. The Privacy Commissioner considered that there had been a breach of Principle 11, and an interference with GC’s privacy.
Privacy proceedings
In October 2016, the Director of Human Rights Proceedings filed proceedings in the HRRT under the Act to determine whether:
- there had been a breach of Privacy Principle 11, causing an interference with GC’s privacy; and
- the disclosure of personal information caused GC harm.
Interference with privacy?
Katui disputes that the information provided by Ms Smith and Mrs Matthews to MUMA was personal information. Katui also submitted that Katui believed on reasonable grounds that GC had authorised Katui to disclose personal information about her to MUMA, by providing Katui’s contact number on her CV.
Katui sought to rely on section 87 of the Act, which provides an exception to the breach of information Privacy Principles.
Did Katui have reasonable grounds of belief?
There was disagreement between the parties as to whether Katui could reasonably believe that GC had authorised the release of her personal information to MUMA.
Katui’s position was that GC authorised Katui to answer Ms Rangiheuea’s questions about her by supplying the number of the centre on her CV.
GC countered that Ms Smith could not have reasonably believed that GC had authorised her to speak with Ms Rangiheuea’s about GC. Due to difficulties with their working relationship, GC had previously informed Ms Smith that if she wished to formally communicate with GC about her performance, Ms Smith must do so through Mrs Matthews. Additionally, GC pointed to Ms Smith’s refusal to provide a reference for GC. As Ms Smith was the person who supplied Ms Rangiheuea with Mrs Matthews’ details, Mrs Matthews also could not have reasonably believed that GC had authorised Mrs Matthews to disclose her personal information to Ms Rangiheuea.
Accordingly, the HRRT found that Ms Smith could not hold any reasonable belief that GC had authorised Ms Smith to disclose GC’s personal information. Similarly, the seriousness of the employment issues between GC and Mrs Matthews precluded the HRRT from finding any reasonableness in Mrs Matthews’ expectation that she had authorisation to discuss GC’s personal information.
Katui failed to satisfy the onus of proof that it held reasonable belief that Katui could disclose GC’s personal information.
Did the disclosure cause harm?
GC had to establish that Katui’s breach of Principle 11 caused GC harm in accordance with the terms sets out in section 66(1)(b) of the Act. GC claimed that the disclosure of her information caused her pecuniary loss, adversely affected her rights, and resulted in significant humiliation.
The key loss claimed by GC was the loss of her employment with MUMA. However, MUMA disputed that GC had in fact been employed. MUMA’s position was that the IEA provided to GC had not been signed by MUMA, and no formal offer of employment had been made. A senior position, such as the role that GC had applied for, required written references to be sighted by MUMA before employment could be offered.
The HRRT was unclear whether GC had commenced employment with MUMA. However, the HRRT considered that MUMA would have required satisfactory references before employment would have been offered to GC. GC was unable to provide an alternative reference to MUMA after Katui disclosed GC’s personal information. An alternative reference may have resulted in MUMA offering GC the position. Accordingly, the HRRT found this was a loss or detriment in terms of the Act, and an interference with GC’s privacy had been established.
Remedies
GC sought a declaration that Katui had interfered with her privacy, an order requiring Katui to attend an online privacy workshop, and damages for lost wages, loss of benefit and humiliation.
The HRRT determined GC was entitled to a declaration that Katui interfered with her privacy. However, an order for training was not made, as both Ms Smith and Mrs Matthews had ceased working for Katui.
GC was unable to establish that she would have been able to provide an alternative reference to MUMA to secure or maintain employment at Waatea. Accordingly, damages for lost wages were not awarded. Similarly, damages for loss of benefit were also declined, as GC did not take appropriate steps to mitigate the risk that MUMA would speak to someone other than Ms Tahere when she provided Katui’s contact number on her CV.
The HRRT accepted that GC suffered significant humiliation, loss of dignity, and injury to her feelings as a result of the interference with her privacy. However, the HRRT considered that those feelings were largely attributed to GC’s own actions, and those of MUMA, rather than the privacy breach by Katui. In recognition that only a minor part of the injury to GC’s feelings were attributable to the breach of Principle 11 by Katui, damages of only $3,000 were awarded against Katui.
Employers: take care when providing a reference
There is an inherent risk of breaching the Privacy Principles when employers provide any information about their employees to unknown sources.
For the avoidance of doubt, it is recommended that employers should only provide references about employees where the employee has expressly made the employer aware that they may be contacted to provide a reference. If an employer is contacted for a reference, best practice may be to confirm with the employee that a reference can be provided, before disclosing any information to the potential employer.
Want to know more?
If you have any questions about your employment or the Privacy Principles, please contact our specialist Employment team here.
This article along with many others were included in the June edition of our Employment Newsletter.