Privacy Commissioner finds Westpac breached Nicky Hager’s privacy

Nicky Hager’s complaint against Westpac has been upheld by the Privacy Commissioner. The Privacy Commissioner found that Westpac had breached Mr Hager’s privacy by releasing his personal information to the Police without a warrant. This is part of the continuing fallout from the Police’s unlawful raid on Mr Hager’s home in 2014.

Mr Hager believes that this is a very important decision. “It is relevant to a big and wide issue of companies providing information to Police. While the decision was based on the particular facts of this case it will be relevant to that debate.” A 3-month study of just 10 companies in 2015 recorded over 2000 informal requests from government agencies. Meanwhile, a Horizon poll has shown that 78% of New Zealanders believe a warrant or production order should always be required.

In the leadup to raiding Mr Hager’s home, the Police asked Westpac for over ten months of Mr Hager’s bank transactions. The Police did not have a warrant or production order for that information. Police falsely said that Mr Hager was being investigated for fraud.

The release by Westpac was done under an agreement that the Police had reached with all New Zealand banks. The banks agreed to release information to the Police without the need for a warrant where the Police said it was needed for an investigation, particularly one involving fraud.

Under the Privacy Act, Westpac may release personal information if it reasonably believes it is necessary to assist the Police investigation. When releasing this information, the Police and Westpac asserted that this exception applied. However, the Police provided Westpac with no information to support the claim that this information was needed and Westpac did not ask for any. Westpac conducted no inquiry of its own.

The warrantless search of Mr Hager’s banking transactions was kept hidden from him until he obtained a discovery order in the High Court. A court order last year made that information public, so Mr Hager was able to use it to bring a complaint to the Privacy Commissioner.

Westpac tried to argue that its terms and conditions allowed it to release Mr Hager’s personal information. This relied on a different exception to the Privacy Act than the one asserted at the time of release.

The Privacy Commissioner rejected Westpac’s arguments. He found that a reasonable person would not have understood those terms to have authorised this release. He also rejected an argument that the Police investigation exception applied.

Westpac have told the public that it has a new policy not to release information to the Police without a production order. However, Mr Hager is concerned that Westpac is not being fully upfront with the public. “If Westpac follow this new policy then that would be a massive improvement. But, since the public announcement, Westpac have told the Police that it may not always follow this policy. I think Westpac needs to promise publicly to follow that policy in all circumstances.”

Mr Hager noted that the problems he experienced are not restricted to Westpac bank. “The Police had this arrangement with all banks. All customers should be asking their bank in what circumstances their bank will release their personal information to the Police and others. This is also an issue for other companies that hold private data such as phone companies, utility companies, and online websites.”

The Privacy Commissioner’s view is only advisory. To obtain binding orders Mr Hager must take his case to the Human Rights Tribunal. Mr Hager is considering his options.

A claim against the Police for making the request is still before the High Court.