Breach of Privacy Principles costs employer $30,000

In Cummings v KAM Transport Limited [2025] NZHRRT 9, the Human Rights Review Tribunal (HRRT) determined that an employee’s privacy had been breached and awarded damages of $30,000 to the employee for humiliation and loss of dignity.

The case serves a timely reminder that claims under the Privacy Act 2020 could have significant financial consequences for employers.

Random drug test refusal

While Mr Cummings was employed by KAM Transport Limited (KAM) as a truck driver he was required to undertake a random drug test which was a term of his employment.

Mr Cummings refused to take the test on 26 August 2020 which, under KAM policy and the terms of his employment, was grounds for misconduct. Mr Cummings was then stood down from work pending the commencement of a disciplinary process.

Mr Cummings subsequently undertook a drug test on 4 September, which returned clear. Mr Cummings returned to work after that, although the disciplinary process remained in place.

False rumours

On 7 September 2020 Mr Cummings drove from Wellington to the premises of an Auckland client of KAM and was confronted by a forklift driver who told him that she and others had heard he was a drug dealer and that he had been dismissed from his job.

Mr Cummings was also informed by a colleague based in Picton that they had been told by another KAM employee, Mr Jzaden Kremm, that he had failed his drug test and had left his employment.

Mr Cummings was taken by surprise and felt anxious and distressed by the implications of the rumour relating to his safety and reputation.

Disciplinary process

On 15 October 2020, KAM wrote to Mr Cummings to inform him that the outcome of the disciplinary process was a written warning that would stay on his file for twelve months. KAM also informed Mr Cummings that its investigation did not result in it finding evidence to corroborate his allegations regarding the alleged privacy breach.

Mr Cummings was not satisfied by this outcome and requested another meeting with KAM management to further discuss the complaint. At the meeting, Mr Cummings referred to an affidavit by Mr Kremm that stated that, on 1 September 2020, Mr Fincham had told Mr Kremm about Mr Cumming’s refusal to take a drug test.

The meeting did not provide a resolution of Mr Cummings’ complaint.

Loss of trust

On 14 December 2020, Mr Cummings wrote to KAM to inform that he was resigning from his employment with immediate effect, citing, among other things, a loss of trust. The parties attended mediation; however, this did not result in any resolution of the employment issues.

Mr Cummings subsequently lodged a complaint with the Privacy Commissioner regarding his allegation that KAM had interfered with his privacy. Following the conclusion of the Privacy Commissioner’s investigation in May 2022, Mr Cummings filed his claim in the Tribunal.

Human Rights Review Tribunal Decision

Mr Cummings claimed that KAM interfered with his privacy by disclosing without authorisation his personal information regarding his refusal to undertake a drug test, in breach of Information Privacy Principle (IPP) 11 of the Privacy Act 1993 (PA).[1]

Mr Cummings claimed that he had suffered detriment and loss, which adversely affected his rights and privilege, and caused him significant humiliation, loss of dignity and injury to his feelings.

When determining if a disclosure of personal information constitutes an interference with privacy, the Tribunal applied the following sequential steps:

1. whether there had been a disclosure of personal information: KAM disclosed information to Mr Kremm, who was not part of the management group and had no need to know such sensitive information about Mr Cummings as part of his employment duties at KAM;
2. if the Tribunal is satisfied that personal information has been disclosed, KAM must show whether the disclosure fell within one of the exceptions provided by IPP 11: KAM did not plead that any of the exceptions applied and did not rely on them (preferring the argument that no disclosure had been made, which was not accepted by the Tribunal);
3. if the Tribunal is satisfied that the personal information has been disclosed, and that KAM has not proven that one of the exceptions in IPP11 applies, the Tribunal must establish whether the disclosure constituted an interference with privacy, by way of Mr Cummings establishing one of the actual or potential harms set out in s 66(1)(b). The burden of proof reverts to the plaintiff (Mr Cummings) at this stage: The matters disclosed involved personal information of a highly personal and sensitive nature. The harm Mr Cummings suffered amounted to significant humiliation, loss of dignity and injury to his feelings, particularly given his long career and status as a senior truck driver. There was sufficient causal connection between these harms and KAM’s disclosure of Mr Cummings’ personal information in breach of IPP 11; and
4. if the Tribunal is satisfied to this stage, then the final task is to determine whether, in its discretion, it should grant any of the statutory remedies identified in s 85 of the PA: the Tribunal considered that a declaration (that KAM interfered with Mr Cummings’ privacy without his consent) and damages of $30,000 sufficiently reflected the humiliation, loss of dignity and injury to feelings[2] Mr Cummings’ experienced.

The Employment Team at Harkness Henry are specialists in privacy law. If you require advice about the privacy principles in the Privacy Act 2020, then please contact Alexandria Till.

[1] The Privacy Act 1993 (PA) was repealed and replaced by the Privacy Act 2020 on 1 December 2020. The transitional provisions of the Privacy Act 2020 sch1 cl 9(1) provide that these proceedings must be continued and completed under the 2020 Act, but that does not alter the relevant legal rights and obligations in force at the time that actions subject to this claim were taken. All references in the decision are to the PA, while the case was argued under the 2020 Act, there is no substantive difference between the provisions engaged under the PA and the 2020 Act.

[2] Under s 88(1)(c) of the PA.

This article is current as at the date of publication and is only intended to provide general comments about the law. Harkness Henry accepts no responsibility for reliance by any person or organisation on the content of the article. Please contact the author of the article if you require specific advice about how the law applies to you.