Bank admits privacy breach
Journalist Nicky Hager has received a financial settlement from Westpac over a privacy breach relating to his controversial 2014 book Dirty Politics.
Police asked the bank for 10 months of Hager’s bank records and falsely claimed he was being investigated for fraud. Police did not have a warrant. The case had been heading for the Human Rights Tribunal but Westpac has now apologised and as part of the settlement Hager will receive a payout, and a contribution to his legal costs.
Under the settlement Westpac will also be significantly tightening its contractual terms in relation to the release of customer information to government agencies including police, a statement provided by Nicky Hager’s lawyers said.
‘‘From now on, if the police ask Westpac for information about its customers, Westpac will only confirm whether or not that person is its customer.
‘‘It will not provide any other customer information except with either a production order, the customer’s consent, where it is necessary to prevent or lessen a serious threat to health or safety, or as required by law.’’
Westpac said in a statement its practice at the time was to comply with requests in the belief it was entitled to do so under the Privacy Act.
‘‘However, in the light of the public discussion of Mr Hager’s and other cases, it is clear bank customers reasonably expect that in similar circumstances such data will be kept private.’’
Westpac said it had implemented a new procedure for responding to information requests and that except for in extremely limited circumstances, such as when police were searching for a missing person, the release of customers’ information would require a production order.
Westpac apologised to Hager for the distress it caused him and his family.
‘‘This is an important victory for privacy in New Zealand,’’ Hager said.
‘‘It will help many people. ‘‘Four years ago, when this story first broke, a wide range of New Zealanders expressed strong concern about the idea that a person’s banking data could be taken without a warrant,’’ Hager said.
‘‘I was confident we were going to prevail before the Human Rights Review Tribunal but that was likely to have been several years away still.
‘‘Westpac have done the right thing here by owning up to the breach and putting in place much better procedures to protect against it happening again,’’ he said.
In June last year, police apologised to Hager and admitted that they had had no basis for that accusation. Police also accepted that their request for data from Westpac had been unlawful, the statement said.
Hager’s lawyer, Felix Geiringer, said that continued pressure on banks and companies holding private data was needed because in 2014 they would have had the same unlawful arrangement with police that Westpac did. ‘‘We do not know that anything has changed.’’
Privacy Commissioner John Edwards said the settlement would likely bring a new discipline to the relationships between commercial entities that hold sensitive customer information, and the police.
‘‘It’s probably a good thing to make sure that those relationships are formalised and well understood on both sides,’’ he said.
The settlement is consistent with the ‘‘direction of travel’’ seen in the courts, Edwards said.
A recent Supreme Court decision, R v Alsford, had important implications for privacy law, affirming the obligations and responsibilities of both law enforcement and agencies responding to them, Edwards said.
The case involved police seeking consumption data from electricity providers to investigate suspected cannabis cultivation, but breached the privacy principle of the Privacy Act in doing so.
The commission’s own findings on the Hager complaint was that there was insufficient rigour on Westpac’s part in the assessment of police needs and that they shouldn’t have disclosed the information.