Employer ordered to pay $30,000 for breaching employee’s privacy
12 May 2025
The recent Human Rights Review Tribunal decision of Cummings v KAM Transport Limited [2025] highlights the importance of employers understanding their obligations under the Privacy Act 2020, and having policies and procedures in place to ensure compliance.
In this case the employer, KAM Transport Limited, was found to have breached its privacy obligations to its employee Mr Cummings, because it failed to adhere to Information Privacy Principle 11 ( “IPP 11” ) of the Privacy Act 2020. This principle states that an organisation may only disclose personal information for the purpose that it was obtained.
The Human Rights Review Tribunal ordered KAM Transport to pay Mr Cummings $30,000 in damages for humiliation, loss of dignity and injury to feelings. This is a significant sum, even for a larger employer, so what went so terribly wrong for KAM Transport, and how could this breach have been avoided?
Background
Mr Cummings was employed by Kam Transport as a Senior Truck Driver and under his terms of employment KAM Transport could require him to submit to a random drug test. Upon being selected for a random drug test Mr Cummings refused to take it. Unsurprisingly, KAM Transport suspended Mr Cummings from work pending the commencement of a disciplinary process.
Mr Cummings undertook a drug test one week later which returned clear. He returned to work to discover that his colleagues (who were not part of KAM Transport’s management team) were aware of his refusal to take a drug test. In addition, rumours that Mr Cummings was a drug dealer and had been dismissed from his employment were circulating amongst staff. Mr Cummings was anxious and distressed by the implications of the rumour on his safety and his reputation. In particular he feared that he could be targeted by gangs when completing his long haul jobs as part of his employment.
Mr Cummings complaint about privacy breach
Mr Cummings raised the privacy breach with his employer. He provided the names of employees who had spoken to him about the rumours and asked KAM Transport to investigate. KAM Transport did complete an investigation but found that no privacy breach had occurred.
Mr Cummings believed that his employer’s response was inadequate, and he subsequently resigned from his employment citing a loss of trust. He reported experiencing depression, anxiety and insomnia following his resignation
The Tribunals decision
The Tribunal found that :
- Mr Cummings’ refusal to take a drug test was disclosed by KAM Transport to another employee who was not part of the management team. KAM Transport had no good reason for making this disclosure.
- The disclosure was not permitted under IPP 11
- The disclosure involved highly sensitive personal information, leading to significant harm. The Tribunal noted in this case that the breach doesn’t have to be the main cause of the harm, but needs to have had a “real influence on the harm suffered.”
Lessons for Employers from the Cummings v KAM Transport Limited decision
Employers need to clearly ringfence the correct people who are authorised to deal with personal information, and privacy complaints within their organisation. They also need to be vigilant that their managers understand what personal information is under the Privacy Act, and what privacy obligations are owed to employees as a result. Training and robust privacy policies are essential to ensure that disclosures of employees’ personal information are not made to other employees or third parties. Employers also need to be prepared to respond appropriately to complaints by employees of a privacy breach.
It’s important to be mindful that the Human Rights Review Tribunal generally make awards at quantums in excess of those seen in the Employment Relations Authority. Privacy issues can therefore expose employers significantly, if the Tribunal finds that there has been a breach and that it has caused harm.
At Pitt & Moore Lawyers we regularly advise on issues concerning privacy in the workplace and can assist if you have any concerns about existing policies, or potential or actual privacy breaches. If you have any questions, please contact Heather Collins (heather.collins@pittandmoore.co.nz) or Marty Logan (marty.logan@pittandmoore.co.nz).
Disclaimer: The information contained in this publication is of a general nature and is not intended as legal advice. It is important that you seek legal advice that is specific to your circumstances.
