IN THE COURT OF APPEAL OF NEW ZEALAND
I TE KŌTI PĪRA O AOTEAROA
CA195/2019
[2020] NZCA 551
BETWEEN

KIM DOTCOM
Appellant

AND

ATTORNEY-GENERAL
Respondent

Hearing:

14 and 15 July 2020

Court:

French, Brown and Clifford JJ

Counsel:

R M Mansfield and S L Cogan for Appellant
V E Casey QC and A P Lawson for Respondent
B J R Keith and J M Hayward for Privacy Commissioner as
Intervener

Judgment:

10 November 2020 at 11.00 am

JUDGMENT OF THE COURT
A

We answer the questions of law submitted for determination by
this Court:
(1)

Can a request for personal information under the Privacy Act 1993
be transferred by the recipient to another agency where the request
seeks urgency and the basis for the urgency request is not a matter
that the recipient is able to sensibly assess but the agency to which
the request is transferred is the only agency able to properly
evaluate the claimed basis for the urgency request?
No. A transfer of an information privacy request under s 39(b)(ii)
of the Privacy Act is permissible only if the person dealing with the
request believes the information to which the request relates to be

DOTCOM v ATTORNEY-GENERAL [2020] NZCA 551 [10 November 2020]

 more closely connected with the functions or activities of the
transferee agency. The fact that a requestor seeks urgent treatment
of an information request, whether or not in the same document as
the request, does not comprise part of the information to which the
information request relates.
(2)

Is a request for urgency under s 37 of the Privacy Act 1993 a
relevant factor for an agency in determining whether to refuse a
request for personal information under s 29(1)(j) of that Act?
Yes, it may be a relevant factor. Although the mere fact of a request
for urgency would not of itself generally be a proper basis for
a finding of vexatiousness, we cannot exclude the possibility of
there being circumstances where an inference of vexatiousness
could be drawn from a request for urgency. Examples of such
circumstances might include a grossly excessive number of
requests for urgency or reasons given for urgency that are not
credible. All will depend on the context in which the request for
urgency is made.

B

The appeal is allowed to the extent reflected in the answers to the
approved questions.

C

The proceeding is remitted to the Human Rights Review Tribunal for
reconsideration of the issue of damages in respect of the interference with
the appellant’s privacy by the wrongful transfer of the appellant’s
information privacy requests.

D

The respondent must pay the appellant costs for a standard appeal on a
band A basis and usual disbursements.

____________________________________________________________________

 Table of Contents
Introduction
The statutory framework
Factual background
Mr Dotcom’s information privacy requests
The transfers of the requests
The Solicitor-General’s letters to Mr Dotcom’s legal advisers
The Solicitor-General’s request for advice from the
Privacy Commissioner
Mr Dotcom’s complaint to the Privacy Commissioner
Mr Dotcom’s claim to the Tribunal
The Tribunal’s decision
The High Court judgment
The interpretation of the Privacy Act
A fundamental difference in approach to interpretation
Ms Casey’s submission
Mr Keith’s submission
Analysis
The Attorney-General’s additional argument
Conclusion
Question 1
Question 2
Consequential directions
Result

Para No
[1]
[8]
[15]
[16]
[18]
[22]
[29]
[34]
[39]
[42]
[49]
[56]
[56]
[60]
[63]
[66]
[78]
[83]
[84]
[97]
[107]
[111]

REASONS OF THE COURT
(Given by Brown J)
Introduction
[1]

This judgment addresses questions (a) concerning the procedure for transfer

between agencies of information privacy requests under the Privacy Act 1993 (the Act)
and (b) the significance of a request for urgency as a factor in the determination of
whether an information request should be refused as vexatious.
[2]

In July 2015 Mr Dotcom sent information privacy requests to some 52 agencies

comprising 24 departments and Crown agencies and all Ministers of the Crown.
Mr Dotcom asked that the requests for all personal information held by the recipients,
colloquially known as “everything” requests, be treated as urgent for the reason that
the information was required for “pending legal action”. It was common ground that

 the litigation referred to included an extradition eligibility hearing in the District Court
then due to commence on 21 September 2015.
[3]

Following an apparently unsolicited communication from Crown Law, nearly

all the requests were transferred by the recipient agencies to the Attorney-General in
reliance on s 39(b)(ii) of the Act, namely that the information to which the request
related was believed by the person dealing with the request to be “more closely
connected with the functions or activities” of the Attorney-General.
[4]

On 5 August 2015 the Solicitor-General provided a response on behalf of

the Attorney-General declining the requests on the ground in s 29(1)(j) of the Act that
they were vexatious and included information which was trivial. The SolicitorGeneral also stated that insufficient reasons for urgency had been provided.
[5]

Mr Dotcom’s complaint to the Privacy Commissioner that the transfer of his

requests and their subsequent declinature constituted an interference with his privacy1
for which there was no basis was rejected in June 2016. However in Mr Dotcom’s
proceeding before the Human Rights Review Tribunal, the Tribunal concluded:2
(a)

The Attorney-General was not the lawful transferee of the
requests because the information to which the request related
was not more closely connected with the functions or activities
of the Attorney-General than with those of the transferring
agencies.

(b)

The decline of the urgency request did not justify declining the
information privacy requests themselves on the grounds of
vexatiousness.

[6]

On appeal, the High Court concluded:3
[239] The appeal is allowed. We find that there was a proper and lawful
purpose for the transfer of the requests and that, because of the insistence that

1
2
3

Privacy Act 1993, s 66(2).
Dotcom v Crown Law Office [2018] NZHRRT 7 [Tribunal decision].
Attorney-General v Dotcom [2018] NZHC 2564 [High Court judgment].

 all 52 requests were required to be responded to urgently, on the ground that
the information sought was relevant to the eligibility proceedings, they were
vexatious.

[7]

Pursuant to leave two questions of law are submitted to this Court for

determination:4
Question 1: Can a request for personal information under the Privacy Act
1993 be transferred by the recipient to another agency where5 the request seeks
urgency and the basis for the urgency request is not a matter that the recipient
is able to sensibly assess but the agency to which the request is transferred is
the only agency able to properly evaluate the claimed basis for the urgency?
Question 2: Is a request for urgency under s 37 of the Privacy Act 1993 a
relevant factor for an agency in determining whether to refuse a request for
personal information under s 29(1)(j) of that Act?
The statutory framework
[8]

The Act has the objective of promoting and protecting individual privacy6 and

in particular establishing certain principles with respect to access by individuals to
information relating to them held by public and private sector agencies.7 Part 2 of the
Act details the 12 information privacy principles. Of particular relevance in the
present case is principle 6.

4

5

6

7

Pursuant to s 124 of the Human Rights Act 1993 which is imported into the Privacy Act by s 89.
In respect of question 1 pursuant to leave of the High Court in Dotcom v Attorney-General [2019]
NZHC 740. In respect of question 2 pursuant to leave of this Court in Dotcom v Attorney-General
[2019] NZCA 509 [Leave judgment].
The word “because” instead of “where” would better reflect the reasoning of the High Court that
a transfer to Crown Law was justifiable because the request for urgency was on account of the
pending extradition hearing: see [85] below.
In general accordance with the Recommendation of the Council of the Organisation for Economic
Co-operation and Development Concerning Guidelines Governing the Protection of Privacy and
Transborder Flows of Personal Data.
See the long title of the Privacy Act.

 Principle 6
Access to personal information
(1)

[9]

Where an agency holds personal information in such a way that it can
readily be retrieved, the individual concerned shall be entitled—
(a)

to obtain from the agency confirmation of whether or not the
agency holds such personal information; and

(b)

to have access to that information.

(2)

Where, in accordance with subclause (1)(b), an individual is given
access to personal information, the individual shall be advised that,
under principle 7, the individual may request the correction of that
information.

(3)

The application of this principle is subject to the provisions of Parts 4
and 5.

Procedural provisions relating to access to personal information are specified

in pt 5. An agency to which an information privacy request is made shall as soon as
reasonably practical and in any case not later than 20 working days after the day in
which the request is received by that agency:8
(a)

decide whether the request is to be granted; and

(b)

give or post to the individual who made the request notice of the
decision on the request.

[10]

Where an information privacy request made by an individual is refused the

agency shall give to the individual the reason for its refusal. 9 Part 4 of the Act
prescribes what are good reasons for refusing access to personal information.
Section 27 addresses reasons relating to security, defence and international relations,
s 28 relates to the protection of trade secrets and s 29 details several other reasons for
the refusal of requests. Relevant to this case is s 29(1)(j):
(1)

An agency may refuse to disclose any information requested pursuant
to principle 6 if—
…

8
9

Section 40(1).
Section 44.

 (j)

[11]

the request is frivolous or vexations, or the information
requested is trivial.

Section 38 directs that individuals making information privacy requests are to

be provided with reasonable assistance:
38

Assistance
It is the duty of every agency to give reasonable assistance to an
individual, who—
(a)

wishes to make an information privacy request; or

(b)

in making such a request, has not made the request in
accordance with the requirements of this Act; or

(c)

has not made his or her request to the appropriate agency,—

to make a request in a manner that is in accordance with the
requirements of this Act or to direct his or her request to the
appropriate agency.

[12]

Section 39 makes provision for the transfer of requests between agencies:
39

Transfer of requests
Where—
(a)

an information privacy request is made to an agency or is
transferred to an agency in accordance with this section; and

(b)

the information to which the request relates—
(i)

is not held by the agency but is believed by the person
dealing with the request to be held by another
agency; or

(ii)

is believed by the person dealing with the request to
be more closely connected with the functions or
activities of another agency,—

the agency to which the request is made shall promptly, and in any
case not later than 10 working days after the day on which the request
is received, transfer the request to the other agency and inform the
individual making the request accordingly.

 [13]

Urgency may be sought in relation to information privacy requests:
37

Urgency
If an individual making an information privacy request asks that his
or her request be treated as urgent, that individual shall give his or her
reasons why the request should be treated as urgent.

[14]

Conduct which constitutes an interference with the privacy of an individual is

addressed in s 66 in pt 8, dealing with complaints. Section 66(2) states:
(2)

Without limiting subsection (1), an action is an interference with the
privacy of an individual if, in relation to an information privacy
request made by the individual,—
(a)

(b)

the action consists of a decision made under Part 4 or Part 5
in relation to the request, including—
(i)

a refusal to make information available in response to
the request; or

(ii)

a decision by which an agency decides, in accordance
with section 42 or section 43, in what manner or, in
accordance with section 40, for what charge the
request is to be granted; or

(iii)

a decision by which an agency imposes conditions on
the use, communication, or publication of
information made available pursuant to the request;
or

(iv)

a decision by which an agency gives a notice under
section 32; or

(v)

a decision by which an agency extends any time limit
under section 41; or

(vi)

a refusal to correct personal information; and

the Commissioner or, as the case may be, the Tribunal is of
the opinion that there is no proper basis for that decision.

Given the inclusive definition, it appeared to be common ground that a decision to
transfer a request under s 39 would fall within s 66(2)(a).
Factual background
[15]

On 18 January 2012 extradition proceedings were commenced by the

United States of America against Mr Dotcom and three other persons. Following their

 arrest on 20 January 2012, extensive and complex litigation ensued which it is
unnecessary to document. The eligibility hearing date was set for 15 February 2015,
but was adjourned until 2 June 2015 after Mr Dotcom’s lawyers withdrew.
The hearing was again adjourned by the High Court on 1 May 2015. On 6 May 2015
a new date of 21 September 2015 was confirmed.
Mr Dotcom’s information privacy requests
[16]

Mr Dotcom had previously made a substantial number of requests of

government agencies under both the Official Information Act 1982 and the
Privacy Act seeking information they held in relation to him.

Responses were

provided by several government agencies.
[17]

On various days in July 2015 Mr Edgeler, acting on behalf of Mr Dotcom, sent

information privacy requests to all Ministers and most government departments and
agencies, all in the following format:
I request under the Privacy Act 1993, all personal information that you hold
about Kim Dotcom, including under his previous names Kim Schmitz, and
Kim Vestor.
Please make sure your response includes all information held by your agency
(and any agency that you have contracted to do work) and is not limited to just
the information recovered as a result of a search across your email system.
Please make certain that your response includes all personal information,
including, for example, information including communications that mention
Kim Dotcom’s name.
Mr Dotcom recently received a wide range of personal information after a
request to the New Zealand Security Intelligence Service (including emails
between staff discussing Mr Dotcom) and hopes that all agencies will follow
their lead in applying the legislation properly.
This information sought is required urgently because of pending legal action.
Therefore, please treat this request as urgent pursuant to s 37 of the
Privacy Act.

The transfers of the requests
[18]

Initially the recipients acted in various ways. Some such as the Reserve Bank

responded to the request. Some, such as the Ministry of Defence, acknowledged the
request and indicated that a response was being prepared. Some recipients initiated
inquiries about relevant documentation.

 [19]

However on a date unknown, but which we infer to be in late July or early

August, Crown Law sent a communication to most of the agencies following which
those agencies then transferred the information requests to the Attorney-General.
Privilege was claimed for the communications from Crown Law to the agencies, hence
their precise content is unknown.
[20]

However several of the recipients wrote to Mr Edgeler advising him in

identical terms of the transfer to the Attorney-General. An example is the letter from
the Ministry of Justice of 4 August 2015 which read:
Thank you for your email of 20 July 2015 requesting, under the Privacy Act
1993, on behalf of your client Mr Kim Dotcom:
“all personal information that you hold about Kim Dotcom
including under his previous names Kim Schmitz, and
Kim Vestor.”
You have asked that the response include:
“all information held by your agency (and any agency that you
have contracted to do work) and is not limited to just the
information recovered as a result of a search across your email
system.”
We have consulted with the Attorney-General, and our view is that the request
is more closely connected with the functions or activities of his office.
We have therefore decided to transfer the request to the Attorney-General, in
accordance with s 39(a)(ii) of the Privacy Act.

[21]

This letter, like several others from other agencies, contained an erroneous

reference to s 39(a)(ii). The correct provision is s 39(b)(ii). Mr Mansfield inferred,
and we agree, that the repetition of that error suggests that the Crown Law
communication had provided a template response which contained that error.
Furthermore as the High Court correctly observed,10 the template response mis-stated
the focus of s 39(b)(ii) for it is not the request, but the information to which the request
relates, which needs to be believed to be more closely connected with the functions or
activities of the other agency.

10

High Court judgment, above n 3, at [98].

 The Solicitor-General’s letters to Mr Dotcom’s legal advisers
[22]

On 5 August 2015 the Solicitor-General sent a letter to Mr Edgeler which

addressed the various information requests in a global way. This letter is significant
in a number of respects. Hence we highlight the different aspects.
[23]

First the letter addressed the co-ordination of responses on behalf of the

Attorney-General:
1. I refer to your client’s request dated 17 July 2015 under s 33(b) of the
Privacy Act 1993 for:
“all personal information that you hold about Kim Dotcom,
including under his previous names Kim Schmitz, and
Kim Vestor.”
2. You have asked that the response include:
“all information held by [the recipient agency] (and any
agency that [the recipient agency has] contracted to do work)
and is not limited to just the information recovered as a result
of a search across [the recipient agency’s] email system.”
and
“all personal information, including, for example, information
including communications that mention Kim Dotcom’s
name.”
3. The request has been sent in identical terms to all Ministers of the Crown,
and most departments of state. You have requested an urgent response
pursuant to s 37 of the Privacy Act. The response is as follows.
4. The urgency request for the information is based on “pending legal
action”. As there is no further information given to support the request
for urgency, it has been assumed that the phrase “pending legal action”
refers to applications made to the extradition Court or in contemplation.
The issues ruled on by Simon France J in Dotcom & Ors v USA and
District Court [2014] NZHC 2550, 17 October 2012 therefore arise again.
In the particular circumstances of this case, the Attorney-General
considers, in terms of s 39(b)(ii) of the Privacy Act, the information
sought, to the extent it is held by other agencies, is more closely connected
with his functions as Attorney-General. Accordingly, I understand most
recipient agencies have informed you the request has been transferred to
the office of the Attorney-General. I will have oversight of the response
to the request on his behalf.

[24]

The letter then addressed the fact that urgency had been sought.

 5. As your client may appreciate, given the scope, nature and duration of the
interaction between the Crown and its agencies and Mr Dotcom, the
information described in your request will run to a very substantial
number of documents. Given the available resources, it is anticipated that
to comply with the request as currently stated, including locating and
making any necessary decisions under Part 4 of the Privacy Act, will take
many months.
6. Having regard to the very limited information in your notification of
“pending legal action” and the very broad scope of the request, I do not
consider that you have complied with the requirements of s 37 of the
Privacy Act to give “reasons why the request should be treated as urgent”.
In my view, this requires the requestor to give sufficiently specific reasons
for urgency to enable the requested agency or agencies to make
reasonably informed decisions about the scope of the request, affecting in
turn its ability to carry out its statutory obligation.

[25]

The letter then advised that the information requests were declined together

with the reason:
7. Further, it is my view, considering the s 37 request in its context, that as
currently expressed your request must be declined under section 29(1)(j),
on the grounds that it is vexatious and includes, due to its extremely broad
scope, information that is trivial.

[26]

The letter concluded in this way:
8. Accordingly, should your client wish to obtain personal information under
s 37 urgently, I would suggest that he gives specific information as to the
nature, time and basis of the legal proceeding sufficient to allow me to
identify and obtain any reasonably relevant information, wherever that
may be held.
9. If the request is maintained as urgent and does relate to his allegations of
abuse of process, the comments of Justice Simon France as to advancing
“an air of reality” as a foundation for identifying specific information may
assist in narrowing the enquiry for s 37 purposes.
10. Your client has the right, under s 67 of the Privacy Act, to make
a complaint to the Privacy Commissioner in relation to my refusal of his
request.

[27]

In response Anderson Creagh Lai sent a letter to the Solicitor-General dated

17 August 2015 recording that the purported transfer of the requests either to
Crown Law or to the Attorney-General was not accepted as permitted or lawful and
requesting that the Solicitor-General “review the same”.

 [28]

The Solicitor-General responded in a letter of 31 August 2015 which materially

stated:
4.1

The decisions made by the recipient agencies to transfer the requests
to Crown Law were lawful and appropriate. The Attorney-General
did not direct that the requests were to be transferred. In the particular
context of Mr Dotcom’s litigation, which is expressly referred to in
the requests, and in light of the large number and extremely broad
nature of the requests, Crown Law was the appropriate agency to
respond.

4.2

The requests did not give any clear ground upon which they required
an urgent response. Assuming the litigation referred to in the requests
was the extradition hearing, the information requested had no
relevance to that hearing. As Simon France J found in respect of the
second application for discovery in Dotcom v USA, the request is too
broad to be relevant.

4.3

We declined the transferred requests on the basis they were vexatious
and included, due to their extremely broad scope, information that was
trivial. It is apparent from the very broad and unfocused nature of the
requests, and the request for urgency, that the requests were not
genuine and were intended to disrupt the extradition hearing.

(Footnote omitted.)

The Solicitor-General’s request for advice from the Privacy Commissioner
[29]

The Privacy Commissioner has had reason to be engaged with this dispute on

three distinct occasions. The first was as a consequence of a letter dated 31 August
2015 from the Solicitor-General requesting advice from the Privacy Commissioner
pursuant to s 13(1)(l) of the Act on the Solicitor-General’s response to date and
intended response to Mr Dotcom’s information requests. The letter explained the basis
for declining the request under s 29(1)(j):
55.

The basis for the decision was that the requests had an ulterior motive
(that is, to disrupt the litigation, and in particular the extradition
hearing). This is apparent from the very broad and unfocused nature
of the requests, along with the request for urgency in the context of
the litigation. Mr Edgeler must have been aware that it would be
simply impossible for the recipient agencies to respond to such broad
requests and, even if some did respond, it would be impossible for
Mr Dotcom’s legal team to review the information before the
extradition hearing in September.

 [30]

With reference to the rationale for the transfer of the requests the letter stated:
44.

[31]

If Mr Dotcom and his lawyers wish to maintain the requests in
a manner not linked to the litigation, we would agree that there would
be no basis to transfer the requests to Crown Law. To use Mr Cogan’s
example, if Mr Dotcom genuinely wants to request information about
his drivers’ licence, there would be no basis to transfer that request to
Crown Law. Nor would there be any reason linked to the litigation to
treat that request as urgent.

The Privacy Commissioner provided a draft response dated 10 September 2015

which he discussed with the Solicitor-General at a meeting on 21 September 2015.
The Solicitor-General then provided comments on the draft advice in a letter of
1 October 2015.

The Privacy Commissioner provided a final response dated

9 October 2015 addressing both refusal grounds and procedural issues, in particular
transfer and urgency.
[32]

In that letter the Privacy Commissioner explained that he did not consider it

appropriate to go quite so far as the Solicitor-General might have wished with advice
on the merits of the process set out in the Solicitor-General’s letter. He flagged two
aspects of the Solicitor-General’s narration which suggested further inquiry, the first
concerning the transfer decisions:
First, it would be my expectation that prior to taking any decision to transfer
a request to another agency under section 39(a)(ii), the person dealing with
the request would review the personal information it holds, or a sample of it,
in order to inform their belief as to the appropriateness or necessity of
the transfer.

[33]

The Privacy Commissioner also offered a provisional view on the merits of the

urgency request:
My provisional view, based on the information provided, is that the reasons
given for urgency are not sufficient to place an onus on the responding
agencies to deal with the requests urgently. The fact of the current litigation
between the parties does not in my preliminary view provide a sufficiently
specific reason to support the request for urgency, without more particulars
being provided by the requester.

However, apart from what he described as general and preliminary comments, he
caveated his response in this manner:

 I am not able to go further by way of advice or conclusions as to the approach
taken to date without engaging in a process of investigation of the information
held by the different agencies, and the ways in which they have made their
decisions. However I am happy to provide some general observations and
share my understanding of the operation of the Act in relation to transfers,
requests for urgency, and the approach this office has taken in the past in
relation to specific withholding grounds.

Mr Dotcom’s complaint to the Privacy Commissioner
[34]

The Solicitor-General’s letter of 5 August 2015 to Mr Edgeler had concluded

by noting that Mr Dotcom had the right under s 67 of the Act to make a complaint to
the Privacy Commissioner in relation to the refusal of his requests. Mr Dotcom did
so. This prompted the Privacy Commissioner’s second phase of participation in the
dispute. On 28 October 2015 Anderson Creagh Lai sent a letter to the Privacy
Commissioner making a complaint in relation to (a) the transfer of Mr Dotcom’s
request from the individual recipient agencies to Crown Law and (b) the Crown Law
response refusing the requests in their entirety. An exchange of correspondence
followed.
[35]

The Office of the Privacy Commissioner’s letter dated 28 April 2016

expressing the preliminary view that there had been no interference with Mr
Dotcom’s privacy explained that the Commissioner was not limited by the position
advanced by the parties or the form in which decisions had been made. The conclusion
was based on the new ground that a transfer of the requests under s 39 was not
necessary because Crown Law was entitled, as the government’s legal adviser, to act
on behalf of the agencies, including in respect of Privacy Act requests. As the Tribunal
later observed,11 this letter implicitly rejected the Crown’s contention that the requests
had been transferred to the Attorney-General under s 39(b)(ii).
[36]

In a letter dated 15 June 2016 the Office of the Privacy Commissioner recorded

its final view that Mr Dotcom’s complaint of a significant and sustained interference
with his privacy did not have substance. With reference to the issues of transfer and
urgency the letter stated:

11

Tribunal decision, above n 2, at [55].

 The transfer of the requests
9.

You advise you consider the respondents have unlawfully delegated
their decision making obligations in breach of the Privacy Act.
With respect, we do not consider they have.

10.

In the alternative, you consider that the addressee agencies did not
properly or lawfully transfer the requests to Crown Law. As I
explained in my earlier letter, the inquisitorial approach the
Privacy Act provides for our investigations enables us to consider
matters not raised by either party. On close examination we have
determined that Crown Law acted lawfully as legal adviser to the
addressee agencies.

…
The request for urgency
17.

[37]

There is no obligation under the Privacy Act for an agency to accept
a request for urgency, only to consider it. It appears to us that they did.

Concerning the substantive decision to decline the information requests the

letter further said:

[38]

12.

In this case we have not concluded that all personal information held
by the Crown about your client is trivial, but we have concluded that
because of the breadth of the requests they included trivial material.

13.

The totality of Mr Dotcom’s requests met the legal test for section
29(1)(j) of the Privacy Act, as set out in my letter of 28 April 2016.
While the test focuses on whether a particular request for information
is frivolous or vexatious, the overall volume and extent of
Mr Dotcom’s requests indicate that the individual requests were
designed to frustrate or vex the respondents.

14.

In your 26 May letter you note that in order for a request to be
vexatious, it must have been intended to be so by the requester.
The test, as outlined in my 28 April letter, is objective and so
Mr Dotcom’s intent does not change my assessment of this matter.
Further, the fact that the respondents not represented by Crown Law
responded to Mr Dotcom’s request is not relevant to this
determination.

The letter concluded with advice that, while the Privacy Commissioner could

not take the issue further, Mr Dotcom was free to take a case to the Tribunal.
Certificates of Investigation which would be required for that process were enclosed.

 Mr Dotcom’s claim to the Tribunal
Mr Dotcom filed a claim in the Tribunal alleging interference with his privacy

[39]

by the alleged unlawful transfer of the requests in breach of s 39, the unlawful refusal
to deal with the requests urgently and the wrongful refusal of the requests in breach of
s 40.

He sought a declaration that the various unlawful acts amounted to an

interference with his privacy, an order that any interference be remedied by the
provision of access to his personal information in accordance with the requests as a
matter of urgency, and damages in the amount of $200,000 for the loss of the benefit
of the requested information in the extradition proceedings and for humiliation, loss
of dignity and injury to his feelings.
[40]

The Crown filed a reply in which it asserted that:
(a)

the requests included requests for information that was not
personal information within the scope of the privacy principles
in the Act;

(b)

the requests were vexatious and frivolous and the information
sought was largely trivial; and

(c)

the information requested was not held in such a way that it was
readily retrievable.

[41]

On the transfer issue the Crown maintained the contention that the transferring

agencies could properly believe the information to which the requests related was
more closely connected to the functions or activities of the Attorney-General.
However, although not pleaded in its reply, the Crown also advanced an alternative
defence adopting the Privacy Commissioner’s 2016 view12 that Crown Law had acted
lawfully as legal adviser to the addressee agencies.13

12
13

At [35]–[36] above.
Tribunal decision, above n 2, at [107]–[111].

 The Tribunal’s decision
[42]

The basic narrative of events was not in dispute in the Tribunal. Mr Dotcom

was cross-examined at length primarily with reference to the Crown’s contention that
his requests for access to information were vexatious or, as claimed in the
Solicitor-General’s letter to the Privacy Commissioner of 31 August 2015, 14 that the
requests were not genuine Privacy Act requests but rather a litigation tactic and
a fishing expedition with the ulterior motive to disrupt the extradition hearing.15
[43]

Mr Dotcom denied those allegations. His evidence was accepted by the

Tribunal which stated:
[8]
As will be seen, we found Mr Dotcom to be a persuasive, credible
witness. His evidence was, as submitted by his counsel, clear, thorough and
consistent. We are satisfied by his evidence that the requests were genuine
and based on an honest belief that in the unique circumstances of a truly
exceptional case, the July 2015 Privacy Act requests were necessary to
ascertain what personal information about him was held by government
agencies in New Zealand. We accept his evidence that there was no ulterior
purpose to the timing of the requests and that he simply wanted to receive the
requested information so that if relevant, it could be used in the extradition
proceedings and in other litigation.

[44]

Following a detailed consideration of the history and interpretation of s 39 the

Tribunal concluded that the requirement in s 39(b)(ii) of a connection with a “function
or activity” must mean a function or activity in relation to “the information to which
the request relates”.16 Finding a useful analogy in the interpretation of the Official
Information Act which requires a transferee to have had some engagement with or
dealing with the information, the Tribunal reasoned that:17
(a)

Section 39(b)(ii) does not permit a “transfer” to a legal adviser
for the purpose of taking legal advice.

(b)

The agencies to which the requests were sent were required to
decide if there were any withholding grounds under ss 27 to 29

14
15
16
17

At [29] above.
Tribunal decision, above n 2, at [7].
At [96.5].
At [96.6]–[96.8].

 which justified the refusal of the access request made by
Mr Dotcom.
(c)

It was artificial for the Crown to argue that simply because the
Attorney-General, Solicitor-General and Crown Law were the
Crown’s legal advisers and conducting litigation against Mr
Dotcom that the transferring agencies could properly believe the
information to which the requests related were more closely
connected to the functions or activities of the Attorney-General,
Solicitor-General or Crown Law.

(d)

If in the context of that litigation the Crown had wanted to
coordinate its responses to the information requests and to the
associated requests for urgency, it could have done so by giving
advice to the agencies and by communicating any decision
made by those agencies.

[45]

On the transfer issue the Tribunal concluded:
[104] For the reasons given our overall conclusion on the law is that [the
Act], s 39(b)(ii) does not permit a transfer for the purpose put forward by the
Crown, namely the obtaining of legal advice or for the purpose of coordinating
the response to the request with the Crown’s litigation strategy. Consequently
our two key conclusions on the facts are:
[104.1] The information to which the requests related was not more
closely connected with the functions or activities of the
Attorney-General than with the functions or activities of the
transferring agencies.
[104.2] The transfers took place in the absence of a properly grounded
belief by the transferors that the information to which the requests
related was more closely connected with the functions or activities of
the Attorney-General.
[105] As the transfers were not made in accordance with the Act the
Attorney-General was not the lawful transferee under [the Act], s 39(b)(ii).
The Attorney-General accordingly had no authority, as transferee, to refuse to
disclose the requested information. In these circumstances Mr Dotcom has
established that in terms of [the Act], s 66(2)(b) there was no proper basis for
the refusal.

 [46]

Turning to the issue of urgency the Tribunal noted that the decline of a request

for urgency does not of itself give rise to a remedy because such decline is not included
in the s 66 definition of interference with privacy.

Consequently the Tribunal

considered that no remedy could be granted under s 85 for declining urgency.18
The Tribunal went on to consider the relevance of an urgency request for the decision
to decline an information request stating:
[193] But decline of the urgency request did not justify or require also the
blanket decline of the information privacy requests themselves on the grounds
of vexatiousness, particularly given the Crown accepts that neither decision
would have precluded an adjournment application being made. The Crown
further accepted that had Mr Dotcom abandoned the request for urgency there
would have been no basis to transfer the requests to Crown Law.
We emphasise again the vexatious ground must be applied with caution and is
not to be a “catch all” ground to be used because it is convenient to terminate
a request.

[47]

The Tribunal therefore concluded that there was no proper basis for regarding

the request for urgency as an indication the requests were not genuine and made with
the intention of disrupting the extradition hearing. Noting that the Crown had ample
remedies under the Privacy Act and under court processes, the Tribunal observed that
terminating the requests by stigmatising them as vexatious was not objectively
justifiable.19
[48]

The Tribunal decided that all the remedies sought by Mr Dotcom should be

granted. After reciting detailed reasons for the remedies granted, it made the following
formal orders:
[255] For the foregoing reasons the decision of the Tribunal is that it is
satisfied on the balance of probabilities that an action of the Crown
(represented by the Attorney-General) was an interference with the privacy of
Mr Dotcom and
[255.1] A declaration is made under s 85(1)(a) of the Privacy Act 1993
that there was an interference with the privacy of Mr Dotcom by:
[255.1.1] The transfer, without legal authority, to the
Attorney-General of the information privacy requests made
by Mr Dotcom in July 2015. The Attorney-General had no
lawful authority, as purported transferee under the Privacy Act
1993, s 39(b)(ii), to refuse the requests on the grounds that

18
19

At [190].
At [195].

 they were vexatious and there was no proper basis for that
refusal; in the alternative, if the transfers were lawful:
[255.1.2] Refusing the information privacy requests on the
grounds that they were vexatious when there was no proper
basis for that decision.
[255.2] An order is made under s 85(1)(d) and (e) of the Privacy Act
1993 that the agencies (including the Ministers of the Crown) to
which the information privacy requests were sent by Mr Dotcom in
the period 17 to 31 July 2015 must comply with those requests subject
to the provisions of the Privacy Act 1993 and in particular (but not
exclusively) Parts 4 and 5 of that Act. For the purposes of this order
the date of receipt of the requests is to be taken to be the fifth working
day which follows immediately after the day on which this decision
is published to the parties.
[255.3] Damages of $30,000 are awarded against the AttorneyGeneral under ss 85(1)(c) and 88(1)(b) of the Privacy Act 1993 for
the loss of a benefit Mr Dotcom might reasonably have been expected
to obtain but for the interference.
[255.4] Damages of $60,000 are awarded against the AttorneyGeneral under ss 85(1)(c) and 88(1)(c) for loss of dignity and injury
to feelings.

The High Court judgment
[49]

Early in its judgment the High Court explained the primary reason why it

reached a different view from the Tribunal on the transfer and urgency issues:20
One of the principal reasons for that is that we have regarded a request which
seeks urgency and provides a particular justification for the urgency, as being
one request rather than two separate and disconnected requests. We have
come to the conclusion that a request which incorporates a requirement for an
urgent response and provides a justification for that requirement, justifies the
agency receiving the request considering the request as a whole. We consider
that, in the present case, this is relevant to both the issues of “transfer” and
“vexatiousness”.

[50]

Adopting that approach the Court reasoned that part of the information that

was the subject of the information privacy request (because of the explicit justification
for the claim of urgency) was information about the eligibility proceedings,21 stating:
[106] In the context of this request and, specifically, in relation to the linking
of the request for urgency with the need to have the information for the
purposes of the extradition hearing, we find that there is a plausible basis upon
which the transferring agencies could have concluded that the information that
20
21

High Court judgment, above n 3, at [6].
At [105].

 was the subject of the request was more closely connected with the functions
or activities of the other agencies. In this case, the functions or activities were
the conduct by Crown Law of the litigation in respect of which the claim for
urgency was made.

[51]

The Court considered it was clear that the only component of the request made

by Mr Dotcom of the agencies that justified the transfer to the Attorney-General was
the request for urgency,22 stating:
[113] We have come to the conclusion that because an integral component
of the information request was that of urgency, it was open to the receiving
agencies to transfer the request for a coordinated response to come from the
Attorney-General. The Act does not require that the Attorney-General holds
the information nor that he had held it previously.
…

[115] There is nothing in the text, context or purpose of the [Act] that
would preclude a receiving agency from transferring the request to the only
other agency that is in any position to make a considered evaluation of the
aspect of the request relating to urgency.

[52]

The Court noted that the Privacy Commissioner had chosen to analyse the

transfer as if it were simply a request for legal advice and assistance from Crown Law
but observed that that was not how Crown Law had presented the case to the
Commissioner.23 The Court said:
[119] … On the facts, the Privacy Commissioner’s analysis is also
unfounded. The recipient agencies transferred the request because they
believed that the information that was a critical component of the request
(namely the requirement to treat the request with urgency because of pending
legal action) was most closely connected with the functions and activities of
Crown Law.
[120] They did not transfer the requests to get legal advice. If Crown Law’s
only involvement was to provide legal advice, the Attorney-General would not
have been authorised to make the decision to decline the request on the ground
of vexatiousness.

[53]

The Tribunal had noted in its decision that the Crown case on vexatiousness

was based on the narrow contention that in making the requests Mr Dotcom had an
improper motive to disrupt the extradition hearing.24

22
23

24

However the High Court

At [123].
Contrary to the Tribunal’s recitation of events that the Crown adopted this as an alternative
defence: see [41] above.
Tribunal decision, above n 2, at [160].

 recorded that the Crown case on appeal was not so narrowly focused. 25 Indeed the
Crown relied on nine separate factors said to support a conclusion that the requests
were vexatious in the sense of having the effect of vexing or frustrating.26 On the basis
of those nine factors the High Court accepted that there was a proper basis under
s 29(1)(j) for the Attorney-General to have concluded that in the particular context of
the requests they were vexatious.27
Somewhat inconsistently the Court also drew attention to the fact that the

[54]

Solicitor-General had made it clear that the only component of the request that made
it vexatious was that of urgency.28 The Court remarked that all Mr Dotcom had to do
to avoid a failure to respond on the ground of vexatiousness was to resubmit the
request without the urgency component but he made a deliberate choice not to do
that.29
[55]

Consequently the Court allowed the appeal, finding there was a proper and

lawful purpose for the transfer of the requests and that, because of the insistence that
all 52 requests were required to be responded to urgently on the ground that the
information sought was relevant to the eligibility proceedings, the requests were
vexatious.30 The Court stated that had it been required to determine the issue of
remedies it would have set aside the awards of damages on the basis that they were
wholly erroneous and remitted the question of damages to the Tribunal for
determination in accordance with the principles outlined in the High Court’s judgment.
The interpretation of the Privacy Act
A fundamental difference in approach to interpretation
[56]

As Ms Casey QC for the Attorney-General emphasised, this appeal is confined

to two questions of law which concern the proper interpretation of particular
provisions of the Act. However, before turning to address those approved questions,
it is necessary to engage with fundamental differences in approach to the interpretation
25
26
27
28
29
30

High Court judgment, above n 3, at [163].
At [160].
At [174].
At [186], referring to para 7 of the letter of 5 August 2015 at [25] above.
At [187].
At [239].

 of the Act adopted by the respondent and the Privacy Commissioner, whose
appearance on this appeal pursuant to s 86(5) of the Act was his third episode of
involvement in the dispute.
[57]

Emphasising the broadly phrased language of the “open-textured” approach of

the Act and noting the Law Commission’s recognition of both its virtues and
associated downside,31 Ms Casey drew attention to the Tribunal’s approach to
interpretation in Taylor v Chief Executive, Department of Corrections:32
[A] key feature of the Privacy Act is that it is not rules-based. It is
principles-based and open-textured, and regulates in a rather light-handed
way. The open-textured nature of the Act means that judgment is required in
its application since it does not set out detailed steps for agencies to follow or
provide a checklist for compliance. The privacy principles must be applied
and assessed in relation to each individual set of facts as they arise.

[58]

It was Ms Casey’s contention that those features inform the approach to the

interpretation of the Act and in particular provide a strong indication against implying
rigid rules or tightly prescribed thresholds or constraints on the exercise of the various
judgements required from decision-makers in giving effect to the privacy principles.
[59]

By contrast and highlighting the constitutional consequence of access to

personal information provided by the Act, Mr Keith for the Privacy Commissioner
submitted that the answers to the questions before the Court, in particular the correct
interpretation of s 29, are not questions of particular fact or discretionary judgment.
Rather they are questions of statutory interpretation of wide consequence.

He

submitted that the interpretation placed upon them by the respondent had the effect of
denying substantive responses to a substantial number of the personal information
requests made by Mr Dotcom.
Ms Casey’s submission
[60]

Ms Casey contended that the Act provides for a low level process for resolving

disputes that is intended to be fast, practical and responsive, consistent with its
31

32

Law Commission Review of the Privacy Act 1993: Review of the Law of Privacy Stage 4
(NZLC R123, 2011) at 11.
Taylor v Chief Executive, Department of Corrections [2018] NZHRRT 35 at [91]. The decision
was upheld on appeal in Taylor v Chief Executive of the Department of Corrections [2020] NZHC
383, although the High Court did not discuss the Act being “open-textured” or “principles-based”.

 principles-based flexible character and the breadth of the regime’s application. Save
for the single exception of privacy principle 6, the rights and duties under the Act are
not enforceable through the courts.
[61]

She drew attention to the fact that, as a precursor to a Tribunal hearing, the

statute makes provision for a complaint to the Privacy Commissioner. In investigating
and attempting to resolve the complaint, the Commissioner is directed to act as a
conciliator.33 If following an investigation the complaint is found to have substance,
the Commissioner is directed to use his or her best endeavours to secure a settlement
between the parties concerned.34 If that fails, then the Commissioner may refer the
complaint to the Director of Human Rights who may, exercising his or her own
discretion, bring proceedings before the Tribunal.35
[62]

Ms Casey explained that the statutory regime is not framed around facilitating

claims by individuals to the Tribunal. Rather, the ability to bring such a claim is a form
of “back-stop”, providing an independent review of a complaint. She then submitted:

33
34
35

34.

The concept of “lawfulness” and “unlawfulness” emphasised in
Mr Dotcom’s submissions is not apt: in the context of a request under
Privacy Principle 6 the Act does not render any action unlawful, but
rather allows for an assessment (and conciliatory resolution) of
whether a complaint that an agency has failed to comply with that
Principle has substance.

35.

This framework is consistent with the flexibility of the regime, and
the recognition that agencies are expected to make judgement calls
with little information under tight timeframes, and should not be
exposed to overly prescriptive retrospective reviews of those
judgements. As the Tribunal recorded in Taylor v Chief Executive,
Dept of Corrections, having noted the timeframes required by the Act,
and that “of necessity” there is no participation by the individual in
the decisions made by the agency …

36.

The interpretation of the Act must accordingly reflect that the regime
is not directed to setting prescriptive rules and then imposing penalties
for non-compliance. The aim of the access right in Privacy Principle 6
and the procedural provisions in Part 5 is to support the promotion and
protection of individual privacy, and so an agency’s judgements are
reviewed on a ‘conciliatory’ basis, with the intention that errors can
be corrected and the privacy issues resolved in a non-punitive way.

Privacy Act, s 69(1)(b).
Section 77(1)(a).
Sections 77(2)–(3) and 82.

 Mr Keith’s submission
[63]

In Mr Keith’s analysis the provisions of the Act can be understood in terms of

three distinct aspects.

In respect of the first, the day-to-day operation of the

information privacy principles, he agreed that much can be understood as
“open-textured”, involving the common sense application of the information privacy
principles to facilitate access to information. The second significant aspect comprised
the limits and other protections which the Act provides for agencies that hold personal
information.
[64]

It was in respect of the third aspect, namely prescribed rights and obligations

under the Act, that he parted company with the Attorney-General’s submission.
Contending that this aspect of the Act prescribes legal standards, he drew attention to
the following statutory features:
(a)

The broad powers of remedy provided in the Act include not
only damages, declarations and costs but also the power to make
orders restraining a defendant from continuing or repeating an
interference with privacy36 and requiring a defendant to perform
any specified acts with a view to remedying an interference.37

(b)

The operation of grounds for refusal is not “open-textured” but
a rigorous legal standard.

(c)

While rights conferred by the information privacy principles are
in general enforceable only through the mechanisms in the Act,
s 11(1) provides that the principle 6 entitlement, so far as it
relates to personal information held by a public sector agency,
is a legal right enforceable in a court of law.

(d)

The Act confers jurisdiction on this Court to determine
questions of law.

36
37

Section 85(1)(b).
Section 85(1)(d).

 [65]

Rejecting the proposition that the particular requests in this case and the

response to them were exceptional, Mr Keith captured the essence of his submission
in this way:
11.

The short point is that, as with this Court’s consideration of
withholding grounds in Commissioner of Police v Ombudsman:
11.1

Through the right of access to personal information, the
Privacy Act upholds basic human rights and, in respect of
information held by public bodies, constitutional safeguards.
Although, and as set out above, aspects of the Act are
concerned with conciliation and practical resolution, it
remains that that right of access is a legal right.

11.2

That said, however, the safeguards that apply under the Act
can and should provide mechanisms by which excessive
requests can be curtailed and, as necessary, declined. For the
Act to be workable and fair, that cannot … depend upon an
intense factual analysis of the context and the stated or
perceived purpose of requests, either as a basis to refuse or as
a basis to require fuller compliance.

11.3

Instead, they are questions of robust application of the
statutory language, interpreted consistently with the purposes
and context of the Privacy Act. What follows, as this Court
and the court below recognised in granting leave on the
questions as put and as discussed in detail below, is that the
extent of and limits upon that right are not, and cannot be left
to be, matters of pragmatic judgment by the recipient agency
or matters of intense factual consideration. The Act, and
ss 29, 37 and 39 in particular, are capable of clear and
straightforward interpretation and application.

Analysis
[66]

The two approved questions qualify as questions of law because they concern

the proper construction of the Act.38 The statutory meaning is to be ascertained from
its text and in light of its purpose.39 We will address the text and purpose of the
particular provisions in the course of considering the two approved questions below.
[67]

At this juncture we discuss the different approaches to the interpretation of the

Act reflected in the submissions of the Attorney-General and the Privacy
Commissioner. For that purpose we accept that pt 2 of the Act, which contains the

38
39

Commissioner of Inland Revenue v Walker [1963] NZLR 339 (CA) at 353 per Gresson P.
Interpretation Act 1999, s 5(1); and Commerce Commission v Fonterra Co-operative Group Ltd
[2007] NZSC 36, [2007] 3 NZLR 767 at [22].

 12 information privacy principles, is open-textured in the manner described by
Ms Casey and, subject to what is said below in relation to principle 6, we assume (but
without making a specific finding) that it is amenable to interpretation in a manner
calculated to achieve the objectives described by Ms Casey at [58] above.
[68]

As the Supreme Court in R v Alsford recognised, the privacy principles do not,

for the most part, create rights that are enforceable through the courts.40 However
different considerations apply in respect of principle 6. That is the consequence of
s 11 which states:
11

Enforceability of principles

(1)

The entitlements conferred on an individual by subclause (1) of
principle 6, in so far as that subclause relates to personal information
held by a public sector agency, are legal rights, and are enforceable
accordingly in a court of law.

(2)

Subject to subsection (1), the information privacy principles do not
confer on any person any legal right that is enforceable in a court of
law.

As Mr Keith submitted, where information is held by public bodies, s 11(1) gives
distinct and legally binding status to the right of access under information privacy
principle 6.
[69]

While recognising the exception in s 11(1), Ms Casey nevertheless envisaged

that the additional provisions specific to the principle 6 entitlement concerning
procedure and grounds for refusal should be subject to the same caution about reading
in strict or rigid requirements.41 Despite its frequent use as an information disclosure
tool, she submitted that the primary purpose of the Act is not about access to
information but rather the promotion and protection of individual privacy.42
[70]

Acknowledging that privacy principle 6 can stand alone, she nevertheless

emphasised that it works as a “key accountability mechanism” that supports the other
privacy principles by allowing an individual to see what information has been
collected about them. She submitted that the fact that privacy principle 6 is not
40
41
42

R v Alsford [2017] NZSC 42, [2017] 1 NZLR 710 at [37].
For example see para 36 of her submission at [62] above.
As stated in the long title of the Act.

 primarily directed at establishing a full “as of right” information disclosure regime
was supported by the Tribunal’s decision in Taylor.43 She also drew attention to the
appeal decision where the High Court approved the observation of the Court of Appeal
of England and Wales that the right to access to personal data enables an individual to
assess whether their privacy is being unlawfully infringed upon, rather than being an
“automatic key to information” for any purpose.44
[71]

However, and as Mr Keith responded, the Court of Appeal has since

emphasised in Dawson-Damer v Taylor Wessing LLP45 that Durant does not invite
critical inquiry into purpose, observing that:
[91]
Confining the scope of subject access rights [to disclosure] by
reference to purpose is an unprincipled restriction of the … right and will
result in complex litigation in an attempt to determine the “true” purpose of
any application. …

[72]

Mr Keith observed that the operation of grounds for refusal is not

“open-textured” but rather a rigorous legal standard, drawing attention to the
observations of this Court in Commissioner of Police v Ombudsman in the context of
the provisions for access to personal information provided in respect of public bodies
in pt 4 of the Official Information Act:46
Parliament has adopted the strong word “right” and has expressly conferred
the rights upon individuals, features which were noticeably absent in Pasmore
itself, and the obvious intention in my opinion was to create a legally
enforceable right in the person concerned. We should not emasculate the Act
by refusing to give effect to it.

[73]

Consistent with the status of an enforceable legal right, pt 5 provides specific

procedural provisions to facilitate responses to requests made pursuant to sub-cl 1(a)
and (b) of principle 6.47 As Mr Keith said, these express provisions and procedures
are provided for the effective and accountable operation of the Act with the objective
of ensuring that a recipient agency is focused on the request and upon the information
sought in accordance with the rights that underpin the Act.

43
44

45
46
47

Taylor v Chief Executive, Department of Corrections, above n 32, at [125].
Taylor v Chief Executive of the Department of Corrections, above n 32, at [53] n 38, citing Durant
v Financial Services Authority [2003] EWCA Civ 1746 at [27].
Dawson-Damer v Taylor Wessing LLP [2017] EWCA Civ 74, [2017] 1 WLR 3255.
Commissioner of Police v Ombudsman [1988] 1 NZLR 385 at 389.
It also applies to a request made pursuant to sub-cl (1) of principle 7: see s 33(c).

 [74]

On this issue of interpretative approach we agree with the view advanced by

the Privacy Commissioner.48 The legal right conferred by s 11(1) is not susceptible to
the more liberal interpretative treatment applicable to privacy principles other than
principle 6. The entitlement to refuse access prescribed in pt 4 and the procedural
steps provided in pt 5 should be construed in accordance with orthodox principles of
statutory interpretation. Their meaning should not vary to accommodate what may be
seen as the flexible and pragmatic objective of the statutory “regime”.
[75]

Ms Casey emphasised that the definition of “agency” in s 2 applies to a far

wider group than the term in the Official Information Act. She submitted that the
interpretation of the Act must be consistent across its application to all agencies, from
the corner dairy to a large bank or government department, making the point that the
Act does not excuse compliance depending on the size or resources of an agency.
[76]

We agree that the interpretation of s 39 and of the other process provisions in

pt 5 should not discriminate between categories of agencies. We do not accept the
proposition that, because there are potentially a broad range of agencies who must
comply with the Act, some lowest common denominator approach to interpretation
should apply to the pt 5 provisions.
[77]

While we recognise that the legal right conferred by s 11(1) extends only in

relation to public sector agencies, we note that it is principle 6 itself which states that
its application is subject to pts 4 and 5. Although it is not strictly part of the ratio of
this judgment, we can see no reason why the process provisions should receive
a different interpretation where the agency in question is not a public sector agency.
The Attorney-General’s additional argument
[78]

In support of the Attorney-General’s statutory interpretation proposition

Ms Casey also referred to passages in judgments which recognise the narrow scope of
appeals limited to questions of law. Attention was first drawn to the following passage
from Bryson v Three Foot Six Ltd:49

48
49

At [64]–[65] above.
Bryson v Three Foot Six Ltd [2005] NZSC 34, [2005] 3 NZLR 721 at [25].

 It is for the Court to weigh the relevant facts in the light of the applicable law.
Provided that the Court has not overlooked any relevant matter or taken
account of some matter which is irrelevant to the proper application of the law,
the conclusion is a matter for the fact-finding Court, unless it is clearly
insupportable.

That extract omitted the initial sentence which reads:
An appeal cannot, however, be said to be on a question of law where the
fact-finding Court has merely applied law which it has correctly understood
to the facts of an individual case.

The Supreme Court was there contrasting factual appeals from appeals on questions
of law. The distinction has no application to the present matter.
[79]

Following reference to Bryson, Ms Casey contended this Court’s approach in

Equus Trust v Christchurch City Council is “particularly apt” for the instant case,
citing the following passage:50
[7]
Where an appeal is limited to a question of law which concerns the
interpretation of legislation, it is not sufficient for an applicant simply to point
to one interpretation being perhaps preferable to another. The Supreme Court
made this abundantly clear in Vodafone New Zealand Ltd v Telecom
New Zealand when endorsing the observation of Lord Mustill in R v
Monopolies and Mergers Commission ex parte South Yorkshire Transport Ltd.
Where a legislative instrument genuinely makes available a range of
meanings, the Court is entitled to substitute its own opinion for that of the
original decision maker “only if the decision is so aberrant that it cannot be
classed as rational”. These principles apply with particular force when the
decision maker is a specialist tribunal. …
(Footnotes omitted.)

[80]

That paragraph concluded with the statement that those principles accordingly

applied in the Equus Trust case. This Court was satisfied that the interpretation of the
Canterbury Regional Policy Statement by the hearing panel “was plainly available to
it and not irrational”.51
[81]

However this Court’s observations in Equus Trust were plainly concerned with

the rare category of case discussed in Bryson which falls within Lord Radcliffe’s

50
51

Equus Trust v Christchurch City Council [2017] NZCA 200.
At [8].

 tripartite description in Edwards (Inspector of Taxes) v Bairstow, namely a state of
affairs described:52
… as one in which there is no evidence to support the determination or as one
in which the evidence is inconsistent with and contradictory of the
determination, or as one in which the true and only reasonable conclusion
contradicts the determination.

It was with reference to that rare category of case that the Supreme Court in Vodafone
New Zealand Ltd v Telecom New Zealand Ltd issued the caution about the
interpretation of words or phrases in statutes which involve an imprecise criterion.53
[82]

We recognise that, viewed in isolation, the first sentence in the Equus Trust

paragraph could be read as having application more generally to appeals on questions
of law. However clearly that was not the intention. Properly understood the dictum
is not authority for the argument which the Attorney-General advances in the present
case in support of the proposition that the procedural processes in pt 5 of the Act should
be construed in a more flexible manner than orthodox statutory interpretation
mandates.
Conclusion
[83]

We agree with the submission of the Privacy Commissioner that pts 4 and 5 of

the Act should be construed in accordance with orthodox principles of statutory
interpretation. We do not accept the Attorney-General’s contention that some more
fluid or liberal interpretative approach should be adopted in order to accommodate
what is described as the flexible and pragmatic objective of the statutory regime.
Question 1
[84]

The first question put before the Court reads as follows:
Can a request for personal information under the Privacy Act 1993 be
transferred by the recipient to another agency where the request seeks urgency

52
53

Edwards (Inspector of Taxes) v Bairstow [1956] AC 14 (HL) at 36.
Vodafone New Zealand Ltd v Telecom New Zealand Ltd [2011] NZSC 138, [2012] 3 NZLR 153
at [54]–[56].

 and the basis for the urgency request is not a matter that the recipient is able to
sensibly assess but the agency to which the request is transferred is the only
agency able to properly evaluate the claimed basis for the urgency?
[85]

The condition-laden formulation of the question derived from the ratio of the

High Court judgment. The Court accepted that the Tribunal had been undoubtedly
correct in holding that the decision to transfer and the declinature itself were made for
reasons other than those related to the assessment of the information itself and what
should be disclosed or withheld.54 However the Court considered the issue to be
whether, in the circumstances where the requests made of all 52 agencies specifically
sought urgency on the basis that the documentation was needed urgently in connection
with the extradition hearing, the “transfer to Crown Law” was justified on the basis it
was the entity conducting that litigation and best placed to analyse and respond to that
request.55
[86]

The High Court reasoned:
(a)

because of the “explicit justification for the claim of urgency”,
information about the eligibility proceedings was “part of the
information that was the subject of the request”;56

(b)

the only component of the information request that justified the
transfer by the agencies to the Attorney-General was the request
for urgency;57 and

(c)

because the request for urgency was an integral component of
the information requests, it was open to the agencies to transfer
the request for a co-ordinated response to come from the
Attorney-General.58

54
55
56
57
58

High Court judgment, above n 3, at [96][97], quoting the Tribunal decision, above n 2, at [67].
At [97].
At [105].
At [123].
At [113]. See [51] above.

 The Court concluded:
[115] There is nothing in the text, context or purpose of the [Act] that would
preclude a receiving agency from transferring the request to the only other
agency that is in any position to make a considered evaluation of the aspect of
the request relating to urgency.

[87]

Ms Casey elaborated upon that justification explaining that the requests were

transferred as part of a “whole of Crown” approach in formulating the response.
59.

… Crown Law (the Attorney-General) was identified as the
appropriate transferee, because:
59.1

Crown Law was (and is) the central agency responsible for
the extradition litigation to which the requests (and the claim
for urgency) were expressly linked;

59.2

Mr Dotcom was involved in extensive litigation with the
Crown, both in defending the extradition and in a range of
related civil … proceedings. Discovery and disclosure had
been a prominent feature of this litigation. Crown Law was
familiar with the full details of this and had visibility across
the entire scope of the potential issues that might arise with
the responses to these requests.

59.3

Crown Law was in the best position to make centralised
decisions in relation to the requested information on the
request for urgency, and in co-ordinating and assessing the
response to the requests, including the application of any
grounds for declining the requests or withholding information
should the requests be accepted.

(Footnotes omitted.)

[88]

Section 39 contemplates an inter-agency transfer in two scenarios:59
Where—
…
(b)

59

At [12] above.

the information to which the request relates—
(i)

is not held by the agency but is believed by the person
dealing with the request to be held by another
agency; or

(ii)

is believed by the person dealing with the request to
be more closely connected with the functions or
activities of another agency,—

 The focus of argument in this case is the second scenario.
[89]

Section 39 is one of three provisions which necessitate consideration of

whether an agency other than the recipient agency is a more suitable respondent to
a request. The second is found in the ground of refusal in s 29:
(2)

An agency may refuse a request made pursuant to principle 6 if—
…
(c)

the information requested is not held by the agency and the
person dealing with the request has no grounds for believing
that the information is either—
(i)

held by another agency; or

(ii)

connected more closely with the functions or
activities of another agency.

In addition, s 38 imposes a duty to direct a request to “the appropriate agency”.60 Both
ss 29(2)(c) and 39 have their antecedents in the Official Information Act 61 and the
Local Government Official Information and Meetings Act 1987.62
[90]

Ms Casey submitted that there is no policy reason to limit the scope of

s 39(b)(ii) or impose strict rules on an agency as to when a transfer is or is not
appropriate. From the requestors’ perspective they are entitled to disclosure of their
personal information unless one of the withholding grounds properly applies. Such
entitlement does not vary with the identity of the agency making the decision.
She submitted that in real terms it makes no difference to a requestor which agency
provides the response:
In other words, in terms of its purpose the Act is neutral as to who responds to
the request.

[91]

Ms Casey submitted that even on “a narrow reading” of s 39(b)(ii) it will be

legitimate for an agency to transfer a request to another agency if the transferee is
assessed to be in a better position to make decisions about “whether and how” to
disclose the information held by the first agency. By way of example it was said the
60
61
62

At [11] above.
Sections 18(g) and 14 respectively.
Sections 17(g) and 12 respectively.

 transferee may be in a better position to undertake the assessment of whether there are
proper grounds for withholding the information under ss 27–29 and the extent to which
it would be appropriate to do so. It was further submitted:
Similarly, that agency may be in a better position to estimate how long that
assessment might take and accordingly whether an extension of time would
be appropriate under s 41 (and equally, whether a request for urgent provision
of the information can or ought to be met).

[92]

However we agree with Mr Keith63 that the High Court’s reasoning presents

several difficulties. First, section 39(b)(ii) provides for transfer in specific terms. It is
the “information” sought that is to be “more closely connected” with the functions or
activities of another agency, not the request as the High Court itself had earlier
correctly observed.64 Secondly the criterion for transfer is a belief, necessarily on
some objective basis, on the part of the person dealing with the request as to such a
connection between the information and the activities or functions of the other agency.
[93]

Mr Keith emphasised the issue is whether s 39 “permits” a transfer.

That involves the application of a statutory procedure and applicable criteria before a
recipient may transfer responsibility for a request. A transfer not falling within those
criteria is not lawful. Hence he took issue with the High Court’s approach 65 in
analysing whether there was anything to “preclude” a transfer for the purpose of
undertaking a considered evaluation of a request for urgency. We agree with the tenor
of his submission that the neutrality of the Act as asserted by the Attorney-General
does not mandate ignoring the procedural requirements of s 39(b)(ii).
[94]

Mr Keith made the further point that the premise of the High Court, that

transfer is necessary in order to make an informed assessment of the claim to urgency,
overlooked the scope for a recipient to seek advice. In particular he drew attention to
the express provision for consultation between public bodies in s 40(4):
Nothing in subsection (3) prevents the chief executive of a department or any
officer or employee of a department from consulting a Minister or any other
person in relation to the decision that the chief executive or officer or
63

64
65

Mr Mansfield supported this argument. He also submitted that it was a requirement of s 39(b)(ii)
that a proposed transferee must either hold or control the requested information. It is unnecessary
for us to address that contention.
At [21] above.
High Court judgment, above n 3, at [115]. See [51] and [86] above.

 employee proposes to make on any information privacy request made or
transferred to the department in accordance with this Act.

[95]

Indeed it was acknowledged in the Attorney-General’s submission that an

agency which held requested information but considered another agency to be more
closely connected, and thus in a better position to make the relevant decisions under
the Act, could either transfer the request or decide to keep the request and consult with
the other agency about what it wished to be done in response to the request.
[96]

On this issue as well, we consider that the argument of the Privacy

Commissioner is to be preferred. The fact that urgency is sought does not comprise
a part of the information the subject of an information privacy request. It does not
provide a proper basis for a transfer of the information request to another agency.
We answer the question in the negative.
Question 2
[97]

As earlier noted66 the High Court concluded that the only component of

Mr Dotcom’s information requests that justified the transfer by the agencies to the
Attorney-General was the fact urgency was sought. Hence the application for special
leave to appeal posed the following question of law:
Is a request for urgency accompanying a request for personal information
under Information Privacy Principle 6 a proper basis for refusing the request
as vexatious under s 29(1)(j) of the Privacy Act 1993?

[98]

The leave judgment records that the question was reformulated in discussion

with counsel at the leave hearing.67 In doing so the question was broadened to address
scenarios where the fact that urgency is sought is not the sole consideration in the
determination whether to refuse the information request on the grounds it is vexatious.
It now reads:
Is a request for urgency under s 37 of the Privacy Act 1993 a relevant factor
for an agency in determining whether to refuse a request for personal
information under s 29(1)(j) of that Act?

66
67

At [86(b)] above.
Leave judgment, above n 4, at [3].

 [99]

Mr Mansfield submitted that a request for urgency can never be relevant to

whether a request is vexatious because, irrespective of how they are made, a request
for information and a request for urgency are two separate requests under two distinct
provisions of the Act. Although they may be made concurrently, they are unrelated
and require two distinct decisions.
[100] Ms Casey suggested that Mr Dotcom’s argument appeared to resolve to the
single proposition that, had the Court adopted the two request analysis, it would have
found there was no proper basis to consider the information request was vexatious.
Ms Casey responded that the High Court’s assessment, that the request for urgency
was an integral component of the information requests, was a finding of fact not
capable of challenge on appeal. However as we have held, the reasoning, that seeking
urgency is a component of the information requested, is flawed.
[101] Ms Casey then submitted that the assessment of whether an information
request is vexatious will always be intensely fact specific. She contended that under
ordinary principles the assessment can and should take into account the full context
and the whole course of conduct68 and that it would be an extraordinary proposition to
say that one important aspect of a request, namely the seeking of urgency, is by law
excluded from the assessment whether the information request is vexatious.
[102] Noting that the threshold for vexatiousness in New Zealand is to require that
“no reasonable person could properly treat it as bona fide (that is, having been made
in good faith)”,69 Mr Keith submitted that it is difficult to see the ancillary provision
for urgency itself reaching the necessarily high threshold for vexatiousness. He drew
attention to the need for rigour being emphasised with considerable care in the English
decision Dransfield v Information Commissioner:70
[T]he emphasis should be on an objective standard and that the starting point
is that vexatiousness primarily involves making a request which has no
reasonable foundation, that is, no reasonable foundation for thinking that the
information sought would be of value to the requester, or to the public or any
section of the public. Parliament has chosen a strong word which therefore
68

69

70

Citing Siemer v Attorney-General [2016] NZCA 43, [2016] NZAR 411 at [33], which in turn
quoted Brogden v Attorney-General [2001] NZAR 809 (CA) at [22].
Citing Paul Roth and Graham Taylor Access to Information (2nd ed, LexisNexis, Wellington,
2017) at [3.10.16].
Dransfield v Information Commissioner [2015] EWCA Civ 454, [2015] 1 WLR 5316 at [68].

 means that the hurdle of satisfying it is a high one, and that is consistent with
the constitutional nature of the right. The decision-maker should consider all
the relevant circumstances in order to reach a balanced conclusion as to
whether a request is vexatious. If it happens that a relevant motive can be
discerned with a sufficient degree of assurance, it may be evidence from which
vexatiousness can be inferred. If a requester pursues his rights against an
authority out of vengeance for some other decision of its, it may be said that
his actions were improperly motivated but it may also be that his request was
without any reasonable foundation. But this could not be said, however
vengeful the requester, if the request was aimed at the disclosure of important
information which ought to be made publicly available.

[103] Mr Keith accepted that on that approach it followed that “in a strict sense”
a request for urgency might conceivably indicate vexatiousness. The important point
in his submission for the operation of the Act is that, as with Dransfield, a broad and
balanced consideration is required and “a sufficient degree of assurance” reached that
the high threshold there described is met.
[104] While considering it to be relatively straight forward for a recipient to
determine whether a request for urgency is well-founded, Mr Keith submitted that it
is very difficult to infer improper purpose or bad faith in the information request by
reference to the accompanying request for urgency.
[105] Unlike an information request which is not required to be supported by reasons,
a requestor seeking urgency under s 37 must give reasons why the information request
should be treated as urgent. Just as those reasons may fail to support urgency, they
may also reveal information from which a vexatious purpose might properly be
inferred. We are mindful of Mr Keith’s caution that reasons advanced for urgency
cannot be assumed to be the reason, or the only reason, for the information request
itself. However for present purposes the issue is whether it is possible for the urgency
request to disclose a vexatious purpose.
[106] In our view the reasons advanced for seeking urgency could inform the
decision-maker on the issue of whether the information privacy request is vexatious.
Hence in that manner a request for urgency could be a relevant factor for consideration
in the decision to refuse the request. However the mere fact of a request for urgency
would not alone be a proper basis for a refusal on the vexatious ground. While we
agree with the tenor of the submissions for the Privacy Commissioner that it is difficult

 to conceive how the mere fact of a request for urgency could be a relevant factor for
consideration in a decision to refuse an information request itself on the grounds it is
vexatious, it is not possible to say that it could never be so.
Consequential directions
[107] It follows from our answer to Question 1 that the transfers of Mr Dotcom’s
information privacy requests to the Attorney-General were invalid and, on the face of
it, an interference with Mr Dotcom’s privacy.
[108] It follows from our answer to Question 2 that a refusal to respond to
Mr Dotcom’s requests on the grounds that they were vexatious would not be
supportable on the basis of the reasons given by the Solicitor-General in his letters of
5 and 31 August 2015. Ms Casey submitted that the High Court did not find that the
request for urgency was the only relevant ground to support the assessment that the
request was vexatious.

However the issue whether the decision to decline the

information requests in reliance on s 29(1)(j) for reasons different from those which
were proffered at the time is not a matter before us on this confined appeal.
[109] Mr Mansfield submitted that the appropriate course was for the Tribunal’s
decision on the issue of interference with Mr Dotcom’s privacy to be reinstated and
the question of damages to be remitted to the High Court for determination. However
the Tribunal’s decision on the transfer issue was based on the different argument then
advanced on behalf of the Crown that the transfer was for the obtaining of legal advice
as well as the co-ordination of the Crown’s response.
[110] We consider that the appropriate order is to allow the appeal from the
High Court judgment to the extent reflected in our answers to the two approved
questions. The issue of damages should be remitted to the Tribunal for reconsideration
in the light of this judgment.
Result
[111] We answer the questions in this way:

 Question 1: Can a request for personal information under the Privacy Act
1993 be transferred by the recipient to another agency where the request seeks
urgency and the basis for the urgency request is not a matter that the recipient
is able to sensibly assess but the agency to which the request is transferred is
the only agency able to properly evaluate the claimed basis for urgency?
No.

A transfer of an information privacy request under s 39(b)(ii) is

permissible only if the person dealing with the request believes the information
to which the request relates to be more closely connected with the functions or
activities of the transferee agency. The fact that a requestor seeks urgent
treatment of an information request, whether or not in the same document as
the request, does not comprise part of the information to which the information
request relates.
Question 2: Is a request for urgency under s 37 of the Privacy Act 1993
a relevant factor for an agency in determining whether to refuse a request for
personal information under s 29(1)(j) of that Act?
Yes, it may be a relevant factor. Although the mere fact of a request for urgency
would not of itself generally be a proper basis for a finding of vexatiousness,
we cannot exclude the possibility of there being circumstances where an
inference of vexatiousness could be drawn from a request for urgency.
Examples of such circumstances might include a grossly excessive number of
requests for urgency or reasons given for urgency that are not credible. All will
depend on the context in which the request for urgency is made.
[112] The appeal is allowed to the extent reflected in the answers to the approved
questions.
[113] The proceeding is remitted to the Human Rights Review Tribunal for
reconsideration of the issue of damages in respect of the interference with the
appellant’s privacy by the wrongful transfer of the appellant’s information privacy
requests.

 [114] The respondent must pay the appellant costs for a standard appeal on a band A
basis and usual disbursements.

Solicitors:
Anderson Creagh Lai, Auckland for Appellant
Crown Law Office, Wellington for Respondent
Office of the Privacy Commissioner, Wellington for Intervener