Reviewed and updated May 2025
We often get asked about how much a complaint is “worth” in settlement terms, by both complainants and respondents. To be honest, very few of our complaints settle for money. The resolution is usually non-financial, like the release of information or a decent apology.
However, we want to be helpful, and make sure our process is fair for both parties, and so we’ve put together some information on settlements under the Privacy Act.
Our process is focused on resolving complaints but there is no easy formula for ‘valuing’ a complaint. In the past we have seen settlements including financial compensation, apologies, donations to social service agencies, arrangements for the installation of security systems, commitments to staff training, policy changes, and even a fruit basket, or restaurant vouchers. What the parties settle on is entirely up to them and will depend on a number of factors including the harm experienced by the complainant, the nature of the breach, and the willingness to resolve the complaint.
Harm
There are three kinds of harm under section 69 of the Privacy Act which can be considered when deciding whether someone’s privacy has been interfered with:
- Specific damage – this could be financial loss, but could also include other forms of damage, such as loss of employment or physical injury;
- Loss of benefits – this is where the agency’s actions have adversely affected, or may adversely affect, the rights, benefits, privileges, obligations or interests of the individual; and
- Emotional harm – where the action has resulted in, or may result in, significant humiliation, significant loss of dignity or significant injury to the individual’s feelings. Mere embarrassment or annoyance is not enough – any emotional harm needs to be ‘significant’.
The Tribunal
If the matter is not resolved through our process, the complainant will be entitled to take their complaint to the Human Rights Review Tribunal. The Tribunal has the same monetary jurisdiction as the District Court, that is up to $350,000, and is able to award damages and compel parties to take action. However, it is worth noting:
- There is currently a significant wait time to get a hearing.
- Proceedings are generally public.
- There can be significant costs associated with the process.
- You can have costs awarded against you if you are unsuccessful.
For these reasons, complaints generally settle for a ‘discount’ if settled before reaching the Tribunal.
Awards in the Tribunal vary substantially, and are fact-dependent. Again this makes it difficult to accurately assess what a complaint is ‘worth’ in money terms. In Hammond v Credit Union Baywide [2015] NZHRRT 6, the Tribunal reviewed recent awards and summarised:
[176] From this general overview it can be seen that awards for humiliation, loss of dignity and injury to feelings are fact-driven and vary widely. At the risk of over-simplification, however, it can be said there are presently three bands. At the less serious end of the scale awards have ranged upwards to $10,000. For more serious cases awards have ranged between $10,000 to about (say) $50,000. For the most serious category of cases, it is contemplated awards will be in excess of $50,000.
Most of the complaints we deal with are not factually similar to the case referenced above, but the comments are useful in setting out the current state of settlements in the Tribunal where there has been a serious interference with privacy. To reach the top band, there will usually have to be some very bad behaviour on the part of the respondent agency. We haven’t seen any awards near that level since the Hammond decision.
Other recent cases in the Tribunal that discuss harm include:
Recent OPC settlements
Below is a summary of some recent settlements our Office has facilitated. As mentioned above, complaints that settle without having to go to the Tribunal usually do so for a “discount”. This is because we can help you quicker, and you avoid the risk of litigation. This is not a complete or comprehensive scale, but may help you understand what some other complaints have settled for.
| $500 |
where an agency had published information on its website about a consent application made by a woman, including her email address and phone number, and hadn’t told the woman her information would be disclosed in this way. |
| $900 |
where an employer posted information about one of her employees on a Facebook group page, complaining about her work ethic and performance. |
| $1,000 |
where an agency delivered someone else’s order to a woman’s house, then told its customer the woman’s address and to go to her house to collect their order. |
| $1,000 |
where an agency told a complainant’s former partner about allegations the complainant had made about their partner, and which affected their ongoing co-parenting relationship. |
| $1500 |
to allow a couple to purchase a security system after an agency disclosed their address to a third party despite the couple expressly asking the third party not be told where they lived. |
| $2,000 |
when a medical centre dropped a patient’s mental health records off to his letterbox but when he went to get them they weren’t in his letterbox. |
| $2,000 |
where an agency failed to take steps to stop their employee from looking up a woman’s file in their database and disclosing the information to people she knew. |
| $2,000 |
where the respondent inadvertently disclosed the complainant’s personal information by sending her a letter in a windowed envelope which was then viewed by another person. |
| $2,000 |
where a retail store posted a picture of a young girl online, wrongly accusing her of theft. |
| $2,200 |
where an agency failed to respond to an access request from an ex-employee, and also disclosed information about the man to their clients. |
| $3,000 |
where the details of an employment investigation into the complainant’s conduct were accessible to all staff in the organisation. |
| $3,275 |
where a government agency collected a lot more information from a man than they needed over a number of years, and refused to provide him with its services unless he kept giving them the information. |
| $3,678 |
where a debt collector used a man’s information for a purpose other than the one they had collected it for, using it to contact his family and friends (the amount was a write-off of the debt he owed). |
| $4,000 |
where a credit reporter was informed that the complainant’s record had been incorrectly merged with another person’s and reflected the other person’s debts on the complainant’s credit report. The credit reported had not corrected this after assuring the complainant that the mistake had been corrected. |
| $5,000 |
where a health agency delayed in attaching a requestor’s Statement of Correction for almost two years. |
| $5,000 |
where a health agency sent the complainant’s health information to an incorrect email address. |
| $5,750 |
where the contact details of the complainant were disclosed to a third party who used this information to harass the complainant. |
| $6,000 |
where a health agency sent the complainant’s information to another patient due to an incorrectly addressed envelope. |
| $6,000 |
where an agency twice sent sensitive information to a woman’s work address in the knowledge that the workplace had a policy of opening all incoming mail. |
| $8,000 |
where the respondent disclosed the complainant’s health information and details of follow up support that needed to occur to a large group of people. |
| $10,000 |
where a staff member of the agency inappropriately accessed the complainant’s sensitive health information. |
| $10,000 |
where a person’s health information was sent to the wrong street address and which caused an exacerbation of an underlying psychological condition and the woman to feel unsafe in her own community. |
| $14,000 |
where a person’s health information was sent to an incorrect email address, and which revealed very sensitive information about the person. |
| $14,000 |
where a district health board sent a patient’s medical records (concerning a termination of pregnancy) to her parent’s address after she had twice requested it update its records. |
| $15,000 |
when, on three separate occasions, an agency failed to check the complainant’s updated address details and posted personal information to an outdated address. |
| $15,000 |
where a human resources complaint made by an employee was printed and left in the company’s break room for other staff to see, and which led to the employee being harassed by their colleagues. |
| $15,000 |
where a woman’s information was given in error to other customers of a government department. The woman was approached on social media by a recipient of her information. |
| $17,000 |
where a government department disclosed a man’s address to his brother, who was about to be released from prison and against whom he had a protection order. |
| $61,000 |
where an employee’s image was used for a marketing campaign without their informed consent. This caused significant emotional distress and relapse of pre-existing mental health conditions. |
As you can see, there is a range, even for similar factual circumstances. It is important to provide evidence of real costs - such as doctor’s visits and counselling sessions - as well as a described experience of significant emotional harm. The threshold is high, and requires more than a fleeting feeling of upset or distress. This is information the respondent agency will have to consider in determining what they are able to offer.
It is important to remember that when you complain to our Office, it is very unlikely the outcome will be cash in your pocket. We only facilitate financial settlements where there has been a clear breach of a privacy principle and serious harm that has flowed from that breach. It’s also relevant to note that even where we have facilitated a settlement, we have no power to enforce it, if either party fails to uphold the agreement. In the unlikely event that happened, you’d need to seek independent advice.
There are provisions in the Privacy Act (Sections 118, 197 and 212) that allow for an agency to be fined $10,000 in some specific circumstances. Sometime people ask us if this means they get $10,000 if they experience an interference with their own privacy. The answer is no.
This section of the Privacy Act instead allows the Commissioner to consider prosecuting an agency in line with our Prosecution Policy (opens to PDF, 192KB) and does not have any bearing on compensation that may be paid to an individual for an interference with their privacy.
complaints,
Human Rights Review Tribunal
Back
