New Zealand’s Privacy Act requires businesses to comply with certain privacy ‘principles’ when collecting, keeping and using personal information. The 2025 Human Rights Review Tribunal’s decision in Cummings v KAM Transport LTD shows how these principles can be breached if proper precautions aren’t taken.
In the case the employee, Mr Cummings, was asked to undergo a drug test in his employment. When he initially refused, KAM suspended him from work. He later returned after completing and passing a drug test, but was told by a client of his employer rumours were that he was a drug dealer and he had been dismissed. It turned out that a senior manager in KAM had disclosed to another employee that Mr Cummings had refused the first drug test, that got out, and the story falsely grew. Mr Cummings lodged a complaint with the Privacy Commissioner, and then filed a claim in the Human Rights Review Tribunal, saying his privacy had been breached.
The Tribunal agreed. It found there was a breach of Information Privacy Principle 11 by KAM under the Privacy Act. The employee that had been told was not part of the disciplinary process, so had no need to personally know about Mr Cummings’ refusal to be drug tested. He shouldn’t have been told. The Tribunal awarded $30,000 in damages given the humiliation, loss of dignity and mana to Mr Cummings.
This decision shows the care New Zealand employers need to take in protecting the privacy of their employees, and when they don’t there can be costly claims. Employers should ensure that management understands the legal limits on internally sharing employees’ personal information.