Concerns raised by the Otago Daily Times about the the Ministry of Health's refusal to provide a privacy impact assessment on the B4 School programme have shown up anomalies which the Office of the Ombudsmen is to raise with the Privacy Commissioner.
While the ministry's refusal to release the document because it was legal advice and therefore privileged has been upheld by Ombudsman David McGee, he has suggested there are issues which need further consideration.
Mr McGee said if the privacy impact assessment (PIA) had been prepared by a policy analyst, rather than a practising lawyer, the section of the Official Information Act allowing the refusal would not have applied.
"Yet the quality of the PIA may not have been any different because of the different authors and certainly the interest of the public in seeing the PIA is in no way diminished by who prepares it."
Mr McGee apologised for his delay in reaching a decision on the ODT complaint lodged in June last year, but said that it had raised complicated issues regarding the nature and scope of legal professional privilege and the relative public interest.
He agreed with the ODT that the approach by agencies on the release of PIAs involving legal advice was inconsistent.
The ODT had pointed out instances of publicly available PIAs, including one naming the lawyer who had prepared it.
Mr McGee said he had questioned whether the type of work involved was legal advice to which legal professional privilege attached, notwithstanding that its author was a legal practitioner.
"Somewhat to my surprise, I cannot find any support for this approach. Legal advice is regarded as being any advice provided by a practising lawyer, without regard to its nature."
The fact that in modern times lawyers were not confined to traditional areas of practice and " stray into wider policy areas that are also the preserve of other professionals" had not been taken to disentitle claims for legal professional privilege when the adviser was a lawyer.
Mr McGee said he considered this questionable as a matter of legal policy.
"But, tempting as it is, I do not feel that as Ombudsman, I can rewrite the rules on legal professional privilege."
So, while he had considerable sympathy with the view that the relevant section of the act 9(2)(h) did not apply to the type of advice in a PIA, under current law " it seems to me that it does".
He found that there were no grounds in the case of the B4 School checks programme in which he could envisage overriding the privilege.
He said, however, that he took the ODT point about the public interest in access to PIAs to improve transparency and community engagement with privacy issues.
The ODT had suggested it could be all too easy for government departments to wriggle out of responsibility for less than wonderful decisions simply by saying they were relying on legal advice.
Mr McGee said he considered the best approach was to see if some principles could be established about the availability of PIAs as a class, regardless of their authorship.
He had contacted the Privacy Commissioner Marie Shroff about this and was exploring the possibility of a joint investigation with her that might lead to some recommendations.
He would meet her later this year to discuss it further.
What is a Privacy Impact Assessment (PIA)?
• A systematic process of assessing a proposal's impact on privacy.
• A PIA helps an agency to. -
> identify potential effects on individual privacy
> examine how to overcome any detrimental effects on privacy
> ensure new projects comply with information privacy principles
