BSA Decisions Ngā Whakatau a te Mana Whanonga Kaipāho

Summary  

[This summary does not form part of the decision.]

The Authority upheld aspects of seven complaints under the privacy and fairness standards, regarding broadcasts by RNZ which included material stolen from the Waikato District Health Board and released by hackers on the dark web. The broadcasts were about a child under the care of Oranga Tamariki, who was effectively ‘living’ in a WDHB hospital because Oranga Tamariki was unable to find them a placement. The Authority found the child was identifiable and their privacy was breached on a segment on Morning Report. While there was a legitimate public interest in the story, this did not extend to all the details included in the item. The Authority also found the Morning Report segment breached the privacy of the child’s family but not of the social worker involved. The fairness standard was also breached as the broadcasts were unfair to the child and their family. The Authority did not uphold the complaints regarding law and order, as it found the broadcasts would not have the effect of inciting or encouraging illegal or seriously antisocial behaviour. 

Upheld: Privacy, Fairness

Not Upheld: Law and Order, Good Taste and Decency

Decision note

[1]  The broadcast concerned in this complaint contains information which we have found breached the privacy of a child and their family. The analysis and application of the privacy standard required a discussion, in detail, of that private information. For that reason we are not publishing the section of the decision which discusses the privacy standard in full, as repeating that information would also constitute a breach of privacy. We have also not included all relevant extracts of the broadcast in this decision for the same reason. This summary decision instead includes a high-level summary of the broadcasts, a summary of the findings under the privacy standard, and the complaints and findings under the remaining standards in full, with the exception of some redactions under the fairness standard (as they contain relevant precedents for this Authority).

Background

[2]  The Waikato District Health Board¹ (WDHB) was affected by a ransomware attack (or ‘hack’) in May 2021.² WDHB documents containing sensitive information including correspondence, medical records, and financial data were released on the dark web in June.³ This material is referred to by complainants and in this decision as ‘the stolen dataset’.

[3]  In its submissions, RNZ explained how, acting on a ‘tip-off’, it was able to access a directory of files released by the hackers, which yielded the information upon which the story is based. Correspondence between the WDHB and Oranga Tamariki (OT) revealed the WDHB had made a complaint to OT about the care of a child who had been effectively ‘living’ in a WDHB ward for more than nine weeks. RNZ published a story about this incident, which is the subject of the broadcasts complained about.

The broadcast

[4]  On 29 July 2021, RNZ reported on the complaint by the WDHB on Morning Report, Midday Report, and in its afternoon news bulletins.

[5]  Morning Report’s introduction to the item outlined the circumstances. A reporter provided detail of the child’s situation and sections of the documents were read on-air.

A child spent more than nine weeks in a Waikato hospital because Oranga Tamariki failed to find anywhere else for them to live. Documents posted on the dark web, by the cyber attackers who targeted the DHB, reveal staff were deeply concerned by aspects of the agency’s work in one of its hospitals. In material reviewed by RNZ, staff at the Waikato District Health Board said they were extremely distressed by the agency’s treatment of a … child…. RNZ is broadcasting this story as the documents raise questions of public interest importance. 

[6]  A reporter provided detail of the child’s situation and sections of the documents were read on-air:

Reporter:      The child was confined to a hospital paediatric ward for [more than 9 weeks]. The DHB reluctantly accepted admission for one week after the child's initial placement had broken down. Despite the lengthy stay, staff said the child didn't require admission to hospital for any medical reason and was not unwell. …. Accusations of failings by Oranga Tamariki are revealed in a report by Waikato DHB staff. …The document says DHB staff recognise the case is complex, but their concerns needed to be raised with Oranga Tamariki, and they requested a full overview of the case and an apology.

Voiceover:   We feel that more could have been done at the beginning of this admission to seek a suitable placement. We do not feel Oranga Tamariki did everything to ensure X's need for this was met in a timely manner.

Reporter:     DHB staff said two placements were proposed by Oranga Tamariki during the first five weeks of admission, but both were unsuitable. They also said the agency didn't seem to prioritise the child's basic rights to enjoyment, play and education. At one stage, the child remained on the ward for three weeks, with no time outside…. DHB staff were also concerned about the social worker assigned to the child's case. They said they had concerns about the way the worker spoke to the child, saying the language used was inappropriate…. The document says DHB staff saw very little effort by the social worker to try and build a relationship with the child.

Voiceover:   This lack of relationship worries us, as we know a key role of an Oranga Tamariki social worker is to ensure the child's voice is heard and their views are taken into consideration, particularly a child vulnerable in this world where they have no control over what is happening to them.

Reporter:     DHB staff said there was a lack of psychological support for the child … the social worker decided they wouldn't be present for [the child’s discharge]. It was only after multiple requests from the DHB that the social worker reluctantly agreed to be present.

Voiceover:   We were extremely disappointed in Oranga Tamariki's management and lack of support during [bleeped]'s discharge and transition to home.

Reporter:     DHB staff requested a formal review, including whether more could have been done to allow the child to stay with family who loved and provided for the youngster. Staff asked for an apology from Oranga Tamariki to be sent to those involved in caring for the child.

[7]  The item concluded, ‘Oranga Tamariki say the agency is unable to comment. The DHB has been approached for comment.’ A Morning Report host explained RNZ’s rationale for the story:

Now, in a statement from RNZ: RNZ news considered very carefully the issue of the source of the material on which our reporting is based. RNZ's view is that reporting this story is in the public interest and all care has been taken to protect the identity and interests of the child involved. All documents have been securely handled, and no confidential patient information has been retained by RNZ.

[8]  Midday Report reported further on the story:

The Minister for Children has called for an investigation into the treatment of a young child by Oranga Tamariki. RNZ revealed this morning that a child spent more than nine weeks in a Waikato hospital because the agency failed to find them a suitable placement.

[9]  It included comments from social worker Paora Crawford Moyle and advocate Julia Whaipooti:

Paora Crawford Moyle:      Children will tell you what they want and what they need. From the brief that I've read, the child was able to articulate what they wanted, what they needed, but what we had was pure incompetence all the way through. Where's the accountability. Who knew about this and what justifies keeping a child in that kind of environment for nine weeks because you can't find a placement…And this is just another example of somebody who just doesn't get the needs of children. I really think that heads need to roll with this one.

…

Julia Whaipooti:      We know of the intergenerational harm of this kind of trauma… I want people to imagine what that would be like for your own children…The impact on this young person's life will be profound, and that lies squarely at the feet of Oranga Tamariki, which does not live up to its name…[This] really highlights the mamae, the mamae that children, who are meant to be our taonga, experience… I really expect that Oranga Tamariki have ensured that there is healthy contact between the child and that family…that they have been supported right now for the failures of what OT has done to this kid, and the harm that has been done to this kid, and that there will be wraparound support.

[10]  The 1pm news bulletin summarised Midday Report:

A justice advocate says the system has let down a child who spent more than nine weeks in a Waikato hospital. It happened because Oranga Tamariki failed to find them a suitable placement. Julia Whaipooti says it’s a distressing case and Oranga Tamariki must do better… The Minister for Children, Kelvin Davis, has called for an investigation, saying at the centre of the story is a vulnerable child. He says he's sought assurances that appropriate support has been provided to them and their family.

[11]  The 4pm news bulletin reported on comments by the Privacy Commissioner:

The Privacy Commissioner says he's very concerned about RNZ's reporting of personal information taken from documents leaked online after the Waikato DHB cyber attack. RNZ reported today that a child spent nine weeks in a hospital because Oranga Tamariki failed to find a suitable placement. John Edwards says he would be concerned to think of journalists trawling through illegally obtained deeply sensitive personal information to identify stories. However, RNZ’s Head of News, Richard Sutherland denies staff trawled through documents saying they opened only a small number. He says the public interest is best served by bringing the case to light, particularly given ongoing questions about Oranga Tamariki.

The complaints

[12]  We received five complaint referrals⁴ and two direct privacy complaints⁵ regarding the broadcasts of 29 July. Two complaint referrals were from OT and the WDHB, who are referred to in the broadcasts. The two privacy-only complaints are from interested agencies, the Privacy Commissioner and the Children’s Rights Alliance (CRA). The final three complaints were from members of the public, Kenneth Begg, John Aitken and Stewart Collinson. All complainants, except Collinson, raised the privacy standard. In addition to privacy, some complainants raised the fairness standard (OT and WDHB) and the law and order standard (OT, WDHB, Collinson). Begg also raised the good taste and decency standard, but relied on arguments originally made to RNZ in relation to law and order under this standard and, as the complainants’ concerns are better addressed under other standards, we have not considered the good taste and decency standard in this decision.

[13]  Below we have summarised, at a high level, the key complaints under each standard and the broadcaster’s response.

Privacy

[14]  Complainants alleged the broadcast breached the privacy of the child, their family, and the social worker:

• These parties were identifiable, even though they were not named, from the details provided in the broadcast.
• The broadcast disclosed sensitive private information about these parties.
• The information was also obtained from an illegal hack into hospital records, which is private by nature.
• The disclosure of information from an illegal hack into medical records was highly offensive.
• The reporting was not necessary in the public interest, including because the issues raised were already being dealt with by OT and the WDHB.
• Any public interest in the information did not outweigh the harm caused (including to the child, family or social worker), the privacy rights of the patients whose data was stolen or the other public interest reasons weighing against disclosure (noting the potential consequences associated with accessing and broadcasting information obtained by hackers).

Fairness

[15]  Complainants alleged the broadcasts were unfair to the child, their family, and to the WDHB:

• The broadcasts publicised the child and their family’s private information to the world.
• The WDHB was not given adequate time to respond to the broadcasts.
• RNZ’s newsgathering methods were unfair (using information obtained from illegal activity).
• The broadcast was also unfair to other WDHB patients and staff who were the subject of information sourced by RNZ from the dark web.

Law and order

[16]  Complainants submitted:

• By broadcasting information from the stolen dataset, RNZ was legitimising use of the data and implicitly encouraging further hacking.
• The broadcasts may have encouraged other individuals to use information obtained through hackers in a less responsible way than RNZ claims to have done.

The broadcaster’s response

[17]  RNZ did not uphold any of the complaints and submitted no standards were breached in the broadcast:

Privacy

• The child and their family were not identifiable in the broadcasts and RNZ had taken care to mask their identity.
• The broadcasts did not disclose medical information, they were limited to information contained in the correspondence between the WDHB and OT.
• A reasonable person in the position of the child would want the information about their treatment by OT and its mismanagement of the case to be made public.
• If there is any breach of the child’s privacy, the publication of information is justified in the public interest, as the conduct of OT carries a high legitimate public interest.

Fairness

• Neither the child nor the WDHB were depicted negatively in the broadcast, so it was not unfair to them.
• The WDHB was notified of the broadcast and is a ‘government agency deployed with its own communications department which is well experienced and versed in responding to this type of media inquiry’.

Law and order

• ‘There is absolutely no evidence to support the contention that RNZ's broadcast "encourages further hacking". In fact, quite the contrary effect may well be in place. The fact that RNZ had access to [a large amount of] so-called private and confidential information and chose to publish none of it, apart from extracts of correspondence between the WDHB officials and OT, would suggest to the hackers that their further distribution of the stolen dataset was in vain. If anything, it diminishes the perceived value of the "stolen information".’

Jurisdiction and preliminary issues

The WDHB

[18]  Following the broadcasts, the WDHB sought and obtained a High Court injunction against RNZ and other unknown defendants (by consent in respect of RNZ) preventing the access, use and broadcast or publication of any material in the stolen dataset, and requiring the permanent deletion of any and all copies of the stolen dataset or information from it, not including the information which was already published (ie. the material in the 29 July broadcasts).⁶ This interim order was made permanent (with consent from RNZ).⁷

[19]  The WDHB referred to affidavits filed in these High Court proceedings in its complaint referral to the BSA. RNZ objected to the inclusion of these in the complaint material and we requested the WDHB provide information supporting its complaint in a form which was not confidential to the court.⁸

[20]  RNZ was also concerned it was unable to mount a proper defence to the complaint as it had been ordered to destroy documents related to the story by the High Court. We requested RNZ provide a list of the facts it intended to rely on for its submissions (primarily, the public interest defence), with the WDHB to confirm these facts. RNZ provided an outline of the facts relied on.

[21]  The WDHB agreed to these facts, with the addition of one detail which RNZ objected to.

[22]  In our view the detail added by the WDHB did not contradict the facts RNZ outlined and did not impede RNZ’s ability to raise a public interest defence. Therefore we noted the discrepancy but did not make a finding on this point. It remains undisputed that the child ‘had no medical reason to be in hospital and was not unwell’ and the child ‘effectively lived in the hospital’ for over nine weeks.

[23]  RNZ also disputed the inclusion of the WDHB’s submissions on harm, and claims they are ‘hearsay allegations and speculation which were in some parts recorded in the High Court judgments’. We requested the WDHB’s submissions on harm, and our process operates without undue formality. The Authority can consider a complainant’s submissions and assertions around the potential effect of a broadcast. Ultimately we are conducting our own assessment and making our own findings. Therefore we see no issue with the inclusion of these submissions.

The Privacy Commissioner

[24]  The Privacy Commissioner made public statements about the hack, prior to,⁹ and following, RNZ’s publication.¹⁰

[25]  Following the Privacy Commissioner’s direct privacy complaint to the BSA, RNZ raised a number of concerns about the complaint. We addressed these in an interlocutory decision,¹¹ finding the Privacy Commissioner did have standing to make a complaint, but some aspects of the Privacy Commissioner’s complaint were out of scope (for example, submissions relating to amending or broadening the scope of the privacy standard).

Scope of the Code – Accessing and viewing the stolen dataset

[26]  A number of complainants raised concerns about RNZ’s conduct in accessing data released by the hackers. The Privacy Commissioner submitted the Radio Code should not be read down to exclude complaints based solely on a broadcaster’s information gathering methods noting:

…the Privacy Act governs collection, use and disclosure of personal information. However, a news entity carrying on news activities is exempt from the Privacy Act under section 8. The news media exemption to the Privacy Act was a recognition of the important role of the Fourth Estate but came with the quid pro quo that the news media should have standards to protect privacy, with rights of redress for a breach of privacy.

[27]  We have carefully considered whether our jurisdiction under the Broadcasting Act extends towards the regulation of a broadcaster’s information collection methods (whether or not the relevant information results in a broadcast). However, in our view, both the purpose of the Act and its text are inconsistent with such an interpretation:

• The purpose of the complaints regime contained in the Act is to establish a process and body for dealing with complaints about ‘broadcast programmes’.¹² Its purpose is not to regulate the affairs or conduct of broadcasters more generally.
• The powers to promulgate the Code and hear complaints are solely directed at ‘broadcasting practice’ and ‘programmes’.¹³

[28]  On this basis, our jurisdiction is limited to considering complaints about programmes and their presentation. The High Court has previously noted this includes ‘not only the broadcast material itself, but also how it was obtained.’¹⁴ However, where material has been obtained but there is no resulting programme, the BSA is unable to intervene.  

[29]  Therefore in this instance we are only concerned with the material published, which was accessed on the dark web as part of information stolen in an illegal hack into the WDHB. This means we are not considering RNZ’s actions regarding accessing other potentially private information which was not broadcast, nor are we considering whether RNZ’s actions in accessing the information were illegal.

The High Court injunction

[30]  Some complainants, and RNZ, have referred to the High Court injunction issued in regard to the files RNZ retained from the dataset, which as outlined above, required RNZ to delete any files they’d retained and prevented publication of material from the dataset by RNZ or other parties. Complainants have submitted the High Court judgment supports their arguments. RNZ has claimed this is unfair as the nature of the injunction meant it was not able to make submissions to the Court. In addition, the High Court injunction related to a larger scope of material which included patient details and health information. We have, however, undertaken our own assessment of the broadcast against the relevant standards, and do not rely upon the High Court’s findings in our determinations.

The standards

[31]  Broadcasters should maintain standards consistent with the privacy of the individual.¹⁵ The privacy standard aims to respect, where reasonable, people’s wishes not to have themselves or their affairs broadcast to the public. However, it also allows broadcasters to gather, record and broadcast material where this is in the public interest. The guidelines assist broadcasters to strike this balance.¹⁶

[32]  The fairness standard¹⁷ requires broadcasters to deal fairly with any person or organisation taking part or referred to in any broadcast.¹⁸ It ensures individuals and organisations are dealt with justly and fairly and protected from unwarranted damage.

[33]  The law and order standard¹⁹ states broadcasters should observe standards consistent with the maintenance of law and order, taking into account the context of the programme and the wider context of the broadcast. Its purpose is to prevent broadcasts that encourage viewers to break the law, or otherwise promote, glamorise or condone crime or serious antisocial activity.²⁰ 

Our analysis

[34]  We have listened to the relevant broadcasts and read the correspondence listed in the Appendix.

[35]  The right to freedom of expression is an important right in a democracy and it is our starting point when considering complaints. We weigh the right to freedom of expression against the harm that may have potentially been caused by the broadcast. We may only intervene when the limitation on the right to freedom of expression is reasonable and justified, in light of actual or potential harm caused.

[36]  Media play a vital role in casting light on matters relating to government, public administration, and the conduct of organisations significantly affecting members of the public.²¹ The RNZ broadcasts carried significant public interest. They explored the actions of two public organisations (OT and WDHB) in relation to a vulnerable child. The scrutiny of alleged failures regarding the care of children is of significant public interest to New Zealanders.

[37]  However, when private information regarding the sensitive circumstances of a child is obtained in a manner which clearly indicates its confidential nature, care must be taken to strike an appropriate balance between disclosing matters of public interest and avoiding harm. In this case, we consider that appropriate balance has not been struck. We are therefore upholding some aspects of the complaints, for the reasons below.

Privacy

[38]  Generally, there are three criteria for finding a breach of privacy:

(a)  the individual whose privacy has allegedly been interfered with was identifiable²²

(b)  the broadcast disclosed private information or material about the individual, over which they had a reasonable expectation of privacy²³

(c)  the disclosure would be considered highly offensive to an objective reasonable person in the position of the person affected.²⁴

[39]  It is a defence to a privacy complaint to publicly disclose matters of legitimate public interest. The level of public interest must be proportionate to the seriousness of the breach of privacy in order for the defence to apply.²⁵

[40]  The privacy standard applies only to identifiable individuals.²⁶ The Privacy Commissioner and WDHB have argued this should not be necessary for the application of the standard. As the standard only requires broadcasters to ‘maintain standards consistent with the privacy of the individual’ then it should not be limited by guideline 10a. They have both argued in the alternate that the child was identifiable. However, to do away with the identification requirement would be a strong departure from previous Authority decisions relating to the privacy standard which have consistently required identification. In any event, as we have found the child, child’s family and social worker were identifiable, it is unnecessary to consider whether the standard can be applied without identification.

[41]  We have considered whether the broadcast breached the privacy of the child and their family, and the social worker involved in the child’s care.

The child

Identification

[42]  The broadcast in question is about a child who was in OT care, and was essentially ‘living’ in a WDHB hospital for more than nine weeks. Complainants have argued the child was identifiable for reasons including:

• The broadcast contained a significant amount of detail about the child, including their location (in the Waikato), the length of their stay at the WDHB, and the unusual nature of their lengthy stay including lack of medical need. Given this detail, the unique circumstances of the case and the small community where the child lives, publication was highly likely to identify them.
• The child would be identifiable to numerous people within the WDHB community including: staff and contractors of WDHB and OT involved in the child’s care; family and friends of the child and the child’s family (and potentially members of their wider community); and members of the public who may have seen the child during their stay in hospital.
• ‘…numerous WDHB staff identified the child immediately, including those who were not actively involved in their care, and were extremely distressed by the Broadcasts.’ (WDHB)
• The family were contacted by the media, causing shock and upset. (OT)
• While some close to the child may have known broadly of their stay in hospital, many who could identify the child are unlikely to have known all of the detailed circumstances reported.
• Some on social media might name the child, potentially causing further harm.

[43]  RNZ submitted the child was not identifiable. It submitted that care was taken to mask the identity of the child, who was not named, and there were no personal details such as age, gender or ethnicity given in the broadcast. While the broadcast identified a WDHB hospital as involved, there are 5 hospitals operated by the WDHB. It argued anyone who could identify the child from the information in the broadcast would already know about the circumstances, and ‘The repetition of pre-existing information held in a third person's mind is not a breach of privacy in respect of the subject of a media story.’

[44]  The test is whether the individual was identifiable beyond family and close friends who would reasonably be expected to know about the matters dealt with in the broadcast.²⁷ An individual may be identifiable even if they are not named or shown.²⁸ They may also be identifiable even if only a small number of people could recognise them from the information provided, if not all of those people were aware of the full details disclosed in the broadcast.²⁹ In some cases, where there is a unique combination of identifying features within the broadcast, the person may be identifiable.³⁰ This concept, where a person’s identity can be pieced together from a collection of identifying features, is known as ‘jigsaw’ identification.³¹

[45]  Although the child was not named, and their gender, ethnicity and age were not revealed, we consider there were sufficient details to enable jigsaw identification of the child, beyond those who knew about all of the circumstances reported on. We consider the child was identifiable in the broadcast to some people who may have been aware of some, but not all, of the details disclosed in the broadcast. It is unlikely that all those who could have identified the child would be aware of all the information in the broadcast.

[46]  We also note the submissions outlined some specific evidence that the child was, in fact, identified by others. OT and the WDHB submitted members of the child’s family were contacted by other media after the story, and the WDHB indicated that ‘numerous WDHB staff identified the child immediately, including those who were not actively involved in their care’.

[47]  Therefore, we found the child was identifiable for the purpose of the standard.

Was there a reasonable expectation of privacy in relation to the material disclosed?

[48]  The next question is whether the broadcast disclosed information about which there was a reasonable expectation of privacy. Children generally have ‘high reasonable expectations of privacy’.³²

[49]  Complainants’ key submissions on this issue included:

• Children generally have high expectations of privacy, and children in the care of OT are particularly vulnerable. Their circumstances require unique consideration before their information is published.
• The reason children are afforded a high expectation of privacy is to recognise that they are not necessarily equipped to cope with being in the media.
• The nature of the information (personal, medical) and that it was collected ‘in a setting where there is a reasonable expectation of privacy’ (ie, from an illegal data hack into confidential information, which RNZ accessed on the dark web), indicated confidentiality. RNZ’s own reporting of the data leak noted the information was ‘incredibly private’
• The information was not in the public domain, and ‘information made available by criminal actors on the Dark Web ought not to be considered to be “in the public domain”.’ Even if it is in the public domain, the ‘circumstances of its availability strongly establish that there remained a reasonable expectation of privacy in the information’. (Privacy Commissioner)
• ‘In its response, RNZ attempts to defend its position by claiming that the broadcasts did not disclose “medical information” about the child, as the child had no “medical need” to stay in hospital so could not have produced “medical records”…‘RNZ’s approach is far too restrictive. Details of the child’s … stay with the WDHB, as recorded by the WDHB in its hacked records, were disclosed in the Broadcasts. This was sensitive and private information.’ (WDHB)
• The whānau have already expressed ‘feelings of stress and unease as they do not know what information the hackers, RNZ, media or others have about them, or whether more of their personal information will be published...and very concerned their names and identities will enter the public sphere’ (OT)
• ‘I had, as Privacy Commissioner, publicly warned against accessing this material given the circumstances in which it was available to be accessed. This warning was also widely reported in the media.’ (Privacy Commissioner)

[50]  RNZ has argued the broadcast did not disclose private health information about the child. It commented:

It appears that OT have tried to exploit the convention of medical confidentiality to conceal that it required the DHB to improperly admit a healthy child because it could not think of a more appropriate placement. This is of great and legitimate public interest as it goes to the health and safety of New Zealand’s most vulnerable.

Patients in hospitals have a reasonable expectation of privacy. When public agencies attempt to disguise minors as patients when there are no medical conditions requiring hospitalisation, (and as much as it is possible to anonymise the minor) then that should be reported in the public interest.

[51]  RNZ also commented the information in the broadcast was ‘more general detail reported from a very limited set of correspondence between WDHB and OT officials with respect to the care and welfare of the child at the heart of the story.’

[52]  We carefully considered the information disclosed in the broadcast. The following information was not private, as it would likely have already been known to those who were able to identify the child:

• The child was not unwell and had no medical reason to be in hospital.
• OT had been unable to find a suitable placement for the child.

[53]  We found other information disclosed in the broadcast was private information. Regardless of whether this was ‘medical information’ or not, we find it to be private information over which the child would have a reasonable expectation of privacy. In making this finding, we considered first that the information is about a child, who has a higher reasonable expectation of privacy. In addition:

• The information was sensitive in nature as it was relating to the care and guardianship of a child in the care of OT.
• It included information provided and collected under a relationship of trust and confidence (including information obtained from a child by a government social worker) and detail about the child’s specific needs and requests.
• The information was not in the public domain, as it was obtained from confidential files.

Was the disclosure highly offensive?

[54]  The third criteria is that the disclosure would be highly offensive to an objective reasonable person in the position of the person affected. Factors determining whether the disclosure of private facts is likely to be highly offensive include where:³³

• the material is particularly embarrassing, sensitive or traumatic, or has the potential to impact negatively on reputation
• the person is particularly vulnerable
• the person concerned has not consented to the broadcast.

[55]  Complainants’ submissions on this issue included:

• The wide disclosure of such information on national radio would have been highly offensive to an objective reasonable person. The information disclosed was highly sensitive, and was clearly private information about a young child.
• Publishing the personal information of a child in the care of the State, and details of their experience in care is likely to negatively impact them. (OT)
• RNZ appears to have applied a lower threshold in the decision to access and publish the information, because it belonged to a child. In addition, RNZ’s approach suggests a different standard may be applied to the privacy rights of children in OT care because of the public interest in OT. (CRA)
• It is not appropriate to assume the child would want their extended family to find out about their circumstances through a national broadcast, and when the information about them was obtained illegally. (OT)
• ‘RNZ did not give WDHB an adequate opportunity to contact the child and their whanau and allow them to take steps to protect their position. This despite WDHBs requests and warnings of legal action to RNZ prior to the Broadcasts. No notice or consent to the child was given.’ (WDHB)
• ‘The broadcast is exploitative or gratuitous because no publicity to the issues was required- the issues had already been comprehensively raised by WDHB with the relevant agency and a response demanded. The only reason this information became available to RNZ was because of the illegal activity [the hack].’ (Privacy Commissioner)
• Widespread social media condemnation of RNZ’s publication also reflects the highly offensive nature of the disclosure.

[56]  A number of complainants highlighted concerns about the manner in which RNZ obtained the information contained in the broadcast, including allegations that RNZ ‘trawled’ through large amounts of private information released by hackers in order to find this particular story. As noted above at paragraphs [26]–[29], we are focused on what was broadcast. While the manner in which the information broadcast was obtained may be relevant, it is not our role to speculate about RNZ’s activities in relation to material not broadcast.

[57]  Some complainants also submitted RNZ’s publication of the information endorses or legitimises the illegal activity of the hackers. We address this concern under the law and order standard.

[58]  Regarding the material broadcast, complainants submitted the manner in which it was obtained contributed to the offensiveness of the disclosure:

• ‘The circumstances of the cyberattack on the WDHB, the posting of the information on the dark web by the perpetrators, the warnings as to use issued by the Privacy Commissioner, and the objection to publication firmly stated by the WDHB all heighten the offensiveness of RNZ’s actions in the Broadcasts.’ (WDHB)
• The ‘material on which the story was based was clearly obtained by deceptive and dishonest means.’ (Privacy Commissioner)
• It was ‘unprofessional, unethical and illegal’ of RNZ to access the DHB information. (Aitken)

[59]  RNZ has argued:

If the Authority is to consider that any material not obtained by "legitimate means", e.g. information obtained from whistleblowers not using official channels, whistleblowers using official channels, information confidentially provided to broadcasters, information which is "fallen off the back of a truck", or that is inadvertently been made public, should never be used by the media to broadcast a story, then that is something not envisaged by any of the broadcasting standards and such a decision would be beyond the scope of any of the current broadcasting standards.

[60]  While we agree that freedom of expression means we must be cautious not to make findings which would effectively limit newsgathering methods, in assessing this complaint we are only making findings regarding this specific set of facts, ie, material obtained by an illegal hack, accessed by RNZ, and published. The way in which RNZ gained the information is relevant to the consideration of whether there was highly offensive disclosure.

[61]  RNZ has argued the disclosure was not highly offensive as a reasonable person in the shoes of the child would have wanted ‘some form of redress’, part of which was ‘for adults in positions of responsibility as well as the public at large to know what had happened’.

[62]  We found the disclosure in this case was highly offensive. This was a situation which deserved sensitivity and care. An objective reasonable person in these circumstances would consider the disclosure of the information in the broadcast to be highly offensive. Therefore, the third criteria has been met, and we find the broadcast breached the child’s privacy.

Public interest defence

[63]  It is a defence to a privacy complaint to disclose matters of legitimate public interest.³⁴ The level of public interest must relate to the particular material disclosed, and must be proportionate to the seriousness of the breach of privacy in order for the defence to apply.³⁵

[64]  Noting the agreed facts, RNZ submitted the public interest defence applied in this instance:

The story was newsworthy for two significant aspects:

1. The public was not previously aware that OT had and was using hospitals to house children they could not place in care elsewhere.
2. The WDHB agreed that this child could stay in one of their hospitals even though their staff complained to OT that… the child had no particular medical reason to be in a hospital and was not unwell. 

For two taxpayer funded organisations to behave in this manner towards a vulnerable child was by any definition a matter of legitimate public interest, i.e. of significant interest to the public, and was certainly new information that the public had not been made aware of before.

[65]  RNZ argued, ‘There is legitimate public interest in how the health and safety of New Zealand’s most vulnerable is handled or in this case mishandled by the agency responsible, OT. If it had not been mishandled there would have been no need for it to apologise to WDHB for its handling of the case.’

[66]  Complainants submitted the public interest defence did not apply for reasons including:

• Any public interest in the particular issues raised by the broadcasts was not proportionate to the gross breach of privacy associated with the broadcasts. (WDHB)
• The following consequential harms weigh against RNZ’s actions being in the public interest (to the extent that there is overwhelming public interest against disclosure here):
  • Harm to the child, family, OT staff.
  • Harm to others affected by the cyber attack (distressed by situation).
  • Incentivising of further ransomware attacks.
• There is a strong public interest against legitimising the use of information in the stolen dataset for journalistic purposes. There are public policy arguments against permitting people from profiting in a way which assists extortionists. The public interest also requires that such information not be used – given the risk of more cyber attacks and harm to those affected (who now face the stress and uncertainty of wondering whether their information may become a headline, adding to the harm caused by the knowledge their information is on the dark web).Regarding the child, ‘There is a particular concern about the likely break down of trust with medical professionals and others who have been trying to assist. Harm has also been suffered by caregivers associated by the child who have been identified.’ (WDHB)
• The broadcast caused harm to WDHB staff, who had concerns about RNZ reviewing the stolen dataset and increased anxiety that media were reviewing WDHB information. (WDHB)
• There was a lack of urgency – WDHB requested a delay of broadcast and ‘investigations by RNZ could have been undertaken by way of the official channels, OIA requests or complaints made to oversight agencies.’ (WDHB)
• The reporting did not address systematic issues and any systematic issues were able to be addressed elsewhere:
  • RNZ dramatically overstates the public interest in the reporting on the events detailed in the broadcasts.
  • The broadcasts concerned a specific set of circumstances with one vulnerable child. Its novelty was what made it newsworthy. There was no legitimate public interest in reporting on such a specific situation. (Privacy Commissioner, WDHB)
  • The issue examined in the Broadcasts had already been identified by the WDHB and actions had been taken, including a detailed report and complaint raised by the WDHB in the appropriate way. There was no pressing public interest need to uncover the situation. (WDHB)
  • The immediate issue had been resolved as the child was no longer in the hospital. (CRA)
  • ‘…there are lawful mechanisms for media outlets to use in order to hold government agencies accountable. Information can also be obtained from government agencies through the Official Information Act 1982. It is not necessary to publicise information that was obtained illegally…’ (OT)
  • ‘It is true that OT responded to the broadcast of the report, but there is no evidence that it was not already preparing a response to the WDHB report. It was simply forced to publicly respond because of the broadcast and the need to defend itself in the public domain.’ (Privacy Commissioner)
• Insufficient rigour was applied to considering the best interests of the child and other rights under domestic law, including rights to privacy and the right to have their best interests be a primary consideration in decisions affecting them (United Nations Convention on the Rights of the Child, Article 3). (CRA)
• ‘What RNZ is arguing for is the lowering of an ethical standard that allows for the prurient interests of journalists to outweigh expectations of ethical and professional behaviour.’ (Aitken)

[67]  We have previously recognised the vital role news media have played in drawing public attention to the issues and challenges facing OT, and scrutinising its effectiveness.³⁶ While this justifies some reporting, there remain limits on this role.  

[68]  In applying the public interest defence, we balanced the legitimate public interest in the issues raised in the story, in particular, the alleged shortcomings of OT in the care and treatment of a child in its care, against the extent of the breach. We consider the breach in this case was of a serious nature (noting the particular vulnerability of the child, the sensitive nature of disclosed information and the manner in which RNZ accessed the information, released on the dark web from an illegal hack into private hospital records). The seriousness of the breach means the threshold for the public interest defence was higher.

[69]  In considering the public interest defence, we have previously noted guidance from Andrews v Television New Zealand, where the High Court said:³⁷

In assessing an asserted defence of legitimate public concern, the Court will ordinarily permit a degree of journalistic latitude, so as to avoid robbing a story of its attendant detail, which adds colour and conviction.

[70]  In a decision from 2003, the Authority found footage of a child being uplifted from the care of her mother was justifiable as being in the best interests of the child, as ‘Nothing more clearly illustrated the plight of the child than being shown being taken away from her mother.’³⁸ In that case, the child was aware she was being filmed. The Authority found she ‘was not exposed to any harm or potentially humiliating footage as a result of the broadcast.’ However, more recently, in WL and Discovery NZ, from 2021, we found footage of children being uplifted from their homes by OT breached the privacy standard as ‘the story could have been told, within the boundaries of the standards, without the identifying details.’³⁹

[71]  We considered whether it was in the public interest to include all of the information about the child in the broadcast, when arguably it was necessary to illustrate the harm alleged to have been caused by the social worker and OT.

[72]  On balance, we found that while aspects of the story were justified in the public interest, the more sensitive information which was revealed was not justified in the public interest. We are satisfied this finding does not overly restrict RNZ’s journalistic latitude, as the story could have been told with appropriate detail, within the boundaries of the standard, in other ways. For example, the comments by Julia Whaipooti in the Midday Report broadcast such as ‘The impact on this young person's life will be profound, and that lies squarely at the feet of Oranga Tamariki...’ illustrated the harm allegedly caused by OT, without revealing the child’s sensitive, private information.

[73]  The public interest defence is therefore not applicable in this case.

[74]  For the same reasons, we find the potential harm to the child justifies placing a reasonable limit on the broadcaster’s right to freedom of expression. Accordingly, we uphold the privacy complaint in relation to the child.

The child’s family

[75]  The Privacy Commissioner also submitted the broadcast breached the privacy of the child’s family. The WDHB and OT both also referred to the child’s whānau being identifiable and negatively impacted by the broadcast (although in submissions focused primarily on the child).

Identification

[76]  We considered members of the child’s family would be identifiable in the same way the child was, to the same group of people (ie those who know some of, but not all, of the details in the broadcast).

Was there a reasonable expectation of privacy in relation to the material disclosed?

[77]  We have already found that the broadcast disclosed private information concerning the child (which, given the child’s membership of a family, may also be considered private information of that family). The details disclosed also included some information which related more directly to the child’s family.

[78]  As discussed above, this information is private, as it is regarding the family’s sensitive affairs. Given the nature of the information and where it was obtained from, we consider this to be information over which family members had a reasonable expectation of privacy.

Was the disclosure highly offensive?

[79]  For the same reasons outlined at paragraph [62], we found the disclosure to be highly offensive. This was a situation which deserved sensitivity and care. We consider persons in the position of the identifiable family members are reasonably likely to consider the disclosures in the broadcast highly offensive. Therefore, the third criteria has been met, and we find the broadcast breached the privacy of the child’s family members.

Public interest defence

[80]  As with considering the child’s privacy, with regard to the family, we asked, did the legitimate public interest in this story extend to the private information about the family? In particular, did informing the public about OT’s alleged shortcomings in the care of this child justify the inclusion of information about the child not wanting to be placed with family?

[81]  For the reasons outlined in paragraphs [68]–[72], we find the public interest defence did not apply in this instance.

The social worker

[82]  The Privacy Commissioner also submitted the social worker was identifiable by some people such as their colleagues, and the broadcast contained ‘the comments and conduct of [the] OT social worker’.

Identification

[83]  The broadcast identified there was a social worker involved with the case, working with a child who was in a WDHB hospital, who OT was struggling to find a placement for. It detailed that WDHB staff were concerned about the social worker’s conduct and included specific statements the social worker made to the child.

[84]  Similar to how the child would be identifiable, we consider the social worker would have been identifiable to some people, such as colleagues, through the unique combination of information included in the broadcast and that such people would not have been aware of all of the information contained in the broadcast.

Was there a reasonable expectation of privacy in relation to the material disclosed?

[85]  We have previously found a social worker carrying out their job is not private facts.⁴⁰ However, the information in the broadcast went beyond that of a social worker carrying out their job. The broadcast addressed specific concerns about the social worker’s conduct. We found this a very finely balanced issue. However, in the circumstances, we have concluded the information has the quality of privacy and the social worker could reasonably expect it would not be broadcast or shared with their colleagues or others who might be able to identify them in the broadcast. Therefore we find the broadcast disclosed information about the social worker over which they had a reasonable expectation of privacy.

Was the disclosure highly offensive?

[86]  The question is whether the disclosure would be highly offensive to an objective reasonable person in the position of the social worker. In our consideration of disclosure in relation to the child, we found it was highly offensive due to the vulnerability of the child, the sensitive nature of the information and the source of the material.

[87]  Regarding the social worker, there is not the same ‘vulnerability’ factor. However, the information reflected negatively on the social worker, and was still sensitive in its nature. A reasonable person in the course of their job would find it highly offensive for such information to be broadcast. Therefore we consider the disclosure to be highly offensive in this case.

Public interest defence

[88]  In applying the public interest test, we considered whether the breach of the social worker’s privacy was justified by the newsworthiness of the story. As above, we acknowledge there was an important story to be told. The social worker’s alleged conduct was a crucial aspect of the criticisms the broadcast levelled against OT. It would have been difficult to tell the story without this information. The information about the social worker did not contain the same level of sensitive, intimate details as with the child; nor was the social worker in a similarly vulnerable position. Therefore the threshold for the public interest defence is not as high (although the information still came from the same source).

[89]  On balance, we consider the breach of the social worker’s privacy was justified in the public interest in this case. The social worker, through their job, is charged with caring for the most vulnerable. There is a strong public interest in knowing and understanding how these roles are carried out. Therefore, we found no breach of the privacy standard in regard to the social worker.

Summary: Privacy

[90]  The privacy complaint about Morning Report is upheld in relation to the child and their family. The later broadcasts did not contain the detail that was in Morning Report, so we do not consider them to have breached the standard.

Fairness

[91]  The WDHB and OT have complained the child and their family were treated unfairly. The WDHB also complained the broadcast was unfair to it, the WDHB, and other WDHB patients and staff who were the subject of the hack and are ‘inadvertent participants and victims’.

[92]  The fairness standard requires broadcasters to deal fairly with any person or organisation taking part in or referred to in a broadcast. If a person or organisation referred to or portrayed in a broadcast might be adversely affected, that person or organisation should usually be given a fair and reasonable opportunity to comment for the programme, before the broadcast. What is ‘fair and reasonable’ will depend on the circumstances.⁴¹ A consideration of what is fair will depend on the nature of the programme and context, for example, the public significance of the broadcast.⁴² A public figure or organisation familiar with dealing with the media has a higher threshold for unfairness.⁴³

The child and their family

[93]  The WDHB and OT both complained the broadcast was unfair to the child and their family:

• The child was adversely affected by the broadcasts (was ‘clearly a victim of the broadcasts’ (WDHB)). The broadcast of the child’s story ‘could result in feelings of distress and humiliation, to a vulnerable child.’ (OT)
• It was unfair that the child’s information was ‘obtained illegally’ and used ‘against their reasonable expectations of privacy and confidentiality’. The newsgathering methods employed by RNZ were unfair to the child and their family.
• RNZ did not appropriately consider the interests of the child and their family.
• ‘Further, tamariki and rangatahi that need support or intervention by Oranga Tamariki generally have needs and characteristics that require an additional layer of consideration, above other children and young people. Radio New Zealand should have turned their mind to the impact that publication would have on te tamaiti and given that impact proper weight before deciding to publish their information.’ (OT)

[94]  RNZ argued the child and their family would not be seen in a negative light by the broadcast, therefore it was not unfair to them.

[95]  Guideline 11h states ‘Individuals, and particularly children and young people, featured in a programme should not be exploited, humiliated or unfairly identified.’⁴⁴

[96]  While the broadcast was focused on the alleged failings of OT and listeners would be left primarily with a negative impression of OT, we found the broadcast could have adversely affected the child and their family.⁴⁵

[97]  Broadcasters must make reasonable efforts to give those who are adversely affected a fair chance to comment on the broadcast. A consideration of what is fair depends on the nature of the programme and context, including the public significance of the broadcast.⁴⁶ RNZ has provided confidential evidence of efforts to provide family with the opportunity to comment. However, given the impact of the broadcast on the child and family members, we are not convinced that what was done was sufficient in this instance.

[98]  Given the vulnerability of the child and the sensitive nature of the information about them included in the broadcast, we consider the broadcasts were unfair to them and their family.

The WDHB

[99]  The WDHB submitted the broadcasts were unfair to it, as RNZ acted unfairly in its dealings with the WDHB in relation to the broadcasts:

Once RNZ notified WDHB of its decision to broadcast the Broadcasts, it did not give WDHB adequate time to undertake the appropriate consideration and consultation with the child’s caregivers, nor seek injunctive relief. Despite the child’s vulnerability, the various other interests at stake, and the lack of urgency in the story.

[100]  The WDHB referred to the High Court judgment regarding the timeline of RNZ’s contact with it prior to the broadcast. The timeline was as follows:

• Tuesday 27 July 2021, 3.58pm: an RNZ journalist contacted the WDHB advising of the story, its source, and asking a number of questions. The journalist requested a response by 4pm the following day.
• Wednesday 28 July 2021, 9.54am: the journalist rang the WDHB asking for a response to the questions. WDHB indicated it was still investigating the matter.
• 3.20pm: WDHB contacted RNZ and advised it would provide a response in writing but requested an extension to the 4pm deadline.
• 3.27pm: RNZ refused WDHB’s request for additional time and said it reserved the right to run the story.
• 5.12pm: WDHB through its solicitors wrote to the Editor-in-Chief of RNZ objecting to any use of information from the hack, requiring RNZ to refrain from publishing such information, and sought an undertaking that RNZ would provide at least 48 hours’ notice of any intention to publish private and confidential health information.
• 6.53pm: RNZ refused to provide the undertaking sought.
• 8.35pm: WDHB requested RNZ hold off from publication of the intended story.
• Thursday 29 July 2021, 7am: RNZ broadcast the story.

[101]  Regarding unfairness to the WDHB and its staff, RNZ commented:

RNZ notes that the WDHB has its own communications department staffed with communications professionals, and obviously has access to senior media law counsel on very short notice…The incident was reported in a matter-of-fact and not a distressing manner, but the facts of OT's actions and inactions were plain for all to see. Other WDHB patients were not mentioned in the story, so they are not "…inadvertent participants". The WDHB staff who were mentioned in the story for raising a formal complaint with OT would not have been seen in a negative light but would rather be congratulated by the audience for acting in the child’s best interests and welfare.

[102]  In our view the broadcast did not reflect negatively on the WDHB, and suggested WDHB staff had care and concern for the child that OT allegedly lacked. However, given the situation went on for over nine weeks, and the general negative tone of the broadcast, the WDHB may still be ‘tarred with the same brush’ as OT and be perceived in a negative light.

[103]  In any event, RNZ contacted the WDHB prior to the broadcast to notify it of the broadcast and provide an opportunity for comments, as per the timeline above. The WDHB was unhappy with this timeline, and argued that RNZ could have delayed the story at least one day further to allow it time to respond. The WDHB is a public-facing organisation and as noted by RNZ has its own communications department and access to legal advice. In the circumstances, we consider it was given a reasonable opportunity to provide comments on the broadcast.

[104]  We find the WDHB was not treated unfairly as the broadcast did not reflect negatively on the WDHB, just OT, and the WDHB is a public-facing organisation capable of dealing with media and which can reasonably expect such scrutiny of its operations.

Other WDHB patients and staff

[105]  The WDHB also submitted that RNZ acted unfairly to ‘other WDHB patients and staff who are the subject of information sourced by RNZ from the dark web, all of whom are inadvertent participants and victims.’

[106]  The fairness standard only applies to people or organisations taking part or referred to in a broadcast. As the broadcasts did not feature or refer to other WDHB staff and patients, the fairness standard does not apply to them.

Summary

[107]  We find the broadcast was unfair to the child and their family, and was not unfair to the WDHB or other WDHB patients and staff.

Law and order

[108]  The law and order standard prohibits the active promotion of serious antisocial or illegal behaviour, including violence, suicide, serious crime and substance abuse.⁴⁷

[109]  Complainants have made the following key arguments under this standard:

• The publication of material released by hackers legitimises the use and access of the data, and implicitly encourages further hacking’ (WDHB), It ‘aligns exactly with the intention of the hackers’ (OT).
• ‘RNZ has knowingly promoted the illegal behaviour of cyber-crime. The story was run on RNZ’s most significant news programmes for maximum public impact. The cyber-attack and blackmail inflicted on Waikato DHB, patients and public has put people's health and lives at risk. It is almost certain that this form of cyber-crime will be repeated if the cyber-attackers see that the stolen information will be weaponised by the media’. (Collinson).

[110]  RNZ has argued this is not the effect of the publication:

There is absolutely no evidence to support the contention that RNZ's broadcast "encourages further hacking". In fact, quite the contrary effect may well be in place. The fact that RNZ had access to [a large amount] of so-called private and confidential information and chose to publish none of it, apart from extracts of correspondence between the WDHB officials and OT, would suggest to the hackers that their further distribution of the stolen dataset was in vain. If anything, it diminishes the perceived value of the "stolen information".

[111]  The WDHB submitted the following, in lieu of confidential affidavits,⁴⁸ concerning the effect of the broadcast regarding cyber-attacks:

Perpetrators of cyber-attacks…will hope that mainstream news outlets pick up on the attack and draw more public attention to the attack. The broadcasts will generate increased interest by the perpetrators of the cyber-attack, other cyber criminals, and others, particularly where the victim of the attack is a well-known, large entity such as WDHB. When media outlets report on the attacks, they may make sensitive personal information public, causing future damage to the victim. Disclosure of stolen data on the dark web is a leveraging tool to extort ransom payments out of organisations. Publishing data from the dark web assists criminal groups as it makes the data appear more valuable, which could encourage repeat attacks from other criminal actors. Personal health information is particularly valuable to a criminal actor using stolen data as a tool to leverage a ransom demand from a public hospital. The private health information that was subject of the Broadcasts is particularly valuable to criminal actors.

[112]  The publication contained limited material accessed from the hack. Although it made clear the information had been obtained from the cyber attack and the dark web, the broadcasts did not provide any detail on how the material was accessed (ie the broadcast was not instructional in how to access the dark web or find the material), and was clear RNZ was only publishing the story as it believed it was in the public interest to do so (see paragraph [5]).

[113]  RNZ also included comments in the online version of the Midday Report item⁴⁹ and in the 4pm news bulletin from the Privacy Commissioner which criticised its own publication of the story (see paragraph [11]). RNZ’s MediaWatch also covered the issues surrounding the story.⁵⁰

[114]  The law and order standard is primarily concerned with broadcasts which encourage the audience to break the law and not with the appropriateness or legality of the broadcaster’s action.⁵¹ The Authority has previously noted:⁵²

The Authority cannot assume the role of a criminal court and determine whether a crime has been committed; our task is to determine whether the programme breached broadcasting standards.

[115]  Given that is the focus of the standard, our task is to consider whether what was broadcast (including broadcast content regarding RNZ’s decision to publish relevant material) would actively promote/incentivise the activities of cyber attackers.⁵³ Given the mitigating elements outlined at paragraphs [112]–[113] and the limited material published, we find the broadcasts did not have the effect of promoting serious illegal or antisocial behaviour, and do not uphold the complaint under law and order.

For the above reasons, the Authority upholds the complaints that the broadcast by Radio New Zealand Ltd of Morning Report on 29 July 2021 breached Standard 10 (Privacy) and Standard 11 (Fairness) of the Radio Code of Broadcasting Practice.

[116]  Having upheld these complaints under the privacy and fairness standards, the Authority may make orders under sections 13 and 16 of the Broadcasting Act 1989. We invited submissions on our provisional decision and orders from the complainants and the broadcaster.

Complainants’ submissions

[117]  In the submissions on orders, complainants argued the breach was serious (with reference to the vulnerability of the child, the sensitive nature of the information and the manner in which it was obtained). They highlighted RNZ’s actions in publishing both the original broadcast and online story despite the WDHB’s objections. They emphasised the high profile of the story and the fact it still remains available online.

[118]  OT advised it had consulted with the child and their caregiver before making submissions on orders. It commented:

• ‘The child and their family have suffered real harm as a direct result of the broadcast. The child is aware their personal information has been broadcast to New Zealand, without their consent. This caused feelings of distress and humiliation.’
• ‘It is clear from the information published by RNZ (and would have been clear from the additional information RNZ obtained from the Dark Web) that the child at the centre of the story was particularly vulnerable.’
• ‘The child’s family was contacted by the media which caused shock and upset. The whānau experienced stress, unease, and ongoing concern that more of their personal information may be published. They were also very concerned that their names and identities would enter the public sphere.’
• ‘The way the broadcast was framed…further risked causing emotional harm by damaging the relationship between the child and their whānau. This is exacerbated by the fact the child was already in care, meaning careful effort is required to maintain and strengthen the relationship between a child and their family, whānau, hapū, or iwi, especially when the child is living in a non-kin placement.’ 

[119]  The WDHB, OT, the Privacy Commissioner, the CRA and Collinson submitted a broadcast statement would be an appropriate order:

• ‘…it is appropriate and necessary for RNZ to explain to the public the upheld aspects of the Authority’s findings…It is important for both the public and other broadcasters to understand where RNZ’s actions and reporting went wrong.’ (WDHB).
• A broadcast statement ‘would help to ensure that the Authority’s determination is well publicised and serves as an important check and guidance to the media on standards and public expectations.’ (Privacy Commissioner)
• A broadcast statement ‘will provide recognition to the child and their family that the publication of the information in that manner was not acceptable…it will at least acknowledge and justify their feelings of shock and distress.’ (OT)
• ‘RNZ’s reporting of personal information sourced from the WDHB ransomware attacks has been the subject of significant public comment and interest’ (Privacy Commissioner). A statement will also provide comfort and reassurance to others who were concerned and upset by the broadcast, including those whose information was captured in the cyber attack that their information is not going to be unfairly published. (Privacy Commissioner, OT)
• The statement should focus on the actions of RNZ ‘and the importance of acting fairly and maintaining privacy in broadcasting’. It should not focus on the individuals involved to avoid further damage from more extensive publication. (OT)
• ‘Given the previous publicity, public debate, and the fact that the broadcast and associated material remains online, it is unlikely that any further publication of the information by way of an approved statement would exacerbate the harm suffered as a result of the broadcast.’ (Privacy Commissioner)
• The statement should acknowledge the broadcast ‘breached the privacy of the child involved and that greater consideration should have been given to the impact of the broadcast on the child and the child’s rights, which in addition to privacy include the right to have their best interests be a primary consideration in editorial decision-making.’ (CRA)

[120] OT and the Privacy Commissioner also sought an order of costs to the Crown:

• This would hold RNZ to account and emphasise the need to meet broadcasting standards in future.
• A costs order would be consistent with previous decisions, including WL and Discovery NZ (which had an order of $1,500 costs to the Crown),⁵⁴ though it would be appropriate to make a higher award of costs in this case as it is more serious.
• Factors supporting a higher level of costs than in WL and Discovery NZ include:
  • The breach was ‘serious’ in comparison to WL which was described by the Authority as ‘medium’.
  • In WL, the broadcaster acknowledged it could have taken further steps to protect the children’s identities.
  • The WL decision was released one month prior to RNZ’s broadcast and RNZ should have been aware of the potential for jigsaw identification and ensuing harm.
  • RNZ’s broadcast included intimate details about the child which may adversely affect them.
  • RNZ ‘sourced the material from confidential files it knew had been criminally exfiltrated from WDHB in an effort to extort a ransom’.
  • RNZ broadcast the story even though WDHB had objected and requested more time to take steps to protect affected individuals; and even though the Privacy Commissioner had made public warnings against accessing material from the stolen dataset.
  • The broadcast has remained available online.

[121]  The WDHB also sought a contribution to its legal costs, arguing it has incurred ‘significant costs’ in relation to RNZ’s broadcasts. It submitted RNZ’s conduct ‘substantially contributed’ to WDHB incurring legal fees including:

• When WDHB became aware that RNZ intended to broadcast the story that is the subject of this complaint, WDHB (through its solicitors) wrote to RNZ and requested that RNZ refrain from broadcasting the story.
• RNZ rejected WDHB’s complaint under the Broadcasting Standards, and has vigorously disputed the complaint before the Authority.
• RNZ appears to have taken every opportunity to re-litigate WDHB’s complaint during the course of the Authority’s process, including making numerous process objections which required additional responses and submissions from the WDHB.

[122]  The WDHB and the Privacy Commissioner suggested an award of privacy compensation may also be appropriate but said they would defer to OT’s submissions on the matter. OT submitted such an award was not suitable in the circumstances.

[123]  OT however commented it would welcome encouragement of education on the fairness and privacy standards, particularly ‘education and training about jigsaw identification and privacy as it relates to tamariki and rangatahi could be beneficial to the sector’. The CRA commented:

We would also like to see RNZ encouraged to either review any existing codes of practice or guidance and/or to develop new codes of practice or guidance on children’s rights to guide its reporting and to ensure its reporting is consistent with a child-rights based approach…we suggest that, as a public broadcaster, RNZ has obligations as a duty holder under international human rights law to which New Zealand is a States Party. In this specific instance, this includes a responsibility to actively consider the best interests of the child as a primary consideration in its editorial decision-making consistent with New Zealand’s obligations under the UNCRC.

[124]  Finally, Collinson submitted the Authority’s findings under law and order were incorrect:

• ‘Section 10 of the Broadcasting Act 1989 gives the BSA flexibility in how it considers and decides a complaint while requiring the BSA to give proper consideration of the complaint. I submit that with respect to the Law and Order complaint, the BSA needs a more informed view about whether the RNZ’s use of the information was in breach of the Crimes Act 1961.’
• ‘…if RNZ has breached the Crimes Act then it follows that it has furthered the hackers’ extortionist objectives and has therefore encouraged crime. If the BSA considers criminality is out of its scope … then the whole matter including the provisional decision should be referred to NZ Police for its consideration, input and possible further action.’
• Given the findings under privacy and fairness, ‘It follows from this that the BSA has called into question RNZ’s judgement and interpretation of the public good. Therefore, RNZ has no Law and Order mitigation as RNZ has claimed and the BSA has described … In fact, the BSA has found that the broadcast did cause harm, which was exactly the hackers' objectives.’

Broadcaster’s submissions

[125]  RNZ commented it was ‘disappointed’ in the Authority’s findings, ‘particularly so in circumstances where no member of the child’s family complained about the broadcast (whether on behalf of the child or on their own behalf) and the Authority had no evidence before it of the broadcast causing or being likely to cause harm to the child or any member of the child’s family.’

[126]  It submitted a costs order of $1,500 to the Crown, consistent with WL and Discovery NZ, would be an appropriate order:

• ‘RNZ’s position is that it made a reasonable editorial judgement based on the perceived public interest in the information concerned and attempted to ensure comment from family members was sought before broadcast.’
• RNZ stood by its efforts to engage with family members prior to the broadcast (see paragraph [97]).
• There was no ‘direct evidence of actual harm to the child or family members’. The Authority has ‘no cogent, direct evidence of harm caused…the Authority’s findings are based on presumed potential harm, but no actual harm has been demonstrated to any reliable standard.’
• There was high public interest in the story ‘which resulted in an immediate investigation and apology by Oranga Tamariki’. While the Authority determined the privacy breach was of a serious nature, raising the threshold for the public interest defence, ‘RNZ submits the seriousness of the breach should be assessed as no higher than medium given the acknowledged public interest in aspects of the broadcast’.
• ‘Those aspects of the broadcast that were found not to be justified in the public interest could reasonably be regarded by a responsible editor as attendant detail adding necessary colour and conviction to illustrate the harm (according to the DHB itself) OT’s actions had caused the child.’
• ‘No action taken by RNZ has aggravated any potential harm’.
• ‘…given the similar nature of findings in WL and Discovery NZ Ltd, an award of costs to the Crown at a similar level is appropriate to acknowledge some complaints were upheld.’
• Publication of the decision is otherwise sufficient to acknowledge the breaches of standards and to provide guidance to broadcasters in the future.

Authority’s decision on orders

[127]  We note first that we stand by our findings and were not persuaded by the submissions that any changes to the decision were necessary.

[128]  In determining whether orders are warranted and the type of order to impose, we consider the following factors:⁵⁵

• the seriousness of the breach and the number of upheld aspects of the complaint
• the degree of harm caused to any individual, or the audience generally
• the objectives of the upheld standards
• the attitude and actions of the broadcaster in relation to the complaint, such as whether the broadcaster upheld the complaint in full or in part
• whether the decision will sufficiently remedy the breach and give guidance to broadcasters, or whether something more is needed to achieve a meaningful remedy or to send a signal to broadcasters
• past decisions and/or orders in similar cases.

[129]  We consider the following aggravating and mitigating factors are relevant in this case:

Aggravating factors:

• The story is still available online and RNZ has not offered either to take it down or to amend it, despite being put on notice by our provisional decision issued 6 July 2022.
• Two standards were breached.
• The privacy and fairness breaches concerned a child in state care who is particularly vulnerable, and their family.
• The privacy breach is comparable to that in WL and Discovery NZ Ltd which the Authority described as ‘medium’ in terms of its seriousness However, in that case the offending material did not remain publicly available after the broadcast meaning it was not causing ongoing harm to the children involved.
• RNZ does not accept the finding and still does not accept the broadcast caused actual or potential harm to the child and their family (although it has nevertheless proposed an order of $1,500 costs to the Crown would be appropriate, in line with WL).

Mitigating factors:

• There was significant public interest in the broadcast as a whole (although the public interest defence did not succeed in relation to the particular material found to have breached the child’s and their family’s privacy).
• Not all aspects of the privacy and fairness complaints were upheld; and the law and order and good taste and decency complaints were not upheld.
• As argued by RNZ, the complaints are not from caregivers or family of the child, but rather from third parties.
• RNZ has not had a privacy complaint upheld against it since 1995 and has had three fairness complaints upheld in the past five years.

[130]  The most persuasive factor in our consideration of appropriate orders in this case, was that the online version of the story has remained available throughout this process. No offer has been made by the broadcaster – even following receipt of our provisional decision – to take it down or make amendments to address the privacy breaches. The broadcaster is also yet to acknowledge the harm caused by this broadcast to a vulnerable child and their family. However, there was a high public interest in the broadcast, and our finding is not that the story should not have been broadcast at all.

[131]  In these circumstances we have determined that orders are warranted in this case beyond mere publication of the decision. We also expect RNZ to remove the story online or at the least edit it to remove all aspects found to be in breach of the privacy standard, which are clearly set out in our full, final decision.

Broadcast statement – section 13(1)(a)

[132]  A broadcast statement is typically ordered where we consider publication of the decision is insufficient to publicly denounce the breach of broadcasting standards, censure the broadcaster, or rectify the harm caused.

[133]  We consider a broadcast statement is appropriate in this case to publicly notify the breach of standards, given the publicity the story attracted at the time and the way the story came to light.

[134]  Recognising the harm already caused to the child and their family, the statement is not intended as a remedy for that harm and will not contain any sensitive information or details that risk re-publicising the information or compounding the harm.

[135]  Consistent with the Authority’s usual practice, the broadcaster will draft a statement summarising the upheld aspects of our decision, for approval by the Authority. Once approved, the statement should be broadcast at a similar time, and on the same day of the week, as the original broadcast, in order to reach a similar audience.

[136]  The statement should also be published on the corresponding online article, for as long as it remains available (even if in an edited form).

Costs to the Crown – section 16(4)

[137]  The broadcaster has proposed an order of $1,500 costs to the Crown, consistent with the Authority’s decision in WL. We agree a punitive response is required to hold the broadcaster to account, deter similar breaches in future and confirm our expectations.

[138]  We agree the privacy breach in this case, as well as the high level of public interest in the story overall, is broadly comparable to WL. However, taking into account that the broadcast remains available online (even after the broadcaster was put on notice of our decision), and the additional breaches under the fairness standard, we consider a slight increase in costs is justified.

[139]  We concluded an order of costs to the Crown of $1,800 is appropriate.

Legal costs

[140]  Costs awards are generally granted to compensate, in part, a successful complainant for legal costs which have been reasonably incurred.⁵⁶ In this case we were not persuaded the legal costs incurred by WDHB were reasonably necessary to the interests that were being protected or upheld in this decision (noting in particular that successful complaints were made by others without the need for legal representation).

Orders

1.  Under section 13(1)(a) of the Broadcasting Act 1989, the Authority orders Radio New Zealand Ltd to broadcast a statement. The statement shall:

• be broadcast during Morning Report
• be broadcast at a similar time, and on the same day of the week, as the original broadcast
• be broadcast within one month of the date of this decision
• summarise the upheld aspects of the Authority’s decision (excluding any sensitive information found to have breached the privacy standard, as detailed in this decision)
• be approved by the Authority prior to being broadcast.

The Authority draws the broadcaster’s attention to the requirement in section 13(3)(b) of the Act for the broadcaster to give notice to the Authority and the complainants of the manner in which the above orders have been complied with.

2.  Under section 16(4) of the Act, the Authority orders Radio New Zealand Ltd to pay to the Crown costs in the amount of $1,800 within one month of the date of this decision. 

The order for costs is enforceable in the District Court | Te Kōti-ā-Rohe.

Signed for and on behalf of the Authority

Susie Staley
Chair
14 September 2022

Appendix

The correspondence listed below was received and considered by the Authority when it determined this complaint:

A – Kenneth Begg

1  Begg’s complaint to RNZ – 29 July 2021

2  RNZ’s decision on Begg complaint – 13 August 2021

3  Begg’s referral to the BSA – 13 August 2021

4  Begg confirming no comment on Summary Decision – 23 August 2022

B – John Aitken

5  Aitken’s complaint to RNZ – 29 July 2021

6  RNZ’s decision on Aitken complaint – 13 August 2021

7  Aitken’s referral to the BSA – 16 August 2021

8  Aitken’s final comments – 30 March 2022

9  Aitken’s comment following Provisional Decision – 5 August 2022

10  Aitken confirming no comment on Summary Decision – 19 August 2022

C – Stewart Collinson

11  Collinson’s complaint to RNZ – 29 July 2021

12  RNZ’s decision on Collinson complaint – 13 August 2021

13  Collinson’s referral to the BSA – 16 August 2021

14  Collinson’s submissions on Provisional Decision and orders – 12 July 2022

D – Privacy Commissioner

15  Privacy Commissioner’s direct privacy complaint to the BSA – 24 August 2021

16   RNZ’s submissions on jurisdiction – 30 September 2021

17  RNZ’s response to complaint – 10 March 2022

18  Privacy Commissioner’s final comments – 13 April 2022

19  Privacy Commissioner’s submissions on Provisional Decision and orders – 5 August 2022

20  Privacy Commissioner’s submissions on Summary Decision – 26 August 2022

E – Children’s Rights Alliance (CRA)

21  CRA’s direct privacy complaint to the BSA – 26 August 2021

22  RNZ’s response to complaint – 10 March 2022

23  CRA’s further comments – 4 April 2022

24  CRA’s final comments – 3 May 2022

25  CRA’s submissions on Provisional Decision and orders – 2 August 2022

26  CRA confirming no comment on Summary Decision – 24 August 2022

F – Oranga Tamariki (OT)

27  OT’s complaint to RNZ – 16 August 2021

28  RNZ’s decision on OT’s complaint – 14 September 2021

29  OT’s referral to the Authority – 12 October 2021

30  RNZ’s confirmation of no further comments on referral – 10 March 2022

31  OT’s submissions on Provisional Decision and orders – 9 August 2022

32  RNZ’s final comments responding to OT – 10 August 2022

G – Waikato District Health Board (WDHB)

33  WDHB’s complaint to RNZ – 26 August 2021

34  RNZ’s decision on WDHB’s complaint – 30 September 2021

35  WDHB’s referral to the Authority – 29 October 2021

36  RNZ outlining facts relied on – 24 January 2022

37  WDHB’s additional submissions on harm – 24 January 2022

38  WDHB response regarding facts relied on – 16 February 2022

39  RNZ’s response to WDHB’s submissions on harm – 25 February 2022

40  RNZ challenging WDHB detail on facts – 28 February 2022

41  RNZ’s response to referral – 10 March 2022

42  WDHB’s final comments – 7 April 2022

43  RNZ’s response to Authority’s questions on the fairness standard – 25 May 2022

44  WDHB’s submissions on Provisional Decision and orders – 1 August 2022

45  WDHB’s further comments supporting request for order of legal costs – 10 August 2022

46  WDHB’s submissions on Summary Decision – 25 August 2022

RNZ’s submissions

47  RNZ’s confirmation of no further comments on complaints A, B, and C – 10 March 2022

48  RNZ’s final comments on complaints D, E, and G – 2 May 2022

49  RNZ’s submissions on Provisional Decision and Orders – 1 August 2022

50  RNZ’s submissions on Summary Decision – 25 August 2022, 12 September 2022

¹ Note: On 1 July 2022 the Waikato DHB was disestablished and replaced by Te Whatu Ora – Health New Zealand under the Pae Ora (Healthy Futures) Act 2022
² Emma Russell “Major cyber attack at Waikato District Health Board - all clinical services affected” NZ Herald (online ed, 18 May 2021); Thomas Manch and Libby Wilson “Waikato DHB scrambles to contain cyber attack, safety of patient data unclear” Stuff (25 May 2021)
³ Tom Pullar-Strecker “Ransomware attack: Waikato DHB supporting patients after documents dumped online” Stuff (online ed, 29 June 2021) 
⁴ Broadcasting Act 1989, s 8(1B)
⁵ Broadcasting Act 1989, s 8(1A)
⁶ Waikato District Health Board v Radio New Zealand Limited& Ors [2021] NZHC 2002
⁷ Waikato District Health Board v Radio New Zealand Limited& Ors, HC Wellington CIV 2021-485-379, 23 August 2021
⁸ See Waikato District Health Board and Radio New Zealand Ltd, Decision No. ID2021-090G, 14 December 2021
⁹ Privacy Commissioner | Te Mana Mātāpono Matatapu (28 May 2021) “Waikato DHB cyber breach: Do the right thing with personal information” <www.privacy.org.nz>
¹⁰ Privacy Commissioner (29 July 2021) “Privacy Commissioner responds to RNZ reporting of personal information from Waikato DHB breach” <www.privacy.org.nz>
¹¹ Privacy Commissioner and Radio New Zealand Ltd, Decision No. ID2021-090D, 27 October 2021
¹² Broadcasting Act 1989, ss 4(1) and 5
¹³ Broadcasting Act 1989, ss 21, 4, 6 and 8
¹⁴ TV3 Network Services Ltd v Broadcasting Standards Authority [1995] 2 NZLR 720 (HC) 
¹⁵ Standard 10 of the Radio Code of Broadcasting Practice
¹⁶ Commentary: Privacy, Broadcasting Standards in New Zealand Codebook, page 21
¹⁷ Standard 11 of the Radio Code of Broadcasting Practice
¹⁸ Commentary: Fairness, Broadcasting Standards in New Zealand Codebook, page 21
¹⁹ Standard 5 of the Radio Code of Broadcasting Practice
20 Commentary: Law and Order, Broadcasting Standards in New Zealand Codebook, page 15
²¹ Guidance: Privacy, Broadcasting Standards In New Zealand Codebook, page 63
²² Guideline 10a
²³ Guideline 10c
²⁴ Guideline 10b
²⁵ Guideline 10f
²⁶ Guideline 10a
²⁷ Guidance: Privacy, Broadcasting Standards in New Zealand Codebook, page 61 at 2.1
²⁸ Guideline 10a
²⁹ NH and Radio Virsa, Decision No. 2020-164, SW and Television New Zealand Ltd, Decision No. 2015-030, JN and MediaWorks Radio Ltd, Decision No. 2017-053; BL and MediaWorks Radio Ltd, Decision No. 2017-025
³⁰ Guidance: Privacy, Broadcasting Standards in New Zealand Codebook, page 61  at 2.3
³¹ WL and Discovery NZ Ltd, Decision No. 2020-167 at [12]
³² Guidance: Privacy, Broadcasting Standards in New Zealand Codebook, page 62, at 5.2
³³ Guidance: Privacy, Broadcasting Standards in New Zealand Codebook, page 62, at 6.2
³⁴ Guidance: Privacy, Broadcasting Standards in New Zealand Codebook, page 63
³⁵ Guideline 10f and Guidance: Privacy, Broadcasting Standards in New Zealand Codebook, page 63
³⁶ WL and Discovery NZ Ltd, Decision No. 2020-167
³⁷ See Grant & Phillips and Television New Zealand, Decision No. 2019-013 at [37] citing Andrews v Television New Zealand Ltd, HC Auckland CIV-2004-404-3536 at [82]
³⁸ Department of Child, Youth and Family Services and TV3 Network Services Ltd, Decision No. 2003-107 at [99]-[100]
³⁹ WL and Discovery NZ Ltd, Decision No. 2020-167 at [25]
⁴⁰ Department of Child, Youth and Family Services and TV3 Network Services Ltd, Decision No. 2003-107, at [94]
⁴¹ Guideline 11d
⁴² Guideline 11a
⁴³ Commentary: Fairness, Broadcasting Standards in New Zealand Codebook, page 21
⁴⁴ See for example Agnew and Television New Zealand Ltd, Decision No. 2001-010 at [20]-[21] and Hastings District Council and TVWorks Ltd, Decision No. 2009-088 at [78]-[80]
⁴⁵ Guideline 11d
⁴⁶ Guideline 11a
⁴⁷ Guideline 5a
⁴⁸ See Waikato District Health Board and Radio New Zealand, Decision No. ID2021-090G
⁴⁹ Kate Gregan and Mani Dunlop, “Minister expects Oranga Tamariki to 'thoroughly' investigate care of child” RNZ (online ed, 29 July 2021)
⁵⁰ Colin Peacock “MediaWatch: RNZ challenged on turning stolen data into news” RNZ (online ed, 15 August 2021)
⁵¹ Harkema and TVWorks Ltd, Decision No. 2012-042 at [206] and Grieve and Television New Zealand Ltd, Decision No. 2011-010 at [22]
⁵² Harkema and TVWorks Ltd, Decision No. 2012-042 at [206]
⁵³ Guideline 5a
⁵⁴ WL and Discovery NZ Ltd, Decision No. 2020-167
⁵⁵ Broadcasting Standards in New Zealand Codebook, page 57
⁵⁶ Guidance: Costs awards to complainants, Broadcasting Standards in New Zealand Codebook, page 66