R v Alsford [2017] NZSC 42

Mr Alsford was a drug grower. The first time he was caught he was only caught by a flagrant trespass by the Police. The case fell over due to the Police’s wrongdoing. But the Police then used the facts of the failed prosecution to gather new evidence to show, again, he was growing drugs.

The case concerns the propriety of using information from the first failed prosecution to gather evidence for a new prosecution. One thing the Police sought was Mr Alsford’s power consumption data. This data was requested from electricity companies voluntarily. That means the Police didn’t get a production order requiring the electricity companies to provide the information.

Alsford is an important case for your to read for three reasons:

• It is one of the few cases in which the Supreme Court has considered privacy.
• It questions the boundaries of five important pieces of legislation:
  • The Privacy Act,
  • The Bill of Rights Act,
  • The Evidence Act,
  • The Crimes Act, and
  • The Search and Surveillance Act.
• And finally, because you are bound to come across voluntary requests for personal information by law enforcement, if you go on to practise in this area.

There are two decisions, one by the majority, formed by Young, Glazebrook, Arnold and O’Regan JJ and a forceful dissent by Sian Elias CJ.

The Majority

The majority start by accepting that power consumption data is personal information. This is because of the broad definition of personal information used in New Zealand. Personal information is information about an identifiable natural person, who is living, not dead.¹ Information is anything that informs anyone about something. Given the Police are seeking the power consumption data for a purpose, it is seeking information, and given it is about the Mr Alsford’s usage, it is about a person.

The majority breaks off to consider whether the Search and Surveillance Act 2012 precludes voluntary requests for information by the Police. They conclude that it does not, so the Police may still make voluntary requests for personal information.² But for the Police to make the request, they had to bring it within the Privacy Act 1993 (now Privacy Act 2020).

To comply with the Privacy Act 1993, the Police had to use the law enforcement exception of IPP 2(2)(d), allowing them to collect the information indirectly. And for the electricity company to provide the information it had to bring it within IPP 11(e), allowing it to release the information. These exceptions are two sides of the same coin. They allow the collection and disclosure of information, “necessary to avoid prejudice to the maintenance of the law by any public sector agency, including the prevention, detection, investigation, prosecution, and punishment of offenses”.

The majority note the broad framing of the exceptions, including a broad range of law enforcement activities.³ We will be returning to this point when we discuss CJ Elias’ dissent, but the majority say that if an explanation is provided for why the information is required for law enforcement purposes a request and disclosure are valid. This was important, because one request for power consumption data had no such reason. This request to Genesis Energy simply said the Police needed the information. So the Police breached the Privacy Act.

The case then turns to what to make of this breach. The Evidence Act 2006 allows for the exclusion of evidence if it collected unlawfully or unfairly.⁴

But is it unlawful to breach to Privacy Act’s Information Privacy Principles? To answer this question, the majority turn to section 11 of the 1993 legislation. That section says that the Information Privacy Principles do not create legally enforceable rights through the courts.⁵ Instead the Act provides a dispute resolution framework whereby one must go through the Office of the Privacy Commissioner, then to the Human Rights Review Tribunal. The majority therefore say that a breach of the Information Privacy Principles is not ‘unlawful’ for the sake of the Evidence Act 2006.⁶

But was it unlawful due to the Bill of Rights Act 1990? This turned on whether it was an unlawful search? This is a two stage question, first, was it a search, and second, was it unreasonable? The first stage turns on the rule in Hamed v R, which says something is a search if it intrudes upon a reasonable expectation of privacy. The majority answer this question referring to four factors:

• The nature of the information,
• The Relationship between the parties,
• Where the information was obtained.
• The manner in which the information was obtained.

The majority therefore start by looking at the privacy policies of the power companies. Each policy anticipated that personal information could be released for law enforcement purposes. They note that Contact Energy said they would only release the information if they were required to, which they were not. The majority say this breach of policy was “problematic”, but go no further to say it was improper.⁷

Given the policies anticipated the release, they conclude there was no reasonable expectation of privacy, and therefore, there was no search. Therefore, the search was not unlawful under the Bill of Rights Act either.

The majority finally consider whether it was unfair. They consider it was not. In passing they also note that a blanket rule requiring police to dispose of or not use inadmissible evidence would significantly hinder the Police’s intelligence gathering powers.⁸

The Dissent

The decision was subject to a strong dissent by Sian Elias CJ. She forcefully criticised the majorities reasoning regarding section 11. The Privacy Act has an enforcement scheme and clearly creates obligations. Therefore, a breach of those obligations is clearly unlawful. She says wherever a breach of the Privacy Act is more than a trivial breach then the evidence will be tainted. The question would then turn to whether it should still be admitted under s 30(2) of the Evidence Act.

Returning to the construction of the law enforcement exception, Sian Elias CJ again disagrees with the majority. Rather than saying the many words give a broad effect to the exception, she says it provides a prescriptive scope. Rule number one of interpretation, don’t interpret something that doesn’t need interpretation! The words are clear, she says. As it is clear, there is no need to interpret the exception.

Turning to the facts, she says the Police never explained that it was necessary for them to collect this information.⁹ She goes further and says

• The Police should also explain why they need the information through the means of a voluntary request. Why they can’t apply for a production order instead?
• The breach was also a breach for IPP 4, because it was unfair.
• She disagreed with the Courts approach to Hamed (but that is a much longer post).

Some brief discussion

While I have you here, I want to make two quick point:

• While reading the case it is worth having on a critical legal studies hat. Mr Alsford was guilty. He had been caught (twice). While you are reading the case, I want you to consider whether this had any effect on the reasoning it contains.
• The majority follow Hamed, meaning they must consider whether Mr Alsford had a reasonable expectation of privacy regarding his power consumption data. Notice how the Court turn straight to Canadian criminal law on this point. Why? The reasonable expectation of privacy is a broader normative idea and there is New Zealand law on this point. So why didn’t the Court look consider the privacy law available to them?

Key points

Here are some key points:

• Police may (still) make voluntary requests for personal information.
• To do so, they must explain that the requested information is necessary for law enforcement purposes.
  • They can use previously excluded information to make the request, but must explain why.
  • They don’t have to explain why the request is made under the Privacy Act.
• An agency that receives a request must be satisfied the law enforcement exception applies before releasing the information.
• A breach of the Information Privacy Principles may be unfair, but is not automatically unlawful (but consider the dissent).

Footnotes

1. Privacy Act 2020 s 7. Note: The Privacy Act can apply to dead people regarding health and the Register of Births Deaths and Marriages—but that is not relevant here.
2. See paragraph 18 to 29.
3. See paragraph 34.
4. See s 30(5)(a).
5. Except for access requests to the public sector.
6. See paragraph 36 – 38.
7. See paragraph 70.
8. See paragraph 80.
9. Paragraph 179.