Privacy Breach in Employment: $30,000 Award for Humiliation and Loss of Dignity

The Human Rights Review Tribunal has issued a significant decision in Cummings v KAM Transport Limited [2025] NZHRRT 8, reinforcing the critical importance of maintaining privacy on a “need to know” basis for workplace matters.

Background

Darren Cummings, a senior truck driver, refused a random drug test in August 2020, triggering a disciplinary process under KAM Transport’s drug and alcohol policy. Although Mr Cummings later passed a subsequent drug test, rumours began circulating within the workplace that he was a drug dealer and had been dismissed. These rumours extended beyond the company and reached a client site, causing Mr Cummings considerable distress and reputational harm.
 
This case illustrates how even a single disclosure can escalate into widespread misinformation, damaging both employee wellbeing and employer reputation.

Tribunal Findings

The Tribunal found that KAM Transport disclosed Mr Cummings’ refusal to take the drug test to a non-management employee who had no legitimate need to know. This disclosure breached Information Privacy Principle 11 under the Privacy Act 2020, which restricts the disclosure of personal information unless specific exceptions apply.

The Tribunal concluded that the breach caused significant humiliation, loss of dignity, and injury to feelings, meeting the harm threshold under s 66(1)(b)(iii) of the Act. Importantly, the decision emphasises that emotional harm alone—without financial loss—can justify substantial compensation.

Remedies

• Declaration: The Tribunal formally declared that KAM Transport interfered with Mr Cummings’ privacy rights.
• Damages: $30,000 was awarded for emotional harm, reflecting the seriousness of the breach and its impact on Mr Cummings’ dignity.
• Other Claims: Claims for lost earnings and benefits were dismissed due to insufficient evidence of a causal link between the privacy breach and financial loss.
  This outcome signals that employers cannot assume minimal liability simply because no monetary loss occurred.

Key Takeaways for Employers

• Limit Internal Disclosures: Sensitive information should only be shared with those who have a genuine need to know.
• Emotional Harm Matters: Breaches of privacy can result in significant awards for emotional harm.
• Policy Review: Employers should review disciplinary and drug-testing policies to ensure compliance with the Privacy Act and reinforce confidentiality obligations.
• Training: Consider implementing staff training on privacy principles to reduce the risk of inadvertent disclosures.

How can we help?

Need advice on managing privacy in employment processes? Need an updated privacy policy or manager training on privacy? We can help!

Contact our team for more information.

Disclaimer: We remind you that while this article provides commentary on employment law, health and safety and immigration topics, it should not be used as a substitute for legal or professional advice for specific situations. Please seek legal advice from your lawyer for any questions specific to your workplace.