ABCs of KMIn the news

“Information held in the mind” can be legally extracted, highlighting knowledge definition and risk issues

A case note from the Office of the Privacy Commissioner (OPC) in New Zealand reports the startling findings of the investigation of a complaint that raised issues under principle 6 of the New Zealand Privacy Act 1993.

To establish a breach of principle 6, a complainant must show that he or she made an information privacy request and that the agency either failed to confirm or deny within 20 working days that they held the information, or that it failed to allow access to the information.

The particular complaint was made by a woman who was taking a personal grievance case to the Employment Relations Authority. As part of that process, she and her lawyer had made requests for information that her former employer claimed he had received about her from other staff, customers and suppliers of the business where she used to work.

The relationship between her and her former employer had completely broken down and had become acrimonious. When the employer did not hand over the information, the woman made a complaint to the OPC. She told them she wanted copies of the statements that the former employer told her he had received from people who had said negative things about her.

The OPC contacted the woman’s former employer and asked about the information that had been requested. The employer responded that some information had been withheld because it was “not currently in a written form but verbal opinions and statements provided by various customers, suppliers, current and former staff” about the woman after her departure.

Because the employer refused to provide the OPC with the information for their review, they took the rare step of issuing a summons for him to be examined under oath. In the meeting, the employer said he did have information about the woman’s behaviour and habits at work.

The employer admitted he had held this information at the time the woman’s lawyer made the initial request. However, he asserted that the information was evaluative and had been supplied to him in confidence, and so could not be released.

The OPC concluded that the employer had interfered with the woman’s privacy, and that this amounted to a breach of principle 6. Further, had the employer continued to refuse to provide the information to the OPC for their review, he would have been committing an offence under s 127 of the Privacy Act of obstructing or hindering the Privacy Commissioner, and could have been subject to prosecution.

In regard to these findings, the case note states:

Information held in the mind

Principle 6 applies to personal information held in a person’s memory. We referred to two previous decisions from the Human Rights Review Tribunal (then named the Complaints Review Tribunal) in 1999 and 2000, in which disclosure of information included “information which was initially held in the memory of the defendant but which she has, at the request of the plaintiff, subsequently committed to writing”.

We noted that accessing information held in a person’s memory could raise practical questions about the extent to which information must be sought out and disclosed when an information privacy request is received. But as noted in the employer’s emails, and in the evidence given under oath, the information appeared to be quite fresh in the employer’s mind. This demonstrated that the information should have been provided to the woman’s lawyer or our office.

The knowledge vs. information dichotomy

The findings in this OPC case highlight two important issues. As RealKM’s Stephen Bounds states in a reply to the posting of the case on LinkedIn, the first of these issues relates to the knowledge vs. information dichotomy:

[The case] highlights the fundamental flaw in the rigid dichotomy between “knowledge” being something that only a person can have, and “information” being something that is always written down.

Without getting too philosophical, information is simply a novel pattern that can be repeated back. If I hear a phone number, I can repeat that phone number to you – it’s information I can provide.

Similarly, when I hear a customer complaint, I can recount that complaint to you (information) without having to incorporate that into my worldview (knowledge) of whether my organisation should change how it works.

[This case] also emphasises how records are distinctly different from information. If the Privacy Commissioner had asked the employer for copies of “all records of information received”, [the employer] would have been entirely justified saying that those records did not exist.

A knowledge risks perspective

Secondly, the OPC case findings reinforce the argument that as well as being seen as a positive organisational endeavour, knowledge management needs to be considered from a knowledge risks perspective.

One of the identified knowledge risks is knowledge hiding. In seeking to hide the knowledge sought by his former employee, the employer in the OPC case could have been subject to prosecution, a serious risk to both himself and his business.

Acknowledgements: With thanks to Prashanta Mukherjee, Paula J Smith, and Stephen Bounds on LinkedIn.

Header image: New Zealand Privacy Commissioner John Edwards, CC BY 3.0, adapted by Bruce Boyes from Wikimedia Commons (John Edwards Privacy Commissioner) and Wikimedia Commons (Privacy Commissioner Logo).

Rate this post

Also published on Medium.

Bruce Boyes

Bruce Boyes (www.bruceboyes.info) is a knowledge management (KM), environmental management, and education professional with over 30 years of experience in Australia and China. His work has received high-level acclaim and been recognised through a number of significant awards. He is currently a PhD candidate in the Knowledge, Technology and Innovation Group at Wageningen University and Research, and holds a Master of Environmental Management with Distinction. He is also the editor, lead writer, and a director of the award-winning RealKM Magazine (www.realkm.com), and teaches in the Beijing Foreign Studies University (BFSU) Certified High-school Program (CHP).

Related Articles

Back to top button