While workplace gossip may seem harmless, a recent Human Rights Review Tribunal decision has reinforced how gossip that amounts to a privacy breach can have serious legal and financial consequences.
The New Zealand Human Rights Tribunal case of Cummings v KAM Transport Limited [2025] NZHRRT 8 highlights the risks that arise when sensitive employee information is shared inappropriately, even within the same organisation. In this case, a rumour that began inside the workplace ultimately cost the employer $30,000 in damages.
Summary of the Case
In August 2020, Mr Cummings, a truck driver at KAM Transport Limited (“KAM”), was one of three truck drivers selected for a random drug test. He initially refused the test, which, under his employment agreement, constituted serious misconduct. He was stood down from work while the matter was dealt with through a disciplinary process.
A little over a week later, Mr Cummings agreed to take a drug test. This returned a clear result, and Mr Cummings was reinstated in his role with KAM.
However, within days of being back on the job, Mr Cummings was told by an employee working for a Martin Brower, a client of KAM, that she and others had been told that he was a drug dealer and had been dismissed from his job.
Shocked and embarrassed, Mr Cummings raised the matter with his employer. KAM investigated and concluded that there had been no breach of Privacy. Unsatisfied, Mr Cummings resigned from his job, and lodged a complaint with the Privacy Commissioner. His complaint was later filed with the Human Rights Review Tribunal.
The Legal Issue
At the core of the case was the Information Privacy Principle 11 (“IPP 11”) of the Privacy Act 2020 (“the Act”), which restricts when an organisation can disclose personal information about an individual.
Mr Cummings alleged that his employer breached IPP 11 by disclosing his refusal to take the drug test to an employee who was not a part of management or HR. From there, he argued, the information spread and morphed into the damaging and untrue rumour that he had been dismissed for dealing drugs.
The Human Rights Tribunal was tasked with deciding:
- whether KAM disclosed Mr Cummings’ personal information regarding his refusal to take the drug test, and
- whether that disclosure caused Mr Cummings any types of harms set out in the Act.
The Tribunal’s Findings
The Tribunal found that Mr Cumming’s personal information had been disclosed inappropriately.
While the exact path of the rumour was unclear, the timeline and proximity of the incident at Martin Brower made it implausible that the information came from anywhere other than KAM.
Importantly, the Tribunal confirmed that the internal disclosure of private information can amount to a breach under the Privacy Act. In this case, the manager shared information with a staff member who had no legitimate reason to be informed.
As a result of the breach, Mr Cummings was awarded $30,000 for humility, loss of dignity and injury to feelings. At his request, Mr Cummings also received a declaration that the company had interfered with his privacy.
Lessons for Employers
Leaking an employee’s personal information within an organisation is caught under the Privacy Act. It is important that robust processes are in place, so that the next round of workplace gossip at your business does not come at a cost. When you are dealing with sensitive employee information, such as the details of a disciplinary process, it must be kept confidential.
