In Hosking v Runting  1 NZLR 1, the New Zealand Court of Appeal found that a person can sue another in tort if that person offensively publishes their sensitive private facts. The recent Canadian judgment of Jones v Tsige 2012 ONCA 32 provides some insight into the direction that New Zealand's privacy tort might take in the future.
The Court of Appeal of Ontario judgment involved two employees of the Bank of Montreal. Over a period of four years, one of the employees, Tsige, without authorisation and contrary to bank policy, accessed and viewed the bank records of Jones at least 17 times. Jones sued Tsige claiming that Ontario law recognises a right to privacy, including a right to be free from intrusion upon one's seclusion or solitude, or one's private affairs.
The Court of Appeal confirmed the existence of a tort of privacy in Ontario and expressed this as a right of action for unreasonable intrusion into seclusion. The Court said that recognition of such a cause of action is an incremental step that is consistent with the role of the Court to develop the common law in a manner consistent with the changing needs of society. The Court was persuaded that the rapid change in technology and the increasing levels of personal and sensitive information being aggregated and stored online supported the finding.
The key difference between the finding in this case and the tort described in Hosking is the absence of the requirement for publication. In Jones v Tsige, Tsige had not published the bank details she had accessed. However, the Court protected Jones' right to be free from intrusion into Jones' personal affairs. This right was breached by Tsige's intrusion, regardless of whether the information was published to anyone else.
The New Zealand Court of Appeal in Hosking did not address the question of whether a remedy is available for unreasonable intrusion into a person's solitude or affairs. It is possible that if the same set of facts arose here as arose in Ontario, a New Zealand court might extend the tort of privacy to include intrusion as a cause of action in its own right. If New Zealand law were to develop in that manner, publication might be treated as an aggravating factor that would be considered in deciding on the quantum of damages.
We will have to wait and see whether New Zealand law develops in this way. In the meantime, the case serves as a reminder to businesses of the importance of maintaining policies and practices to protect personal information.