A passenger telephoned an airline requesting all information it held about him relating to a ticket dispute. The airline told the passenger he had to make his request in writing. Over a month later, the passenger emailed the airline's CEO as he had not received the information. The airline tried to reach him several times, apologised and asked for clarification on the information he wanted. The passenger did not respond. Instead, he emailed the CEO expressing frustration and asking for recordings of the phone calls he made. The airline offered transcripts and audio files of some of the calls and an opportunity to listen to the calls by phone.
The passenger kept trying to engage with the CEO by email while also continuing to contact the call centre. The airline found it difficult to manage and understand his requests, described many of his calls as abusive and threatening and eventually decided to refuse his requests for recordings of phone calls, citing section 29(1)(j) of the Privacy Act. This section allows agencies to withhold personal information if the request is frivolous or vexatious or if the information requested is trivial.
Privacy Commissioner's decision
The Privacy Commissioner concluded that the first request was not vexatious, but his later requests were. The Commissioner looked at:
- The frequency and method of contact
- The individual's behaviour
- The nature and volume of requests
- The stated purpose for requesting information.
The Commissioner found that the passenger made it difficult for the airline to manage and understand his requests, yelled, spoke over staff, refused to listen to attempts to resolve issues and engaged in name calling. The Commissioner believed this was to intimidate staff and make it difficult for the airline to respond. Further, the passenger was unwilling to clarify or resolve older requests as he kept making more, and, in one call, the passenger stated that he wanted to edit a call and spread it through the media and social media to make the airline "look as bad as possible". While the Privacy Act does not require requesters to specify the purpose of their request, in some cases the reason can indicate bad faith.
In addition, organisations cannot refuse a request simply because the requestor is difficult, annoying or made numerous requests one after another. The particular request needs to be vexatious (or frivolous). Things that can suggest a vexatious request include:
- Many requests for the same information without any clear reason
- Using information from one request to demand more information – one request leading to another, and another
- Abusive or aggressive behaviour and no clear need for the information
- A clear intent to use the request to divert the agency's resources or upset people.
Agencies should take care before relying on this ground and should not rely on it as a matter of course. For further information or guidance, speak to one of our team or contact the Privacy Commissioner's office directly.