The Northland Regional Council has been told to apologise to bleach attack victim Mike Nager for accessing text messages he sent to a former employer.
The then-NRC employee was driving to Whangarei from Kerikeri in June 2013 to give evidence in a court case relating to illegally extracted swamp kauri when he stopped for a car flashing its lights. He was attacked by assailants who threw bleach into his eyes and cut his face with a knife. His attackers have never been caught.
Mr Nager returned to his job but took sick leave after getting flashbacks. He was dismissed in March after going public about the council's refusal to destroy a confidential report it had received in error from ACC.
He later lodged a complaint for unjustified dismissal with the Employment Relations Authority, which has yet to be heard, and took his concerns to the Privacy Commissioner.
The privacy complaint stemmed from one of his managers accessing text messages he sent to a former boss in Taranaki in the days after the attack.
The regional council told the Commissioner it needed the texts because they contradicted Mr Nager's complaint he had received insufficient support in the wake of the attack.
The Commissioner ruled that the council had breached principle 1 of the Privacy Act.
However, the breach had not caused sufficient harm to Mr Nager to find that his privacy had been interfered with. He also found the council was not in breach of principle 6.
The Commissioner advised the council to send Mr Nager a written apology and to provide its staff with Privacy Act training to prevent future breaches.
Mr Nager earlier told the Advocate he only discovered the council had obtained his private text messages when he requested his personal file.
The Commissioner previously ruled that another complaint by Mr Nager, about the council refusing to destroy an ACC report received in error, was not a breach of the Privacy Act.
Regional council chief executive Malcolm Nicolson did not wish to comment on the Commissioner's ruling.
-Principle 1 of the Privacy Act states that personal information must not be collected unless it is for a lawful purpose connected with a function or activity of the agency collecting the information, and it is necessary to collect the information for that purpose. Principle 6 gives individuals the right to access information about themselves.