Nicky Hager: Westpac must confess to all customers whose privacy was breached

Investigative journalist Nicky Hager. Photo / Supplied

Every single Westpac banking customer whose information has been secretly and unlawfully supplied to the police could be told about the disclosure.

It would be an extraordinary disclosure from the bank to its customers and one of the outcomes sought by author and journalist Nicky Hager in a fresh claim against the bank before the Human Rights Tribunal.

The filing of the case follows a ruling by the Privacy Commissioner John Edwards that Westpac breached Hager's privacy by giving police large amounts of private information without any legal obligation to do so.

The bank claimed it had not breached the Privacy Act because its customers effectively waived their right to privacy through Westpac's "terms and conditions".

The tribunal hearing is the next step in a series of cases prompted by police overstepping lawful boundaries during an investigation to find Hager's source for his book Dirty Politics. Already police have suffered a ruling that its search on Hager's property was unlawful.

Now Westpac has been censured over releasing Hager's information through a practice that has been common across the New Zealand banking industry.

The Privacy Act allows organisations holding private information to release it to police or other agencies if there is a reasonable belief that failing to do so would cause injury to the cause of law.

The Dirty Politics book led to a police investigation as to the identity of author Nicky Hager's hacker source. Photo / Stephen Parker

The Herald has previously reported

that all banks regularly released information to police without any "reasonable belief" it was necessary to protect the maintenance of the law.

The Privacy Commissioner's decision could bring an end to the practice but it is not binding. In the absence of an admission, Westpac breached Hager's rights, the author was now seeking a ruling from the Human Rights Tribunal, which has the power to make binding orders.

Hager's lawyer Felix Geiringer said Westpac's response to the ruling from the Privacy Commissioner had prompted the filing of the case with the tribunal.

"He has asked Westpac to acknowledge that it breached his rights. Despite the Privacy Commissioner's ruling, it has not been prepared to do that," he said.

Geiringer said Hager would be asking the tribunal for a binding order that the bank refuse to hand over customer information unless police had a production order which legally compelled it to comply.

Hager was also concerned there were others in his position and believed they should be told their private information had been handed to police and others, said Geiringer.

"He has also asked the Human Rights Review Tribunal for an order requiring Westpac to notify everyone whose privacy may have already been breached."

Privacy Commissioner John Edwards. Photo / John Stone

Such an order would oblige Westpac to make contact with potentially thousands of people to explain their information had been handed over to police or other agencies in a breach of the law.

Geiringer said the issue did not only relate to Westpac. "All New Zealand's banks had the same arrangement with the police. Many other companies have also been releasing personal information without asking for a production order."

Westpac defended itself before the Privacy Commissioner with the claim - as Edwards phrased it - that "every customer has authorised the disclosure of all of their information from each of their accounts to Police for whatever reason Police give".

Edwards rejected the argument, saying: "I simply cannot accept that is a well-founded belief. As a general proposition it seems untenable that Westpac would genuinely hold this belief. I am sure it would come as a surprise to a great many of Westpac's customers that this were so."

Westpac New Zealand chief executive David McLean. Photo / Brett Phibbs

A Westpac spokesman said the bank would "follow the process" through the tribunal.

In earlier comments, Westpac would not point to the section of its terms and conditions it relied on, instead referring the Herald to a section of its privacy policy.

The policy states Westpac would "share personal information with the police, government agencies in New Zealand or overseas or other financial institutions where ...(Westpac) reasonably believes that the disclosure will assist it to comply with any New Zealand or overseas laws" including for investigating fraud, money laundering "other criminal offences".

There is nothing in the policy which explains what "reasonable belief" might be.

Westpac has also refused to release to its customers an internal policy which appears to protect customer information. The bank has released an excerpt of the policy including the bottom line that the "reason for the release of information is valid".

However, there is no indication as to whether or not the policy also includes reasons for waiving the rule.

The Westpac spokesman said the bank only provided information to police without a warrant on 33 occasions in the past 12 months. In that time, it received close to 30,000 requests for information from police and other agencies.

In the 33 cases information was released, 29 were for missing persons and one to help identify a foreign person who had died in New Zealand. Of the two remaining, one was to seek evidence an elderly customer had been defrauded and the other to find a fraudster using a stolen chequebook.

It is believed the number of requests complied with by agencies has dropped significantly since the Herald highlighted the issue in 2015 and the Privacy Commissioner ran a pilot project to track how often it happened.