Legal Q: Email sent on to 3rd party

Forums › Off topic › Legal Q: Email sent on to 3rd party

spacefish

22 posts

Geek

#250672 21-May-2019 10:46

Hi, I've posted here as I'm sure someone is probably going to be able help with the answer(s) I have.

I sent an email to a big Corp, who in reply decided to CC in a 3rd party outside of the organisation. They did this without asking me. The information is highly personal and sensitive, and I would not have agreed for it to be shared. I've lodged a complaint with the Privacy Officer of the organisation, but haven't heard back yet.

I emailed the 3rd party and asked him to destroy it, but he has refused saying he is going to use it as evidence with (HDC).

Does anyone know what the rules/laws are relating to this 3rd party who refuses to destroy this email? Or recipients he may have also sent on too?

Thanks! :)

1 | 2

198 posts

Master Geek

#2242139 21-May-2019 10:53

https://www.privacy.org.nz/your-rights/your-privacy-rights/

Not a huge amount of info on what a third party can do with your info other than they shouldn't have received it without your consent...

SirHumphreyAppleby

2844 posts

Uber Geek

#2242156 21-May-2019 11:09

My understanding of the Privacy Act 1993 is that only Principle 6, relating to requesting information held about you, is actually enforcable.

I doubt there is any way to compel the third party to destroy the e-mail. I wouldn't.

Behodar

10502 posts

Uber Geek

Trusted

Lifetime subscriber

#2242163 21-May-2019 11:12

Technically this also violates copyright so there may be an avenue there. On the other hand, I'm not sure whether anyone would enforce it, since this type of violation is exceedingly common.

spacefish

22 posts

Geek

#2242204 21-May-2019 11:21

The Privacy Officer only really gives an opinion, which is a highly valued opinion, and a suggested remedy, and he/she the sends everyone on their way to come to a settlement. However, if either party wishes to pursue the issue further, then they can go to the Human Rights Tribunal.

Also as this is Health related it comes under Health Information and Privacy Code which has a stronger onus of responsibility on Health Care providers that what then general Privacy Principle do.

I have been looking under the Crimes Act too but there is a query about whether emails (and video footage etc) are "property".

surfisup1000

5288 posts

Uber Geek

#2242205 21-May-2019 11:21

spacefish:

Hi, I've posted here as I'm sure someone is probably going to be able help with the answer(s) I have.

I sent an email to a big Corp, who in reply decided to CC in a 3rd party outside of the organisation. They did this without asking me. The information is highly personal and sensitive, and I would not have agreed for it to be shared. I've lodged a complaint with the Privacy Officer of the organisation, but haven't heard back yet.

I emailed the 3rd party and asked him to destroy it, but he has refused saying he is going to use it as evidence with (HDC).

Does anyone know what the rules/laws are relating to this 3rd party who refuses to destroy this email? Or recipients he may have also sent on too?

Thanks! :)

I write emails with the assumption that email can be intercepted, forwarded , printed and shared.

So, emails should be considered as public.

Once an email is forwarded, you can't be sure all copies are deleted anyway. It is not like you see it go up in ashes.

Item

1717 posts

Uber Geek

Subscriber

#2242207 21-May-2019 11:22

Is there any prior agreement or NDA in force or did you explicitly request that this data not be shared or disclosed?

If not, it may well be an uphill battle.

freitasm

BDFL - Memuneh
79254 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#2242216 21-May-2019 11:34

As above, check with the Privacy Commission. If either company has a Privacy Officer or Ombudsman, check with this person as well.

For all effects, emails are like postcards. Anyone can read them while in transit and shouldn't be treated as confidential as soon as it leaves your machine.

Equinox IT

Cloud spending continues to surge globally, but most organisations haven’t made the changes necessary to maximise the value and cost-efficiency benefits of their cloud investments. Download the whitepaper From Overspend to Advantage now.

spacefish

22 posts

Geek

#2242219 21-May-2019 11:36

It's personal health information so there are explicit boundaries and rules around NOT sharing without consent, security of organisational systems, storage etc ... it is enforced and quite high damages can be paid out depending on the breach.

This is not an ordinary email situation, it is Govt and Health and privacy is an absolutely must. Privacy is also inbuilt into professionals ethical practice too. The Privacy Officer has been contacted (awaiting reply), but they don't speak for the 3rd party.

I'd just like to know how to get the email destroyed by the 3rd party.

networkn

Networkn
32350 posts

Uber Geek

ID Verified

Trusted

Lifetime subscriber

#2242221 21-May-2019 11:37

Even if they deleted them, they are likely still in their backups if they have them, so would be recoverable if they wanted to anyways.

Fred99

13684 posts

Uber Geek

#2242225 21-May-2019 11:40

spacefish:

I emailed the 3rd party and asked him to destroy it, but he has refused saying he is going to use it as evidence with (HDC).

I assume by "HDC" you mean the Health and Disability Commissioner?

In which case, there are requirements for privacy/non disclosure (patient confidentiality) beyond what would be expected in commercial law etc (IANAL).

spacefish

22 posts

Geek

#2242244 21-May-2019 11:45

networkn:

Even if they deleted them, they are likely still in their backups if they have them, so would be recoverable if they wanted to anyways.

. But then they can't use the info, if they get caught sharing or using it then they're in big trouble.

Fred99:

I assume by "HDC" you mean the Health and Disability Commissioner?

In which case, there are requirements for privacy/non disclosure (patient confidentiality) beyond what would be expected in commercial law etc (IANAL).

HDC - yes correct, but they don't apply to the big Corp, they don't like to get involved with them ... but the privacy/non disclosure (patient confidentiality) factor is very high for agencies and practitioners.

Fred99

13684 posts

Uber Geek

#2242262 21-May-2019 12:00

Well without disclosing more - who the parties are, who the complainant to HDC is, IOW "what it's all about" I doubt you'll get good advice here, even from the lawyers who post in the forum.

jnimmo

1097 posts

Uber Geek

#2242271 21-May-2019 12:10

I'm not sure the third party could be compelled to delete anything even if it was a breach for the information to be shared with them. Whether or not they could use it as evidence would be another matter.

Rule 11 of the HIPC defines what is allowed to be disclosed.

It may also depend somewhat on the terms & conditions of the company as to whether this third party would count as someone who they have stated they may need to share information with.

spacefish

22 posts

Geek

#2242278 21-May-2019 12:15

Maybe it will end up being a giant pointer to their lack of integrity ... if nothing else. The standard disclaimer is at the bottom of the email too, but I'm not sure if this counts for anything.

allio

885 posts

Ultimate Geek

#2242288 21-May-2019 12:25

Fred99:

Well without disclosing more - who the parties are, who the complainant to HDC is, IOW "what it's all about" I doubt you'll get good advice here, even from the lawyers who post in the forum.

I'm a lawyer who used to work at HDC and can confirm there aren't enough details here to really offer any meaningful advice.

I'm assuming you are the complainant (as you have shared details of your own personal health information) and the third party is the provider you have complained about? What is the relationship between you, the corporation, and the third party?

1 | 2