PRIVACY COMPLAINTS

All New Zealand businesses must comply with the Privacy Act 2020 (Act) and the Information Privacy Principles (IPPs) when dealing with personal information. An apparent failure to comply can prompt a complaint, which may lead to legal consequences. 

For franchisees, dealing with complaints can be complicated by the franchise relationship. Responsibility may sit with the franchisee, the franchisor or both. Mishandling a complaint can also damage the wider brand. Katrina Hammon of Wynn Williams explains why knowing what to do in the event of a privacy complaint is crucial. Responsible franchisors have a process in place and manuals or policies to deal with privacy complaints.

Responding to privacy complaints

Most privacy complaints can be dealt with internally. While individuals can bring their complaints to the Privacy Commissioner, they will normally be referred back to the business in question. Therefore, franchisees should be prepared to notify the franchisor and agree on how to respond to complaints.

The first step is to contact the complainant, acknowledge the concern and establish the outcome sought. The business should then investigate whether an IPP or another obligation has been breached. Finally, the business should report back with the outcome and provide a response. Even where no breach is discovered, an explanation, apology or other response may help to preserve any customer relationship. 

Complaint handling is especially important within a franchise network because one incident can affect the reputation of the whole brand. A franchise-wide policy, explaining how complaints are received, escalated, investigated and resolved can support consistent responses across franchise network locations. Careful documentation may also help to reveal recurring issues across multiple franchisees that require attention.

Notifying privacy breaches

An investigation may reveal a notifiable privacy breach. A notifiable privacy breach is a breach that has caused or is likely to cause serious harm to an affected individual. If a breach is notifiable, the Privacy Commissioner and the affected individuals (where they are not the complainant) must be notified. The Act has specific obligations for notification, and failing to notify carries a fine of up to $10,000. The Privacy Commissioner encourages notification within 72 hours of identifying a notifiable privacy breach.

It may not always be clear whether the franchisee or franchisor bears notification responsibility. If the information is held in a franchise-wide system controlled by the franchisor, the franchisor may be responsible. However, if franchisees maintain their own systems and hold the information that has been breached, responsibility may rest with them, subject always to the franchise agreement. In some cases, both entities may have obligations and as the brand owner, the franchisor must always be aware.

Hot tips for franchisees

Key tips for franchise networks from Wynn Williams:

• understand your obligations under the Act and the IPPs; 
• have a clear process for handling and escalating privacy complaints;
• promptly escalate any suspected privacy breach to the franchisor;
• check your franchise agreement, manual and policy for any specific privacy, complaint handling or breach notification obligations;
• keep clear records of complaints, investigations and outcomes; and
• if you are unsure whether a breach is notifiable or who is responsible, seek legal advice immediately upon becoming aware of a privacy breach.

See this advertorial on page 30 of Franchise New Zealand magazine Year 35 Issue 03

For more information and advice on buying a franchise get your FREE copy of Franchise New Zealand magazine.