Commentary
- This decision was based on the preceding legislation to the Privacy and Data Protection Act 2014 (Vic.) (PDP Act), the Information Privacy Act 2000 (Vic) (IP Act).
Reading the IPPs in line with the Victorian Charter of Human Rights and Responsibilities
- In this decision, VCAT interpreted the IPPs in light of the requirements in s 7 and s 32 of the Charter of Human Rights and Responsibilities 2006 (Vic) (CHRR Act). That is, in such a way that is compatible with promoting human rights. We note that this approach was also adopted in Jurecek v Director Transport Safety Victoria [2016] VSC 285 (see case note).
IPP 4.2 – Data retention
- This decision suggests that an organisation must destroy or de-identify personal information when the personal information is no longer ‘useful’, ‘required’, or ‘indispensable’ to a purpose. In other words, there must be some causal link between the personal information in question and the achievement of a purpose.
- VCAT stated that this purpose does not have to be the same or related to the primary purpose of collection, but it does have to be a purpose set out in IPP 2.1 (Use or disclosure).
- In this case, the primary purpose of collecting Ms Caripis’s photograph was not under the Public Records Act 1973 (Vic) (PR Act), but its retention was required by the PR Act and therefore this purpose met a purpose listed in IPP 2.1, namely IPP 2.1(f) (use or disclosure required or authorised by law).
Facts and decision
- In 2010, Ms Caripis, along with a number of others, attended a climate change protest at a power station. During the protest, Victoria Police took 70 minutes of video footage, seven still photographs and 124 minutes of aerial footage from a police helicopter.
IPP 4.2 – Data retention
Submissions
- Ms Caripis alleged that Victoria Police retaining images of her after the protest had ended interfered with IPP 4.2 of the IP Act (equivalent to IPP 4.2 of the PDP Act). She contended the wording ‘needed for any purpose’ in IPP 4.2 meant ‘indispensable for a reasonable purpose’.
- Victoria Police contended that it had not interfered with IPP 4.2 because the personal information was needed for several purposes, including: intelligence, planning and briefing for further protests, evidence in case a complaint was made, and because of the requirements in the PR Act.
Decision
- VCAT held that Victoria Police had not interfered with IPP 4.2. VCAT interpreted the wording ‘needed for any purpose’ in IPP 4.2 to mean ‘useful’ or ‘required’ not ‘indispensable’ and that this purpose does not have to be the same or related to the primary purpose of collection.
- VCAT agreed with Victoria Police’s position that the personal information was needed for purposes such as intelligence, planning, and complaint handling given the historically high number of environmental protests in the area.
- VCAT also held that the personal information could only be destroyed in accordance with the PR Act and that because a standard issued under the PR Act stated that the record needed to be kept for 7 years, Victoria Police was not permitted to destroy or de-identify the personal information prior to this time.