Commentary
- This decision was based on the preceding legislation to the Privacy and Data Protection Act 2014 (Vic.) (PDP Act), the Information Privacy Act 2000 (Vic.) (IP Act).
IPP 1.3 – Organisations must provide a collection notice
- In this decision, VCAT appears to have taken a subjective approach when determining whether Victoria Legal Aid (VLA) took reasonable steps for the purposes of IPP 1.3 as it held that Mr Gao was already aware of a number of matters listed in IPP 1.3. That is, it looked at what Mr Gao knew about the collection to determine whether any reasonable steps were required.
- However, this approach was rejected by the in Jurecek v Director, Transport Safety Victoria [2016] VSC 285 (see case note) which held that whether an organisation has taken ‘reasonable steps’ is an objective test that depends upon the circumstances and cannot be discharged by an organisation making a presumption or assumption as to the individual’s knowledge.
IPP 4.2 – Data retention
- One criticism that can be levelled against this determination is VCAT’s reasoning regarding the application of IPP 4.2 and s 6 of the IP Act (substantially similar to s 6 of the PDP Act). VCAT found that the record keeping requirements under the Public Records Act 1973 (Vic.) (PR Act) were inconsistent with VLA’s IPP 4.2 requirements, and therefore, by applying s 6 of the IP Act, the record keeping requirements prevailed over the requirement to destroy or de-identify in IPP 4.2.
- A better statutory interpretative approach has been to read the obligations of both IPP 4.2 and the PR Act harmoniously. For example, in Caripis v Victoria Police (see case note), VCAT held that the record keeping requirements under the PR Act were a ‘purpose’ under IPP 4.2 and, accordingly, destruction or de-identification only required once the record keeping requirement had lapsed.
Facts and decision
- Mr Gao had been charged with an offence and attended VLA’s premises to obtain legal aid.
- Mr Gao spoke to a receptionist who fixed an appointment for him with a lawyer working for VLA. Mr Gao met with the lawyer who collected and recorded some of his personal information in a legal advice record. Based on this conversation, the lawyer explained that Mr Gao would need to seek a private lawyer’s assistance because his weekly income exceeded $800.
- Mr Gao alleged breaches of IPP’s 1.1, 1.2, 1.3, 4.2 and 10.1 arising from the VLA’s collection and retention of his personal information, even though shortly after the beginning of the conversation, it was apparent that he would be ineligible for funding.
IPP 1.1 – Collection must be necessary for an organisation’s functions or activities
Submissions
- Mr Gao alleged that VLA interfered with IPP 1.1 because it was apparent, after VLA had ascertained his weekly income, that he was ineligible for funding. Accordingly, VLA should not have, from that point in time, collected additional personal information about him, including information about the offence he was charged with.
Decision
- VCAT held that VLA had not interfered with IPP 1.1:
- The ‘function or activity’ being carried out by VLA was to assess and decide applications for legal assistance.
- The collection of Mr Gao’s personal information was ‘necessary’ to achieve this function as s 24 of the Legal Aid Act 1978 (Vic.) set out the factors that VLA had to consider when deciding whether to grant legal aid. These factors extended beyond just Mr Gao’s financial position and included how complex the case was and in what court the matter would be tried, as this would affect the cost of the representation.
IPP 1.3 – Organisation must provide a collection notice
Decision
- VCAT held that VLA did not interfere with IPP 1.3 because Mr Gao was aware, at or before the time that his personal information was collected, of the matters set out in IPP 1.3. This was based on the fact that Mr Gao had come to VLA to seek legal aid, and was aware that the purpose of VLA collecting his personal information was to determine his eligibility for legal aid assistance, and that if he did not provide the personal information then the legal aid would not be provided.
IPP 4.2 – Data retention
Submissions
- Mr Gao alleged that since he was ineligible for legal aid, personal information collected by VLA is no longer needed for any purpose and should have been destroyed. The fact that VLA retained it interfered with IPP 4.2.
- VLA contended that it needed to retain Mr Gao’s personal information in order to satisfy its record keeping obligations under the PR Act.
Decision
- VCAT held that the record keeping obligations under the PR Act conflicted with the requirements in IPP 4.2 and applied s 6 of the IP Act (substantially similar to s 6 of the PDP Act) to find that the inconsistency meant that VLA did not have to comply with IPP 4.2 until the retention period had expired.
IPP 10.1 – Collection of sensitive information
Submissions
- Mr Gao contended that VLA interfered with IPP 10.1 when it collected sensitive information, being:
- his name and country of birth which indicated his ethnic origin; and
- the charges brought against him for which he was seeking legal aid, which indicated his criminal record.
- VLA contended that:
- information about the charges brought against Mr Gao did not constitute a criminal record as the term ‘criminal record’ should be interpreted to information about findings of guilt, or conviction or disposition after a finding that an offence has been committed;
- in the alternate, Mr Gao had given implied consent to the collection when he attended and provided the sensitive information to VLA’s lawyer.
Decision
- VCAT held that even if both those pieces of information were sensitive information, the collection was authorised under IPP 10.1(a) because Mr Gao had given implied consent:
- his country of birth was provided in the context of a discussion about whether he required an interpreter; and
- the charges brought against him was provided in the context of seeking legal aid.
- VCAT did not make any definitive conclusions about whether the information the Complaint contended was sensitive information was in fact sensitive information as defined by the IP Act. However, it did make the following comments:
- The terms ‘race’, ‘ethnic origin’, and ‘criminal record’ are not defined in the IP Act and interpretative guidance could be obtained from other legislation, such as the Equal Opportunity Act 2010 (Vic.). On this basis, VCAT felt that Mr Gao’s country of birth combined with his name could constitute information about his race or ethnic origin and was therefore capable of being sensitive information.
- VLA’s position about the interpretation of the term ‘criminal record’ to findings of guilty was unlikely to be correct. VCAT looked at the other terms within the definition of sensitive information and stated what “these kinds of information have in common is how they tend to define what a person is, and how their disclosure might distress the individual, and damage his or her relationship or community reputation or standing. These kinds of information are more private, more “sensitive” than other kinds of personal information.”