Commentary
IPP 1.3 – Organisation must provide a collection notice
- This decision illustrates that IPP 1.3 does not require an organisation to provide a written collection notice prior to the collecting personal information every time. Organisations must take ‘reasonable steps’ to do this. Whilst what amounts to ‘reasonable’ ultimately depends on the circumstances, some factors VCAT highlighted include:
- what information the individual is or ought to have been aware of;
- the actions of the individual in making contact or sharing their personal information with the organisation;
- the surrounding context in which the personal information is provided to the organisation; and
- in certain circumstances, there might not be any reasonable steps an organisation can take.
Facts and decision
- In 2011, the Harrisons, husband and wife, wrote to the Building Commission (which later became the Victorian Building Authority (VBA)) and Building Practitioners Board (BPB) complaining about five practitioners, who they had hired to carry out building work at their premises. The BPB commenced an investigation against all five, and three were found guilty of various offences and sanctioned under the Building Act 1993 (Vic.) (Building Act).
- The Harrisons made three privacy complaints relating to the VBA’s and BPB’s conduct when investigating and prosecuting the practitioners.
- VCAT previously summarily dismissed two complaints against the BPB (see case note).
- This case primarily centred around whether the VBA inappropriately collected and disclosed the Harrisons personal information (contained in a witness statement) to the BPB who then disclosed this to one of the practitioner’s solicitors (S) as part of a brief of evidence relating to their prosecution. The witness statement contained the Harrisons residential address, and so they feared for their safety.
IPP 1.3 – Organisation must provide collection notice
Submissions
- The Harrisons alleged that the VBA interfered with IPP 1.3 when she attended an interview with a VBA investigator and provided her witness statement. She alleged that no verbal or written information was provided to her about how the statement would be used and that she believed it would remain confidential. She alleged that had VBA provided her with a complaint collection notice, this would have required them to explain that the VBA was required to disclose to the BPB her personal information, and that the BPB is an entity that is not required to comply with the PDP Act.
- The VBA contended that it had provided the Harrisons with a collection notice when she lodged a previous complaint about one of the other practitioners. This was in the form of an acknowledgement section at the end of the complaint form, which talked about the VBA using and disclosing personal information in line with its Privacy Policy. Its Privacy Policy explained the roles played between the VBA (investigating complaints) and the BPB (prosecuting complaints).
Decision
- VCAT found that the VBA had taken reasonable steps to make the Harrisons aware of the matters in IPP 1.3 either expressly or by implication, such that they ought to have expected that their personal information would be disclosed to the BPB to take enforcement action against the practitioners. This was based on the following factors:
- The actions of the Harrisons – the Harrisons had specifically written to both the VBA and BPB asking them to investigate the complaints and exerted pressure on the VBA to take action.
- The context in which the personal information was collected – the witness statement was collected in a formal setting with the Harrisons having to sign, it having to be witnessed by a second person, and the VBA investigator explaining to the Harrisons penalties associated with perjury.
- Former notice – the Harrisons had signed an acknowledgement which referred to the Privacy Policy that explained the role played in investigating and prosecuting complaints between the VBA and BPB.
IPP 2.1 – Use and disclosure
Submissions
- The Harrisons alleged that the VBA interfered with IPP 2.1 when it disclosed the witness statement containing their personal information to S.
- The VBA contended that it did not disclose the personal information to S, rather, it had disclosed it to the BPB, and this disclosure was authorised under IPP 2.1, IPP 2.1(a), 2.1(b), 2.1(e), 2.1(f) or 2.1(g).
Decision
- VCAT found that the VBA did not disclose the Harrisons personal information to S. The VBA did disclose the Harrisons personal information to the BPB, but this was authorised under:
- IPP 2.1 – the disclosure to the BPB was for the primary purpose of collection, being to investigate complaints about practitioners and, where appropriate, to refer complaints to the BPB for disciplinary action to be taken.
- IPP 2.1(a) – the Harrisons ought to have reasonably expected that the VBA would disclose their personal information to the BPB given that they had previously written to the BPB to investigate the practitioners and had on previous occasions, requested the VBA to take relevant disciplinary action.
- IPP 2.1(b) – VCAT implied that the Harrisons consented to the disclosure, given the circumstances in which they made the complaint and the degree of pressure they exerted on VBA on take action against the practitioners.
- IPP 2.1(e) and IPP 2.1(g) – the Buildings Act made certain conduct of the practitioners unlawful and established the BPB as the relevant entity with ability to impose sanctions, given the VBA had reason to suspect that the practitioners had engaged in unlawful conduct, the relevant entity to report its concerns to was the BPB.
- IPP 2.1(f) — upon a referral from the VBA to the BPB, clause 15(1) of Schedule 3 of the Buildings Act required the VBA to disclose all information to the BPB, it did not allow the VBA to redact or choose which information to disclose to the BPB.
About this decision
Venue: VCAT
Date of decision: 24/01/2017
Tags:
- IPP 1.3 ,
- IPP 2.1(a) ,
- IPP 2.1(b) ,
- IPP 2.1(e) ,
- IPP 2.1(f)