Haung v Frankston City Council [2022] VCAT 24

Facts, decision and commentary

  • Mr Huang operated a short stay rental property in the municipality governed by the Frankston City Council (Council). Mr Huang and his neighbour (N) had, what VCAT described, as an “acrimonious relationship” which led to both of them making a number of complaints about each other to the Council.
  • Mr Huang made two privacy complaints about the Council with over 10 different allegations. These complaints were joint in this decision and this case note largely focuses on VCAT’s interpretation and application of what constitutes personal information, use, and disclosure.
  • VCAT held that there had not been an interference with Mr Huang’s privacy. VCAT provided a series of primary and alternate reasons in its decision. Aspects of VCAT’s reasoning relating to the concepts of personal information, use and disclosure are of limited precedential value, as the reasoning is at times inconsistent with other cases and regulatory guidance.

Allegation 1

Submissions

  • Mr Huang’s allegations related to a total of 13 emails and two letters. The common thread running through all the correspondence was an allegation that the Council had interfered with Mr Huang’s privacy by revealing his identity, and in doing so disclosed his personal information in breach of breaching IPP 2.1.
  • Most of the emails were part of one of two email chains initiated by N to the Council complaining about Mr Huang leasing his property as a short stay rental. N included the address of the property in the subject line of one of the email chains.
  • Mr Huang alleged that the Council interfered with IPP 2.1 when it responded to N’s email, updating N on the progress of the Council’s investigation of his complaint on multiple occasions. These responses included various statements such as:
    • Council’s “next step is to identify the property and formally approach the owners under the Act to act on the circumstances you have described including requiring registration of the properties…”
    • “Council’s Environmental Health Officers have contacted the owner of the property to advise him that his property falls within the prescribed accommodation legislation…”
    • “I have asked Council Officers to liaise with the Police in order to get transcripts of their attendance sheets so that we can use as evidence as we move towards prosecution…”
  • Council contended that there was no use or disclosure as N was already aware of Mr Huang’s identity and that it would be an absurd outcome if it were to be found that the Council had disclosed personal information to a person already in possession of that information and who had provided it in the first place.
  • Other correspondence that was the subject of Mr Huang’s allegations included:
    • an email from Council to the local police station relating to noise complaints at Mr Huang’s property
    • a letter from Council to another individual (not N) regarding a noise complaint at Mr Huang’s property
    • a letter from Council to Airbnb generally raising concerns about complaints from residents about short stay rentals
    • an email from Council to a journalist reporting on Airbnb rentals in the area.

Decision

Whether the information was personal information

  • In relation to the email chains between Council and N, VCAT held that the information in these emails was not personal information and therefore not subject to compliance with the IPPs:
    • ‘apparent’ – VCAT held that there was nothing in the emails (such as the Mr Huang’s name) to make the Mr Huang’s identity apparent.
    • ‘reasonably ascertainable’ – VCAT held that there was nothing in the emails that would have made the Mr Huang’s identity reasonably ascertainable to N. This was because the ordinary definition of ‘ascertain’ means “to find out by trial, examination or experiment” and N did not need to perform these actions as he already knew Mr Huang address (and identity) when he sent his email.
  • In relation to the email from Council to the local police station relating to noise complaints, VCAT found that Mr Huan’s address was personal information because Mr Huang’s identity could be reasonably ascertained by the police “through the use of extraneous materials, for example, by way of land title searches.”
Commentary
  • VCAT’s interpretation of whether someone’s identity is ‘reasonably ascertainable’ (requiring some sort of trial, examination, or experimentation) does not appear to be consistent with other decisions and commentary, particularly at the Commonwealth level.
  • For example, in the Office of the Australian Information Commissioner’s (OAIC) Guidelines, the OAIC explains that whether an individual is ‘reasonably identifiable’ from information will depend upon factors such as who will have access to the information. The OAIC Guidelines provide the example that information that an unnamed person with a certain medical condition lives in a specific postcode may not be sufficient to enable general members of the public to identify an individual. However, if that same information is disclosed to an entity or individual with specific knowledge who can link that individual to the medical condition and postcode, it would be personal information.
  • Similarly, in WZ v CEO of Services Australia [2021] AICmr 12, the OAIC held that the respondent updating the complainant’s ex-partner’s online portal with the complainant’s residential address amounted to a disclosure of the complainant’s personal information because the ex-partner had knowledge that their online account was at some point linked to that of the complainant’s and so the address, not being their own, must have been that of the complainant’s.
  • Furthermore, VCAT’s interpretation also produces strange outcomes. For example, in this case, Mr Huang’s address was considered to be personal information in the hands of local police (who might not have known Mr Huang) but not in the hands of N (who did in fact know Mr Huang).

Whether the information was used or disclosed

  • VCAT also held that there had not been a use or disclosure of the information involved in the email chains between Council and N, and therefore no interference with IPP 2.1.
  • VCAT interpreted the term ‘use’ to mean “to employ for some purpose” and ‘disclose’ to “open up something to view or revealing it.” In this case, VCAT held that:
    • ‘disclose’ – there was no disclosure to N as the Mr Huang’s identity was already known to N, therefore, in responding to N’s email, the Council did not ‘reveal’ anything to N.
    • ‘use’ – there was no use of the personal information because it was not “employed for some purpose” by the Council, rather, it was sent back to N because of the design of the Council’s email system which mean that the subject line and original email sent from N remained within the email chain.
Commentary
  • The application of VCAT’s interpretation of ‘disclosure’ does not appear to be consistent with other decisions and commentary.
  • For example, in the IPP Guidelines, Office of the Victorian Information Commissioner (OVIC) explains that an entity discloses information “where it releases the information out of its effective control and into the control of another organisation or person.” Similarly, the OAIC in the APP Guidelines explains that this “…focuses on the act done by the disclosing party, and not on the actions or knowledge of the recipient.”
  • Further, it could be argued that the Council did ‘reveal’ something to N. The Council’s statements conveyed that they intended or were taking additional action against Mr Huang. This, coupled with N’s knowledge about the identity of Mr Huang, revealed new information about Mr Huang to N that N was not previously aware of.

Whether the disclosure was authorised under IPP 2.1(a) – use or disclosure is for a related and reasonably expected secondary purpose

  • VCAT also held that the disclosures in the email chain to N, the letter to another individual, and the email to police would have been authorised under IPP 2.1(a).
  • VCAT characterised the primary purpose of collection by refence to Council’s enabling legislation, the Local Government Act 1989 (Vic.). It held that the primary purpose was complaint handling, investigation, and resolution of complaints, as well as determining whether there were any breaches of the laws that it had power to enforce.
  • VCAT went on to characterise the secondary purpose of the disclosure as responding to complaints received and that this was:
    • ‘related’ – to the primary purpose of collection; and
    • ‘reasonably expected’ –Mr Huang himself expected that when he made complaints to the Council about N, that the Council would report back to him about his complaints, so the inverse should also be reasonably expected if someone made a complaint about him to the Council that the Council would report back to them about him.
Commentary
  • The characterisation of the Council’s primary purpose by referencing to its enabling legislation is consistent with other decisions such as SET v Department of Health and Human Servies [2019] VCAT 113 (see case note here). However, more recent VCAT decisions have preferred to look at the underlying motive of the collection by reference to the organisation’s subjective intentions (see case notes on WOS v Victoria Police [2021] VCAT 1540; Roberts v Anglicare Victoria [2014] VCAT 1515; and Ng v Department of Education [2005] VCAT 1054).
  • VCAT appears to have applied a subjective test (by reference to what Mr Huang would have thought) when determining whether the disclosure was reasonably expected. This is inconsistent with other decisions (see case note on Ng v Department of Education [2005] VCAT 1054) and commentary (such as in OVIC’s IPP Guidelines) which suggest that it is an objective test. That is, the reasonableness of the disclosure is judged according to the expectations of a reasonable person, not the complainant.

Allegation 2

Submissions

  • Mr Huang alleged that the Council unlawfully and unfairly collected his personal information in contravention of IPP 1.2 when it trespassed onto his property and took a variety of photos.

Decision

  • VCAT held that none of the photos taken by the Council contained personal information. VCAT examined the photos and found that they were of objects such as the Mr Huang’s spa, fence behind the spa, and signage – from these the identity of the Mr Huang was not apparent or reasonably identifiable.

About this decision

Venue: VCAT
Date of decision: 12/01/2022