Jurecek v Director, Transport Safety Victoria [2015] VCAT 253

Commentary

  • This decision was based on the preceding legislation to the Privacy and Data Protection Act 2014 (Vic.) (PDP Act), the Information Privacy Act 2000 (Vic.) (IP Act).
  • This decision was appealed to the Victorian Supreme Court (VSC) in Jurecek v Director, Transport Safety Victoria [2016] VSC 285 (see case note). It’s important to note that the VSC was limited only to considerations of whether VCAT had erred in law. In other words, the VSC did not re-hear or review the factual basis of VCAT’s decision.

Beneficial interpretation of the IP Act

  • VCAT observed that section 31 of the Charter of Human Rights and Responsibilities Act 2006 (Vic) (the Charter) applies in relation to the interpretation of the IP Act. The Charter says:
    • So far as it is possible to do so consistently with their purpose, all statutory provisions must be interpreted in a way that is compatible with human rights.
    • International law and the judgments of domestic, foreign and international courts and tribunals relevant to a human right may be considered in interpreting a statutory provision.
  • VCAT stated that the “effect is that, where there is any ambiguity in the [IP Act], it should be construed beneficially and given an interpretation which is compatible with human rights.”

Beneficial interpretation of complaints

  • VCAT applied a similar beneficial interpretation when determining the scope of Ms Jurecek’s complaint to the Privacy Commissioner, which sets the scope of what VCAT is able to consider (as VCAT can only consider matters referred to it by the Privacy Commissioner).
  • Observing that the IP Act does not envisage that privacy complaints would usually be drafted by people with legal training, VCAT found that when determining the scope of a complaint referred by the Privacy Commissioner, it is “appropriate to give as broad an interpretation as is possible and there is not the need to ‘dissect every word’ as one might in other circumstances.”

s 12 – Exemption for publicly available information

When will something be considered a generally available publication

  • VCAT held that in general, the fact that something is posted online does not mean that it becomes a ‘generally available publication’. That is, for information posted online to amount to a ‘generally available publication’ it must be “able to be accessed by most members of the public, who are not particularly skilled in carrying out such searches.”
  • We read this as suggesting two criteria for something to be a ‘generally available publication’:
    • it has to be ‘publicly available’, that is, published in a medium that is accessible to members of the public; and
    • it has to be ‘generally’ available, that is, accessible by most members of the public without any special skills in carrying out searches.

IPP 1.1 – Collection must be necessary for organisation’s functions or activities

  • This is another VCAT decision which cites and applies the interpretation of ‘necessary’ to mean ‘reasonably required and legally ancillary’ and not ‘essential’, following the interpretation espoused in Ng v Department of Education (see case note).

IPP 1.1 and 2.1 – Information collected inadvertently

  • In this decision, VCAT considered the application of IPP 1.1 and 2.1 to personal information that was inadvertently provided to and collected by the Director Transport Safety Victoria (DTSV) as part of an investigation.
  • VCAT found that as the DTSV never intended to collect the personal information as part of the investigation, it cannot be said to be ‘necessary’ for the purposes of IPP 1.1.
  • Further, VCAT found that because the information was collected inadvertently, it can’t be said that there was a ‘primary purpose’ of collection for the purposes of IPP 2.1.
  • This approach appears to be in conflict with OVIC’s guidance, which contemplates that unsolicited personal information may be collected as a necessary element of a general function that involves the receipt of information (such as an investigation).

IPP 1.3 – Organisation must provide collection notice

What constitutes ‘reasonable steps’

  • This decision affirms that it may be reasonable to postpone the provision of a collection notice where, for example, doing so would jeopardise an investigation into the person that is being carried out and personal information being collected for.
  • This position was ultimately upheld and expanded upon by the VSC on appeal (see Jurecek v Director, Transport Safety Victoria [2016] VSC 285 (see case note)).

Facts

  • Ms Jurecek was employed by the Secretary of the Department of Transport, but was seconded to assist the Office of the Director of Transport Safety Victoria (we will just refer to this as the DTSV).
  • Ms Jurecek made several posts and chats on Facebook in connection with her employment in April and September 2012. These included:
    • April – exchanging a series of chat messages with her workplace colleague (PF) on Facebook discussing the suspension of another work colleague.
    • September – making a series of posts in reply to PF’s post. PF had made a post on her Facebook requesting her friends to refrain from making comments regarding a murder that was receiving publicity at the time.
  • PF found that the last reply Ms Jurecek made to her Facebook post was abusive and decided to take screenshots of the September posts, unfriend Ms Jurecek from Facebook, and report Ms Jurecek’s conduct (by providing the screenshots) to the DTSV.
  • DTSV investigated and gained access to Ms Jurecek’s Facebook through another workplace colleague’s (AP) Facebook.
  • DTSV then collected personal information from Ms Jurecek’s Facebook and shared this with a linguistic expert who they had engaged to determine whether the last September 2012 reply was written by Ms Jurecek or her partner (Ms Jurecek alleged her partner wrote it using her Facebook).
  • DTSV subsequently served a Notice of Investigation on Ms Jurecek in accordance with the Victorian Public Service Workplace Determination where it made Ms Jurecek aware of their investigation and that they suspected her of having engaged in serious misconduct. Following the investigation, DTSV issued Ms Jurecek with a final warning.

Personal information

Submissions
  • DTSV contended that the information it had collected from Ms Jurecek’s Facebook was not personal information because her identity was not apparent or reasonably ascertainable, given she operated her Facebook account using a pseudonym. Accordingly, it was not subject to privacy protections under the IP Act.
Decision
  • VCAT held that the information was personal information because her identity was reasonably ascertainable to DTSV.
  • Whilst Ms Jurecek’s identity was not apparent because of the pseudonym, it was ascertainable to DTSV by using extraneous material, such as talking to PF or reviewing the Facebook posts of September 2012 and an email that Ms Jurecek had sent to AP regarding the posts of September 2012, both of which provided the link between the pseudonym and Ms Jurecek’s identity.

s 12- Exemption for publicly available information

Submissions
  • DTSV contended that the personal information was subject to the exemption in s 11 of the IP Act (similar to but not the same as s 12 of the PDP Act), as it was generally publicly available, and therefore exempt from compliance with the IPPs.
  • Ms Jurecek contended that the exemption did not apply because:
    • A narrow interpretation should be adopted as to what information/documents should be considered a generally available publication, given that the IP Act is beneficial legislation in nature.
    • The manner in which Ms Jurecek had set up her Facebook meant that she had a reasonable expectation of privacy.
    • Just because something is posted online does not mean it necessarily becomes a generally available publication.
Decision
  • VCAT held that the personal information was not subject to the s 11 exemption because it was not generally publicly available.
  • VCAT considered that whilst almost anything posted online could be information that is publicly available (because of the way the internet works), the word ‘generally’ qualifies the term ‘publicly available’ to mean that it needs to be accessible by most members of the public, without any particular skill in carrying out searches.
  • In this case, most members of the public were unlikely to be able to access the personal information because:
    • It appeared that PF and AP had attempted to apply security settings to their Facebook accounts such that they could not be accessed by anyone other than their Facebook friends (although it did not appear that this had worked in practice).
    • Ms Jurecek took several steps to make it hard for people to access her personal information, including:
      • limiting the amount of personal information shared on her profile;
      • using a pseudonym, a display picture of someone else from a movie, and some other false information to disguise her identity (including setting her employer as fictious Weasel World);
      • setting up her Facebook account with a separate email address that she had created specifically for this purpose; and
      • not adding any work colleagues as friends on Facebook, other than PF and AP who she had considered friends at the time.

IPP 1.1 – Collection must be necessary for organisation’s functions or activities

Submissions and decision
  • Ms Jurecek alleged that the DTSV collected three parcels of personal information in contravention of IPP 1.1, these and VCATs decision/reasons are outlined below:
Personal information VCAT’s decision

 

5 and 11 April 2012 Facebook chats between Ms Jurecek and PF

 

No evidence to support that this collection had occurred.
12 April 2012 Facebook chat between Ms Jurecek and PF Breach of IPP 1.1 because the information had been collected unintentionally by the DTSV and it was therefore not ‘necessary’ for the function or activity it was carrying out, being the misconduct investigation.

 

September 2012 Facebook posts Authorised under IPP 1.1.

·         One of the functions or activities of an employer is to carry out investigations into allegations of misconduct, otherwise the employment relationship could not operate effectively.

·         The information in question was ‘necessary’ to carrying out this function because a complaint had been raised from another employee (PF) and it was relevant to the complaint.

 

IPP 1.3 – Organisation must provide collection notice

Submissions
  • Ms Jurecek alleged that the DTSV did not comply with IPP 1.3 and IPP 1.5 when it collected her personal information from her Facebook and PF because it only provided her with a Notice of Investigation which did not explain all elements of IPP 1.3 and was not at or before the time of collection or as soon as practicable thereafter.
  • The DTSV contended that it had complied with IPP 1.3 and IPP 1.5 because:
    • it had provided Ms Jurecek with a Notice of Investigation, which informed her of some of the matters in IPP 1.3/1.5; and
    • Ms Jurecek was already aware of other matters in IPP 1.3/1.5 such that it did not have to take any steps to inform her.
Decision
  • VCAT held that the DTSV had complied with IPP 1.3 and IPP 1.5 because:
    • Reasonable steps
      • The DTSV had taken reasonable steps to make Ms Jurecek aware of IPP 1.3(b) and IPP 1.3(c) by providing her with the Notice of Investigation, whilst there were no reasonable steps that could be taken for others because Ms Jurecek would already have been aware of this given she was an employee (IPP 1.3(a)) or they were not relevant (IPP 1.3(d) to (f)).
    • Temporal element
      • IPP 1.3 and IPP 1.5 did not impose an obligation on the DTSV to immediately notify Ms Jurecek about the collection, as this could have jeopardized the DTSV’s investigation. The provision of the Notice of Investigation after the personal information had already been collected was therefore reasonable.

IPP 1.4 – Preference for direct collection

Submissions and decision
  • VCAT held that it was not reasonably or practicable for the DTSV to collect personal information about Ms Jurecek directly from her given that Ms Jurecek was uncooperative with the misconduct investigation and that the DTSV could have assumed that Ms Jurecek would not have been forthcoming in providing her personal information to assist the misconduct investigation.

About this decision

Venue: VCAT
Date of decision: 20/02/2015