Jurecek v Director, Transport Safety Victoria [2016] VSC 285

Commentary

  • This decision was based on the preceding legislation to the Privacy and Data Protection Act 2014 (Vic.) (PDP Act), the Information Privacy Act 2000 (Vic.) (IP Act).
  • This decision is an appeal from the Victorian Civil and Administrative Tribunal (VCAT), see Jurecek v Director, Transport Safety Victoria [2015] VCAT 253 (see case note). It’s important to note that the VSC was limited only to considerations of whether VCAT had erred in law. In other words, the VSC did not re-hear or review the factual basis of VCAT’s decision.

Human rights and beneficial interpretation

  • In this decision, the VSC ruled that where the IPPs adopt qualitative standards (such as reasonableness, fairness, necessity and practicability), these should be interpreted in line with international human rights law. This is because the IP Act and the Information Privacy Principles “were intended to give effect in a particular context to the right to privacy stipulated in art 17 of the [International Covenant on Civil and Political Rights], and reasonable proportionality is a central component of that right, it informs the interpretation and application of those Principles.”
  • Reasonable proportionality is a well established legal test in the context of human rights. It requires any limitations on human rights to:
    • have a legitimate objective, of sufficient importance to warrant limiting the right;
    • be necessary in order to achieve that objective; and
    • be proportionate, in that there is fair balance between the public interest in achieving the legitimate objective and the limitation on the right.
  • This approach has also ben followed by the Office of the Australian Information Commissioner (OAIC), see paragraph 59 of the Commissioner initiated investigation into 7-Eleven Stores Pty Ltd decision, where the OAIC adopted the test of ‘reasonably proportionality’ to evaluate whether the collection of personal information was ‘necessary’.

s 12 – Exemption for publicly available information

Whether the exemption applies to both documents and the information itself

  • Section 12(1) of the PDP Act exempts from the operation of the PDP Act “any information contained in a document that is (a) a generally available publication”. The equivalent of that section in the IP Act was s 11, which stated that: “Nothing in this Act or in any IPP applies to a document containing personal information, or to the personal information contained in a document, that is – (a) a generally available publication.”
  • In CT v Medical Practitioners Board of Victoria [2005] VCAT 1801 (see case note), VCAT held that the exemption in s 11 of the IP Act only applied to documents not to information within those documents. Accordingly, in that case VCAT held that a letter that the Respondent sent was not subject to the exemption because it was not a document that was generally publicly available. Even though the information within the letter (that the Complainant was to attend a formal hearing regarding their medical license) was generally publicly available.
  • In this decision, the VSC considered and overturned that interpretation, holding that the exemption applied to both documents and information contained in a document that is a generally available publication. As a result, the VSC held that the exemption could apply to both the Facebook posts (as documents) as well as the information contained within the Facebook posts (even when that information is recorded in different documents that themselves may not be generally available publications, such as screenshots collected in the course of the investigation).
  • Ultimately however, the VSC found that the exemption did not apply on the basis that the posts did not amount to generally available publications.
  • S 11 of the IP Act has been amended in the PDP Act, substituting the phrase “a document containing personal information, or to the personal information contained in a document” with “any information contained in a document”. In our view, this amendment strengthens the argument put by the VSC that if information appears in a generally available publication, it will no longer be subject to the PDP Act – even if reproduced in non-public documents.

When will something be considered a generally available publication

  • The VSC affirmed VCAT’s finding that the mere fact that information might be accessible by anybody does not mean that the information is a generally available publication.
  • Whether information amounts to a generally available publication will depend on:
    • the nature of the information;
    • the prominence of the location;
    • the likelihood of access; and
    • the steps needed to obtain the access.
  • This is an important finding and may be relevant where an organisation proposes to conduct web scraping or scanning of publicly available information.

IPP 1.1 – Collection must be necessary for organisation’s functions or activities

  • The VSC decision affirms that the word ‘necessary’ should be interpreted to mean “reasonably appropriate and adapted” and not “essential or indispensable.” When applying this to a set of facts, the application should be balanced against interfering with the capacity of government organisations to effectively pursue their functions on the one hand, and the individual’s right to privacy on the other.

IPP 1.3 – Organisation must provide collection notice

What constitutes ‘reasonable steps’

  • The VSC decision affirms that whether an organisation has taken ‘reasonable steps’ to make an individual aware of the items in IPP 1.3 is an objective test. It depends upon the circumstances and cannot be discharged by an organisation making a presumption or assumption as to the individual’s knowledge.
  • However, in certain circumstances, there may not be any ‘reasonable steps’ that an organisation can take. For example, where an item in IPP 1.3 is not relevant.

Temporal element of when notice needs to be provided

  • The VCAT decision (see Jurecek v Director, Transport Safety Victoria [2015] VCAT 253 (see case note) suggested that where an organisation is carrying out an employee misconduct investigation, it may be permissible to postpone the provision of notice where this would jeopardise the investigation.
  • This VSC decision sets out a number of factors when determining whether an organisation has taken reasonable steps ‘as soon as practicable after’ collection:

Facts

  • Ms Jurecek was employed by the Secretary of the Department of Transport, but was seconded to assist the Office of the Director of Transport Safety (we will just refer to this as the DTSV).
  • Ms Jurecek made several posts and chats on Facebook in connection with her employment in April and September 2012. These included:
    • April – exchanging a series of chat messages with her workplace colleague (PF) on Facebook discussing the suspension of another work colleague.
    • September – making a series of posts in reply to PF’s post. PF had made a post on her Facebook requesting her friends to refrain from making comments regarding a murder that was receiving publicity at the time.
  • PF found that the last reply Ms Jurecek made to her Facebook post was abusive and decided to take screenshots of the September posts, unfriend Ms Jurecek from Facebook, and report the Ms Jurecek’s conduct (by providing the screenshots) to the DTSV.
  • The DTSV investigated and gained access to Ms Jurecek’s Facebook through another workplace colleague’s (AP) Facebook.
  • The DTSV then collected information from Ms Jurecek’s Facebook and shared this with a linguistic expert who they had engaged to determine whether the last September 2012 reply was written by Ms Jurecek or her partner (Ms Jurecek alleged her partner wrote it using her Facebook).
  • The DTSV subsequently served a Notice of Investigation on Ms Jurecek in accordance with the Victorian Public Service Workplace Determination where it made Ms Jurecek aware of their investigation and that they suspected her of having engaged in serious misconduct. Following the investigation, the DTSV issued Ms Jurecek with a final warning.

Submissions and decision

Personal information

Submissions
  • DTSV contended that VCAT erred in law when finding three posts to contain personal information, as these posts were not expressions of Ms Jurecek’s opinion or otherwise information about her.
  • In her evidence, Ms Jurecek underlined several words in these posts and contended that these amounted to personal information.
Decision
  • The VSC affirmed that the information in the posts was personal information. This was because it amounted to Ms Jurecek’s opinion in relation to various subjects, as well as being on the subject of and concerning her own opinion.
  • The VSC also noted that the words of Ms Jurecek should be read as a whole, it discouraged an interpretative approach (as adopted by Ms Jurecek when highlighting specific words/phrases in the posts) of essentially redacting the non-personal parts of the posts word by word.
  • In doing so, the VSC adopted a wide approach to interpreting ‘personal information’. It stated that the “intention is that, at least in most cases, debate about the scope of protection of personal information under the [IP Act] is preferably to be determined not at the level of whether information is personal but at the level of the operation of the exemptions.”

s 12- Exemption for publicly available information

VSC (appeal – ground 1)

Submissions
  • DTSV contended that VCAT had erred in law as some of the personal information was accessible by most members of the public, this being: Ms Jurecek’s Facebook page, her pseudonym, and her friendship with AP. This is because:
    • the security settings that PF had attempted to apply did not work as people who were not her Facebook friends could still access her Facebook and accordingly the posts relating to September 2012; and
    • two of the DTSV’s investigators were able to find the Ms Jurecek’s Facebook by searching for her real name on Google, which came up with a Facebook guestbook that showed her real name against the pseudonym.
Decision
  • The VSC affirmed VCAT’s decision that the personal information was not subject to the exemption, noting:
    • Although PF’s security settings had not worked, there were other factors that VCAT had highlighted to indicate that not just any member of the public could access the personal information. This included the steps Ms Jurecek had taken to protect her personal information.
    • The evidence of the two investigators suggested that they needed to have knowledge both that a pseudonym was being used and that that pseudonym was Facebook friends with AP in order to gain access to Ms Jurecek’s Facebook.
    • Further, just because some of the Facebook users could access the personal information did not automatically mean that it was generally available.
  • The VSC then set out some factors it considered relevant to whether information is generally publicly available (but it did not apply these to the facts in question):

VSC (appeal – ground 2)

Submissions
  • DTSV also contended that VCAT erred in law as it had not considered that the exemption also applied to personal information (the information within the downloaded screenshots AP took of the Facebook chats and posts), not just documents containing personal information (the Facebook chats and posts themselves on Facebook).
  • Ms Jurecek contended that the exemption only applied to documents, rather than personal information, citing CT v Medical Practitioners Board of Victoria [2005] VCAT 1810 (see case note) as support for this proposition.
Decision
  • The VSC agreed with the DTSV, holding that as a matter of statutory interpretation the exemption applied both to documents and personal information that is generally publicly available.
  • The VSC stated that s 11 of the IP Act: “…clearly stipulates that the exemption applies not only to a document containing personal information that is a generally available publication; it stipulates that the exemption also applies to personal information that is contained in a document that is a generally available publication.”
  • However, the VSC did not feel that this changed the outcome of VCAT’s decision, because the documents on Facebook were not found to be subject to the exemption so this could not extend to the personal information within those documents.

IPP 1.1 – Collection must be necessary for organisation’s functions or activities

Submissions and decision
  • Ms Jurecek alleged that VCAT erred in law by taking an interpretation of the word ‘necessary’ that imposed too low of a threshold.
  • The VSC affirmed VCAT’s decision, being of the view that VCAT’s interpretation was consistent with Gleeson CJ’s judgement in Mulholland v Australian Electoral Commission [2004] HCA 41 where ‘necessary’ was interpreted as “reasonably appropriate and adapted” and not “essential or indispensable”.
  • The VSC also highlighted several other points in respect of interpreting ‘necessary’:
    • the principle is intended to ensure that information collection by organisations is purposive and not an end in itself;
    • to interpret the word broadly would alter the proper balance between privacy protection and the conduct of public administration; and
    • to interpret the word too narrowly would restrain the reasonable performance of the conduct of public administration and interfere with the capacity of government organisations to effectively pursue their functions.

IPP 1.3 – Collection notice

Submissions and decision
  • VSC affirmed VCAT’s decision:
    • Reasonable steps
      • Ms Jurecek contended that VCAT had erred in law by applying a subjective test by looking at the knowledge of Ms Jurecek in determining what matters listed in IPP 1.3 the DTSV was required to make her aware of, rather than an objective test.
      • The VSC held that whether ‘reasonable steps’ have been taken is an objective test that depends upon the circumstances. It cannot be discharged by the organisation making a presumption or assumption of the individual’s knowledge.
      • The VSC felt that VCAT was not suggesting otherwise and did not approach the matter on a subjective basis. Rather, VCAT had considered all relevant factors including that Ms Jurecek was an employee of the DTSV.
    • Temporal element
      • The VSC held that the concept of what is ‘reasonable’ attempts to balance the protection of the individual’s privacy with the purpose of the collection.
      • The VSC then set out a number of considerations (which it did not apply to the facts), these included the:
        • nature of the information;
        • what is at stake for the individual;
        • degree of interference; and
        • public interest being served by the collection.
      • The VSC concluded that in this case, it was open to VCAT to decide that it was practicable for the DTSV to delay notification.

About this decision

Venue: VSC
Date of decision: 11/10/2016