Commentary
- This decision was based on the preceding legislation to the Privacy and Data Protection Act 2014 (Vic.) (PDP Act), the Information Privacy Act 2000 (Vic.) (IP Act).
S 118 – Attribution of actions by employees and agents
- This decision supports the assertion that agents acting on behalf of a Victorian public sector organisation (VPSO) will, if certain conditions are met, have the same or similar duties as the VPSO. This has a number of implications on the IPPs including characterising their purpose of collection as the same as a function or activity of the VPSO’s.
IPP 3.1 – Data quality
- One critique about this decision is VCAT’s statement that IPP 3.1 does not require an organisation to check the data integrity of personal information provided to it by a contractor before disclosing it to third parties. As IPP 3.1 requires ‘reasonable steps’ to be taken, what will be ‘reasonable’ in one set of circumstances may be unreasonable in another. Organisations should therefore be cautious about any interpretative value this statement holds.
Facts and decision
- Mr Mathews worked as a cleaner at the Gleneagles Secondary College (College) and made a Work Cover application under the Accident Compensation Act 1985 (Vic.) (ACA).
- There was some dispute about who his employer and relevant WorkSafe authorised agent was, some options included:
- the College, which was operated by the Department of Education and Early Childhood Development (Department) – and who had obtained WorkCover insurance through CGU Workers Compensation (CGU);
- the College’s School Council – who had obtained WorkCover insurance through Xchanging; or
- the Complainant was a contractor – in which case he would have been responsible for organising his own WorkCover insurance through an authorised agent.
- In any event, when Mr Matthews submitted a Worker’s Injury Claim Form (Form) to the College, on the Form he had listed the College as his employer.
- The College forwarded the Form to CGU for assessment. CGU engaged Probe Investigation to investigate and provide a Circumstance Investigation Report (Report). CGU then wrote to Mr Matthews rejecting his claim based on the Report.
- Mr Matthews then sent his Form to WorkSafe. WorkSafe forwarded the Form to Xchanging for assessment. Xchanging emailed CGU requesting a copy of the Report, which the CGU provided. Xchanging also subsequently wrote to Mr Matthews rejecting his claim.
IPP 1.1 – Collection must be necessary for organisation’s functions or activities
Submissions
- Mr Matthews contended that CGU had interfered with IPP 1.1 when it collected his personal information because the collection was not necessary. CGU could only assess claims made against the Department, but the Complainant contended he was employed by the College’s School’s Council with Xchanging being the relevant authorised agent who could assess claims made in respect of the College’s School Council.
- CGU argued that the collection was necessary because it had an obligation to assess any claims it received from the College, regardless of whether the Department or College’s School Council was the Complainant’s employer.
Decision
- VCAT held that the collection of Mr Matthews’ personal information was necessary for CGU to carry out its function of assessing worker cover claims.
- VCAT reasoned that as a matter of law, an agent stands in the shoes of its principal and has an obligation to carry out those duties of its principal.
- In this case, WorkSafe had an obligation under s 103(4G) of the ACA to assess all work cover claims, even those that are defective or irregular.
- WorkSafe had appointed CGU as its authorised agent, and, therefore, CGU’s functions were to assess claims it received, regardless of whether the Department was the employer.
IPP 1.2 – Method of collection must be lawful, fair, and not unreasonably intrusive
Submissions
- Mr Matthews contended that CGU interfered with IPP 1.2 when it unlawfully and unfairly held itself out as the College’s authorised WorkSafe agent when collecting his personal information.
Decision
- VCAT held that CGU had not interfered with IPP 1.2 when it collected his personal information. VCAT held that the College was not a separate legal entity from the Department and that any references by CGU’s employees to the College were references to the location where Mr Matthews had provided his cleaning services, rather than statements that could be found to amount to a misrepresentation about which employer CGU had a contract with.
IPP 2.1 – Use or disclosure is for the primary purpose of collection
Submissions and decision
- Mr Matthews contended that CGU interfered with IPP 2.1 when it used his personal information for the commercial purpose of rejecting his claim to keep its customer, the Department, satisfied.
- CGU contended and VCAT agreed that the use of the Mr Matthews’ personal information was for the primary purpose of collection, being to assess his claim in accordance with its obligations as an authorised agent of WorkSafe under the ACA.
IPP 3 .1 – Data quality
Submissions
- Mr Matthews contended that CGU interfered with IPP 3.1 when it disclosed the Report to Xchanging because the Report did not include a copy of the letter he had provided accompanying his Form (it’s unclear from the decision what value this letter had) and that the Report was inaccurate with respect to various sections of WorkSafe’s claim manual.
- CGU contended that to comply with IPP 3.1, it was only required to ensure that when it gave Xchanging a copy of the Report, the document it gave to Xchanging was an up-to-date copy of the Report.
Decision
- VCAT held that CGU had not interfered with IPP 3.1 because it would have been unreasonable for CGU to essentially replicate the investigative work done by Probe in order to ensure the data integrity of the Report.
About this decision
Venue: VCAT
Date of decision: 31/07/2014
Tags:
- IPP 1.1 ,
- IPP 1.2 ,
- IPP 2.1 ,
- IPP 3.1 ,
- Section 118