Polkinghorne v Warrnambool City Council [2018] VCAT 171

Commentary

s 13 / s 17 – Entities subject to the PDP Act / effect of outsourcing

  • This decision does not explain why Warrnambool City Council (Council), as opposed to its contracted service provider, is the respondent, as there is no analysis and application of s 13 or s 17 of the Privacy and Data Protection Act 2014 (Vic.) (PDP Act). We assume that the outsourcing arrangement did not include a clause to the effect of s 17(4) of the PDP Act and that is why the Council was the treated as the respondent.

IPP 1.2 – Method of collection must be lawful, fair, and not unreasonably intrusive

  • This decision is useful on the interpretation of IPP 1.2 because it suggests that one factor VCAT will consider about whether a collection is ‘unfair’ is whether the respondent has informed Mr Polkinghorne about their role and process associated with collecting the personal information.

IPP 2.1 – Use or disclosure must be for the primary purpose of collection

  • This decision provides little interpretative guidance on IPP 2.1 because the reasons often do not provide substantive analysis of IPP 2.1. For example, VCAT did not consider the distinction between a ‘use’ or ‘disclosure’ of personal information, or any implications (if any) of such a distinction, and did not extrapolate when and where something is ‘reasonably expected’ and why.

Facts and decision

  • Mr Polkinghorne was a volunteer at Council and made a complaint which prompted Council to hire Atwork Consulting to investigate and prepare a report (Report).
  • As part of investigating the complaint, Atwork Consulting interviewed Mr Polkinghorne and collected his personal information which was then included in the Report. Atwork Consulting then sent the Report to Council’s Chief Executive Officer (CEO) marked “confidential – not for circulation”.
  • Mr Polkinghorne asked the CEO for a copy of the Report, the CEO forwarded the Report to his Executive Assistant to send to Mr Polkinghorne (which she did).
  • Later, Mr Polkinghorne raised a complaint about Council to the Victorian Commissioner for Equal Opportunity and Human Rights (VEOHRC). In responding to this complaint, the CEO provided a copy of the report to Council’s Manager for Risk and Governance.

IPP 1.2 – Method of collection must be lawful, fair, and not unreasonably intrusive

Submissions

  • Mr Polkinghorne alleged that Council interfered with IPP 1.2 when Atwork Consulting collected his personal information because Atwork Consulting mislead Mr Polkinghorne by giving him the impression that they were independent, whereas they were really acting in the interests of Council’s. Mr Polkinghorne highlighted that in the Report, Atwork Consulting used phrases like “support the Council” and did not interview anyone else relating to the complaint.
  • Council contended that it had not interfered with IPP 1.2 because the personal information was collected lawfully by Atwork Consulting for the purpose of investigating the complaint.

Decision

  • VCAT held that there was no breach of IPP 1.2.
  • VCAT was of the view that the collection was fair because there was no “trickery, deception or duress” used by Atwork Consulting when collecting the personal information, in particular, VCAT noted:
    • Atwork Consulting provided valid reasons for why they used certain phrases like “support the Council” which did not suggest any bias; and
    • Prior to the interview, Atwork Consulting had informed Mr Polkinghorne of the process and role they played in the investigation.
  • VCAT was also of the view that the collection was lawful because Atwork Consulting was hired by Council to investigate and provide a Report in the normal course of the Council’s business.

IPP 1.3 – Organisation must provide a collection notice

Submissions and decision

  • Mr Polkinghorne alleged that Council interfered with IPP 1.3(d) because it had not advised him that it would share the Report with the Executive Assistant and Manager for Risk and Governance.
  • Council contended that there had been no interference with IPP 1.3(d) because IPP 1.3(d) required them to inform Mr Polkinghorne of any external third parties they would be disclosing the personal information to, the Executive Assistant and Manager for Risk and Governance both being internal employees.
  • VCAT held that there had not been an interference with IPP 1.3(d) largely agreeing with Council’s position.

IPP 2.1 – Use or disclosure must be for the primary purpose of collection

Submissions

  • Mr Polkinghorne alleged that Council interfered with IPP 2.1 when it disclosed his personal information in the Report to the Executive Assistant and the Manager for Risk and Governance. To support his position, Mr Polkinghorne highlighted that neither of those individuals was listed as a person who had a copy of the Report and the Report was marked “confidential – not for circulation.”
  • Council contended that sharing the Report was authorised as follows:
    • Sharing to the Executive Assistant – under IPP 2.1 being the primary purpose of investigating the complaint and facilitating sharing the Report with Mr Polkinghorne.
    • Sharing to the Manager for Risk and Governance – under IPP 2.1(a) the secondary purpose being representing Council in a complaint at VEOHRC which was related and reasonably expected given the substantial overlap between Mr Polkinghorne’s initial complaint to Council and the complaint at VEOHRC and the Manager for Risk and Governance’s role with such issues.

Decision

  • VCAT held that there was no interference with IPP 2.1. The reasons VCAT provided are hard to disentangle from its reasons relating to the other allegations. However, it appears that VCAT largely agreed with the Council’s position stating that in its view of the circumstances it was “reasonable and appropriate” for both the EA and Manager for Risk and Governance to have access to the Report.

About this decision

Venue: VCAT
Date of decision: 06/03/2018