Roberts v Anglicare Victoria [2014] VCAT 1515

Commentary

IPP 1.1 – Collection must be necessary for organisation’s functions or activities

  • This decision follows other VCAT decisions (such as Ng v Department of Education [2005] VCAT 1054 (see case note) and WOS v Victoria Police [2021] VCAT 1540 (see case note) in interpreting the word “purpose” as being synonymous with “the intent [with] which personal information was collected.”
  • It also confirms that this is a subjective enquiry into the motive underlying the collection, rather than an objective enquiry into the effect that the collection would have had.
  • In adopting this interpretation, VCAT considered the witness testimony of Anglicare Victoria’s employee as critical to characterising the primary purpose of collection, given that she took it upon herself to collect the personal information on behalf of the Respondent.
  • However, this interpretation can also be contrasted to other decisions, such as SET v Department of Health and Human Services [2019] VCAT 113 (see case note) which have looked at the organisation’s statutory functions and enabling legislation to determine primary purpose.

IPP 2.1 – Use or disclosure must be for the primary purpose of collection

  • This decision demonstrates that the primary purpose of collection for IPP 2.1 is the primary purpose that the personal information was originally collected by the organisation under IPP 1.1. This will be different for different organisations, even if they share the same personal information between themselves. This is because organisations will handle that personal information for different functions or activities and may have different legislative authorisations or requirements to collect, use and disclose it. Therefore, it doesn’t follow that just because organisation 1 collected personal information for purpose 1 and subsequently discloses it to organisation 2, that organisation 2’s primary purpose is the same as organisation’s 1.

IPP 4.1 – Data security

  • In this decision, VCAT held that there was no interference with IPP 4.1 because it was not convinced that there could be an ‘unauthorised disclosure’ where there was no interference with IPP 2.1. This interpretation is inconsistent with interpretations adopted by both Office of the Victorian Information Commissioner (OVIC) and the Office of the Australian Information Commissioner (OAIC) which suggest that the focus of IPP 4.1 (or APP 11.1 as similar to IPP 4.1) is on whether an organisation has taken reasonable steps to prevent unauthorised disclosure and, that an unauthorised disclosure does not have to occur for an interference with IPP 4.1 to be demonstrated.
  • See OVIC’s IPP Guidelines paragraph 4.7. Similarly, see ZN and a School [2021] AICmr 95 at paragraph 93-94 where the OAIC states: “The question is whether the respondent failed to take reasonable steps in all the circumstances to protect personal information from a security risk…. merely because the complainant has not identified that their personal information has been the subject of a security risk does not necessarily mean that the AAPP entity has complied with APP 11.”

Remedies

  • This decision affirms that VCAT has jurisdiction to award that a respondent must reimburse a complainant for expenses reasonably incurred by the complainant in connection with the making of a complaint (either before OVIC or VCAT), irrespective of whether the complainant is successful in demonstrating that the respondent has interfered with their privacy. However, it provides little further guidance on what circumstances VCAT will be prepared to do this and what factors it will consider when making such an award.

Facts and decisions

  • In 1994, the Mr and Mrs Robertson were granted joint custody and guardianship of a 10-month-old boy under a Permanent Care Order (PCO). This boy grew up in their care and was considered their son for all intents and purposes.
  • The Robertsons were contacted via telephone by their son’s biological half-brother. The half-brother had obtained the Robertsons’ contact details after a staff member of Anglicare Victoria collected them from the Department of Human Services (Department), which they then provided to the half-brother.
  • After having contact with the half-brother, the son went down what VCAT described as a “negative life path” by becoming involved with drugs, leaving his family home, sustaining an injury and developing a mental illness.

IPP 2.1 – Use or disclosure must be for the primary purpose of collection

Submissions

  • The Robertsons alleged that the Anglicare Victoria interfered with IPP 2.1 when it disclosed their names and residential address to the half-brother. They contended that the primary purpose that Anglicare Victoria collected their personal information was the same as the Department (being to facilitate the adoption of the son) and this was not the purpose that the personal information was disclosed to the half-brother (being to facilitate his contact with his family).
  • Anglicare Victoria contended that it did not interfere with IPP 2.1 because the personal information was collected for a different primary purpose, namely, providing contact details to the half-brother to allow him to contact the son after identifying it would be beneficial for the half-brother to have a connection to his family.

Decision

  • VCAT held that there was no breach of IPP 2.1 because it was disclosed for the primary purpose for which it was collected by Anglicare Victoria.
  • VCAT looked at the subjective underlying motives of Anglicare Victoria when collecting the personal information by reference to Anglicare Victoria’s employee who had collected the Robertsons’ personal information from the Department. On this basis, VCAT characterised the primary purpose of collection as facilitating the half-brother’s contact with his family, namely the son, after that employee identified it would be beneficial for the half-brother to have a connection to his family.
  • VCAT rejected the Robertsons’ position that the Department’s primary purpose of collection should be extended to Anglicare Victoria, primarily for two reasons:
    • departmental portfolios commonly comprise of distinct business units and generally these entities will be treated as separate organisations under s 13 of the PDP Act; and
    • these organisations will have different functions or activities, especially where they are subject to a specific statutory or other authority to collect personal information.
  • During trial, the Robertsons’ counsel also questioned Anglicare Victoria’s employee in an attempt to indicate the inappropriateness of the disclosure and that it had been mismanaged. VCAT held that the manner of disclosure does not necessarily inform what the primary purpose of collection was.

IPP 4.1 – Data security

Submissions

  • The Robertsons alleged that Anglicare Victoria interfered with IPP 4.1 when it allowed the unauthorised disclosure of their personal information to the half-brother because:
    • even if Anglicare Victoria was authorised to collect the personal information for a particular service, that authorisation did not extend to the disclosure of the information to a child or client, in particular to the half-brother who was not even an employee of Anglicare Victoria; and
    • Anglicare Victoria’s Storage, Protection and Backup of Client Data Policy did not explain entities that the Anglicare Victoria’s employees were/not authorised to disclose personal information to, which it should have given the gravity of harm if a security breach occurs.
  • Anglicare Victoria contended that it did not interfere with IPP 4.1 because there can be no breach if a breach of IPP 2.1 is not established.

Decision

  • VCAT held that there was no breach of IPP 4.1 because it was not convinced that there could be an ‘unauthorised disclosure’ where there was no breach of IPP 2.1.

Remedies

Reimbursement or expenses incurred in making a privacy complaint

  • Although unsuccessful in demonstrating an interference of privacy, the Robertsons sought reimbursement for a number of expenses under s 77(1)(d) of the Privacy and Data Protection Act 2014 (Vic.) (PDP Act). These included: taxis and other costs associated with attempting to locate the son, the cost of installing an alarm system at their house, and counselling for the son.
  • VCAT held that this provision does entitle a complainant to seek reimbursement of expenses reasonably incurred by them in connection with making a privacy complaint, irrespective of whether an interference of privacy has been proven, given the wording ‘in any case’ at the start of the subparagraph.
  • However, VCAT did not make a decision on this point in this case. It allowed the parties the opportunity to either put forward their positions at a separate hearing or for the matter to be determined at a later date on the basis of written submissions. We have not been able to locate these, if they exist.
  • VCAT then noted that it was cynical about whether it could award the type of reimbursement being sought by the Robertsons. This was because the expenses did not appear to have been incurred by the Robertsons in connection with making the complaint. That is, they appeared to have been made prior to the making of the complaint itself.

Non-economic loss

  • The Robertsons also sought financial compensation for the son going down a negative life path as a result of the half-brother making contact with him.
  • VCAT held that even if Anglicare Victoria had managed the disclosure more appropriately (such as by only disclosing the son’s name and the suburb he lived in) or carefully managing the contact between the son and half-brother, it was likely that the same consequences would have resulted once the son and half-brother made contact anyway. Accordingly, it would have been likely, had an interference been established, that any compensation for non-economic loss would have been limited to the distress the Robertsons experienced when the half-brother made contact with them, and not for the subsequent consequences to the son.

About this decision

Venue: VCAT
Date of decision: 25/11/2014