Commentary
- This decision confirms that in order to receive a remedy under s 77(1)(a)(ii) or s 77(1)(a)(iii) of the Privacy and Data Protection Act 2014 (Vic.) (PDP Act) then a complainant must establish:
- causation – that the interference of privacy caused the loss or damage that they suffered and are seeking compensation for; and
- remoteness – that the loss or damage that they suffered is not too remote from the interference of privacy and that is appropriate for the respondent to be held liable.
Facts and decision
- In the early 2000s, Mr Smeaton made a request for access under the Freedom of Information Act 1982 (Vic.) (FOI Act) on behalf of his wife, Ms Smeaton, to her WorkSafe file.
- A lengthy litigation history ensued with multiple FOI requests and FOI complaints to OVIC and VCAT made by Mr Smeaton.
- Sometime later, Mr Smeaton discovered that the file he had been provided with was not a complete copy of Ms Smeaton’s WorkSafe file because WorkSafe had a number of technical and administrative issues resulting in emails relating to Ms Smeaton’s WorkSafe matter not being saved to her file or being lost.
- In 2016, Ms Smeaton made a privacy complaint on behalf of Ms Smeaton contending that these technical and administrative issues amounted to an interference with IPP 3.1 (data quality) and IPP 4.1 (data security).
- The privacy complaint was stayed for a number of years for a number of reasons, including applications that Mr and Ms Smeaton be declared vexatious litigants.
- Eventually, the privacy complaint progressed to a summary hearing and WorkSafe requested that it be summarily dismissed, which VCAT agreed with and ordered. This case note primarily deals with VCAT’s comments on compensation under the PDP Act. It’s important to note that the comments VCAT made where in the process of it considering whether there was a reasonable case to be tried (at trial) and not a definitive decision at trial considering all of the submissions and evidence put forward by the parties.
S 77(1)(a)(ii) – Order that the respondent perform or carry out any reasonable act or course of conduct to redress any loss or damage suffered by the complainant
Submissions
- Mr Smeaton sought that WorkSafe:
- confirm that Ms Smeaton’s personal information was intact on WorkSafe’s backup system;
- store any emails that it held containing Ms Smeaton’s personal information on Ms Smeaton’s WorkSafe file; and
- provide a complete list of documents it held containing Ms Smeaton’s WorkSafe matter, to OVIC.
- WorkSafe contended that these outcomes did not fall within VCAT’s jurisdiction because Mr Smeaton had not explained how those outcomes would address any loss or damage Ms Smeaton had suffered as a result of WorkSafe failing to save or backup emails.
Decision
- VCAT expressed doubt that it had the power to award the outcomes that Mr Smeaton was seeking for several reasons:
- VCAT looked at the wording in s 77(1)(a)(ii) of the PDP Act and noted that it required the reasonable act or course of conduct (in this case the three outcomes Mr Smeaton was seeking) to “redress any loss or damage suffered by the complainant.” VCAT agreed with WorkSafe that Mr Smeaton had not explained what the loss or damage was nor how the outcomes would seek to address it.
- VCAT did infer that one of the loss or damages Mr Smeaton was seeking to readdress was the multiple failed FOI complaints (some of which hinged on the lost personal information). However, VCAT felt that if this was the case, it would amount to an abuse of process, as Mr Smeaton was essentially trying to redress failures under another legislation scheme (the FOI Act) through the PDP Act.
S 77(1)(a)(iii) – Order that the complainant is entitled to a specified amount, not exceeding $100,000, by way of compensation for any loss or damage suffered by the complainant
Submissions
- Mr Smeaton sought $100,000 in financial compensation for time and money lost in having to make 66 FOI complaints over the years to VCAT in respect of Ms Smeaton’s personal information which WorkSafe had failed to keep accurate and lost.
- WorkSafe contended that the asserted loss was actually a claim for costs against WorkSafe in relation to failed FOI complaints and was therefore inappropriate.
Decision
- VCAT expressed doubt that it could award the amount of compensation for the loss that Mr Smeaton was seeking for several reasons:
- VCAT agreed with WorkSafe that what Mr Smeaton was seeking was essentially an adverse cost order against WorkSafe relating to the failed FOI complaints. VCAT held that it was inappropriate to make this order as part of a privacy complaint given it was trying to redress a failure under another legislation scheme (the FOI Act).
- VCAT was not satisfied that Mr Smeaton, at trial, would be able to establish causation:
- causation – VCAT held that Mr Smeaton might be able to demonstrate that WorkSafe’s failure to save and backup Ms Smeaton’s personal information resulted in the multiple failed FOI complaints which Mr Smeaton incurred considerable expenditure in pursuing;
- remoteness – VCAT held that Mr Smeaton’s own actions in pursuing the number of FOI complaints likely contributed to the expenditure he incurred and was therefore inappropriate to award compensation for.