Tucker v State Revenue Office [2020] VCAT 53

Commentary

IPP 1.1 – Collection must be necessary for organisation’s functions or activities

• This decision follows other VCAT decisions such as Ng v Department of Education [2005] VCAT 1054 (see case note) and Jurecek v Director of Transport Safety Victoria [2016] VSC 285 (see case note) and Jurecek v Director Transport Safety Victoria [2015] VCAT 25 (see case note) in interpreting the word ‘necessity’ as being “reasonably required or legally ancillary to the accomplishment of the Department’s functions”.
• In this case, VCAT considered the witness testimony of the State Revenue Office’s employee as a critical account of the standardised employee recruitment process to establish if a new employee can legally work in Australia. By adopting this interpretation, VCAT determined that the collection of the information was reasonably required by the State Revenue Office in order to employ Mr Tucker.

IPP 1.3 – Organisation must provide collection notice

• This decision stands for the proposition that IPP 1.3 is limited to the point in time when collection occurs. In other words, it does not impose an obligation on organisations to notify individuals of every handling activity it performs with personal information it has already collected, after collection has already occurred. The obligation is to do so prior to the collection.
• Further, it illustrates what VCAT may consider relevant in determining whether an organisation has taken ‘reasonable steps’ to make an individual are aware of the matters in IPP 1.3. In this case, VCAT looked at:
  • the nature of the onboarding process;
  • the documents provided to an employee as part of any onboarding process; and
  • the discussions held as part of meetings an employee has, prior to commencing their employment, with the employer.
• This is consistent with decisions such as Harrison v Victorian Building Authority [2017] VCAT 108 (see case note) which determined that ‘reasonable steps’ would depend on the circumstances of each case.

IPP 2.1(e) – Use or disclosure is necessary to investigate or report unlawful activity

• In this decision VCAT followed the interpretation taken in McLean v Racing Victoria [2019] VSC 690 (see case note) and Zeqaj v Victoria Police [2018] VCAT 1773 (see case note) that the term ‘unlawful activity’ goes beyond statutory criminal conduct.

IPP 5.2 – Explanation of what personal information the organisation holds

• This decision is one of the few that considers the scope of IPP 5.2. It stands for the proposition that IPP 5.2 requires an organisation to inform individuals generally about the sort of personal information it holds. It does not require an organisation to carry out an inventory or audit of the personal information it holds or respond to requests about whether it holds specific personal information about individuals.
• This interpretation appears to be consistent with Office of the Victorian Information Commissioner’s (OVIC) Guidelines, where OVIC takes the view that “IPP 5.2 does not require an organisation to inform individuals about what information is specifically held about them. Requests for access to personal information are governed by IPP 6 and the Freedom of Information Act 1982 (Vic.). For IPP 5.1, it is sufficient to give information about the sort of information held, its purposes, and how it is collected, held, used and disclosed. IPP 5.2 should be seen as a requirement for a further, more detailed level of information beyond the minimum required in an IPP 5.1 privacy policy.”

Facts and decision

• Mr Tucker was employed by the State Revenue Office as a solicitor and senior solicitor for a period of 8 years.
• During Mr Tucker’s employment, there were two allegations of misconduct brought against him. One relating to misconduct towards another employee and the other that he used the State Revenue Office’s system to access records belonging to taxpayers without authorisation.
• The State Revenue Office appointed an investigator to investigate these allegations and disclosed to the investigator Mr Tucker’s mobile phone number and birth certificate.

IPP 1.1 – Collection must be necessary for organisation’s functions or activities

Submissions

• Mr Tucker alleged that the State Revenue Office interfered with IPP 1.1 when it collected his birth certificate because the State Revenue Office could have collected other forms of identification, such as a passport or citizenship certificate.
• The State Revenue Office contended that it did not interfere with IPP 1.1 because the collection of a document that established an employee’s right to work in Australia was necessary as part of its function as an employer, and that employees could choose the type of document they provided.

Decision

• VCAT held that there was no breach of IPP 1.1 because the collection of the personal information was reasonably required or legally ancillary for the State Revenue Office’s functions and activities as an employer to manage its workforce.
• VCAT also stated that the collection of different identity documents would not have changed its position on necessity as they were aimed at achieving the same function – verifying identity.

IPP 1.2 – Method of collection must be lawful, fair, and not unreasonably intrusive

Submissions

• Mr Tucker alleged that the State Revenue Office interfered with IPP 1.2 when it collected his birth certificate because they did so without his knowledge or consent.
• The State Revenue Office produced evidence to contend that it did not interfere with IPP 1.2 because Mr Tucker willingly provided his birth certificate as part of the onboarding process before his employment.

Decision

• VCAT held that there was no breach of IPP 1.2 as the evidence led by the State Revenue Office indicated that Mr Tucker had willingly provided his birth certificate to the State Revenue Office, who photocopied it and put it in his personnel file. Further, Mr Tucker was also provided a choice as to the kind of documentation he might supply.

IPP 1.3 – Organisation must provide collection notice

Submissions

• Mr Tucker alleged that the State Revenue Office interfered with IPP 1.3 because it did not make him aware that it had disclosed his mobile phone number and birth certificate to the investigator.
• The State Revenue Office contended that it did not interfere with IPP 1.3 because Mr Tucker was subject to workplace policies and responsibilities during his employment meaning he would be on notice of the reasons for collection of the information and the issues required by IPP 1.3.

Decision

• VCAT held that there was no breach as the State Revenue Office had taken reasonable steps to make Mr Tucker aware of the matters listed in IPP 1.3. These steps included: the nature of the onboarding process, the employment agreements, and the meetings that Mr Tucker had with the State Revenue Office prior to the commencement.
• In respect of Mr Tucker’s position, VCAT noted that IPP 1.3 is limited to the point in time when collection occurs. In other words, there was no obligation in IPP 1.3 for the State Revenue Office to notify Mr Tucker of every handling activity it performed with personal information it had already collected, after collection had already occurred. The obligation was to do so prior to the collection.

IPP 2.1 – Use and disclosure

Submissions

• Mr Tucker alleged that the Respondent interfered with IPP 2.1 when it disclosed his mobile phone number and birth certificate to the investigators because he did not consent to the disclosure, nor was it disclosed for a primary or permitted secondary purpose.
• In relation to the birth certificate, Mr Tucker argued that given no misconduct was found, the investigation was based on a false allegation and thus did not provide proper reason for the State Revenue Office to disclose his birth certificate. Further Mr Tucker contended that because none of the taxpayers whose records he was alleged to have accessed had lodged any complaint, there were no grounds for the State Revenue Office to investigate him.
• In relation to the phone number, Mr Tucker submitted that because he had engaged legal counsel to represent him regarding the investigation, there would need to be exceptional circumstances present for him to be contacted directly, as per Rule 33 of the Legal Profession Uniform Law Australian Solicitors Conduct Rules 2015 (LPUL).
• The State Revenue Office contended that the disclosure was authorised under:
  • IPP 2.1 – The personal information was collected for the primary purpose of employment and both disclosures were also carried out for the purpose of employment, therefore consistent with the primary purpose.
  • IPP 2.1(a) – The secondary purpose was carrying out an investigation into complaints raised against an employee and ensuring that the public sector workforce is operating in accordance with the Victorian Public Sector Code of Conduct (the Code). This secondary purpose was reasonably expected because it was directly related to the primary purpose of employment.
  • IPP 2.1(e) – The State Revenue Office suspected that Mr Tucker had used their system to access records belonging to taxpayers without authorisation, which was unlawful under s 61 of the Public Administration Act 2004 (Vic.)).

Decision

• VCAT held that the disclosure was authorised under IPP 2.1(a) because:
  • Secondary purpose —The primary purpose of collecting the birth certificate was proof of residency. The State Revenue Office disclosed the birth certificate to the investigator so that they could identify Mr Tucker’s father and determine whether he had used the State Revenue Office’s systems to access records belonging to the father.
  • Related — The secondary purpose was related to the primary purpose because it was within the context of a workplace investigation and related to Mr Tucker’s ongoing status as an employee.
  • Reasonably expected — Any employee under investigation for workplace misconduct ought to reasonably expect that all relevant personal information on their personnel file may be made available to an investigator.
• VCAT also held that the disclosure was authorised under IPP 2.1(e), largely agreeing with the State Revenue Office’s position.
• In relation to Mr Tucker’s position:
  • VCAT disagreed that the LPUL was applicable as the investigator was not a legal practitioner and therefore not bound to conduct themselves in accordance with the LPUL. VCAT also noted that the mobile phone number was collected for the purpose of contacting Mr Tucker about work-related matters when he was not at work and this was the purpose that it was disclosed to the investigator for.
  • VCAT held that just because no taxpayer had complained did not make the investigation unnecessary, employers having an obligation to investigate regardless of the source of the allegations.

IPP 5.2 – Explanation of what personal information the organisation holds

Submissions

• Mr Tucker alleged that the State Revenue Office interfered with IPP 5.1 when it did not provide a detailed list of the personal information it held regarding him following multiple requests he made for the information.

Decision

• VCAT held that there was no breach of IPP 5.1 as the State Revenue Office provided the Mr Tucker a letter which explained what personal information they held about him.
• VCAT noted that the obligation in IPP 5.1 is to take reasonable steps to inform an individual generally of the sort of personal information held and did not require an organisation to carry out an inventory of audit of the personal information it held. Mr Tucker’s requests for very specific information was therefore in excess of what IPP 5.1 required the State Revenue Office to do.