Commentary

IPP 1.5 – Organisations must provide a collection notice

In this case, VCAT held that IPP 1.5 is of no effect regarding personal information collected as part of a criminal investigation. This is because any obligation to provide notice under IPP 1.5 is inconsistent with Part 3.2 of the Criminal Procedure Act 2009 (Vic) (CPA), which consolidates disclosure obligations for prosecution of summary offences. Under Part 3.2 of the CPA, disclosure is not required in the investigation phase but only after charges are brought and only of information that is to be relied upon in a hearing. Section 6(1) of the Privacy and Data Protection Act (PDP Act) provides that CPA prevails and the IPPs have no force or effect to the extent of the inconsistency.
Other cases (such as Quick v Transport Accident Commission [2022] VCAT 622) have reached a similar outcome by different means, namely through interpretation of the ‘reasonable steps’ required for IPP 1.5. That is, it may be reasonable for an organisation to take no steps to provide a collection notice to an individual after collecting personal information about them indirectly (from a third party) in circumstances where doing so would jeopardise an investigation they are carrying out.

Victoria Police opened an investigation into Mr Walne, following complaints about him stalking, recklessly causing injury, and contravening Personal Safety Intervention Orders. As part of this investigation, Victoria Police requested the professional opinion of a psychologist, Dr Bennett.
Dr Bennett prepared a letter, and in it she formed the view that Mr Walne’s conduct met the classification of a stalker. Dr Bennett suggested that Victoria Police carry out further investigations (including contacting his previous employers, neighbours, municipal councils where he had lived, and his ex-wife) to ascertain any pattern of behaviour and whether Mr Walne had a mental health illness.
Victoria Police did so, collecting various information about Mr Walne, and then brining charges against him.

Both Victoria Police and Mr Walne contended that the information in Dr Bennett’s letter was personal and not health information. That is, that it was capable of being subject to a complaint under the Privacy and Data Protection Act 2014 (Vic.) (PDP Act) and not the Health Records Act 2000 (Vic.) (HR Act). This is because:
- Dr Bennett expressly denied making a diagnosis in the letter and only expressed a suspicion, not a medical opinion, about Mr Walne’s mental health illness; and
- Victoria Police is not a health service provider and was not providing a health service to Mr Walne.

VCAT held that the information was health and not personal information because:
- Dr Bennett was called upon in her capacity as a qualified psychologist to make an assessment of Mr Walne’s behaviour. This involved performing a desk-based assessment of Mr Walne’s mental state and likely possible future behaviour.
- The definition of health information in the HR Act did not require that the information conclude in a diagnosis or opinion, or that it is collected with a view to be applied for therapeutic treatment. Therefore, the fact that Dr Bennett did not reach a medical opinion or did not provide a health service to Mr Walne was irrelevant.
Accordingly, VCAT held that any information contained in Dr Bennett’s letter could not be subject to a complaint under the PDP Act and dismissed the complaint under s 77(1)(d) of the PDP Act. However, VCAT noted that because neither party agreed with this view and because the IPPs are so similar to the HPPs, VCAT went on to assess how the information may have been treated had it been a complaint under the PDP Act.

Mr Walne contended that the collection of his personal information by Victoria Police was excessive to manage a neighbourhood dispute, and therefore not necessary, contravening IPP 1.1.
Victoria Police contended that the collection of Mr Walne’s personal information was authorised by IPP 1.1 because it was necessary for its investigation into his potential criminal conduct. Mr Walne’s birth certificate was collected to ascertain the name of his ex-wife to try and contact her, and details from previous employers and municipal councils where he had lived collected to ascertain any previous complaints made about him.

VCAT held that the collection would have been authorised under IPP 1.1. The function or activity that Victoria Police was carrying out was its community policing function, which extended to managing ongoing disputes between neighbours. VCAT largely agreed with Victoria Police’s position about why the personal information was necessary to fulfil this function.

Mr Walne contended that Victoria Police interfered with IPP 1.5 because it did not provide him with any collection notice and he became aware that they had collected his personal information after they shared it with his solicitor pre-trial.
Victoria Police contended that there was no breach of IPP 1.5 on two separate grounds:
- First, that it was not reasonable or practicable to provide Mr Walne with a collection notice before collecting his personal information because doing so would have “the potential to frustrate or prejudice the ongoing criminal investigation” into him.
- Second, that IPP 1.5 does not apply because any obligation to provide notice under IPP 1.5 is inconsistent with Part 3.2 of the CPA, which consolidates disclosure obligations for prosecution of summary offences. Under Part 3.2 of the CPA, disclosure is not required in the investigation phase but only after charges are brought and only of information that is to be relied upon in a hearing. Section 6(1) of the PDP Act provides that CPA prevails and the IPPs have no force or effect to the extent of the inconsistency.

VCAT agreed with Victoria Police’s second argument, that IPP 1.5 is inconsistent with Part 3.2 of the CPA and therefore IPP 1.5 is of no effect regarding personal information collected as part of a criminal investigation.

Mr Walne contended that Dr Bennett’s letter contained inaccurate information (because it was based on historical events that were out of date) and incomplete information (because Victoria Police did not invite his wife to participate in the collation of information).
Victoria Police contended that the information in Dr Bennett’s letter was accurate and complete because it reflected her expert opinion based on material available at the time.

VCAT largely agreed with Victoria Police’s position, adding that IPP 3.1 does not prohibit an organisation from collecting and retaining historical material and the fact that information means historical events does not make it out of date.

Venue: VCAT

Date of decision: 02/04/2025

Tags: