Charles Darwin University Summary

Breach details – Transcript of (C2009/10319)

Who was involved in the suspected breach?

s.365 - Application to deal with contraventions involving dismissal (C2009/10319) [matter type]
Mr Brett Jeffrey Reynolds (Applicant)
Veolia Environment Services (Australia) Pty Ltd (Respondent)

When did the suspected breach occur?

4 July 2022 (approx). This is the date the transcripts were ingested to Document Search and they were made available in the document search platform shortly after.

How did you become aware of the breach?

The breach was raised by an internal staff member with the document search project team on 2 March 2023 via a ticket in Ivanti. The staff member noticed a transcript that should not be accessible via document search which led to the Digital Transformation Team removing transcripts on Document Search that were tagged with the following matter types:
s.365, s.372, s.394, s.773, s.699, s.709, s.789FC

This transcript was returned in that search and removed from the production environment of Document Search (i.e. the public facing Document Search).

What steps have been taken to address the suspected breach?

The transcript was removed from document search on 9 March 2023.

A thorough manual check of transcripts on document search has been conducted to ensure there are no more published in error.

This involved searching for transcripts on Document Search that were tagged with the following matter types: s.365, s.372, s.394, s.773, s.699, s.709, s.789FC; and viewing each one to determine if it should not be published. The Digital Transformation Team also searched for the phrases “s.365”, “s.372”, “s.394”, “s.773”, “s.699”, “s.709”, “s.789FC” to review any transcript documents relating to those matter types that were not picked up in the tag search.

Briefly explain nature of suspected breach.

All historical transcripts were taken from the Commission’s old website storage folder to be uploaded and made accessible via the document search platform. The old website storage folder contained a number of transcripts that had been previously published in error and removed from the website itself but not deleted from the storage folder.

There was no record that this had occurred.

This resulted in a small number of transcripts being inadvertently published via document search.

What sort of information was disclosed?

The names of the parties are disclosed –
Witness name; Mr John Kapay
Also named; Mr Brett Jeffrey Reynolds, MR A TURNER, MR C TANZER, MR R GREEN, Messrs Chris Trevor, Ronnie Templeman, David Demaceshon, Ian Coulson

Transcript includes that the the applicant ‘hadn't had any training or proper induction’

The transcript concludes with the commissioner statement ‘I have concluded that Mr Reynolds did not intend to resign from or abandon his employment with Veolia.’

Set out what details regarding the dispute were disclosed, eg was sensitive information disclosed,

also consider whether any information is of a sensitive nature (eg: allegations of improper conduct) etc.

Also set out what details regarding the matter were disclosed.

Also consider for the transcripts, whether witnesses were sworn in and their addresses are in the transcript.

e.g.
There is no sensitive information disclosed (no witness names, no sensitive allegations, no addresses or phone numbers).

Does the person whose personal information was disclosed know what happened?

Has the Commission staff member responsible for the suspected breach received training in privacy?

The suspected breach is not the responsibility of a single staff member – it is the result of historical procedures relating to the publishing of transcripts not being able to identify that these transcripts should not be published to document search.

All staff members involved have completed mandatory training modules on privacy.

Please attach a copy of what was disclosed in error.

In the case of Veolia Environment Services (Australia) Pty Ltd v Brett Jeffrey Reynolds, the applicant, Mr Brett Jeffrey Reynolds, sought to address a breach of privacy occurring approximately on 4 July 2022. This breach involved the inadvertent publication of a transcript via the document search platform, which was later identified and removed on 9 March 2023. The transcript, containing sensitive information such as personal names and details of the applicant’s employment status, was disclosed to the public due to an error in the historical procedures for publishing transcripts.

The legal issues before the court included whether the respondent, Veolia Environment Services (Australia) Pty Ltd, had breached privacy laws by making the transcript publicly accessible. Additionally, the court had to determine the adequacy of the measures taken to rectify the breach and prevent future occurrences. The applicant argued that the disclosure of personal information without consent constituted a breach of privacy.

In addressing these issues, the court considered the steps taken by the respondent to remove the transcript and conduct a thorough manual check of other transcripts to ensure compliance with privacy standards. The court acknowledged the inadvertent nature of the breach and the respondent’s efforts to rectify it promptly. The court also noted the mandatory training on privacy that all staff members involved had completed. The court concluded that while the breach was regrettable, the respondent had taken reasonable steps to address it and mitigate its impact.

The court ordered the respondent to ensure that all measures are in place to prevent future breaches of this nature. The court also emphasised the importance of ongoing compliance with privacy laws and the necessity for staff to adhere to established procedures when handling sensitive information.

Charles Darwin University

CaseChat Overview and Summary

Orders of the court

Background to the litigation

Evidence Before The Court

Reasons for decision

Legal Principle Established