HYYL and Privacy Commissioner

Case [2023] AATA 2961

HYYL and Privacy Commissioner [2023] AATA 2961 (13 September 2023)

Division:Freedom of Information Division

File Number(s):      2021/1143

Re:HYYL  

APPLICANT

AndWP  

APPLICANT

Privacy CommissionerAnd  

RESPONDENT

AndSecretary, Department of Home Affairs

JOINED PARTY

DECISION

Tribunal:Justice Melissa Perry, Deputy President

Date:13 September 2023

Place:Sydney

The Tribunal orders that:

1.Pursuant to s 43(1)(a) of the Administrative Appeals Tribunal Act 1975 (Cth), Declaration 4 of the Determination made by the respondent on 11 January 2021 (the Determination) is set aside and the following is made in its place:

The members of the class who:

(a)  did not provide a submission and/or evidence to the Office of the Australian Information Commissioner (OAIC) within the timeframe specified by the OAIC, and who did not opt out; and

(b)  do not provide a reasonable explanation for not making submissions or providing evidence in response to the January 2018 OIAC notice within 3 months of the publication of a notice by the scheme administrator as described in Annexure A;

have not substantiated that they have suffered loss or damage as a result of the conduct constituting an interference with the privacy of class members and subject of this Determination (the data breach). Pursuant to s 52(1)(b)(iv) of the Privacy Act 1988 (Cth), the Tribunal declares that it would be inappropriate for any further action to be taken in relation to those individuals.

2.Pursuant to s 43(1)(c) of the Administrative Appeals Tribunal Act 1975 (Cth), Declarations 2 and 3 of the Determination are set aside and the following are made in their place:

Each of the participating class members, being:

(a)  the 1,295 class members who made submissions and/or provided evidence of loss or damage to the OAIC within the timeframe specified by the OAIC, and who did not opt out; and

(b)  the class members who establish, within the timeframe prescribed in order 1 above, that they have a reasonable explanation for not responding to the January 2018 OIAC notice and make submissions and/or provide evidence of loss or damage;

is to be paid an amount of compensation worked out in the manner specified in Annexure A to these orders.

3.Pursuant to ss 52(4) and/or 52(5) of the Privacy Act 1988 (Cth), the Department of Home Affairs is to pay:

(a)  the costs of the expert determination process described in Annexure A;

(b)  the costs of translating communications relating to the assessment of compensation for loss and damage arising from the data breach;

(c)   the costs of interpretation/translation services relating to the provision of evidence by those participating class members without a written language and communications with that cohort of class members relating to the assessment of compensation for loss and damage arising from the data breach; and

(d)  for assessments conducted under the compensation assessment scheme described in Annexure A, up to $500 to each participating class member to obtain assistance from a legal practitioner to prepare the participating class member’s evidence or submissions for provision to…

Continue reading HYYL and Privacy Commissioner

Sign in free to access the full text

Details
AGLC
HYYL and Privacy Commissioner [2023] AATA 2961
Case
[2023] AATA 2961
Decision Date

CaseChat Overview and Summary

This matter concerned a serious data breach where the Department of Home Affairs inadvertently published personal details of 9,258 individuals in immigration detention online. The majority of these individuals were seeking asylum in Australia. The Office of the Australian Information Commissioner had previously found the Department in breach of privacy principles. The proceedings were brought under section 52 of the Privacy Act, as it stood at the time of the breach, concerning the adequacy of the compensation process offered by the Department to affected individuals. The court was required to determine whether the Commissioner's determination regarding the compensation scheme was correct and preferable.

The legal issues before the court included which version of section 52 of the Privacy Act applied, and its proper construction, specifically whether class members were required to establish by evidence that they had suffered loss or damage to be eligible for compensation. The court also considered whether it had the power to direct the Department to undertake a non-statutory exercise that might lead to the Minister lifting a bar on further protection visa applications for certain individuals. Further issues related to the adequacy of prior notice given to class members regarding the consequences of not providing submissions or evidence of loss or damage, and whether all class members should be given a further opportunity to participate in the compensation scheme. Finally, the court had to determine the correct and preferable method for assessing compensation, including the selection of an independent scheme administrator, the categories and quantum of non-economic loss, and the process for resolving disputes.

The court reasoned that compensation under section 52 of the Privacy Act requires an individual class member to establish that they have suffered loss or damage, and compensation cannot be awarded solely on the basis of a breach of the Act. The court found that while the previous notice issued by the Department was widely disseminated, it contained deficiencies that failed to provide class members with a sufficient opportunity to have their claims considered. Consequently, the court determined that any class member who did not provide submissions or evidence of loss or damage in response to the original notice, but can provide a reasonable explanation for this failure, should be given an opportunity to participate in the compensation scheme. The court also ordered that the compensation assessment scheme should be administered by an independent law firm with expertise in personal injury and privacy law, selected through a government procurement process, and that the Department must pay for necessary translation and interpretation assistance.

Orders

Orders of the court

Full text does not contain this section.

Background

Background to the litigation

Mr Kiley and Mr Temby were cross-examined on their evidence. 2. BACKGROUND2.1. The data breach On 10 February 2014, a Microsoft Word document dated 31 January 2014 entitled ‘The Immigration Detention and Community Statistics Summary’ (report) was published on the website of the Department (the data breach). The report had a Microsoft Excel spreadsheet embedded within it, which included the personal information of 9,258 individuals who were in immigration detention on 31 January 2014 (class members). The personal information included class members’ full names, gender, citizenship, date of birth, period of immigration detention, relevant detention facility, reason for detention, boat name and boat arrival details. The applicants submit that, of these 9,258 identified people, it could be inferred that the overwhelming majority were people purporting to seek asylum in Australia. The applicants, without dispute, claim that this inference could be drawn because one column of the excel spreadsheet designated a majority of class members as either an “irregular maritime arrival”, an “unauthorised maritime arrival” or an “irregular maritime arrival”. The applicants further submit that, from the published information (alongside other information), it is possible to infer that such persons were in Australia for the purpose of seeking protection from that country or those refugee-producing countries’ regimes even if some of those claims had not been accepted. I agree that this inference is appropriately drawn and do not understand this to have been in dispute. The report was publicly accessible when published on the website on 10 February 2014. On 19 February 2014 at 9.15am, the Other Party was notified about the data breach by a journalist. By 10am that same day, the Other Party removed the report from its website. Consequently, the report was available for the public to access from the Other Party’s website for approximately eight days. While on the website, the report was accessed 123 times by 104 unique Internet Protocol (IP) addresses, although it is uncertain how many of these IP addresses had accessed the spreadsheet. The Department subsequently identified that the report was also available on the Internet Archive from 11 February 2014. On 27 February 2014, the report was removed from the Internet Archive. The document was therefore accessible on the Internet Archive for a period of 16 days. It is not known how many times the report was accessed on the Internet Archive. In total, therefore, the document was publically accessible from 10 to 27 February 2014, that being an overall period of 17 days. It follows, as the High Court held in Minister for Immigration and Border Protection v SZSSJ[2016] HCA 29; (2016) 259 CLR 180 at [4], that “On any view, the Data Breach was very serious”. Furthermore, as the High Court also held at [7], “there was obviously a risk that those in other countries from whom the applicants for protection visas claimed to fear persecution or other relevant harm might have gained access to the document containing the embedded information so as to become aware of the identities of applicants for protection visas in Australia.”2.2 Privacy complaints in respect of the data breach

Evidence

Evidence Before The Court

Full text does not contain this section.

Decision

Reasons for decision

The respondent was further satisfied that there was no evidence that a serious procedural problem had occurred, or that such a finding of a procedural problem (if proven) would have led to an unjust outcome (Determination at [68]). The respondent reached this view for multiple reasons, including the respondent’s findings that (amongst others):(a)the requirements for class members to make a claim for loss and/or damage were clearly expressed in the notice;(b)numerous steps had been taken to ensure that the notice was effectively communicated to class members; and (c)class members were given a reasonable opportunity to provide submissions and evidence (Determination at [69]–‍[70]).3. ISSUES FOR DETERMINATION AND SUMMARY OF CONCLUSIONS The Tribunal must decide whether the Determination was the correct and preferable decision and should therefore be affirmed, or whether it should be set aside or varied in whole or in part. The applicants and the Other Party agreed that the Determination required amendment but did not agree on all of the issues. The following matters were conceded or agreed (including as a result of the parties’ modifying their positions during and after the hearing):(a)The Other Party amended its proposed compensation scheme as follows:(i)Annexure B, category 4—‍replaced the reference to “medical specialist” with “health practitioner”;(ii)Annexure D, clauses 3(a)(i)(B),(ii) (the words “and the Respondent will identify the legal service providers that are acceptable to the Respondent as potential scheme administrators”) and (iv)(C) were not pressed. The following issues arise for determination and are answered by me as summarised below in italics:(a)Which version of s 52 of the Privacy Act applies to the Tribunal’s review in these proceedings?The Privacy Act as at the date of the data breach.(b)What is the proper construction of s 52 of the Privacy Act? In particular:(i)Is it necessary for class members to establish by evidence that they have suffered loss or damage for the purposes of s 52 Privacy Act?Yes.(ii)Does the Tribunal have power to, and should the Tribunal, direct the Other Party to undertake an exercise of non-statutory power that might culminate in a submission to the Minister to consider lifting the bar which prevents refused class members from making a further protection visa application?No. The respondent (and the Tribunal standing in the shoes of the respondent) has no power to make such a direction.(c)As to Declaration 4 of the Determination: is it correct and preferable that a declaration be made under s 52(1)(b)(iv) of the Privacy Act that no further action be taken in relation to individuals affected by the data breach who did not provide a submission or evidence of loss or damage prior to the making of the Determination?No.As part of this issue:(i)Is there power, under s 52(1)(b)(iv) of the Privacy Act or otherwise, to make a declaration in the terms of Declaration 4?Yes.(ii)Were class members given adequate prior notice of the consequences provided for in Declaration 4 to support the making of a declaration in those terms?No. While the notice was widely disseminated, there were deficiencies in the notice itself as a result of which the notice failed to provide class members with a sufficient opportunity to have their claims considered in the respondent’s resolution of the representative complaint. (iii)Should all class members be given a further opportunity to make submissions or provide evidence of loss or damage and, thus, to become class members who are eligible for an award of compensation in this representative complaint?No. However, any class member who did not make submissions or provide evidence of loss or damage in response to the OIAC notice in 2018 but establishes to the satisfaction of the scheme administrator that they have a reasonable explanation for not doing so, should be given an opportunity to participate and provide evidence of loss or damage.In addition, any existing participating class member who wishes to make submissions and/or provide updated and/or supplementary submissions and/or evidence of loss or damage is to do so within three months of the publication of the further notice unless granted an extension by the scheme administrator.(d)As to Declaration 2 of the Determination: what is the correct and preferable method for assessing compensation for individuals affected by the data breach?As part of this issue: (i)Who is the correct and preferable administrator of the compensation assessment scheme?A law firm with appropriate expertise which is appointed in accordance with [6(a)] of the new Determination in Annexure A to the orders, being (among other things) a law firm which: is independent of the Other Party and class members; has not represented or advised any of the class members in relation to this proceeding; is appointed to the Whole of Australian Government Legal Services Panel in relevant areas; and has not represented or advised the Other Party or the Minister for Immigration, Citizenship and Multicultural Affairs with respect to any matter arising from the data breach or in proceedings related to the grant or refusal of a visa or Australian citizenship.(ii)What is the correct and preferable manner for working out class members’ compensation (ss 52(1)(b)(iii), 52(4)(a), 52(5)(a)), and for determining any dispute regarding class members’ entitlement to compensation (s 52(5)(b))?See Annexure B to the orders. (iii)What are the correct and preferable categories of non-economic loss (both as to magnitude of harm and as to quantum) to which individual class members should be assigned for the purposes of assessing their compensation for the data breach?Compensation for non-economic loss is to be determined as set out in Annexure B to the orders according to 5 categories ranging from: no compensation where the individual has not provided a submission or evidence substantiating any loss or damage resulting from the data breach; to compensation from $20,000 for extreme loss or damage resulting from the data breach, with the amount of compensation available for the last of these categories being uncapped. Categories 2 to 5 include examples of loss or damage falling within the category to assist in assessing the appropriate category.(iv)What is the correct and preferable scheme for review of compensation decisions?See Annexure B to the orders.(e)Is it correct and preferable to direct that the Other Party pay for particular aspects of the compensation assessment process—specifically, access to translation and interpretation assistance during the operation of the compensation assessment process?Yes, but only such expenses as are reasonably necessary to ensure that individual class members have a real opportunity to receive and understand information relevant to their claims, and to communicate their responses, concerning the implementation of the compensation assessment process (as the Other Party accepts).

Ratio Decidendi

Legal Principle Established

Full text does not contain this section.