HYYL and Privacy Commissioner

This matter concerned a serious data breach where the Department of Home Affairs inadvertently published personal details of 9,258 individuals in immigration detention online. The majority of these individuals were seeking asylum in Australia. The Office of the Australian Information Commissioner had previously found the Department in breach of privacy principles. The proceedings were brought under section 52 of the Privacy Act, as it stood at the time of the breach, concerning the adequacy of the compensation process offered by the Department to affected individuals. The court was required to determine whether the Commissioner's determination regarding the compensation scheme was correct and preferable.

The legal issues before the court included which version of section 52 of the Privacy Act applied, and its proper construction, specifically whether class members were required to establish by evidence that they had suffered loss or damage to be eligible for compensation. The court also considered whether it had the power to direct the Department to undertake a non-statutory exercise that might lead to the Minister lifting a bar on further protection visa applications for certain individuals. Further issues related to the adequacy of prior notice given to class members regarding the consequences of not providing submissions or evidence of loss or damage, and whether all class members should be given a further opportunity to participate in the compensation scheme. Finally, the court had to determine the correct and preferable method for assessing compensation, including the selection of an independent scheme administrator, the categories and quantum of non-economic loss, and the process for resolving disputes.

The court reasoned that compensation under section 52 of the Privacy Act requires an individual class member to establish that they have suffered loss or damage, and compensation cannot be awarded solely on the basis of a breach of the Act. The court found that while the previous notice issued by the Department was widely disseminated, it contained deficiencies that failed to provide class members with a sufficient opportunity to have their claims considered. Consequently, the court determined that any class member who did not provide submissions or evidence of loss or damage in response to the original notice, but can provide a reasonable explanation for this failure, should be given an opportunity to participate in the compensation scheme. The court also ordered that the compensation assessment scheme should be administered by an independent law firm with expertise in personal injury and privacy law, selected through a government procurement process, and that the Department must pay for necessary translation and interpretation assistance.