Jurecek v Director, Transport Safety Victoria

IN THE SUPREME COURT OF VICTORIA

Not Restricted

AT MELBOURNE
COMMON LAW DIVISION
JUDICIAL REVIEW AND APPEALS LIST

S CI 2015 01240

LARA JURECEK	Appellant
v
DIRECTOR, TRANSPORT SAFETY VICTORIA	Respondent

---

JUDGE:	BELL J
WHERE HELD:	Melbourne
DATE OF HEARING:	17 & 18 March, 4 & 5 April 2016
DATE OF JUDGMENT:	11 October 2016
CASE MAY BE CITED AS:	Jurecek v Director, Transport Safety Victoria
MEDIUM NEUTRAL CITATION:	[2016] VSC 285

---

APPEAL – protection of personal privacy – decision of Victorian Civil and Administrative Tribunal – whether error of law – respondent collected information from appellant’s Facebook without her knowledge - information used during employment misconduct investigation and disciplinary process – whether information was personal information covered by Information Privacy Principles – whether collection necessary for respondent’s functions or activities and carried out in lawful, fair and not unreasonably intrusive way – whether respondent ensured appellant was made aware of collection as soon as practicable – whether it was reasonably practicable to obtain information from appellant directly – whether information exempt from Principles by reason of being contained in document that was generally available publication – interaction between privacy protection and human rights – interpretation of statutory provisions expressed as general principles – limitations on jurisdiction of court to determine questions of law not fact - ‘personal information’, ‘necessary’, ‘fair’, ‘not unreasonably intrusive’, ‘practicable’, ‘reasonable steps’, ‘aware’, ‘reasonable and practicable’, ‘generally available publication’ – Victorian Civil and Administrative Tribunal Act 1998 (Vic) s 148(1), Information Privacy Act 2000 (Vic) s 11(1), sch 1, Charter of Human Rights and Responsibilities Act 2006 (Vic) s 13, International Covenant on Civil and Political Rights art 17

---

APPEARANCES:	Counsel	Solicitors
For the appellant	Michael Rivette with Andrew Denton	Shine Lawyers
For the respondent	Jason Pizer QC with Fiona Batton	Maddocks

HIS HONOUR:

In an application to the Privacy Commissioner, Lara Jurecek (‘the appellant’) complained that, during the course of her employment, the Director of Transport Safety Victoria (‘the respondent’) collected personal information about her without first attempting to obtain it from her directly and then used it without making her aware of what had been obtained. The appellant alleged that the respondent had thereby breached the Information Privacy Principles in sch 1 of the Information Privacy Act 2000 (Vic). The Commissioner dismissed the complaints and, at the appellant’s request, referred them to the Victorian Civil and Administrative Tribunal (‘the tribunal’) for hearing and determination.

Except in one minor respect, the tribunal (constituted by Member A Duggan) found the complaints not to be proven and, under s 43(1)(c) of that Information Privacy Act, made orders dismissing the appellant’s application. She now seeks leave to appeal and, if leave is granted, appeals upon grounds of error of law pursuant to s 148(1) and (2) of the Victorian Civil and Administrative Tribunal Act 1998 (Vic) against those orders.

Appellant’s complaints to Privacy Commissioner

In 2012, the appellant was employed by the respondent in the Office of the Director of Transport Safety. She had been experiencing ongoing difficulties in the nature of alleged workplace bullying, stress and other complaints. In that connection, she engaged in chats and posts on Facebook with a workplace colleague in which she made a number of employment-related remarks. These chats and posts were disclosed to officers of the respondent by the appellant’s colleague, which led to an investigation. Details of the content of the chats and posts will be given below. In the investigation, officers or agents of the respondent accessed the appellant’s Facebook, which she operated under a pseudonym (Lora Otto), without her knowledge. The investigation resulted in the appellant being charged and found guilty of the disciplinary offence of misconduct in respect of which she was given a final warning.

Without legal assistance, the appellant made two complaints to the Privacy Commissioner under the Information Privacy Act that the respondent had breached the Information Privacy Principles. In substance, her complaints were that, in the investigative and charging process, the respondent unfairly, intrusively and secretly obtained and used personal information relating to the appellant from her Facebook without it being necessary for the performance of the respondent’s functions and activities, without notice to her and without attempting to obtain the information from her first.

Upon the basis that the respondent had not interfered with the appellant’s privacy or breached the Information Privacy Principles, the Privacy Commissioner rejected these complaints. The Commissioner referred the complaints to the tribunal on the appellant’s request pursuant to s 29(5) of the Information Privacy Act.

Proceeding in Victorian Civil and Administrative Tribunal

Jurisdiction of and hearing before tribunal

Under s 43(1) of the Information Privacy Act, the tribunal has jurisdiction to make certain orders if it finds that referred complaints are proven. These include a restraining order, a performance order and a compensation order. As the tribunal found the appellant’s complaints not to be proven, it ordered that they be dismissed (except in the minor respect).

The proceeding in the tribunal occupied some eight sitting days during which evidence was heard from numerous witnesses. Both parties were represented by experienced counsel who went fully into the relevant issues. The tribunal determined many disputed issues of fact. None of the findings that it made have been challenged. Therefore the appeal in this court proceeded upon the basis that the findings of fact made by the tribunal were to be accepted. In the appellant’s submission, the proper interpretation and application of the Information Privacy Principles should have led the tribunal, upon the facts as found, to come to a different conclusion than it did.

Personal information in question: as identified by tribunal

As already noted, the appellant’s complaints raised questions about whether the respondent had complied with its obligations under the Information Privacy Principles with respect to allegedly personal information in a number Facebook chats and a group of Facebook posts in April and September 2012. The tribunal found that the information was personal information under the Information Privacy Act. This was not disputed by the respondent in the appeal except in certain respects specified in a notice of contention (see below).

The relevant chats and posts were described by the tribunal in its reasons for decision under these headings:

·the 5 April chat
·the 11 April chat
·the 12 April chat
·the 30 September posts (including one that came to be called ‘the abusive post’).

Upon the basis of the findings of the tribunal, details of the chats and post are now given.

The 5 April chat

An issue arose in the workplace involving another employee, Christopher Wighton (referred to as CW). On her Facebook operated under a pseudonym, the appellant sent a post,[1] on 5 April 2012, to her workplace colleague, Paula Ferronato discussing this matter. The post was in the following terms:

(CW) has been suspended from duties for 3 weeks (on full pay) because Cathy and Alan think he should be as he is ‘intimidating’ … as he has a mental illness … WOW! The circus goes on!

The 11 April chat

[1]The tribunal used the word ‘post’ but it may be more appropriate to use ‘message’ or ‘chat’ (see the below Facebook Glossary).

Ms Ferronato responded to the 5 April chat some days later. She said:

I saw IH today, and asked her how she was, as she was looking shit and after what you told me, I knew that she would be having a hard time. She told me that (CW) sees it as a suspension but she absolutely doesn’t. She has been really concerned about him and he’s been working super long hours and she thought he needed a break. She said she’d do the same for any of her staff members … but anyway, she asked me how I heard and I said both AP and you told me directly …

The 12 April chat

The appellant replied to Ms Ferronato’s post the next day, as follows:

Oh yeah … right … what exactly is it called then? When you are DIRECTED NOT to turn up to the office though you want to (and you can work from home if you want to) and your Dr is saying you are fine to be at work and you are about to have a 4 Day Easter holiday anyway then?
As qualified Drs they think 3 weeks is what … ‘about right?’ I think they have effed up really BIG here and it is on the back of alot (sic) of other stuff that has been happening to Chris all motivated by … GUESS who!! I think you would remember the feeling.
I do feel for IH too … you know I really admire and like her alot (sic) … but really?? This is HUGE backtracking by the Organisation to protect itself.
IH did not issue the directive.
Apparently they are going to ‘deal’ with people who are saying (CW) has been suspended … I guess Alicia & I can look forward to that now too.
Yipeeeeeeeeee!!!
Please keep this Facebook chat confidential!

Ms Ferronato responded thus:

Of course. I don’t know about the other stuff but I certainly know what it feels like to be targeted. And so I’m very sorry for (CW) and I hope he’s ok. I can’t imagine you and Alicia have anything to worry about? He told you that he was suspended (and apparently he asked for Iresha’s door to be left open so some people heard that way as well) so it’s not like he was keeping it confidential himself. I don’t know the details of all this so I’m trying to stay out of it. Unlike with (AP) where I knew exactly what happened because I watched it. But anyway talk soon. X.

The appellant responded in turn:

No probs love … I would love to stay out of it but I offered my friendship to (CW) a long time ago to help him have some support at work and some connectedness at work because he always kinda isolated himself … so I can’t really keep out of it … or abandon him as I am his coffee friend every few weeks.
This stuff has been going on for months in one form or another with poor (CW) and I know IH is very conflicted but she has to do her job as GC for the Organisation … they need to wake and get rid of CD!!
All this mess is HER!
LX.

The 30 September 2012 posts (including the abusive post)

A vicious murder was receiving prominent publicity at the time, including a great deal of comment on social media. Ms Ferronato was concerned that the publicity and comment might assist the defence of the person suspected of the murder and, on 30 September 2012, posted a request on her Facebook to her friends requesting that they desist from such comments.

The appellant responded as follows:

See above article I posted for you [referring to a newspaper article about the murder suspect which gave some detail about his criminal history] … I think he has a history of media attention anyway … but thanks for telling everyone how to react and express themselves. Cheers.

A little later she said:
They removed the newspaper article…yawn.

Later again she said:
They removed the newspaper article from my page and everyone else who shared it so sorry you did not get to see it PF! Certainly would have made you think twice. I think it was a bit telling on the freaking justice system! Anyway it was an article from 2001 (small article) stating that this particular guy had been put back into jail after committing a further 16 counts of rape after being released from jail in 1993 after serving 22 months of a 5year [sic] maximum sentence for previous rapes because he completed a ‘sex offenders’ program. He was then sent to jail for an 11 year period with a possible release of 8 years. Looks like he just got out a little while ago! BAM! Great job by the system again! It was an article directly from a newspaper and give me some time … I WILL get it back for everyone. You believe it will be fair this time? He’s DONE like a dinner because of the social outrage … they will not let this guy walk ANYWHERE!NO [sic] matter what!

Later on the evening of 30 September 2012, the following post (‘the abusive post’) appeared on Ms Ferronato’s Facebook wall:

BTW I really don’t CARE WHAT you think Paula!! Much less your ‘fucking’ commands!
I haven’t done so for a long time because you flit from one point to another with alarming speed.
Most of all, I don’t give my time to cowardly disloyal types who use other people to help them then totally abandon them in their time of need.
I guess I will have to set out what I am talking about for you as you have the self awareness of a brick.
AP stuck her neck out defending you in you [sic] bully saga for MONTHS and as soon as you were clear of the bullying it became her problem BIG TIME because she defended you … and where were you?
Too busy sucking up to give AP the time of day while her mental health was nosediving due to the amp up from the people who were initially TARGETTING YOU but then turned their attention to her because she got you what you wanted!!
What a GREAT friend and colleague!!
As long as YOU are OK right?
I spent a lot of time supporting you and encouraging you and giving you advice too!
And what was MY reward?
I was shown irrefutable evidence that you were reporting FB statuses to IH you deplorable traitor!!
I immediately restricted your access to my page MONTHS ago!
BUT would you notice that? LMAO! NO WAY!!
Too busy sucking up or preaching your self righteous drivel to people.
Its [sic] all about you isn’t it? ALL DAY every DAY.
GROSS!
AP can like you all she wants … Me … NOT at all. You ‘ve really proven to me who you are over the last year!
You are the kind of person who leaves your mates in the trenches after they have saved your ass.
And you want to tell people how to behave on FB when you behave like a total disgrace in real life and on FB?
NOT likely sunshine!
You go round snitching on AND using people and carrying on in a self serving manner…well then now you have that reputation.
You earned it!
You enjoy it!
Hope heaps of people get to read this before you!
Go report this to IH! Print it off!
See how you come off!

The tribunal rejected the appellant’s submission that her husband had written the abusive post and found that it had been written by her. This finding impugned the appellant’s credit but did not destroy her application completely.

After seeing the last of these posts, Ms Ferronato unfriended the appellant from her Facebook and brought the chats and posts to the attention of her manager, Cameron Toy, who notified the manager of human resources, Catherine Daly. She set an investigation in train. For that purpose, a private investigator, Leanne Faraday-Brash, as well as a linguistic expert, Kristina Illingworth, were engaged. It was this investigation that led to the appellant being charged and disciplined.

Important aspects of appellant’s complaints to tribunal

It is important to note that the appellant did not contend that the respondent failed to comply with the Information Privacy Principles by receiving (and therefore collecting) personal information about the appellant from Ms Ferronato when she made the initial complaint to Ms Toy. Rather, the appellant contended that she should have been made aware of that collection and that other elements of the Information Privacy Principles should have been complied with. She also contended that the information gathering activities occurring after the initial complaint by Ms Ferronato to Mr Toy were unwarranted, fishing and in breach of the Information Privacy Principles in various respects.

It is also important to note that a critical element of the appellant’s complaint of breach of the Information Privacy Principles was that officers or agents of the respondent had accessed the Facebook account that she was operating under a pseudonym. Officers or agents of the respondent were able to access that Facebook through the Facebook of another person (Alicia Parker) with whom the appellant had been in Facebook communication. The tribunal found that the identity of the appellant as the operator of the Facebook account was ascertained by those officers or agents of the respondent by using extraneous information that was in their possession. In essence, the appellant left a trail behind her which could be followed to her Facebook, although not into those parts that were password protected. The appellant contended that the respondent breached the Information Privacy Principles in various respects by accessing information on her Facebook in this way. The tribunal rejected these contentions.

Important aspects of tribunal’s determination

The Information Privacy Principles relevantly apply in relation to the collection, notification and use of personal information. In the application of the Principles, it is important to identify the information, collection, notification (if any) and use that are in question. It is especially important to identify the relevant personal information and the collection, for these are foundational to the application and discharge of the obligations imposed. There may be different items of personal information and multiple collections and these may raise different issues as regards the application and discharge of the obligations. As a self-represented complainant or applicant cannot be expected to appreciate all this, it will often be necessary for the commissioner or the tribunal to give what assistance is due in this connection.

In the present case, the appellant’s complaints, and the tribunal’s determination of those complaints, were organised by reference to chats and posts as modes of social communication rather than by reference to the relevant obligations in the Information Privacy Principles. This reflected the way that the complainant organised her complaints, and understandably so. They were initially prepared by her without legal assistance, as would normally be the case. It was perfectly natural for her to express the complaints in a general way by reference to chats and posts and also perfectly proper for the commissioner and the tribunal generously to interpret the complaints so expressed, as they did.

But the relevant Information Privacy Principles involve the application of standards expressed by reference to collections and notifications (see below) of personal information. At least after the complaints were referred to the tribunal and the parties became legally represented, it would have been better for consideration of the issues to be organised by reference to the information, and the collections and notifications (and other standards), that were in question rather by reference to the chats and posts, for that is what the application of the standards in the Information Privacy Principles ultimately required. I note that the tribunal did attend to the detail of the relevant information and collections in the course of its determination, despite the way in which the appellant put her case (see above). In the appeal, the appellant provided the court with particulars of the personal information, collections and notifications that were in issue. The summary was disputed by the respondent. I deal with the issues that arise in this connection below.

It was common ground in the appeal that the tribunal was correct beneficially to interpret the Information Privacy Principles as human rights legislation and pursuant to s 32(1) of the Charter of Human Rights and Responsibilities Act 2006 (Vic).

VCAT determined as a matter of statutory interpretation that IPP 1 applied to the respondent as a public sector agency in the context of the appellant’s employment. The respondent did not contend in this appeal proceeding that this decision was incorrect.

To certain issues that arose in the course of the proceeding I now turn.

Appeal proceeding

Leave to appeal

Under s 148(1)(b) of the Victorian Civil and Administrative Tribunal Act, the appellant can appeal against the decision of the tribunal only with the leave of this court.

Pursuant to r 4.14(3) of the Supreme Court (Miscellaneous Civil Proceedings) Rules 2008 (Vic), the court has ordered that the appellant’s application for leave to appeal is to be heard and determined by the judge who (if leave were to be granted) hears and determines the appeal.

This appeal raises important and novel questions of law in relation to the interpretation and application of the Information Privacy Act, the grounds of appeal were reasonably arguable and it is in the public interest that these questions and grounds be determined. Applying the well-established principles,[2] leave to appeal will be granted.
[2]See Secretary to the Department of Premier and Cabinet v Hulls [1999] 3 VR 331 (Phillips, Tadgell and Batt JJA agreeing); Myers v Medical Practitioners Board (2007) 18 VR 48 (Warren CJ, Chernov JA and Bell AJA agreeing).

Jurisdiction

Under s 148(1) of the Victorian Civil and Administrative Tribunal Act, the jurisdiction of the court is confined to the determination of question of law. The court does not have jurisdiction to determine questions of fact.

As I have already noted, the factual findings of the tribunal were not challenged in this appeal and the court will confine itself to the facts as found by the tribunal. As will be seen, this will be an important consideration in the ultimate determination of the appeal.

Facebook terminology

The complaints in this case concerned the operation of Facebook as a medium of social communication. Expert evidence was not given to the Tribunal about the technical aspects of that medium and certain terms were used by the parties that may be understood by Facebook users but not necessarily by everybody. In the appeal, the parties very helpfully provided the court with an agreed glossary of these terms, as follows (footnotes omitted and slightly edited):

FACEBOOK GLOSSARY

Cover photo

The large image at the top of a Facebook user’s profile.

Facebook homepage
An individual user’s profile page. A Facebook user creates their profile page by uploading photos, images and information about themselves.

Who can see a person’s Facebook homepage depends on the person’s privacy settings.

Facebook message

A private message between Facebook users delivered to a Facebook user’s inbox. It is also called a Facebook chat. A Facebook user can send a message/chat to any number of his/her friends at a time’

Facebook status
A feature that allows users to ‘post’ and share a small amount of content on their profile, on their Facebook friends’ walls and in Facebook News Feeds (a centre column that shows updates from the people and pages that user follows on Facebook).

Facebook status is one of the key interactive features on Facebook. It allows users to receive information about what their friends are doing, reading, watching or thinking, and provides opportunities for friends to comment and interact based on what is shared. Updates can be shared from a Web browser, mobile site or through text message.

Facebook wall
The profile space where a Facebook user’s content is displayed. It shows updates of a user’s recent activity on Facebook – for example, a comment the user has posted on another Facebook friend’s wall.

Who can see a person’s Facebook wall depends on the person’s privacy settings.

Profile photo The small picture next to the Facebook user’s name.

I have had regard to the glossary when examining the evidence and determining the questions raised in the appeal.

Difficulties with grounds of appeal

As I have stated, the jurisdiction of the court is to determine question of law, not fact. The alleged questions of law and grounds of appeal are set forth in an amended draft notice of appeal. Pursuant to a grant of leave to appeal, I have treated the amended draft notice as filed. However, the questions and grounds were drafted in a manner that made it difficult to identify the alleged errors of law.

For example, the first question of law was:

1.As a matter of construction of Information Privacy Principle (IPP) 1.1, does the finding that the Respondent (as the Appellant’s employer) without the Appellant’s knowledge or consent:
(a)accessed the Appellant’s restricted Facebook account when not a Facebook friend;
(b)that the Appellant operated under a pseudonym, outside of work hours;
(c)and collected personal information about the Appellant that was not publicly available;
(d)for the purposes of conducting a workplace disciplinary investigation;

meet the statutory description of ‘information necessary for one or more of the organisations functions or activities’?

This question does not specify the error of interpretation made by the tribunal or the correct interpretation advanced by the appellant.

Similarly, the first ground of appeal was:

1. Having correctly found that:
(a)the Appellant operated a Facebook account under a pseudonym that was restricted;
(b)the fact that the Appellant operated the Facebook account under a pseudonym was personal information (pseudonym personal information);
(c)the Respondent obtained the pseudonym personal information without the Appellant’s knowledge or consent;
(d)the Appellant’s Facebook account contained personal information that was not publicly available;
(e)the Appellant operated the Facebook account out of work hours; and
(f)the Respondent collected personal information, not publicly available, from the Appellant’s Facebook account without her knowledge or consent and through using the pseudonym personal information;

the Tribunal erred in finding that the collection of the personal information from the Facebook account for the purposes of a workplace disciplinary investigation was ‘necessary for one or more of the organisations functions or activities’ for the purposes of IPP 1.1?

Likewise, the erroneous and correct interpretation are not specified.

This kind of problem bedevilled almost the whole of the appellant’s amended draft notice of appeal and, in consequence, bedevilled the course of argument in the appeal on both sides. It did not help that the appellant’s and respondent’s submissions were differently organised and therefore not easy to correlate. The amended draft notice of appeal and submissions also attempted to draw the court heavily into the facts of the case rather than focussing upon whether the tribunal committed an error of law in dismissing the application.

The genesis of the problem was that, in the tribunal and in this court, the appellant did not identify with sufficient particularity the personal information, and the collections and notifications of collections, which were in issue under the various elements of the Information Privacy Principles. I have already emphasised the importance of doing so. At my request, the appellant’s counsel prepared a document summarising that information and those collections and notifications (see below). I very much appreciate them doing so and it has been of real assistance.

The response of the respondent was to dispute that all of the collections and notifications specified in the summary had actually been placed in issue in the application before the tribunal and in the appeal in the court. I do not criticize the respondent for doing so.[3] To that response, the appellant replied in terms to which the respondent objected. A round of further submissions and replies ensued.
[3]For example, the respondent understandably informed the court that its notice of contention was not drawn upon the basis of the appellant’s summary of personal information, collections and notifications in issue and would have to be revised if the issues in the appeal were (in its submission) to be widened in accordance with that summary.

After consideration, I have decided that it is not necessary to resolve this controversy. In the circumstances, I think the fairest course is to take the appellant’s case at its highest and as put in the information, collections and notifications summary. With some possible exceptions (which form the basis of the objections made by the respondent and which I have taken into account), I think this summary corresponds reasonably well to the understanding of the tribunal, as revealed by its reasons for decision. With the summary in one hand and the amended grounds of appeal in the other, I have found it possible to make sense of the submissions made by the parties. I will now turn to the summary

Personal information, collections and notifications in issue: appellant’s summary

According to the appellant’s summary, the collections in issue in the application before the tribunal and the appeal before this court were:

·one collection by Cameron Toy
·three collections by Catherine Daly
·three collections by Leanne Faraday-Brash

I will set out the particulars of these collections as given in the summary.
Collection by Cameron Toy

The particulars of the one Toy collection are (footnotes omitted):

1.Mr Cameron Toy was employed by the Respondent as the Manager Navigational Service. Paula Ferronato reported directly to Mr Toy.
2.On or about 1 October 2012, Paula Ferronato showed Mr Toy the Abusive Post and advised Mr Toy that Lara Jurecek operated a Facebook account under the pseudonym Lora Otto. Mr Toy recorded this personal information in a written diary note dated 1/10/12. Mr Toy requested that Paula Ferronato send him copies of the Facebook Screenshots, which she did later that day.
3.Mr Toy did not forward the email or attachments to anyone, but used the information to conduct an internet search for Lora Otto, in which he was unable to obtain any results.

Collections by Catherine Daly

The particulars of the first Daly collection are (footnotes omitted):

6.Ms Catherine Daly was employed by the Respondent, as the Manager, People and Culture.
7.On 2 October 2012, Ms Daly had a face to face meeting with Paula Ferronato, at which time Paula Ferronato:
a)showed Ms Daly the Abusive Posts;
b)told Ms Daly that Lara Jurecek operated her Facebook Account under the pseudonym Lora Otto; and
c)told Ms Daly that Alicia Parker was Facebook friends with Lara Jurecek.

8.Ms Daly recorded the personal information relating to Ms Jurecek’s Facebook friends in a written file note.
9.During the 2 October 2012 meeting, Paula Ferronato texted from her mobile phone a copy of the Abusive Post (which consisted of 5 separate screenshots) to Ms Daly, which Ms Daly emailed to herself later that day (through 5 separate emails).

The particulars of the second Daly collection are (footnotes omitted):

12.Later on 2 October 2012, Ms Daly conducted a Google search and a Facebook search for Lara Jurecek’s Facebook page, by searching for the names Lara Jurecek and Lora Otto, but came up with no result. Ms Daly then combined the information that Alicia Parker was a Facebook friend of Lara Jurecek with the information that Lara Jurecek operated her Facebook account under the pseudonym Lora Otto by first searching for Alicia Parker and clicking on a link of an Alicia Parker that lived in Melbourne with a photo of a dog. Even though she could not see Alicia Parker’s friends list, Ms Daly scrolled through Alicia Parker’s Facebook Wall and saw that Lora Otto has commented on a photo on that page. Ms Daly then clicked on the Lora Otto icon and obtained access to the Lora Otto Facebook page.

The particulars of the third Daly collection are (footnotes omitted):

13.On 5 October 2012, Ms Daly again accessed the homepage of the Lora Otto Facebook account by the same method as 2 October 2012 described in paragraph 12 above, and took a screenshot of Lora Otto homepage.

Collections by Leanne Faraday-Brash

The particulars of the first Faraday-Brash collection are (footnotes omitted):

18.Ms Leanne Faraday-Brash was at all relevant times a private investigator engaged by the Respondent to conduct an investigation. The Respondent provided her with the Applicant’s personal information that included:
a)the Abusive Posts;
b)that Lara Jurecek operated a Facebook account under the pseudonym Lora Otto; and
c)that Alicia Parker was a Facebook friend of Lara Jurecek.

…
20.On 9 October 2012, Ms Faraday-Brash conducted a Facebook search for Lara Jurecek’s Facebook page, by searching for the names Lara Jurecek and Lora Otto, but came up with no result. Ms Faraday-Brash then combined the personal information that Lara Jurecek operated her Facebook account under the pseudonym Lora Otto with the personal information that Alicia Parker was a Facebook friend of Lara Jurecek and was able to gain access to the Lora Otto homepage in the same manner as Ms Daly had used to gain access to the Lora Otto Facebook account (who had informed Ms Faraday-Brash how she had gained access). Ms Faraday-Brash then collected personal information from the Lora Otto homepage.

The particulars of the second Faraday-Brash collection are (footnotes omitted):

21.In late October 2012, Ms Faraday-Brash again accessed the Lora Otto Facebook homepage and took Screenshots containing personal information which she included in her final report.

The particulars of the third Faraday-Brash collection are (footnotes omitted):

22.On 11 December 2012, Ms Faraday-Brash again accessed the Lora Otto Facebook homepage and took further Screenshots containing personal information which she included in her final report.

The appellant made clear that no claim was made under IPP 1.1 relating to the collection by Mr Toy or Ms Daly’s first collection of the abusive post or the information that the appellant operated a Facebook account under the pseudonym ‘Lora Otto’. Rather, she relied upon alleged breaches of the Information Privacy Principles that occurred after and in consequence of those collections.

Notifications sent by respondent to appellant

The appellant particularised the notifications of information that were sent by the respondent to her, as follows:

27.On 8 October 2012, the Respondent sent Lara Jurecek a Notice of Investigation dated 8 October 2012. In paragraph[s] [180] to [182] the Tribunal found that this Notice of Investigation complied with the obligations under the Act in relation to IPP 1.3 (as applied by IPP 1.5). This finding is the subject of Amended Draft Grounds of Appeal 5 to 14 and 18 to 19, and Questions 4 and 6.
28.On 1 November 2012, the Respondent sent Lara Jurecek a further Notice of Investigation dated 1 November 2012, informing her that the investigation, that had been put on hold, was now to recommence. This also attached the initial Notice of Investigation dated 8 October 2012.
29.On 14 January 2013, after conducting the investigation, the Respondent sent Lara Jurecek a Notice of Proposed Discipline Outcomes dated 14 January 2013. This Notice contained copies of some of the personal information collected, but not all. This was the first time Lara Jurecek received copies of any of the personal information that the Respondent had collected. Lara Jurecek gave evidence that this was the first time that she realised that the Respondent had accessed, collected and used personal information relating to her use of her Facebook account.
30.On 8 February 2013, the Respondent sent Lara Jurecek a Notice of Discipline Outcome – Final Warning dated 8 February 2013.
31.On 11 February 2013, the Respondent sent Lara Jurecek a Notice of Intention to Commence Formal Process dated 11 February 2013. This commenced a new process which alleged dishonesty by Lara Jurecek during the investigation undertaken as part of the disciplinary process.

By reference to the questions and grounds specified in the amended draft notice of appeal, the appellant also particularised which information, collection and notification related to the grounds and questions. I will refer to those particulars in that context.

I will turn to the grounds of appeal after determining the issues raised in the respondent’s notice of contention. It is first necessary to discuss the Information Privacy Act.

Protection of personal privacy under the Information Privacy Act

Statutory scheme

As relevant in this case, the main purposes of the Information Privacy Act are to establish a regime for the responsible collection and handling of personal information in the Victorian public sector, to provide individuals with a right of access to information about them held by organisations and to provide remedies for interference with the information privacy of individuals (s 1(a), (b) and (d)). For these purposes, s 14(1) specifies Information Privacy Principles as set out in sch 1 which apply to the Victorian governmental organisations specified in s 9(1).

Section 3 defines ‘personal information’ to mean:

information or an opinion (including information or an opinion forming part of a database), that is recorded in any form and whether true or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion, but does not include information of a kind to which the Health Records Act 2001 applies.

There is an issue in the present case whether some of the information in question falls within this definition.

It was common ground in this case that the respondent was a ‘public sector agency’ as specified in s 9(1)(c). By virtue of s 16(1), the respondent was therefore prohibited from doing an act or engaging in a practice that contravened an Information Privacy Principle in respect of personal information collected, held, managed, used or disclosed by it.

Information Privacy Principle 1 stipulates principles with respect to the collection of personal information. These principles are:

1 Principle 1—Collection
1.1An organisation must not collect personal information unless the information is necessary for one or more of its functions or activities.
1.2An organisation must collect personal information only by lawful and fair means and not in an unreasonably intrusive way.
1.3At or before the time (or, if that is not practicable, as soon as practicable after) an organisation collects personal information about an individual from the individual, the organisation must take reasonable steps to ensure that the individual is aware of—
(a)the identity of the organisation and how to contact it; and
(b)the fact that he or she is able to gain access to the information; and
(c)the purposes for which the information is collected; and
(d)to whom (or the types of individuals or organisations to which) the organisation usually discloses information of that kind; and
(e)any law that requires the particular information to be collected; and
(f)the main consequences (if any) for the individual if all or part of the information is not provided.

1.4If it is reasonable and practicable to do so, an organisation must collect personal information about an individual only from that individual.
1.5If an organisation collects personal information about an individual from someone else, it must take reasonable steps to ensure that the individual is or has been made aware of the matters listed in IPP 1.3 except to the extent that making the individual aware of the matters would pose a serious threat to the life or health of any individual.

The interpretation and application of all of these principles are at issue in the present case.

Not all personal information is afforded protection by the Information Privacy Act. Division 2 of pt 2 contains exemptions in relation to courts and tribunals (s 10), Parliamentary Committees (s 10A), publicly-available information (s 11), the operation of the Freedom Information Act 1982 (Vic) (s 12) and law enforcement generally (s 13). Relevant here is only the exemption in relation to publicly-available information as stipulated in s 11(1), which provides:

(1) Nothing in this Act or in any IPP applies to a document containing personal information, or to the personal information contained in a document, that is—

(a) a generally available publication; or

(b) kept in a library, art gallery or museum for the purposes of reference, study or exhibition; or

(c) a public record under the control of the Keeper of Public Records that is available for public inspection in accordance with the Public Records Act 1973, or

(d) archives within the meaning of the Copyright Act 1968 of the Commonwealth.

There is an issue in the present case about whether some of the information is contained in a document that is covered by para (a). Relevant to this issue is s 3, which defines ‘generally available publication’ to mean:

a publication (whether in paper or electronic form) that is generally available to members of the public and includes information held on a public register.

Information Privacy Principle 2 stipulates principles in relation to the use and disclosure of personal information. These prohibit the use or disclosure of personal information about a person for purposes other than the primary purpose of collection except in certain specified circumstances (IPP 2.1). The circumstances are several and include that the individual has consented to the use or disclosure, that it would lessen a serious or imminent threat to life or as a necessary part of an investigation into unlawful activity required or authorised by law (IPP 2.1(b), (d), (e) and (f)). These principles are not in the present case. There are several other principles which are also not in issue.

Principle-based protection of personal information

The Information Privacy Act implements a system of protection of personal privacy primarily based on general standards expressed as principles, not detailed rules. Information privacy principles first appeared in Australian legislation in the Privacy Act 1988 (Cth),[4] which regulated the collection, handling and use of personal information by federal departments and agencies. As the second reading speech for that Act states,[5] the principles then enacted drew on those stated by the Organisation of Economic Cooperation and Development of which Australia was and is a member.[6] A later inquiry by the Privacy Commissioner led to the development of National Privacy Principles and the enactment of those principles by amendment of the federal legislation.[7] As the second reading speech relating to the Victorian Information Privacy Act states,[8] the Information Privacy Principles specified in sch 1 of that Act, being the ones at issue in this case, were based upon the National Privacy Principles.
[4]See s 14.
[5]Commonwealth, Parliamentary Debates, House of Representatives, 1 November 1988, 2118 (Lionel Bowen, Attorney-General).
[6]Organisation for Economic Cooperation and Development, Guidelines governing the protection of privacy and transborder flows of personal data (23 September 1980).
[7]See Privacy Amendment (Private Sector) Act 2000 (Cth) sch 3.
[8]Victoria, Parliamentary Debates, Legislative Assembly, 26 May 2000, 1906 (John Brumby, Minister for State and Regional Development).

Federal and Victorian law has evolved further since the enactment of the original legislation in those jurisdictions. As amended by the Privacy Amendment (Enhancing Privacy Protection) Act 2012 (Cth), federal regulation of privacy is carried out under the Privacy Act[9] in accordance with Australian Privacy Principles as recommended by the Australian Law Reform Commission in 2008.[10] Victorian regulation is now carried out under the Privacy and Data Protection Act 2014 (Vic), although the principles there[11] are the same as those specified in the Information Privacy Act. Principle-based protection has been and is the common theme of the system of information privacy regulation enacted in this legislation at all levels.
[9]Privacy Act 1998 (Cth) s 14 and sch 1.
[10]Australian Law Reform Commission, For Your Information: Australian Privacy Law and Practice, report 108 (vol 1) (2008) 34-48, recommendations 18-31.
[11]See s 18(1) and sch 1.

The concept behind principle-based protection of information privacy was discussed by the Australian Law Reform Commission in its 2008 report. The Commission explained that principle-based protection was preferable to compliance-based protection because the former offered ‘greater flexibility in comparison to rules’ and it also allowed ‘for a greater degree of “future proofing” and [enabled] the regime to respond to new issues as they arise without having to create new rules’.[12] However, the Commission made clear that principle-based protection was implemented in privacy principles in a pragmatic and not in a pure form. Typically, some principles were expressed as prescriptions while others were expressed as high-level principles.[13]
[12]Australian Law Reform Commission, For Your Information: Australian Privacy Law in Practice, Report 108, Vol 1 (2008) 240-1 [4.28]–[4.29].
[13]The Commission compared its recommended principle 5 which set out detailed rules relating to the use and disclosure of personal information with its recommended principle 7 which set out a broad, high-level principle relating to data quality: ibid 241-2 [4.34].

The Information Privacy Principles are statutory provisions to which the established rules of interpretation apply, but they are statutory provisions of a particular kind. In the process of interpretation, I would take into account that the Principles are intended to operate in a practical and sensible way so as to afford privacy protection to personal information held by Victorian governmental organisations. In that process, the operation of principles expressed more generally should not be restricted and the operation of principles expressed more specifically should not be diluted.

Privacy and human rights

Both parties in the proceeding advanced arguments based on the connection between privacy and human rights. Reference was made to the International Covenant on Civil and Political Rights[14] (‘the ICCPR’) and the Charter of Human Rights and Responsibilities Act 2006 (Vic) (‘the Charter’). However, notices were not served by either party under s 35(1) of the Charter.
[14]Opened for signature 16 December 1966, 999 UNTS 171 (entered into force 23 March 1976).

The privacy of the individual is protected as a human right in art 17(1) of the ICCPR in these terms:

(2) No one shall be subjected to arbitrary or unlawful interference with his privacy, family, home or correspondence, nor to unlawful attacks on his honour and reputation.

(3) Everyone has the right to the protection of the law against such interference or attacks.

The Human Rights Committee has published a General Comment on the right to privacy[15] and the Human Rights Council has appointed a Special Rapporteur on the Right to Privacy who has recently published an extensive report on the subject.[16] Of course, the scholarship is extensive on privacy and human rights, including in the context of mainstream and social media.[17]

[15]Human Rights Committee, General Comment No 16: Article 17 (Right to Privacy), 32^nd session (8 April 1988).

[16]Joseph A Cannataci, Report of the Special Rapporteur on the Right to Privacy (Advance Unedited Version) UN Doc A/HRC/31/64 (8 March 2016).

[17]See generally, NA Moreham and Sir Mark Warby (eds), Tugendhat and Christie: The Law of Privacy and the Media (Oxford University Press, 2016).

The right to protection from arbitrary or unlawful interference with privacy as stipulated in art 17 of the ICCPR was influential in the enactment of the federal legislation that adopted the National Privacy Principles.[18] As we have seen, the Information Privacy Principles in the Information Privacy Act were based upon those adopted in the federal legislation. Like the federal legislation, the Information Privacy Act and the Information Privacy Principles may generally be conceived as a scheme that gives domestic legal effect in a particular context to the human right to privacy stipulated in art 17 of the ICCPR. According to the general tenets of statutory interpretation and quite apart from the Charter, the provisions of that Act (including those Principles) would be interpreted consistently with Australia’s international obligations, including art 17.[19]
[18]‘[The Privacy Amendment (Private Sector) Bill 2000] will … implement certain obligations under article 17 of the International Covenant on Civil and Political Rights’: Commonwealth, Parliamentary Debates, House of Representatives, 12 April 2000, 15749 (Daryl Williams, Attorney-General).
[19]I collected the relevant authorities in Tomasevic v Travaglini and Another 17 VR 100, 113-4 [72]-[73].

Privacy is also protected as a human right in s 13 of the Charter and in terms that reflect art 17 of the ICCPR. Section 13 provides:

A person has the right—

(a) not to have his or her privacy, family, home or correspondence unlawfully or arbitrarily interfered with; and

(b) not to have his or her reputation unlawfully attacked.

The right to privacy stipulated in s 13 of the Charter has an obvious connection with protection of personal information under the Information Privacy Act. By reason of ss 32(1) and 38 of the Charter, the provisions in the two bodies of legislation interact, including in relation to the interpretation and application of the Information Privacy Principles. As notices under s 35(1) of the Charter were not served, I cannot go into that interaction in this case. However, if my analysis and conclusions seemed to be inconsistent with the provisions of the Charter, I would have given consideration to directing that those notices to be served.

Human rights were raised in this case in two main respects: (1) to stress the general importance of protecting personal information as an aspect of the right to privacy; and (2) in the interpretation and application of the standards of what is ‘necessary’ in IPP 1.1, ‘lawful and fair’ and not ‘unreasonably intrusive’ in IPP 1.2, ‘practicable’ and ‘reasonable’ in IPP 1.3, ‘reasonable and practicable’ in IPP 1.4 and what are ‘reasonable steps to ensure’ in IPP 1.5.

As to the first respect, the general importance of protecting personal information as an aspect of the human right to privacy is not to be doubted. The Information Privacy Act gives effect to that purpose, as s 1(a) and the general scheme of the Act make clear. In relation to the protection of personal privacy, individuals have fundamental interests at stake and these must be fully appreciated and taken into account in the application of the Information Privacy Principles stipulated under that Act. But it is well-established that privacy as a human right is not absolute, which brings me to the second respect.

The right in art 17(1) of the ICCPR is a not right to protection of personal privacy absolutely but a right to not be ‘subjected to arbitrary or unlawful interference’ (emphasis added). The word ‘arbitrary’ is used in this context in the human rights sense, which I explained in PJB v Melbourne Health (Patrick’s Case)[20] (in the analogous context of s 13(a) of the Charter) as follows:

the human right in s 13(a) not to have your privacy, family, home or correspondence ‘arbitrarily’ interfered with extends to interferences which, in the particular circumstances applying to the individual, are capricious, unpredictable or unjust and also to interferences which, in those circumstances, are unreasonable in the sense of not being proportionate to a legitimate aim sought. Interference can be arbitrary although it is lawful.[21]

That explanation was based largely on the jurisprudence with respect to art 17 of the ICCPR.[22]

[20](2011) 39 VR 373.

[21]Ibid 395 [85], approved WBM v Chief Commissioner of Police (2012) 43 VR 446, 470-72 [105]-[117] (Warren CJ, Hansen JA agreeing), 490 [202] (Bell AJA).

[22]Patrick’s Case (2011) 39 VR 373, 389-95 [64]-[85].

It was the requirement for interference not to be arbitrary in the human rights sense that the appellant relied upon in the present case. In particular, her submission was that the standards to which I have referred in IPP 1.1-1.5 should be interpreted and applied in a way that requires any interference with personal privacy to be reasonable in the sense of being proportionate to a legitimate aim sought. I would generally accept that submission. As the provisions of cl 1 of the Information Privacy Principles were intended to give effect in a particular context to the right to privacy stipulated in art 17 of the ICCPR and reasonable proportionality is a central component of that right, it informs the interpretation and application of those Principles.

I think reasonable proportionality comes into the interpretation and application of the provisions of cl 1 of the Information Privacy Principles because the specified standards are evaluative in nature: it is necessary to determine in a given case what is ‘necessary’ in IPP 1.1, ‘lawful and fair’ and not ‘unreasonably intrusive’ in IPP 1.2, ‘practicable’ and ‘reasonable’ in IPP 1.3, ‘reasonable and practicable’ in IPP 1.4 and what are ‘reasonable steps to ensure’ in IPP 1.5. To a greater or lesser extent, matters of fact and degree are involved, which requires consideration of what is at stake for the individual (including the nature of the personal information in question) and balancing, in a reasonably proportionate way, the nature and importance of any legitimate purpose and the extent of the interference.

For the reasons given below, the appellant has not established that the tribunal erred in applying the Information Privacy Principles, so interpreted. The respondent did have obligations under those Principles with respect to the appellant’s personal information but, taking into account (among other things) that the respondent was reasonably conducting a legitimate employment misconduct investigation, the tribunal did not err in concluding that there was no failure to perform those obligations (except in the minor respect).

Now to the respondent’s notice of contention.

Notice of contention

The respondent relied upon a notice of contention under r 64.32 of the Supreme Court (General Civil Procedure) Rules 2015 (Vic). It was submitted that, even if the appellant established that the tribunal had erred in law, the order of the tribunal should be affirmed upon a ground of law that was erroneously decided by the tribunal.

The notice of contention specified alleged errors in relation to the tribunal’s decision with respect to two categories of information: the posts on Ms Ferronato’s Facebook wall and the screenshots. Under those headings, the notice specifies the following grounds:

The posts on Paula Ferronato’s Facebook ‘wall’
1.It was not open to the Tribunal to conclude (at [169]) that the following underlined passages – in the posts on Paula Ferronato’s Facebook ‘wall’ – constituted ‘personal information’ of the Plaintiff for the purposes of the Information Privacy Act 2000 (‘the Act’) as they were not expressions of the Plaintiff’s opinions or otherwise information about the Plaintiff:
‘See above article I posted for you .. I think he has a history of media attention anyway .. but thanks for telling everyone how to react and express themselves. Cheers’. (‘Post 1’).
‘They removed the newspaper article .. yawn’. (‘Post 2’).
‘They removed the newspaper article from my page and everyone else who shared it so sorry you did not get to see it PF! Certainly would have made you think twice. I think it was a bit telling on the freaking justice system! Anyway it was an article from 2001 (small article) stating that this particular guy had been put back into jail after committing a further 16 counts of rape after being released from jail in 1993 after serving 22 months of a 5year [sic] maximum sentence for previous rapes because he completed a “sex offenders” program. He was then sent to jail for an 11 year period with a possible release of 8 years. Looks like he just got out a little while ago! BAM! Great job by the system again! It was an article directly from a newspaper and give me some time … I WILL get it back for everyone. You believe it will be fair this time? He’s DONE like a dinner because of the social outrage … they will not let this guy walk ANYWERE!NO [sic] matter what!’ (‘Post 3’).

2.Further or alternatively to paragraph 1, the Tribunal should have concluded that, by reason of section 11 of the Act, nothing in the Act or in any Information Privacy Principle applied to the personal information in Post 1, Post 2 or Post 3 because Paula Ferronato’s Facebook ‘wall’ was a ‘generally available publication’ for the purposes of the Act, and it was not open to the Tribunal to conclude otherwise.
The screenshots
3.[Not pressed]
4.[Not pressed]
5.Alternatively to paragraphs 3 and 4, the Tribunal should have found that, by reason of section 11 of the Act, nothing in the Act or in any Information Privacy Principle applied to the personal information in the screenshots (with the exception of the reference to ‘Weasel World’ in the 5 October screenshot) because each piece of personal information in those screenshots formed part of some other ‘generally available publication’, namely:
5.1the fact that the Applicant lived in Melbourne had been published in a newspaper article;
5.2the fact that the Applicant was from New York was accessible from Tavis Lamprell’s missing persons page on the internet;
5.3the fact that the Applicant studied at RMIT University was available on the internet; and
5.4all of the photos on the Facebook page were photos taken from the internet.

It can be seen that grounds 3 and 4 were not pressed. I will deal with the other grounds in turn.

Ground 1

The respondent submitted that the tribunal erred in law in deciding that the posts on Ms Ferronato’s Facebook wall consisted of personal information about the appellant. The alleged error of law was making a finding that was not open. The information in question is specified in para 1 of the notice. In the respondent’s submission, the underlined words are not expressions of the appellant’s opinions and in any event are not about the appellant.

The definition of ‘personal information’ in s 3 of the Information Privacy Act relevantly specifies ‘information or an opinion … about an individual’. While it includes information and opinions, both must be about an individual. As regards people speaking in a personal capacity, such as the appellant, opinions are intrinsically about the expresser because they necessarily reveal what opinions he or she holds. The definition thus affords privacy protection to information about individuals and to opinions that they might express, subject to the provisions of the Act (see the exemptions in pt 2, div 2 and the scope and operation of the Information Privacy Principles). In respect of the protections afforded to opinions expressed by individuals, there is an obvious connection between the right to privacy and the right to freedom of expression as human rights, both being central to the personal autonomy and dignity of the individual. As the tribunal decided and the parties rightly agreed, the definition would be interpreted beneficially and compatibly with human rights.

None of the words ‘information’, ‘opinion’ or ‘about’ are defined. The ordinary meaning of the word ‘information’ is ‘facts or knowledge provided or learned’.[23] The ordinary meaning of the word ‘opinion’ is ‘a view or judgment not necessarily based on fact or knowledge’.[24] The ordinary meaning of the word ‘about’ is ‘on the subject of; concerning’.[25] These are words of considerable amplitude and have been deliberately chosen. The definition of ‘personal information’ eschews a narrow approach to the concept of ‘personal information’ in favour of a wide approach. The intention is that, at least in most cases, debate about the scope of protection of personal information under the Information Privacy Act is preferably to be determined not at the level of whether information is personal but at the level of the operation of the exemptions (see pt 2, div 2) and the Information Privacy Principles (see sch 1).
[23]Catherine Soanes and Angus Stevenson (eds), Concise Oxford English Dictionary (Oxford University Press, 11^th ed, 2006) 730; see also Ann Atkinson, Alsion Moore and Susan Butler (eds), Macquarie Encyclopedic Dictionary (Macquarie Dictionary Publishers, 2^nd ed, 2010) 632.
[24]Catherine Soanes and Angus Stevenson (eds), Concise Oxford English Dictionary (Oxford University Press, 11^th ed, 2006) 1003; see also Ann Atkinson, Alsion Moore and Susan Butler (eds), Macquarie Encyclopedic Dictionary (Macquarie Dictionary Publishers, 2^nd ed, 2010) 882.
[25]Catherine Soanes and Angus Stevenson (eds), Concise Oxford English Dictionary (Oxford University Press, 11^th ed, 2006) 4; see also Ann Atkinson, Alsion Moore and Susan Butler (eds), Macquarie Encyclopedic Dictionary (Macquarie Dictionary Publishers, 2^nd ed, 2010) 4.

In my view, the underlined words in the posts are plainly opinionative in relation to various subjects and the tribunal did not err in law in so deciding. They are about the appellant in the sense of being on the subject of and concerning her personal opinions.

In effect, the appellant has adopted the approach of redacting the (allegedly) non-personal parts of the posts word by word and sentence by sentence, as if this were a freedom of information case, which I would not want to encourage. Redaction may be a useful tool for protecting exempt matter in a document in the freedom of information context but the purpose of the Information Privacy Act is to protect the information privacy of persons, not exempt matter in documents. There is nothing in the nature of the information and circumstances in question to suggest that such an approach is warranted. The words of the appellant as written in the posts should be read as a whole. So read, the tribunal was correct to find that they constituted personal information. Ground 1 must be rejected.

Ground 2

The respondent submitted that the tribunal erred in law in not concluding that the information in the specified posts was exempt from the operation of the Information Privacy Act by s 11(1)(a) by virtue of being ‘a generally available publication’.

This ground was put upon a quite narrow basis. The respondent did not challenge the tribunal’s approach of determining whether the posts or the information in them ‘would be able to be accessed by most members of the public, who are not particularly skilled in carrying out [internet or social media] searches’.[26] It was rather contended that the tribunal was bound to answer that question in favour of the respondent because the only evidence on the subject was that of Ms Ferronato and that evidence was that her Facebook wall could be accessed by people who were not her Facebook friends.
[26]Reasons for decision [121].

I do not accept the proposition that the only evidence on the subject was that of Ms Ferronato nor the respondent’s characterisation of that witness’s evidence. The tribunal’s reasons for decision contain an extensive discussion of the Facebook privacy settings that were put in place by Ms Ferronato and others, what information could and could not be accessed on the Facebooks in question, who could and could not access that information, among other subjects. Ms Ferronato did express the view that, despite her privacy settings, it appeared that non-friends could access her Facebook information. I do not take that to mean that anybody could do so. In any event, the tribunal’s conclusion that the relevant posts were not generally available publications was based upon a finding of fact that was made after a consideration of all of the evidence and betrays no error of law.

Moreover, the respondent’s submissions were based upon the proposition that, if information could be accessed on some Facebook by anybody, it necessarily constituted a ‘generally available publication’. This is a misconception. That information, otherwise personal, might be accessible on some Facebook by anybody does not necessarily mean that the information is a generally available publication; equally, that information, otherwise personal, might be accessible somewhere on the Internet by anyone does not necessarily mean that the information is a generally available publication. Whether the information possesses that character depends upon a consideration of the facts and circumstances as a whole. The nature of the information, the prominence of the Facebook (or Internet website), the likelihood of the access and the steps needed to obtain that access are relevant considerations, among others. Ground 2 must be rejected.

Ground 5

The respondent contended that the information in sub-cll 5.1-5.4 of the notice of contention could not constitute personal information because it was established by the evidence that this information formed part of the specified generally available publications. This submission was based on a particular interpretation of s 11(1)(a) of the Information Privacy Act which the tribunal rejected.

As we have seen, s 11(1)(a) provides that nothing in the Act or in any IPP applies ‘to a document containing personal information, or to the personal information contained in a document, that is – (a) a generally available publication’. The definition of ‘generally available publication’ in s 3 relevantly specifies ‘a publication (whether in paper or electronic form) that is generally available to members of the public’. On the respondent’s interpretation, the information in sub-cll 5.1-5.4 was not personal information because, besides being contained in the screenshots, it was contained in the articles and on the Internet as specified in those sub-clauses. In other words, the respondent would have it that information in a document that is not publicly available (the downloaded screenshots that were given to the respondent) is not personal information if the information is contained in a document that is publicly available (allegedly, the newspaper articles and the pages on the Internet).

In support of that interpretation, the respondent drew attention to the distinction in the opening words of s 11(1) between a document containing personal information and to personal information in a document. The respondent relied upon the explanatory memorandum relating to s 11[27] and to learned commentary on the question.[28]
[27]Explanatory Memorandum, Information Privacy Bill 2000 (Vic) 6: ‘[This clause] grants an exemption in respect of specified types of information that are regarded as publicly available information, including public registers. With limited exceptions, the Act seeks only to regulate personal information that is not publically available’.
[28]Thomson Lawbook Co, Victorian Administrative Law vol. 2 (at update 154) [IPA 11.60].

The controversy about the interpretation of s 11(1)(a) concerns the scope of the exemption created by this provision. In the respondent’s submission, interpreting the provision so as to exempt information from privacy protection if it is generally publicly available is consistent with the purposes of the Information Privacy Act, which includes collecting and handling of ‘personal information’ (s 1(a)), and the objects in s 5(a)-(c), neither of which refer expressly to documents. In the appellant’s submission, so interpreting the provision would create an unreasonably wide exemption and defeat the protective purposes of the Act.

The proper interpretation of s 11(1) was considered in CT v Victorian Government Solicitors Office[29] on which the appellant relied. Sitting as the president of the tribunal, Morris J held that the provision was ‘concerned with documents that are generally available or publicly available. It is not concerned with information that is publicly available’.[30] His Honour went on to state that:

Further, it is difficult to see how the section could operate in a practical sense if it turned on whether information was publicly available, as this would involve an exercise that would always be controversial and difficult.[31]

The respondent submitted that the decision of Morris J in CT was incorrect and ought not to be followed.

[29](2005) 23 VAR 237 (‘CT’).

[30]Ibid 241 [19].

[31]Ibid 242 [20].

The president of the tribunal is a judge of this court.[32] By analogy with the doctrine of precedent as it applies to decisions of judges of this court,[33] I would follow the decision of Morris J unless I were persuaded that it was clearly wrong.
[32]Victorian Civil and Administrative Tribunal Act s 10(1).
[33]Tomasevic (2007) 17 VR 100, 105 [21]-[24] (Bell J).

With respect but without enthusiasm, I am so persuaded. Section 11(1) must be read as a whole.[34] The word document twice appears in the opening words of s 11(1). I accept that, in each case, it refers to the documents specified in paras (a)-(d). But the provision clearly stipulates that the exemption applies not only to a document containing personal information that is a generally available publication; it stipulates that the exemption also applies to personal information that is contained in a document that is a generally available publication. By virtue of the second stipulation, where personal information is contained in a document of the kind specified in paras (a)-(d), nothing in the Act nor in any Information Privacy Principle applies to it. As regards para (a), the intention of the legislation is that, however collected, personal information that is contained in a document that is otherwise published in a form that is generally available to members of the public will not have legislative privacy protection (see the definition of ‘generally available publication’ in s 3).
[34]Project Blue Sky Inc v Australian Broadcasting Authority (1998) 194 CLR 355, 381 [69] (McHugh, Gummow, Kirby and Hayne JJ).

With considerable force, Morris J points out that the interpretation of s 11(1) that I prefer would result in uncertainty about the privacy status of personal information. It would be protected by the Act and the Information Privacy Principles only when not contained in a document that was not (for example) a generally available publication (s 11(1)(a)), which may take time and resources to ascertain. As in the present case, an agency may seek to avoid responsibility for non-compliance by relying strategically upon this exemption well after the relevant collection has taken place.

A partial answer to this criticism is that, as regards para (a), mere publication of information on Facebook or the Internet does not, in my view, necessarily make it a ‘generally available publication’ for the purposes of the definition in s 3 (see above). While, I accept that this is only a partial answer, I think the legislature has clearly indicated that personal information contained in a document of the kind specified in paras (a)-(d) is not to have legislative privacy protection.

I therefore accept that the tribunal erred in law when interpreting s 11(1) of the Information Privacy Act. However, the conclusion that it reached that the screenshots were not generally available publications was not necessarily incorrect. The respondent was contending that the information in the screenshots was generally available to members of the public on Facebook and the Internet. For the reasons I have given, a more contextual and fact-intensive examination of the issue was required than that. Because of the interpretation that the tribunal adopted, it did not conduct that examination. If the outcome of the appeal turned upon it, I would probably have remitted the application back to the tribunal to reconsider this aspect of its decision in accordance with this judgment. As I think the appeal should be dismissed in any event (see below), there will be no such order.

Grounds of appeal
Grounds of appeal 1 and 2 (IPP1.1)

Ground of appeal 1 is that, having made certain findings, the tribunal

erred in finding that the collection of the personal information from the Facebook account for the purposes of a workplace disciplinary investigation was ‘necessary for one or more of the organisations functions or activities’ for the purposes of IPP 1.1.

Ground of appeal 2 is that the tribunal

ought to have found the collection of personal information from the Appellant’s Facebook account in such a manner without her knowledge or consent, was not ‘necessary for one or more of the organisations functions or activities’ and was in breach of IPP 1.1.

As specified, these grounds raise questions of fact, not law. As developed in argument, the grounds raise a question of law concerning the proper interpretation of IPP 1.1.

In the collections and notifications summary, the appellant stated that grounds 1 and 2 relate to:

· the second and third Daly collections

· the first second and third Faraday-Brash collections

As found by the tribunal, the factual context here relevant was that, having been given the abusive post, the respondent went on to obtain other personal information about the appellant, including by accessing her Facebook, which she operated under a pseudonym, without her knowledge. The tribunal found that this was necessary to carry out the misconduct investigation and therefore not in breach of IPP 1.1.

The appellant submitted that the tribunal adopted an interpretation of the expression ‘necessary for one or more of its functions or activities’ in IPP 1.1 that imposed too low a threshold. This raises a question of law.

As Gleeson CJ said in Mulholland v Australian Electoral Commission,[35] ‘the word “necessary” has different shades of meaning’ depending upon the legislative context.[36] After discussing several authorities in which the meaning of the word was considered, the Chief Justice stated: ‘There is, in Australia, a long history of judicial and legislative use of the term “necessary”, not as meaning essential or indispensable, but as meaning reasonably appropriate and adapted.’[37]
[35](2004) 220 CLR 181.
[36]Ibid 199 [39].
[37]Ibid 199-200 [39].

Similarly, the meaning of the word ‘necessary’ was considered in Pelechowski v The Registrar of the Court of Appeal (New South Wales).[38] In that case, Gaudron, Gummow and Callinan JJ said:[39]

The term ‘necessary’ in such a setting as this is to be understood in the sense given it by Pollock CB in Attorney-General v Walker,[40] namely as identifying a power to make orders which are reasonably required or legally ancillary to the accomplishment of the specific remedies for enforcement provided in Div 4 of Pt 3 of the District Court Act. In this setting, the term ‘necessary’ does not have the meaning of ‘essential’; rather it is to be ‘subjected to the touchstone of reasonableness’.[41]

[38](1999) 198 CLR 435.

[39]Ibid 452 [51].

[40](1849) 3 Ex 242, 255-6 [154 ER 833, 838-839].

[41]State Drug Crime Commission of NSW v Chapman (1987) 12 NSWLR 447, 452 (Allen J). See also Attorney-General v Leveller Magazine Ltd [1979] AC 440, 450 (Diplock LJ); Proprietors Units Plan No 52 v Gold(1993) 44 FCR 123, 126 (Gallop, Ryan and O’Loughlin JJ); Martin Dockray, ‘The Inherent Jurisdiction to Regulate Civil Proceedings’ (1997) 113 Law Quarterly Review 120, 130-1.

In my view, the test of what is ‘necessary’ for the functions or activities of the organisation as specified in IPP 1.1 is to be understood in the broad, practical sense discussed in these authorities. The principle is intended to ensure that information collection by organisations is purposive and not an end in itself. While the intention is to confine information collection to that which is necessary for the functions and activities of the organisation, it is not to restrain the reasonable performance of those functions and activities. To interpret ‘necessary’ narrowly would alter the proper balance between privacy protection and the conduct of public administration. It would not be consistent with the human right to privacy, which is neither absolute nor intended to interfere with the capacity of governmental organisations effectively to pursue their functions and activities. Therefore, in that principle, ’necessary’ does not mean ‘essential’ or ‘indispensable’ but ‘reasonably necessary’ for the organisation’s functions or activities, as correctly so decided by Macnamara DP in Re Ng v Department of Education,[42] which the tribunal specifically mentioned in the present case. As I have stated, the concept of reasonable proportionality comes into that assessment.
[42](2005) 23 VAR 86, 106 [84].

The tribunal found that the collection of the further information was necessary under IPP 1.1, so interpreted, after carefully considering the evidence in relation to this subject.[43] This conclusion was primarily based upon the consideration that the tribunal was conducting a misconduct investigation, which was a legitimate purpose. I think it understood and took into account the privacy interests that were at stake for the appellant and nature of the interference, which was carefully identified. There is nothing in the tribunal’s reasoning to suggest that an incorrect interpretation of the principle was adopted or that its approach was inconsistent with the human right to privacy. In particular, there is nothing to suggest that the tribunal adopted a threshold of ‘necessary’ for the organisation’s functions or activities that was too low. Upon the basis of the found facts, the tribunal was not bound to determine that IPP 1.1, properly interpreted, had been breached.
[43]Reasons for decision [172]-[174].

Grounds of appeal 1 and 2 are therefore rejected.

Grounds of appeal 3 and 4 (IPP 1.2)

Ground of appeal 3 is that, upon certain specified findings, the tribunal erred in finding that the respondent had collected personal information only by ‘lawful and fair means and not in an unreasonably intrusive way ‘as required by IPP 1.2.

Ground of appeal 4 is that the tribunal

ought to have found that the collection of personal information from the Appellant’s Facebook account without her knowledge or consent, by means that involved the use of the pseudonym personal information, was not collection of personal information by ‘lawful and fair means and not in an intrusive way’.

Again, as specified, these grounds raise issues of fact, not law. The appellant’s submissions developed these grounds further to raise questions of law.

In the collections and notifications summary, the appellant stated that grounds 3 and 4 relate to:

· the second and third Daly collections

· the first second and third Farraday-Brash collections

Again the gravamen of the appellant’s submission under these grounds of appeal was also that the tribunal interpreted IPP 1.2 in a manner that specified too law a standard. So interpreting IPP 1.2 the tribunal found that the principle had not been breached even though the collections of personal information from the Lora Otto Facebook homepage was carried out in an unreasonably intrusive and unfair manner and through the combining of pieces of personal information. While the appellant’s submissions under these grounds involved an element of circularity, I think legitimate questions of law were raised.

Information Privacy Principle 1.2 mandatorily requires an organisation to collect personal information only in a particular way. The purpose of this requirement is to confine organisations to the specified standard of collection. The standard is that the collection must be lawful, fair and not unreasonably intrusive. Each of these elements must separately be satisfied. Consistently with the beneficial purpose of the Information Privacy Principles, I would give a broad meaning to the ‘lawful’ collection requirement. Therefore, a collection breaching another Information Privacy Principle relating to collection, such as IPPs 1.1 and 1.4, would not be lawful under IPP 1.2.

The appellant submitted that the tribunal erred in law by interpreting and applying IPP 1.2 in a way that approved of the respondent’s method of collection simply because it did not involve ‘hacking’. It thus failed to consider the various elements of the principle and the appellant’s pleaded case, including her reliance upon a breach of IPP 1.4. The respondent submitted that the appellant’s submissions represented a reformulation of her case before the tribunal and were based upon an unfair and incomplete account of its findings. Noting the force of these criticisms, I reject the appellant’s submissions as put.

The appellant has not shown that the tribunal failed properly to apply and interpret IPP 1.2 by reference to all of its elements. Its finding that ‘hacking’ as a way of collection did not occur does not show that the tribunal confined its attention to that consideration. The tribunal expressly considered IPP 1.4 in a different context, finding (without legal error – see below) that it had not been breached.

The proper context for examining the tribunal’s consideration of IPP 1.2 is its careful consideration of the nature and purpose of the investigative process undertaken by or on behalf of the respondent and its conclusion that the process was reasonable, necessary and proper and did not involve breach of the Information Privacy Principles (except in a minor respect). Once the tribunal’s general findings are so appreciated, its express reference to the absence of ‘hacking’ is understandable. That, in the end, was the only way that the collection might have been in breach of IPP 1.2, and it was not.

Grounds 5 and 6 (IPP 1.3 (and 1.5))

Ground of appeal 5 is:

The Tribunal erred in law in finding that for the purposes of determining whether the Appellant had been made ‘aware’ of the matters listed in IPP 1.3 that:
(a)by implication, it was not necessary for the Respondent to specify the document the Respondent had collected and in which the personal information was contained; and
(b)the Notice of Investigation made it apparent what personal information the Respondent had.

Ground of appeal 6 is:

The Tribunal ought to have found that the Notice of Investigation did not make the Appellant aware of her personal information the Respondent had collected.

In the collections and notifications summary, the appellant stated that grounds 5 and 6 relate to:

· the Toy collection

· the first, second and third Daly collections

· the first, second and third Faraday-Brash collections

These grounds raise similar issues to those raised under grounds 7-14 and the reasoning here will apply to those grounds also.

As found by the tribunal, the factual context for the consideration of the issues raised by these grounds is that, at no material time, did officers of the respondent turn their minds to the notification obligations imposed by IPP 1.3 (or 1.5). The relevant information was collected and used in the investigative, charging and determinative process without express or indeed any regard to those obligations. The submissions of the respondent before the tribunal were that the steps taken on behalf of the respondent in that process were nonetheless sufficient to bring about compliance with the notification requirements in IPP 1.3 (and 1.5) and at the earliest practicable opportunity. The tribunal upheld those submissions.

Grounds of appeal 5 and 6 do not well identify the alleged errors of law. The appellant’s submissions in the appeal raised a complex admixture of legal and factual matters under these grounds. The court only has jurisdiction with respect to questions of law, which were clarified in argument, to which the analysis here will be confined.

The main purpose of the notification requirement on IPP 1.3 is to promote governmental transparency and respect for the autonomy and dignity of individuals with respect to their personal information. In the temporal respect, the obligation imposed by the principle is to take the reasonable steps to ensure ‘at or before the time (or, if that is not practicable, as soon as practicable after)’ the collection. The clear intent of the principle is that the steps be taken as early as practicably possible. Consistently with the importance of collection notification for privacy protection, the notification must be at or before the time of the collection and later only if that is not practicable and then as soon thereafter as is practicable.

The tribunal determined that IPP 1.3 (and 1.5) did not impose an obligation of immediate notification upon the respondent because this could have jeopardised the integrity of the disciplinary investigation.[44] That conclusion was based upon an interpretation of the principle that permitted the integrity of the disciplinary process to be taken into account in determining when it was ‘practicable’ to give the notification. I think that interpretation is correct. The concept of what is practicable necessarily involves an assessment that reasonably balances protection of privacy in relation to personal information with the purposes of the collection. Considerations such as the nature of the information, what is at stake for the individual and the degree of the interference, on the one hand, and the public interest being served by the collection, on the other, come into play. The tribunal’s ultimate assessment that IPP 1.3 (and 1.5) was not breached in this temporal respect was, on the findings of fact made, consistent with this concept of reasonable proportionality. I am not suggesting, nor did the tribunal decide, that it will be considered practicable to delay notification in all such cases, for the issue will always turn on the facts and circumstances of the case and a reasonable balancing of the matters to which I have referred.
[44]Reasons for decision [196].

The tribunal determined that IPP 1.3 (and 1.5) could be complied with by the organisation when taking steps for other purposes that happened to ensure that the individual was made aware of the relevant matters within the specified time. In my view, this interpretation of the principle is also correct. Zeqaj v Victoria Police[45] is another example in the tribunal of this matter being correctly so determined.
[45][2013] VCAT 2105 (20 December 2013) [124ff] (A Dea, Member).

I reach this conclusion because IPP 1.3 (and 1.5) imposes an obligation to take reasonable steps to ensure that the individual is made aware of the specified matters but does not stipulate how this is to be done (except that the steps must be reasonable) or refer to the organisation’s knowledge of the obligation. Nothing in the purpose or language of the principle suggests that steps taken without knowledge of the obligation but otherwise reasonable to ensure cannot constitute compliance. The purpose of the notification requirement is to bring the specified matters to the awareness of the individual in the interests of governmental transparency and respect for his or her autonomy and personal dignity in relation to personal information. Fulfilment of that purpose does not depend upon the state of knowledge of the notifying organisation. As long as the steps are reasonable for the ensuring in the circumstances, there will be compliance.

So interpreting IPP 1.3 (and 1.5), the question whether an organisation has properly complied with the notification obligation is an objective question of fact for the tribunal to determine, as the appellant submitted. In the present case, the tribunal went into this question in some detail, giving careful consideration to the evidence. It has not been shown that the tribunal made an error of law in the findings of fact that it made in this regard. The reasons for decision show that the tribunal did consider all of the matters specified in IPP 1.3 (a)-(f), finding that, during the disciplinary process, officers of the respondent did take reasonable steps to ensure that the appellant was made aware of those matters.

The submissions made on behalf of the appellant focussed upon certain passages in the reasons for decision that suggested otherwise. In particular, the tribunal said this about the subject of indirect notification in the facts and circumstances of the case:

Clearly, in this situation, a number of the provisions in IPP 1.3 do not apply – for example, the identity of the organisation was known to the complainant. She would also have been aware, expressly or impliedly, of most of the other matters listed in IPP 1.3 it being the case that the organization was her employer. She did not need to be told that she was able to gain access to the information. She would be presumed to have been aware of the purpose for which the information had been collected. Other parts of 1.3 – 1.3(d), regarding to whom the organization usually discloses the information; 1.3(e), any law requiring the particular information to be collected and 1.3(f), the main consequences for not providing all or part of the information - are simply not relevant in this context.[46]

The appellant submitted that this passage demonstrated that the tribunal did not properly apply IPP 1.3 (or 1.5) and, in effect, treated the obligations imposed therein as discretionary or subject to exemption.

[46]Reasons for decision [187]; see also [206].

The notification obligations in IPP 1.3 (and 1.5) serve the important purposes of promoting governmental transparency and respect for the autonomy and dignity of individuals in relation to their personal information. Where it applies (which would mean that the provisions of div 2 of pt 2 did not apply), the operation and application of the principle is neither discretionary nor subject to override. The obligation to take reasonable steps to ensure as early as practicable arises whenever an organisation collects personal information about an individual. Noting the conjunctive word ‘and’ between the last two of paras (a)–(f), the organisation must ensure that the individual is made aware of all of the matters specified, for they are all individually important and have particular work to do. Failure to take reasonable steps to ensure with respect to any one of them would represent non-compliance. I do not think that the tribunal determined otherwise.

Because the respondent had collected personal information about the appellant, the reasonable steps to ensure had to be taken. In the circumstances, this could be done, and was found by the tribunal to have been done, through the operation of the respondent’s disciplinary process. The tribunal found that para (a) was satisfied because the identity of the organisation was known to the appellant, and so on. I do not think the tribunal decided that the particular notification obligations were non-applicable or irrelevant. The tribunal rather found that the obligations were satisfied through the disciplinary process in the facts and circumstances of the case. In the reasons for decision, such words as ‘not apply’ and ‘not relevant’ are to be so understood.

In relation to the collection of personal information about an individual, an organisation has a positive obligation under IPP 1.3 (and 1.5) to take reasonable steps to ensure. It cannot discharge this obligation by speculating about whether the individual has awareness of the matters specified in paras (a)-(f). It cannot discharge the obligation by making a presumption or assumption about that subject. The tribunal was not suggesting otherwise and did not approach the matter upon a subjective basis. Reading the reasons for decision fairly, in context and as a whole,[47] I think the tribunal found that, upon objective consideration of all of the evidence, the respondent had taken reasonable steps to ensure through the disciplinary process that the appellant was made aware of the relevant matters as soon as practicable, taking into account as a fact that the appellant was an employee of the organisation. The tribunal so found in relation to all of the personal information of the appellant, including that she operated a Facebook account using a pseudonym and that, on behalf of the respondent, personal information was (lawfully) obtained from that Facebook. I generally accept the submissions made on behalf of the respondent in this regard.
[47]Minister for Immigration and Ethnic Affairs v Wu Shan Liang (1996) 185 CLR 259, 272 (Brennan CJ, Toohey, McHugh and Gummow JJ); Shock Records Pty Ltd v Jones [2006] VSCA 180 (7 September 2006) [85] (Bell AJA, Callaway and Ashley JJA agreeing).

I do not accept that the tribunal applied a different and lower standard to the personal information of the appellant because she was an employee of the respondent. The tribunal decided that the Information Privacy Principles applied in the context of the respondent’s employment of the appellant. Upon that basis, it applied IPP 1.3 (and 1.5) according to its terms. In doing so, it took into account as a relevant objective fact that the appellant was an employee of the respondent. This did not involve applying a lesser standard of privacy protection under the principle. I think the tribunal proceeded by determining, as an objective fact, what the information supplied to the appellant would have conveyed to her and, upon this basis, decided that the appellant’s obligations in IPP 1.3 (and 1.5) were satisfied. It committed no error of law in doing so.

Grounds of appeal 5 and 6 are rejected.

Grounds of appeal 7, 8, 9, 10, 11, 12, 13 and 14 (IPP 1.3 (and 1.5))

Ground of appeal 7 is:

The Tribunal erred in law in finding that provisions of IPP 1.3 did not apply to the Applicant because she was an employee of the Respondent, and in so doing applied a lower standard for personal information of employees.

Ground of appeal 8 is:

The Tribunal ought to have found that the provisions of IPP 1.3 did apply to the Appellant, and the Respondent remained under a positive obligation to ensure that the Appellant was aware of the matters listed in IPP 1.3

Ground of appeal 9 is:

The Tribunal erred in law in finding the Respondent was not required to inform the Applicant of matters in IPP 1.3, including:
(a)       how to gain access to the personal information collected;
(b)       who the organisation is that had collected the personal information;
(c)       any law that required the information to be collected;
(d)      and the main consequence of collecting the information;
as the Applicant was entitled for the purposes of IPP 1.3 to assume the Appellant already possessed this knowledge as an employees (sic).

Ground of appeal 10 is:

The Tribunal ought to have found that the Respondent was required to inform the Appellant of those matters listed in IPP 1.3, and that by failing to do so, the Respondent breached IPP 1.3

Ground of appeal 11 is:

The Tribunal erred in law in finding the Respondent did not need to take any positive steps to make the Appellant aware of matters under IPP 1.3, as it could be assumed that as a result of her employment the Appellant was already, either ‘expressly or impliedly’, aware of those matters listed in IPP 1.3.

Ground of appeal 12 is:

The Tribunal ought to have found that:
(a)IPP 1.3 imposed positive obligations on the Respondent as a collecting organisation to take steps to make the Appellant aware of the matters listed in IPP 1.3;
(b)the Respondent was not absolved of the obligation to take steps to provide the information prescribed by IPP 1.3 by assuming that the Appellant must have already known the information; and
(c)the failure of the Respondent to inform the Appellant of the matters listed in IPP 1.3 was a breach of IPP 1.3.

Grounds of appeal 13 is:

The Tribunal erred in law by applying a subjective test to the knowledge of the Applicant in determining what matters listed in IPP 1.3 the Respondent was required to make her aware of, rather than applying an objective test to knowledge based on the information actually provided by the Respondent to the Applicant in compliance with obligations under IPP 1.3.

Ground of appeal 14 is:

The Tribunal ought to have found that for the purposes of IPP 1.3 the test of whether an individual has been made aware of the information listed in IPP 1.3 is an objective test that is based on the positive actions of the collecting organisation in making the person so aware.

In the collections and notifications summary, the appellant stated that grounds 7 to 14 relate to:

· the Toy collection

· the first, second and third Daly collections

· the first, second and third Faraday-Brash collections

Each of these grounds of appeal must be dismissed in accordance with the reasoning behind the dismissal of grounds of appeal 5 and 6.

Grounds of appeal 15, 16 and 17 (Information Privacy Principle 1.4)

Ground of appeal 15 is:

The Tribunal erred in law in finding that for the purposes of IPP 1.4 that it was not ‘reasonable and practical’ (sic) for the Respondent to obtain the personal information from the Appellant.

Ground of appeal 16 is:

The Tribunal erred in law in the determination of what was ‘reasonable and practical’ (sic) under IPP 1.4 by:
(a)ignoring or failing to put any or sufficient weight on the evidence of Geraldine Hughes; and
(b)finding that neither the Appellant and her union representative, Geraldine Hughes, was participating in the investigation.

Ground of appeal 17 is:

The Tribunal ought to have found that for the purposes of IPP 1.4 it was ‘reasonable and practical’ (sic) for the Respondent to obtain the personal information from the Appellant, and by failing to do so was in breach of IPP 1.4.

These grounds of appeal barely raise questions of law, if at all. Again, the appellant’s submissions covered a range of factual and legal matters. I will confine myself to the legal issues.

In the collections and notifications summary, the appellant stated that grounds 15 and 16 relate to:

· the second and third Daly collections

· the first, second and third Faraday-Brash collections

The summary does not refer to ground 17 but it raises similar issues to grounds 15 and 16 and the reasoning here applies to that ground also.

These grounds of appeal all concern IPP 1.4. This principle is mandatory in terms and compels an organisation to collect personal information about an individual only from the individual if it is reasonable and practicable to do so. Personal information about an individual cannot be collected from a source other than the individual unless it is not so reasonable and practicable.

The purpose of IPP 1.4, as is the human right to privacy in the relevant respect, is to ensure respect for the autonomy and dignity of individuals with respect to their personal information. Information about individuals is an aspect of their personal privacy and therefore ordinarily within their autonomous control. It follows that respect should be afforded to an individual’s freedom to choose whether to divulge the information or not. So that individual autonomy in relation to personal information is not undermined by collection from other sources, collection must be directly from the individual unless it is not reasonable and practicable to do so. As such information is an aspect of the privacy of individuals, collection should not ordinarily occur without them being the first point of collection. Imposing such an obligation also ensures that individuals are made aware of collection activity in relation to their personal information. Again, as such information is an aspect of the privacy of individuals, collection should not ordinarily occur without their knowledge.

To repeat, the relevant factual context in the present case is that the respondent was not conscious of the obligations specified in the Information Privacy Principles, including 1.4. The respondent did not collect the relevant personal information from the appellant. If it would have been reasonable and practicable to do so, it would have been a breach of IPP 1.4 for the respondent to collect it by other means.

Victorian governmental organisations should be aware of their legal responsibilities, including the obligations that arise under the Information Privacy Principles. It is regrettable that the respondent did not. But IPP 1.4 operates objectively: it is not breached by collecting personal information about an individual other than from the individual where, as a matter of fact, it would not have been reasonable and practicable to do so. As with IPP 1.3, the operation of IPP 1.4 does not depend upon the organisation making a conscious decision to collect personal information about an individual from, or not from, the individual. It follows that where, objectively, it would not be so reasonable and practicable, an organisation is not in breach of IPP 1.4 by obtaining personal information about an individual other than from that individual without considering this issue. Conversely, it is not sufficient for an organisation subjectively to determine that is it not ‘reasonable and practicable’ to collect personal information about an individual other than from that individual. To collect such information other than from the individual must be objectively ‘reasonable and practicable’ whether the organisation thinks so or not.

The appellant’s submissions in relation to these grounds of appeal focussed upon this passage in the tribunal’s reasons for decision:

IPP 1.4 states that ‘if it is reasonable and practicable to do so, an organization must collect personal information about an individual only from that individual’. I consider that in this particular case, such a course of action was not ‘reasonable or practicable’, given that neither the complainant nor her union representative was participating in the investigation. In the circumstances, the respondent may well have been of the opinion that the complainant would not be forthcoming in providing information to assist the investigation.[48]

[48]Reasons for decision [193].

The appellant submitted that the tribunal was mistaken to find that the appellant and her union representative were not participating in the investigation and that important evidence on this subject (including the witness statement of the union representative) was not taken into account. I reject this submission. I do not see that the tribunal’s finding in this connection was inconsistent with the evidence. More importantly, however, any mistake made by the tribunal in this connection was a mistake of fact, not law. I do not infer from the tribunal’s failure to mention the witness statement or list the union representative in the witness list that this evidence was not taken into account. The weight to be given to the evidence was a matter for the tribunal.

As discussed, the concept of what is ‘reasonable and practicable’ in IPP 1.4 is an objective one. I reject the submission of the appellant that the tribunal determined this question by reference to a subjective standard. In referring to the respondent’s opinion, the tribunal was analysing the issue in retrospect and attempting to reconstruct objectively what was ‘reasonable and practicable’ in the circumstances that obtained.

More fundamentally, these grounds of appeal cannot succeed once it is accepted, as the tribunal found (without legal error and consistently with human rights), that it was appropriate for officers of the respondent to conduct the disciplinary investigation and prosecute the charges up to a certain point without first approaching the appellant for the relevant information. Attempting to collect such information from her prior to that point could have undermined the integrity of the disciplinary process, as the tribunal found in relation to IPP 1.2 and 1.3 and must have found in relation to IPP 1.4. In other words, the tribunal was entitled to take into account that personal collection from the appellant might have defeated the purpose of the collection itself. The above passage from the reasons for decision of the tribunal must be read in the context of the reasons for decision as a whole. Given the tribunal’s general emphasis upon the importance of preserving the integrity of the respondent’s disciplinary process, it is clear that this would have been taken into account in relation to IPP 1.4.

Grounds 15, 16 and 17 are therefore rejected.

Grounds of appeal 18 and 19 (IPP 1.3)

Ground of appeal 18 is:

The Tribunal erred in law in finding that for the purposes of interpreting how an individual is to be made ‘aware’ of the various matters set out in IPP 1.3, a copy of a document collected containing the personal information does not have to be provided to the individual, even in circumstances where personal information about an individual:
(a)       is in the form of a document;
(b)       is not collected from that individual;
(c)       is collected without the individual’s knowledge or consent; and
(d)      the individual is an employee of the collecting organisation.

Ground of appeal 19 is:

The Tribunal ought to have found that when personal information about an individual is contained in a document and that document:
(a)       is not collected from that individual;
(b)       is collected without the individual’s knowledge or consent; and
(c)       the individual is an employee of the collecting organisation
that, in order to comply with the requirements of IPP 1.3, the collecting organisation must provide a copy of the document to the individual whose personal information is contained therein.

In the collections and notifications summary, the appellant stated that grounds 18 and 19 relate to:

· the Toy collection

· the first, second and third Daly collections

· the first, second and third Faraday-Brash collections

These grounds place in contention the proper interpretation of IPP 1.3 in relation to the way in which an organisation must make an individual aware of the relevant matters. Contrary to the appellant’s submissions, the tribunal decided that it is the information, not documents containing the information, of which the individual must be made aware:

Regarding the screenshot collected by Catherine Daly, the respondent was required to comply with the matters set out in IPP 1.3, to the extent that these matters were relevant. As stated he was not required to provide the actual information to the complainant. As was the case with the information the subject of the third alleged breach, I consider that the complainant was made aware to a sufficient degree of the fact that her Facebook page had been accessed, that her pseudonym was known and that Alicia Parker was a Facebook friend. It would also have been apparent that Paula Ferronato’s Facebook wall had been accessed in order to investigate the allegations. In providing the Notice of Investigation, the respondent complied with these requirements to the extent necessary.[49]

[49]Reasons for decision [204].

The appellant submitted that, where a document containing personal information has been collected, compliance with IPP 1.3 requires provision of a copy of the document or provision of access to the document. At the least, information as to the nature and substance of the document must be given. There must be no ambiguity in the individual’s mind as to what has been or is to be collected. Such an interpretation is consistent with the purpose of IPP 1.3, especially promoting transparency. I can accept much of what was said on behalf of the appellant under these grounds of appeal but not the general proposition that notification of information collected in documentary form always, and in the first instance, requires access to the document itself.

The purposes in s 1 and the objects in s 5 of the Information Privacy Act are expressed in terms of personal information, not documents. The purposes and objects of the legislation do not suggest that, in cases of collection of documentary information, compliance with IPP 1.3 always, and in the first instance, requires notification in terms of the document.

Under the definition in s 3, ‘personal information’ means ‘information or an opinion (including information or an opinion forming part of a database), that is recorded in any form …’ By reason of this definition, the statutory concept of ‘personal information’ is confined to recorded personal information and does not extend to personal information generally. Therefore, the Information Privacy Act applies to recorded personal information and not to personal information generally. It also follows that, in every case in which the obligation in IPP 1.3 arises, there will be a record of the information concerned: the principle only applies to personal information so defined and the definition only captures information that is recorded. In many if not most cases that record will be documentary.

Despite the fact that, under the statutory scheme, the personal information to which the obligation in IPP 1.3 applies is recorded personal information, the obligation in that principle is not expressed by reference to the record, such as a document, but by reference to the information. This seems to be deliberate and the collection notification scheme seems to work perfectly well upon that basis.

Section 4(1) contains an interpretative provision in the following terms:

For the purposes of this Act, an organisation holds personal information if the information is contained in a document that is in the possession or under the control of the organisation, whether alone or jointly with other persons or bodies …

This provision relates to when an organisation holds personal information. It will be so held if the information is in a document possessed or controlled (alone or jointly) by the organisation. The provision treats the personal information as the content and the document as the form in which the information is held. It does not conflate content and form such as to support an interpretation of IPP 1.3 whereby, in the case of documentary collection, notification always, and in the first instance, is required in terms of the document.

The language of IPP 1.3 is expressed in terms of taking reasonable steps to ensure that the individual is made aware of the matters specified in paras (a)-(f) in relation to the information, not any document containing the information. However desirable or practical it may be in cases of documentary collection to comply with this principle by reference to the document containing the information, the specified matters permit compliance, and compliance is (at least usually) capable of being carried out, by reference to the information. I think that IPP 1.3 does contemplate that an individual will ultimately be able to obtain access to a document (or other form of recording) containing information because access to the information in that form will involve access to the document (see para (c)). But it is too much to interpret IPP 1.3 as always, and in the first instance, requiring notification of a documentary collection by reference to the document.

In some cases, the form in which the personal information is recorded, whether that is documentary or electronic, will itself convey content that represents personal information. Personal information in an Internet website or on an individual’s Facebook may fall into this category, depending upon the circumstances. In cases where collection is carried out by reference to information in such a form, the notification requirement in IPP 1.3 will need to include making the individual aware of the form in which the collection occurred. But that can be done, at least in the first instance, without necessarily providing a copy of the document or other form of recording in which the organisation holds the information, as long as information sufficient for the purpose is given.

In the present case, the tribunal carefully attended to the question of fact whether the respondent had complied with IPP 1.3 in these critical respects. The tribunal found that, through the disciplinary process, officers of the respondent notified the appellant of the contents and form of the information in question. For example, the tribunal expressly found that officers of the respondent implicitly informed the appellant that access had been made to the appellant’s Facebook, which she operated under a pseudonym.[50] These were matters of fact for the tribunal to decide. No error of law has been established in relation thereto.
[50]Reasons for decision [204].

Grounds 18 and 19 are rejected.

Grounds of appeal 16 and 22 (ignoring relevant considerations)

Ground 16 is:

The Tribunal erred in law in the determination of what was ‘reasonable and practical’ (sic) under IPP 1.4 by:
(a)ignoring or failing to put any or sufficient weight on the evidence of Geraldine Hughes; and
(b)finding that neither the Appellant and her union representative, Geraldine Hughes, was participating in the investigation.

Ground 22 is:

The Tribunal erred in law in giving no consideration or weight, or insufficient weight to the evidence of Geraldine Hughes.

As I conclude above in relation to grounds 15, 16 and 17, the appellant has not established that the tribunal failed properly to consider the evidence of the appellant’s union representative. These grounds are rejected.

It follows that all of the grounds of appeal of the appellant are rejected. The appeal must therefore be dismissed.

Conclusion

This appeal raised important, novel and reasonably arguable questions about the application of the Information Privacy Act in the social media context and in particular about the application of the Information Privacy Principles to personal information on Facebook. Therefore leave to appeal will be granted.

However, the appellant has not established that the tribunal made any legal error in (substantially) dismissing her claim against the respondent for failing to observe its obligations under those Principles. For the reasons given in this judgment, the tribunal did not err in law in deciding that the respondent had (substantially) complied with those obligations. Therefore the appeal must be dismissed.

FACEBOOK GLOSSARY
Cover photo	The large image at the top of a Facebook user’s profile.
Facebook homepage	An individual user’s profile page. A Facebook user creates their profile page by uploading photos, images and information about themselves. Who can see a person’s Facebook homepage depends on the person’s privacy settings.
Facebook message	A private message between Facebook users delivered to a Facebook user’s inbox. It is also called a Facebook chat. A Facebook user can send a message/chat to any number of his/her friends at a time’
Facebook status	A feature that allows users to ‘post’ and share a small amount of content on their profile, on their Facebook friends’ walls and in Facebook News Feeds (a centre column that shows updates from the people and pages that user follows on Facebook). Facebook status is one of the key interactive features on Facebook. It allows users to receive information about what their friends are doing, reading, watching or thinking, and provides opportunities for friends to comment and interact based on what is shared. Updates can be shared from a Web browser, mobile site or through text message.
Facebook wall	The profile space where a Facebook user’s content is displayed. It shows updates of a user’s recent activity on Facebook – for example, a comment the user has posted on another Facebook friend’s wall. Who can see a person’s Facebook wall depends on the person’s privacy settings.
Profile photo	The small picture next to the Facebook user’s name.

[2016] VSC 285

11 October 2016