NWFQ and Privacy Commissioner - [2019] AATA 1302

NWFQ and Privacy Commissioner [2019] AATA 1302 (14 June 2019)
Division:FREEDOM OF INFORMATION DIVISION
File Number(s): 2017/4345 and 2017/2393
Re:NWFQ
APPLICANT

AndPrivacy Commissioner
RESPONDENT

AndSecretary, Department of Defence
OTHER PARTY

And Comcare
OTHER PARTY

DECISION
Tribunal: Deputy President Gary Humphries AO
Date:14 June 2019
Place:Canberra

The Commissioner’s decisions of 24 March and 26 June 2017 are affirmed.
............................................................
Deputy President Gary Humphries AO
Catchwords
PRIVACY – review of decision of the Privacy Commissioner – where Commissioner found that data security failure caused interferences with the Applicant’s privacy in breach of Part III of the Privacy Act 1988 – where it was determined that the Other Parties were consequently liable to pay compensation for non-economic loss and her legal expenses – whether the sums payable by the Other Parties should be increased – whether Applicant is entitled to aggravated damages – decision under review is affirmed
Legislation
Freedom of Information Act 1982
Privacy Act 1988 s 52
Cases
Beezley v Repatriation Commission [2015] FCAFC 165
'BO’ and AeroCare Pty Ltd [2014] AICmr 32
CM’ and Corporation of the Synod of the Diocese of Brisbane [2014] AICmr 86
Dell v Dalton (1991) 23 NSWLR 528
‘DK’ v Telstra Corporations Limited [2014] AlCmr 118
Freelancer International Pty Ltd and Australian Information Commissioner [2017] AATA 2426
Hall v A & A Sheiban Pty Ltd [1989] FCA 72
‘HW’ v Freelancer International Pty Ltd [2015] AlCmr 86
'LA' and Department of Defence (Privacy) [2017] AICmr 25
‘LB’ and Comcare (Privacy) [2017] AICmr 28
‘LU’ and Department of Defence (Privacy) [2017] AICmr 61
Rummery and Federal Privacy Commission and Anor [2004] AATA 1221
REASONS FOR DECISION
Deputy President Gary Humphries AO
14 June 2019
INTRODUCTION

The Applicant in these proceedings has been given a pseudonym (NWFQ) to protect her identity. She is a long serving officer of the Australian Army. Between 2011 and 2012 a serious breach of her privacy occurred when Comcare published on its website a report which contained extensive personal information about her, including personal medical records. The report was taken down from Comcare’s website in August 2012, but the Applicant made a complaint to the Privacy Commissioner (the Commissioner), who conducted an investigation. In 2017 the Commissioner found, in two decisions, that both the Department of Defence (Defence) and Comcare had breached the (then) Information Privacy Principles (IPPs) in relation to the Applicant, and determined that they must pay her compensation of $30,000 and reimburse $6,000 of the legal expenses she had incurred in relation to that breach.
Later in 2017 the Applicant lodged applications for merits review by the Tribunal of the decisions made by the Commissioner in relation to the quantum of damages for non-economic loss, aggravated damages and reimbursement of legal expenses awarded against Comcare and Defence (application 2017/2393 in relation to Comcare and application 2017/4345 in relation to Defence). She argued that the amounts awarded by the Commissioner were inadequate and should be increased to reflect the…

Grounds of appeal

[14] The appellant contends that the primary judge erred in finding that the respondent had discharged the onus of establishing the matters required under the relevant provision.

[15] It was submitted that his Honour failed to give adequate weight to the evidence of the second witness, and that the findings of fact were not reasonably open on the material before the Court.

[16] The respondent, for its part, submits that no error is disclosed, and that the conclusions reached were well within the range of outcomes available to the primary judge.

Consideration

[17] It is convenient to deal first with the question of construction, as the resolution of that issue informs the remaining grounds advanced by the appellant.

[18] For the reasons that follow, we are of the view that the appeal should be allowed in part and the matter remitted for further determination.

Continue reading NWFQ and Privacy Commissioner

Details

AGLC: NWFQ and Privacy Commissioner [2019] AATA 1302
Case: [2019] AATA 1302
Decision Date: 14 June 2019

CaseChat Overview and Summary

This matter concerned an application for review of decisions made by the Privacy Commissioner. The applicant, a serving member of the Defence Force, alleged that a data security failure by the Department of Defence and Comcare had led to interferences with her privacy. The Commissioner had previously found the parties liable to pay compensation for non-economic loss and legal expenses, and the applicant sought an increase in these sums, as well as aggravated damages.

The primary legal issues before the Tribunal were whether the compensation awarded by the Commissioner for non-economic loss was inadequate and whether the applicant was entitled to aggravated damages. The applicant contended that the response to the discovery of the poorly redacted report, which contained her personal and medical information, was lackadaisical and that subsequent conduct by Defence constituted harassment and an attempt to terminate her service. Defence and Comcare argued that the disclosure was due to human error and that their subsequent actions were not malicious.

The Tribunal considered the applicant's claims for increased compensation and aggravated damages together, noting they were partly based on Defence's conduct after the breaches were discovered. While acknowledging the applicant's distress and allegations of harassment, the Tribunal found that the evidence did not support an award of aggravated damages. The Tribunal also addressed a separate submission by Defence that it had mistakenly advised the Commissioner that a poorly redacted report had been supplied to HBA Consulting. The Tribunal was satisfied that HBA had not received the report but determined that amending the Commissioner's previous finding was neither desirable nor necessary, as the Commissioner's decision regarding the supply of the report was based on the evidence before him at the time and was irrelevant to the resolution of the other issues before the Tribunal.

The Tribunal affirmed the Commissioner's decision, finding no basis to increase the compensation awarded or to grant aggravated damages. The Tribunal was satisfied that the Commissioner had not misinterpreted or misapplied the relevant privacy principles concerning the disclosure of the report.

Orders

Orders of the court

Full text does not contain this section.

Background

Background to the litigation

The Applicant was self-represented at the hearing. The Commissioner, represented by Ms Mihalic, made submissions in support of the two decisions under review, and assisted the Tribunal generally with factual matters. Both the Secretary of the Department of Defence and Comcare were represented by Ms Katavic of Counsel, who played the role of contradictor to the applications.BACKGROUND The Applicant enlisted in 1978 (initially in the Army Reserve) and rose through the ranks over the subsequent 40 years of her military service. At the time of this hearing she had reached the rank of Major. However, she was also beset with periods of severe ill-health during her service, including a diagnosis of terminal lung cancer in 2002. In 2009 she was employed by Defence in its Land Systems Division (LSD). On 12 October 2009, her solicitors requested that Comcare investigate whether her employment with LSD had caused or contributed to her contraction of cancer. The request arose from concern that there was a cancer cluster[1] at the Victoria Barracks in Melbourne. Comcare completed an investigation and produced a report, which included personal information of the Applicant.[1] In this decision, italicised text is used to indicate direct quotations. In July 2011, she made a request under the Freedom of Information Act 1982 for a copy of the Comcare report. Comcare provided a version of the report to her. Subsequently, a version of the report that did not properly de-identify the Applicant (the poorly redacted report) was made publicly available through the FOI disclosure log on Comcare's website. The personal information about the Applicant in the report included her full name, her residential address, date of birth and extensive details of her medical records, including illnesses and conditions she had been treated for. At some point the poorly redacted report was also placed into a folder on the Defence Records Management System (called Objective) where it could be accessed by LSD staff (approximately 1,270 people). On 8 August 2012, Darryl Felix, an employee of LSD, sent an email to the groups All Staff Victoria Barracks Melbourne and All Staff Defence Plaza Melbourne, in which he made allegations concerning, among other things, a cancer cluster. In response, on 9 August 2012, Major General Grant Cavenagh, the head of LSD, sent an email to DMO LSD Staff in which he responded to some of the issues raised in Mr Felix’s email. In his email General Cavenagh provided a link to the poorly redacted report available on Comcare's website. It appears he referenced this report in the email to rebut the suggestion that there was a cancer cluster at the Victoria Barracks. Upon reading that email, the Applicant learned for the first time that the poorly redacted report on Comcare's website contained her personal information. She told the Tribunal she was shocked by the discovery. She raised the presence of her personal information on the website with the office of General Cavenagh on 10 August 2012. A series of emails and telephone calls ensued over the course of that day involving Defence and Comcare staff, directed at removing access to the Applicant’s personal information. It appears that the outcome of this activity was that the poorly redacted report was removed from the Comcare website later that day, although there was some evidence before the Tribunal that the report may still have been accessible to LSD staff through the Objective folder for a few days after 10 August. Also later that day, General Cavenagh sent an email to all LSD staff requesting that they immediately destroy any copies of the poorly redacted report they may have printed or downloaded.

Evidence

Evidence Before The Court

The Applicant contended before the Tribunal that the sum of $10,000 awarded by the Commissioner as compensation for the loss or damage arising from Defence’s breaches of her privacy was inadequate. She submitted that this amount be substantially increased. In addition, she submitted that the Commissioner had been in error in determining that Defence’s actions in respect of her did not satisfy the conditions for a grant of aggravated damages. As both these claims were based at least partly on the conduct of Defence subsequent to the discovery of the breaches in August 2012, I will consider them together.The evidence Defence and Comcare contended that the appearance of the Applicant’s personal information on the Comcare website and on the Objective network occurred through human error. I do not understand the Applicant to have suggested that there was malice associated with this, although she submitted that the response (particularly by Defence) to its discovery was lackadaisical. However, she did allege malice with respect to Defence’s subsequent conduct. She referred to Defence’s behaviour, resulting from [my] reaction to Defence’s interference with [my] privacy, to include frequent psychological assessments, a determined attempt to terminate [my] Army service, and ongoing harassment in the workplace. A statement by Mr Felix was tendered. In it he described meeting the Applicant for the first time on 9 August 2012. He said that, following the discovery that her privacy had been breached, she was trembling, vulnerable, teary and distressed. He accompanied her to a meeting on 10 August with Ms Isaacs, where the Applicant asked that her personal information be withdrawn immediately. Mr Felix wrote that Ms Isaacs tried to play down the seriousness of this matter by patronising [the Applicant] in stating that the information was common knowledge and on the Comcare Website… He said that they left Ms Isaacs’ office without any resolution as to if or when this matter would be resolved. The Applicant told the Tribunal she was called on 10 August 2012 and directed not to come to work by her director, Colonel Rye, who also told her not to neck herself (that is, not to suicide). Col Rye then rang her on the following Monday, demanding to know why she was not at work. The Applicant alleged that Squadron Leader Stewart, at Colonel Rye’s instigation, began to visit her at her home to elicit information for Colonel Rye. She also said that her director made unrealistic work demands on her, for example by requiring that she identify duplicates in 150,000 electronic files in the space of three weeks without the assistance of IT staff. Later in August 2012, Colonel Rye required her to undergo a psychological assessment to ascertain her suitability for continued service with the Defence Force. This initiated, she said, a succession of attempts to have her declared psychologically unfit for service; these attempts were persisting to the present time, causing her insecurity and upset. She claimed that General Cavenagh and Colonel Rye disapproved of [her] response to the breach of privacy, initiated assessments attempting to have her declared unfit to serve in the ADF and engaged in a program of harassment and psychological injury. She was required to undertake a further psychological assessment in 2014. All of this, she maintained, was out of keeping with what she described as a stellar career in the Army before this point, a career which has led to many awards and commendations, some of which were tendered.

Decision

Reasons for decision

Full text does not contain this section.

Ratio Decidendi

Legal Principle Established

The Tribunal was also asked to vary the Commissioner’s finding that Defence had supplied the poorly redacted report to HBA in about August 2012. This request stemmed from a submission from Defence that, following an examination of its records, it determined that it had been in error to have earlier advised the Commissioner that the report had been supplied to HBA. CONSIDERATIONDid Defence provide a copy of the poorly redacted report to HBA Consulting? The matter referred to in the previous paragraph can be disposed of briefly. The Applicant took the Tribunal to a number of documents in the written evidence which made reference to the supply by Defence of the poorly redacted report (or possibly the unredacted version of the report) to HBA. Conversely, Defence referred the Tribunal to a letter from HBA confirming that, following an examination of their files, they had never received a copy of the report. Defence submitted that it had been in error to advise the Commissioner in the course of his investigation that the report had been so supplied. I am comfortably satisfied that the evidence shows HBA was never supplied with the report. However, for the reason given in the next paragraph, I do not consider it necessary to set out in detail the basis for forming this view. I have been asked to amend the Commissioner’s decision in ‘LU’ to reflect that HBA was never supplied with the report, but I do not consider that to be either desirable or necessary. The Commissioner’s decision stands as his assessment of the evidence as it stood at the conclusion of his investigation. The fact that a more complete picture is available to this Tribunal does not necessitate the amendment of the Commissioner’s finding at that time. Whether the report was made available to HBA is irrelevant to the resolution of the other issues before the Tribunal. This is because the Commissioner found in ‘LU’ that the supply (as he supposed) by Defence of the document to HBA was permitted for a secondary purpose pursuant to IPP 10.1(c), that is, that its use was required or authorised by or under law. The Commissioner found that Defence had duties under the relevant work, health and safety legislation to conduct its business so as to ensure the health and safety of its workers and other people (at [51]-[52]). The events of August 2012 had given rise to concerns regarding workplace behaviour and practices, which required investigation. The supply of the report to an independent consultant to facilitate those investigations was consistent with Defence’s obligations under the law. If there was no breach of an IPP by virtue of the supply of the report, clearly there can be no question of compensation or damages in respect of the supply. There was no submission from the Applicant before me suggesting that the Commissioner had misinterpreted or misapplied IPP 10. In my view, he did not.Application 2017/4345: should the award of compensation against Defence be increased? Is the Applicant entitled to aggravated damages?