NWFQ and Privacy Commissioner - [2019] AATA 1302

NWFQ and Privacy Commissioner [2019] AATA 1302 (14 June 2019)
Division:FREEDOM OF INFORMATION DIVISION
File Number(s): 2017/4345 and 2017/2393
Re:NWFQ
APPLICANT

AndPrivacy Commissioner
RESPONDENT

AndSecretary, Department of Defence
OTHER PARTY

And Comcare
OTHER PARTY

DECISION
Tribunal: Deputy President Gary Humphries AO
Date:14 June 2019
Place:Canberra

The Commissioner’s decisions of 24 March and 26 June 2017 are affirmed.
............................................................
Deputy President Gary Humphries AO
Catchwords
PRIVACY – review of decision of the Privacy Commissioner – where Commissioner found that data security failure caused interferences with the Applicant’s privacy in breach of Part III of the Privacy Act 1988 – where it was determined that the Other Parties were consequently liable to pay compensation for non-economic loss and her legal expenses – whether the sums payable by the Other Parties should be increased – whether Applicant is entitled to aggravated damages – decision under review is affirmed
Legislation
Freedom of Information Act 1982
Privacy Act 1988 s 52
Cases
Beezley v Repatriation Commission [2015] FCAFC 165
'BO’ and AeroCare Pty Ltd [2014] AICmr 32
CM’ and Corporation of the Synod of the Diocese of Brisbane [2014] AICmr 86
Dell v Dalton (1991) 23 NSWLR 528
‘DK’ v Telstra Corporations Limited [2014] AlCmr 118
Freelancer International Pty Ltd and Australian Information Commissioner [2017] AATA 2426
Hall v A & A Sheiban Pty Ltd [1989] FCA 72
‘HW’ v Freelancer International Pty Ltd [2015] AlCmr 86
'LA' and Department of Defence (Privacy) [2017] AICmr 25
‘LB’ and Comcare (Privacy) [2017] AICmr 28
‘LU’ and Department of Defence (Privacy) [2017] AICmr 61
Rummery and Federal Privacy Commission and Anor [2004] AATA 1221
REASONS FOR DECISION
Deputy President Gary Humphries AO
14 June 2019
INTRODUCTION

The Applicant in these proceedings has been given a pseudonym (NWFQ) to protect her identity. She is a long serving officer of the Australian Army. Between 2011 and 2012 a serious breach of her privacy occurred when Comcare published on its website a report which contained extensive personal information about her, including personal medical records. The report was taken down from Comcare’s website in August 2012, but the Applicant made a complaint to the Privacy Commissioner (the Commissioner), who conducted an investigation. In 2017 the Commissioner found, in two decisions, that both the Department of Defence (Defence) and Comcare had breached the (then) Information Privacy Principles (IPPs) in relation to the Applicant, and determined that they must pay her compensation of $30,000 and reimburse $6,000 of the legal expenses she had incurred in relation to that breach.
Later in 2017 the Applicant lodged applications for merits review by the Tribunal of the decisions made by the Commissioner in relation to the quantum of damages for non-economic loss, aggravated damages and reimbursement of legal expenses awarded against Comcare and Defence (application 2017/2393 in relation to Comcare and application 2017/4345 in relation to Defence). She argued that the amounts awarded by the Commissioner were inadequate and should be increased to reflect the circumstances of the breaches of the IPPs and the conduct of the respondent parties subsequently.
The Applicant was self-represented at the hearing. The Commissioner, represented by Ms Mihalic, made submissions in support of the two decisions under review, and assisted the Tribunal generally with factual matters. Both the Secretary of the Department of Defence and Comcare were represented by Ms Katavic of Counsel, who played the role of contradictor to the applications.
BACKGROUND
The Applicant enlisted in 1978 (initially in the Army Reserve) and rose through the ranks over the subsequent 40 years of her military service. At the time of this hearing she had reached the rank of Major. However, she was also beset with periods of severe ill-health during her service, including a diagnosis of terminal lung cancer in 2002. In 2009 she was employed by Defence in its Land Systems Division (LSD). On 12 October 2009, her solicitors requested that Comcare investigate whether her employment with LSD had caused or contributed to her contraction of cancer. The request arose from concern that there was a cancer cluster[1] at the Victoria Barracks in Melbourne. Comcare completed an investigation and produced a report, which included personal information of the Applicant.
[1] In this decision, italicised text is used to indicate direct quotations.
In July 2011, she made a request under the Freedom of Information Act 1982 for a copy of the Comcare report. Comcare provided a version of the report to her. Subsequently, a version of the report that did not properly de-identify the Applicant (the poorly redacted report) was made publicly available through the FOI disclosure log on Comcare's website. The personal information about the Applicant in the report included her full name, her residential address, date of birth and extensive details of her medical records, including illnesses and conditions she had been treated for.
At some point the poorly redacted report was also placed into a folder on the Defence Records Management System (called Objective) where it could be accessed by LSD staff (approximately 1,270 people).
On 8 August 2012, Darryl Felix, an employee of LSD, sent an email to the groups All Staff Victoria Barracks Melbourne and All Staff Defence Plaza Melbourne, in which he made allegations concerning, among other things, a cancer cluster. In response, on 9 August 2012, Major General Grant Cavenagh, the head of LSD, sent an email to DMO LSD Staff in which he responded to some of the issues raised in Mr Felix’s email. In his email General Cavenagh provided a link to the poorly redacted report available on Comcare's website. It appears he referenced this report in the email to rebut the suggestion that there was a cancer cluster at the Victoria Barracks. Upon reading that email, the Applicant learned for the first time that the poorly redacted report on Comcare's website contained her personal information. She told the Tribunal she was shocked by the discovery.
She raised the presence of her personal information on the website with the office of General Cavenagh on 10 August 2012. A series of emails and telephone calls ensued over the course of that day involving Defence and Comcare staff, directed at removing access to the Applicant’s personal information. It appears that the outcome of this activity was that the poorly redacted report was removed from the Comcare website later that day, although there was some evidence before the Tribunal that the report may still have been accessible to LSD staff through the Objective folder for a few days after 10 August. Also later that day, General Cavenagh sent an email to all LSD staff requesting that they immediately destroy any copies of the poorly redacted report they may have printed or downloaded.
At about this time an officer from the Office of the Chief of Army advised the Applicant to make a complaint to the Commissioner about the breach of her privacy. On 17 August 2012 her then solicitors, Williams Winter Solicitors, made a complaint to the Commissioner’s office. However, on 11 September 2012 that office advised that it could not investigate the complaint until she had first addressed it to the appropriate area of Defence.
In August 2012 Defence engaged a consultant, HBA Consulting (HBA), to investigate matters related to Mr Felix’s allegations. Defence later told the Commissioner, who conducted an investigation of the breaches of the Applicant’s privacy, that it had supplied a copy of the poorly redacted report to HBA.
In 2013 the Applicant moved to Canberra and retained new solicitors, Snedden Hall & Gallop. On 7 July 2014, these solicitors, acting on her behalf, made a complaint to the Commissioner concerning the breaches of her privacy. On 15 August 2014, the Commissioner’s office indicated that it would conduct an investigation into her complaint.
In 2015 the Applicant clarified her claim for legal expenses incurred in relation to the breaches of her privacy. She indicated that it has cost me $24,605.99 in legal fees. She quantified her claim as follows:
(a)tax invoices from Snedden Hall & Gallop, dated 2014 and 2015, totalling $14,783.72;
(b)tax invoices from Lyn McDade (barrister), dated 2013 and 2014, totalling $4,250;
(c)a statement of fees and trust receipt from Williams Winter Solicitors dated 2013 and 2014 totalling $9,350; and
(d)various other items including application fees, parking receipts, taxi receipts and a parking infringement notice.
The Commissioner conducted an investigation. With respect to the conduct of Comcare, on 24 March 2017 the Commissioner made a decision (‘LB’ and Comcare (Privacy) [2017] AICmr 28) that Comcare had:
(a)disclosed the Applicant's personal information, including sensitive health information, on a publicly available website contrary to IPP 11; and
(b)failed to take such security safeguards as it is reasonable in the circumstances to take, against loss, against unauthorised access, use, modification or disclosure, and against other misuse contrary to IPP 4.
He ordered that Comcare pay the Applicant $20,000 for non-economic loss caused by the interference with her privacy, together with $3,000 for legal expenses incurred in connection with the making of the complaint and its investigation.
With respect to the conduct of Defence, the Commissioner similarly made a decision on 26 June 2017 in which he found that Defence had:
(a)failed to take such security safeguards as it is reasonable in the circumstances to take, against loss, against unauthorised access, use, modification or disclosure, and against other misuse contrary to IPP 4; and
(b)used the Applicant’s personal and sensitive health information contrary to IPP 10: ‘LU’ and Department of Defence (Privacy) [2017] AICmr 61
He ordered that Defence issue a written apology to her, pay her $10,000 for non-economic loss and $3,000 for legal expenses incurred in connection with the making of the complaint and its investigation. However, he declined to award her aggravated damages on account of Defence’s conduct following the discovery of the breaches.
The Commissioner further considered whether Defence had breached IPP 10 by supplying the poorly redacted report to HBA in August 2012. He found however that this use of the report was authorised under law for IPP 10.1(c) and that accordingly Defence had not breached IPP 10.
RELEVANT LEGISLATION
The Privacy Act 1988 (the Act) gives the Commissioner (and the Tribunal standing in his or her shoes) a discretion to require a party responsible for a breach of the IPPs to redress any loss or damage. Section 52 of the Act provides:
Determination of the Commissioner
(1) After investigating a complaint, the Commissioner may:
(a) make a determination dismissing the complaint; or
(b) find the complaint substantiated and make a determination that includes one or more of the following:
…
(iii) a declaration that the complainant is entitled to a specified amount by way of compensation for any loss or damage suffered by reason of the act or practice the subject of the complaint…
(1AB) The loss or damage referred to in paragraph (1)(b) or subsection (1A) includes:
(a) injury to the feelings of the complainant or individual; and
(b) humiliation suffered by the complainant or individual… .
(3) In a determination under paragraph (1)(a) or (b) (other than a determination made on a representative complaint), the Commissioner may include a declaration that the complainant is entitled to a specified amount to reimburse the complainant for expenses reasonably incurred by the complainant in connection with the making of the complaint and the investigation of the complaint.
(3A) A determination under paragraph (1)(b) or subsection (1A) may include any order that the Commissioner considers necessary or appropriate.
ISSUES TO BE DETERMINED BY THE TRIBUNAL
All the parties accepted that, in accordance with the Commissioner’s decisions of 24 March and 26 June 2017, there had been a significant breach of the Applicant’s privacy. At issue in the hearing before the Tribunal was whether the amounts awarded by him under s 52 reflected the seriousness of the breach, or the extent of the expenses which the Applicant was entitled to recover in pursuing her complaint. Specifically, the Tribunal was asked to consider:
(a)whether the amounts of $20,000 and $10,000 awarded under s 52(1)(b)(iii) against Comcare and Defence respectively should be increased;
(b)whether aggravated damages should be awarded, particularly against Defence on account of its conduct following the discovery of the interference with the Applicant’s privacy; and
(c)whether the amounts of $3,000 payable by each of Comcare and Defence for the Applicant’s legal expenses should be increased.
The Tribunal was also asked to vary the Commissioner’s finding that Defence had supplied the poorly redacted report to HBA in about August 2012. This request stemmed from a submission from Defence that, following an examination of its records, it determined that it had been in error to have earlier advised the Commissioner that the report had been supplied to HBA.
CONSIDERATION
Did Defence provide a copy of the poorly redacted report to HBA Consulting?
The matter referred to in the previous paragraph can be disposed of briefly.
The Applicant took the Tribunal to a number of documents in the written evidence which made reference to the supply by Defence of the poorly redacted report (or possibly the unredacted version of the report) to HBA. Conversely, Defence referred the Tribunal to a letter from HBA confirming that, following an examination of their files, they had never received a copy of the report. Defence submitted that it had been in error to advise the Commissioner in the course of his investigation that the report had been so supplied.
I am comfortably satisfied that the evidence shows HBA was never supplied with the report. However, for the reason given in the next paragraph, I do not consider it necessary to set out in detail the basis for forming this view. I have been asked to amend the Commissioner’s decision in ‘LU’ to reflect that HBA was never supplied with the report, but I do not consider that to be either desirable or necessary. The Commissioner’s decision stands as his assessment of the evidence as it stood at the conclusion of his investigation. The fact that a more complete picture is available to this Tribunal does not necessitate the amendment of the Commissioner’s finding at that time.
Whether the report was made available to HBA is irrelevant to the resolution of the other issues before the Tribunal. This is because the Commissioner found in ‘LU’ that the supply (as he supposed) by Defence of the document to HBA was permitted for a secondary purpose pursuant to IPP 10.1(c), that is, that its use was required or authorised by or under law. The Commissioner found that Defence had duties under the relevant work, health and safety legislation to conduct its business so as to ensure the health and safety of its workers and other people (at [51]-[52]). The events of August 2012 had given rise to concerns regarding workplace behaviour and practices, which required investigation. The supply of the report to an independent consultant to facilitate those investigations was consistent with Defence’s obligations under the law. If there was no breach of an IPP by virtue of the supply of the report, clearly there can be no question of compensation or damages in respect of the supply. There was no submission from the Applicant before me suggesting that the Commissioner had misinterpreted or misapplied IPP 10. In my view, he did not.
Application 2017/4345: should the award of compensation against Defence be increased? Is the Applicant entitled to aggravated damages?
The Applicant contended before the Tribunal that the sum of $10,000 awarded by the Commissioner as compensation for the loss or damage arising from Defence’s breaches of her privacy was inadequate. She submitted that this amount be substantially increased. In addition, she submitted that the Commissioner had been in error in determining that Defence’s actions in respect of her did not satisfy the conditions for a grant of aggravated damages. As both these claims were based at least partly on the conduct of Defence subsequent to the discovery of the breaches in August 2012, I will consider them together.
The evidence
Defence and Comcare contended that the appearance of the Applicant’s personal information on the Comcare website and on the Objective network occurred through human error. I do not understand the Applicant to have suggested that there was malice associated with this, although she submitted that the response (particularly by Defence) to its discovery was lackadaisical. However, she did allege malice with respect to Defence’s subsequent conduct. She referred to Defence’s behaviour, resulting from [my] reaction to Defence’s interference with [my] privacy, to include frequent psychological assessments, a determined attempt to terminate [my] Army service, and ongoing harassment in the workplace.
A statement by Mr Felix was tendered. In it he described meeting the Applicant for the first time on 9 August 2012. He said that, following the discovery that her privacy had been breached, she was trembling, vulnerable, teary and distressed. He accompanied her to a meeting on 10 August with Ms Isaacs, where the Applicant asked that her personal information be withdrawn immediately. Mr Felix wrote that Ms Isaacs tried to play down the seriousness of this matter by patronising [the Applicant] in stating that the information was common knowledge and on the Comcare Website… He said that they left Ms Isaacs’ office without any resolution as to if or when this matter would be resolved.
The Applicant told the Tribunal she was called on 10 August 2012 and directed not to come to work by her director, Colonel Rye, who also told her not to neck herself (that is, not to suicide). Col Rye then rang her on the following Monday, demanding to know why she was not at work. The Applicant alleged that Squadron Leader Stewart, at Colonel Rye’s instigation, began to visit her at her home to elicit information for Colonel Rye. She also said that her director made unrealistic work demands on her, for example by requiring that she identify duplicates in 150,000 electronic files in the space of three weeks without the assistance of IT staff.
Later in August 2012, Colonel Rye required her to undergo a psychological assessment to ascertain her suitability for continued service with the Defence Force. This initiated, she said, a succession of attempts to have her declared psychologically unfit for service; these attempts were persisting to the present time, causing her insecurity and upset. She claimed that General Cavenagh and Colonel Rye disapproved of [her] response to the breach of privacy, initiated assessments attempting to have her declared unfit to serve in the ADF and engaged in a program of harassment and psychological injury. She was required to undertake a further psychological assessment in 2014. All of this, she maintained, was out of keeping with what she described as a stellar career in the Army before this point, a career which has led to many awards and commendations, some of which were tendered.
The Applicant told the Tribunal she had been diagnosed with terminal cancer in 2002. This necessitated radical radiotherapy and chemotherapy. As a consequence, in 2012 she was quite weak physically and mentally, to be able to tolerate that sort of shock. What happened in 2012 left her shattered. She said that many medical issues were compounding in about 2014, at the time when matters related to the privacy breach were coming to a head. At this time she was also required to undertake a psychological assessment in relation to what she characterised as the attempt to terminate her employment. She described other steps taken by Defence which increased the difficulty and cost associated with obtaining treatment for her illness.

The Applicant produced a report from Associate Prof Gavin Wright, of the Victorian Comprehensive Cancer Centre, dated 11 August 2018, in which he commented on the relationship between workplace stress in the development or exacerbation of cancer. He said that there was such a link, though the evidence that stress might cause cancer was weak. In the Applicant’s case, he concluded that
…you already had significant risk factors for lung cancer, such as previous lung cancer, prior radiation and chemotherapy. It is however quite plausible that the aggressiveness of this cancer, with its requirement for complete removal of the lung, and its metastasis to local lymph nodes, was enhanced by the chronic, persistent psychosocial stressors you have described to me in your workplace.
The Applicant said an investigation was conducted into General Cavenagh’s handling of her personal information, but it found that he had no case to answer. Other avenues of complaint within the Defence organisation proved similarly fruitless.
On 14 August 2014 Defence issued the Applicant with a termination notice. According to her, the reasons given were:
·Behaviours, thoughts, attitudes, beliefs in conflict with Army values;
·Potential to present as an administrative burden and disciplinary liability if retained;
·Unsuited on an organisational basis to remain in Army;
·Difficulty with interpersonal relationships.
As part of the process of responding to the termination notice, she was required to meet short deadlines, and was denied procedural fairness, while at the same time she was in and out of surgery. She said that Defence never articulated which of her thoughts, attitudes and beliefs were in conflict with Army values.
In October 2015 the termination notice was withdrawn, in part, the Applicant said, through the intervention of then Senator Jacqui Lambie. She remains however under constant threat of review for her suitability to serve in the Army. In addition, since 2012 she has been unable to obtain tenure in any position she has occupied within Army; the usual posting cycle is three years, she said, but her postings have been generally of much shorter duration since then. A document setting out her posting history was tendered; it showed more or less annual changes of job from 2012 onwards. She said a consequence of this was that it was more difficult to obtain access to Defence-related rental assistance.
She also told the Tribunal that she encountered unfair treatment at the hands of the Army on account of her being a woman. She alleged that this was the manifestation of a common phenomenon whereby women are constantly under pressure in the military, as a result of the expectations of the men in that environment. This meant, in her case, that she was constantly walking on egg shells. She said that, as a woman, you’re required to do twice as much work to be considered just average. She was denied opportunities that were available to men. She tendered two articles describing the challenges facing women in male-dominated occupations.
The Applicant also drew attention to a tendency in Defence for appalling behaviour to be tolerated. As an example she referred to the behaviour of a superior officer in 2006 who made fun of her having had lung cancer, slapping himself like a spastic and talking to me like a spastic and taunting me. She observed that this was not a normal working environment but that that sort of stuff goes on in Defence quite often. She said you can’t lodge a complaint about every idiot who behaves like this. It was a pack mentality.
The Applicant referred to evidence that Comcare had introduced a new policy in February 2012 regarding access to personal information, and the application of the policy ought to have led to the removal of her personal information from its website, but this did not occur. She said that the new policy resulted from a determination or direction of the Commissioner with respect to the way personal information was held on publicly-accessible websites. Details of this new policy were not presented to the Tribunal, and it remains unclear as to whether Comcare or Defence were at fault for not applying the new policy. The Applicant suggested that the failure of Defence to follow the new policy is a matter that should sound in the quantum of compensation payable to her, though she conceded that any failure on the part of Defence to follow the new policy was due to human error rather than to malice. She also conceded, as the hearing progressed, that the direction of the Commissioner, and the new Comcare policy which apparently flowed from it, were general in nature and not directed specifically at the information held by Comcare about her.
The Applicant pointed to entries on the electronic log relating to the version of the poorly redacted report which appeared on Objective. The log shows that the report was accessed by Ms Kim Isaacs, Chief of Staff to General Cavenagh, on 8 and 9 August 2012 and by Mr Felix on 10 August 2012. The Applicant said that her name appeared on the first page of the poorly redacted report, and so Defence – in the form of Ms Isaacs – must have known that the Applicant’s personal information was accessible to those who opened the link in General Cavenagh’s email of 9 August 2012. She said That, to me, shows intent.
A further allegation was made. The Applicant told the Tribunal that the electronic records suggested that individuals within Defence had cached the poorly redacted report, or copied or modified it, and then forwarded the report onto a person or persons unknown. Her argument was that this activity exacerbated the breach of her privacy, as identified by the Commissioner, and should operate to increase the compensation to which she was entitled. In support of this contention, the Applicant pointed to an electronic log of occasions when the Comcare report was accessed on Objective. The log shows numerous occasions after August 2012 when the report (whether the poorly redacted version or some other version) was accessed by Defence staff, with the document being retrieved or opened on most occasions where it was accessed.
The Tribunal was referred, in particular, to an occasion on 17 May 2013 when a Mr Jonkergouw, an employee within a work health and safety area of Defence, Exported the report. The next entry in the log, about a minute later and also in relation to Mr Jonkergouw, records Successfully exported to C:\Desktop. The Applicant argued that the entries establish that the report was accessed on that occasion for the purpose of forwarding it to somebody else.
Another version of the Objective log was tendered by the Applicant, in which Mr Alan Legge in the WHS area is shown accessing the report on 3 April 2012 and again on 15 August 2013. On each occasion the log records No initial address list defined, which the Applicant submitted indicated that Mr Legge had sent the report, or a link to the report, to a list of people not identified by the log.
The Applicant called her brother, a former police officer, to give evidence. He described how he had attempted to accompany his sister to a psychological assessment done by Major Fiona Richardson, an Army psychologist, on 31 July 2014. He said Major Richardson had become quite animated at the suggestion he accompany his sister into the meeting, and she indicated he could not do so. He said he found this approach quite concerning.
He also described how, following the incident of August 2012, his sister then began to exhibit symptoms of PTSD. He also told the Tribunal that she had bounced back since then.
The Applicant also submitted that she had been the victim of episodes of identity theft, which she felt may have been facilitated by the publication on Comcare’s website of details such as her middle name and her address.
Defence disputed much of this evidence. With respect to the Applicant’s allegation that Defence’s response to the discovery of her personal information on the Comcare website was conducted without alacrity, Counsel for Comcare and Defence took the Tribunal to email exchanges between staff at LSD and Comcare on 10 August 2012. Those exchanges suggest that the matter was drawn to the attention of Major Andrew Judd at 7:54am, that he apparently had a conversation with Mr Legge sometime before 8.53am, when he forwarded to Mr Legge the link to the poorly redacted report on the Comcare website. At 10:43am, an officer at Comcare[2] contacted Mr Legge to advise him that Comcare’s web team are removing the link now. At 11:55am an email from Ms Isaacs sought an explanation from someone at Comcare as to how the personal information of the extremely distressed applicant came to be on the Comcare website.
[2] The T-documents are redacted and so the names of some parties to this email exchange are not available.
Further email exchanges occurred in the early afternoon. At 2:11pm someone at Comcare contacted Mr Jeff Gardiner in a WHS area of Defence to advise I can confirm we have removed the information from Comcare’s website. (It may still be available for those who have accessed it recently via their systems cache – but this will no longer be possible after 24 hours.) An email from Ms Isaacs to General Cavenagh at 3:45pm described the process whereby the offending information had been removed and passed on advice that an email should be sent to all staff advising them to destroy copies of the report they may have made hitherto. An email in those terms was in fact sent by General Cavenagh at 5:45pm.
Counsel for Defence tendered a report compiled in August 2014 by Major Richardson. The report contained what purported to be information relating to the Applicant’s service and medical history as held in military records. Included in the report were the following data:
·A service record from October 1998 describing a psychological assessment undertaken at that time by the Applicant. She came across as “frustrated” and “confrontational” and displayed an “assertive/overbearing demeanour… “any difficulties experienced in the past were attributed to incompetence of others and [the Applicant] failed to accept any responsibility for such difficulties”. She was described as “overly abrasive” and may experience difficulties with interpersonal relations.
·An assessment in 1998, apparently connected with seeking promotion, records a psychologist noting some evidence of interpersonal conflict in her previous working relationships and an admission that she had an “authoritarian” leadership style.
·A request for psychological assessment in June 2001 makes reference to the Applicant having “administrative problems” and as such her hierarchy wished to transfer her into a “less demanding position to resolve” her issues. It further notes that she was “difficult to supervise” and that her “level of performance fluctuates widely and often”.
·The same request makes reference to a number of incidents, including when her car was damaged in what was “considered a retaliatory act by a disgruntled employee” and that [the Applicant] was seeking compensation; her being “stalked” by a contract cleaner where the Applicant was frustrated by the lack of staff support; her milk had been “spiked” by a cleaning product “possibly poisonous” where she reportedly felt aggrieved that the situation was “not taken seriously”.
·A report dated June 2001 indicated that she attended an ADF psychology section for treatment of her chronic pain and stress. It noted that she “externalises all responsibility for situations in which she finds herself”. It indicated that she had revealed a history of mental illness, including depression and obsessive-compulsive disorder. It indicated that she revealed interpersonal issues at work, which she attributed to communication problems and that she reported that she had not responded well to the performance management/communication efforts of her superior and had perceived that he was “harassing” her.
·The Applicant attended a follow-up session a week later, in which she demanded that the treating psychologist document that she had been harassed in her workplace over several months, that her work performance had been impeccable, and that she was not amenable to any further attempts by her workplace to mediate or resolve the conflict. [The Applicant] made many allegations, most of which focused on her being the victim – occasionally because she believed she was a female.
·In July 2001 a treating psychologist recorded that of most concern, however, is the depth with which she is embroiled in her victim role, and the chaos that creates around her, and is likely to continue to create in the future.
·She was engaged in psychological sessions with an external provider over eight occasions in 2011.
·Following the incidents of August 2012, she had several interactions with Defence health services concerning her mental health. On 22 August 2012 she was Administratively Referred after appearing at work in a “distressed state”. In September 2012 an entry notes that she reported having difficulties with a senior colleague and described him as a “sociopath” whom she believed was “harassing” her.
·In a referral for assessment dated 5 September 2012 a number of matters are catalogued, including ongoing difficulties with the behaviour of her neighbours relating to her dog, deterioration in her relationships with her immediate family at the time of her treatment for cancer and an earlier diagnosis with PTSD associated with gunfire directed at her house in Sydney, which she explains was an attempt at intimidation relating to her work role.
·A report dated 28 September 2012 documents a follow-up session with a psychologist, where the Applicant discussed her work environment and said that the LTCOL (previously described as a “sociopath” and “harassing”) was “behaving in a bizarre manner”; an explanation for this was “because he is catholic and I am single” he reportedly “turns his back on me”. The report further notes themes of paranoia and persecution evident in discussion.
·An email of the same date purports to convey the view (through a psychologist) of a psychiatrist depicting concerns about the Applicant’s social isolation and lack of support structures/networks as well as concerns that while the incident that triggered [her] decompensation was “reality based” there appeared to be some significant “misinterpretation” and “personalisation” related to the incident.
·A document dated 18 July 2014 provides details of the basis on which she was Administratively Referred by her DCO hierarchy for termination. Those details include Evidence of significant paranoia and persecutory thoughts in the workplace; making threats to superiors and subordinates; the allegation that she had difficulties understanding the scope of her ‘Duty Statement’ as she constantly acts outside of her purview; and unacceptable behaviour/problematic interpersonal interactions in the workplace. This entry goes on to note that she refused to complete any psychometric tests associated with her Administrative Referral. The psychometric tests were not insisted upon Given her previous tendency to employ positive impression management strategies which might render them invalid.
Other entries in the report impart a similar flavour. The Applicant responded by saying that Major Richardson, being a major, succumbs to pressure in the workplace and had merely done a cut-and-paste. The Applicant also observed that the major’s report failed to note her previously-diagnosed PTSD; she implied that this omission was deliberate, to facilitate her termination.
Major Richardson’s report also records the attempt to have the Applicant’s brother sit in on the assessment she was conducting. The report sets out a number of reasons why he could not be admitted, including that his presence had not been authorised by the Referring Authority, and that the brother did not have security clearance, meaning that he could not sit in on an organisational assessment where sensitive ADF matters, procedures, protocols and policy would be discussed.
When some aspects of Major Richardson’s report were put to the Applicant, she denied that they were accurate. She said some issues in 2001 had arisen because she was required to work to separate superior officers, who did not get on with each other.
The Tribunal was taken to a number of records of conversation made by the Applicant’s commanding officer in mid-2014, Lieutenant-Colonel Llanwarne. These records document, inter alia, concerns about accusations made in relation to the Applicant regarding a bearer party for a deceased serviceman. One record notes staff complaining about the Applicant’s attitude towards funeral arrangements for the servicemen, including that the serviceman wasn’t deserving of a $50,000 funeral. Col Llanwarne notes that the Applicant’s communication has been interpreted as rude, unhelpful and insulting by other staff. Reference was also made to a statement by one of her subordinates where he recounted a conversation where she asked him to help identify listening devices planted around her work station.
It was put to the Applicant that it was incidents such as these that led to the referral for a psychological assessment in mid-2014, and that none of those incidents made reference to the privacy issue in 2012. She agreed with this last summation. It was further put to her that, both before and after the incident of 2012, her military career had episodes of workplace conflict, tension with superior officers and demonstrations of anger with Defence. She agreed, though she later explained that much of her anger stemmed from her concern that she had not spoken out sooner about the cancer cluster which, she said, took the lives of a number of her colleagues. She also said that none of those episodes occurred between 2007 and 2012.
Defence and Comcare called Dr Wasim Shaikh, consultant psychiatrist, to give evidence. A report dated 20 December 2018 of Dr Shaikh, following his examination of the Applicant, was tendered. In that report he came to the following conclusions:
…[The Applicant] presents with a complex psychiatric history. There is evidence to suggest long-standing personality vulnerabilities, this trait noted by multiple psychiatric professionals. This has likely contributed to adversarial work relations, externalising thought patterns, and a need to assume a victim role. There is an arsenal of history of mental illness in the years preceding her nominated injury, with receipt of treatment including psychiatrist attendances, psychologist attendances, and use of psychotropic medications. At the time of her nominated issues, she would have met criteria for Major Depressive Disorder of recurrent nature. Service records in the month preceding her nominated injury suggest work and personal stressors and associated psychiatric symptomatology.
In response to the privacy breach of 2012, likely developed a condition of Adjustment disorder with mixed anxiety and depressed mood [sic]…
Over the past few years, the protracted investigation process has led to distress, not necessarily amounting to a psychiatric disorder. Her ongoing involvement in the tribunal process is a further stressor.
I am of the opinion that [the Applicant] sustained a temporary Adjustment Disorder in August 2012, which resolved by November 2012. She certainly has ongoing angst in relation to events of 2012, but this does not equate to a diagnosable disorder.
The Applicant cross-examined Dr Shaikh about some of the history he had taken during his examination of her.
A report dated 22 September 2014 of Dr Alex Pilsky, consultant psychiatrist, was tendered. Completed following an examination of the Applicant, Dr Pilsky noted that, other than her reporting that she thought her conversations were being monitored, there were no over-valued ideas and she was cognitively intact. He opined that she did not suffer from a psychotic illness and her concerns about being monitored are not delusional. He observed that he was not sure on what basis Major Richardson in her report had concluded that the Applicant lacked fitness to serve in the Army.

The medical evidence suggests that the incident of August 2012 lead to the onset of mental illness in the Applicant, illness which had resolved by September 2014 at the very latest. Dr Shaikh suggested that this could be diagnosed as adjustment disorder with mixed anxiety and depressed mood. He also suggested that it had abated by November 2012. Although the Applicant had some quibbles with aspects of Dr Shaikh’s report, I did not understand her to disagree with either his diagnosis of her illness in mid-2012, nor his conclusion that she no longer suffered from that illness. She considered that the adjustment reaction persisted for longer than suggested by Dr Shaikh, but could not say how much longer.
Consideration
In his decision on the Applicant’s privacy complaint against Defence in ‘LU’the Commissioner noted a history similar to that outlined above. He recorded the steps taken by Defence on 10 August 2012 and in the following days to prevent access by unauthorised persons to the poorly redacted report. He recorded the supply of the poorly redacted report to HBA for the purposes of an investigation (reflecting the submission made to him by Defence). He also noted the retention of the report beyond August 2012 on Objective. He made a finding that the collection of the two versions of the Comcare report by Defence was not an interference with the Applicant’s privacy, but did find that such a breach occurred by Defence failing to take such security safeguards as were reasonable in the circumstances to protect against loss, unauthorised access, use, modification or disclosure.
There was evidently information before him about the audit log showing access by Defence personnel to versions of the report under its control. He found that Defence interfered with the Applicant’s privacy by making the poorly redacted report available to some 1,270 LSD staff. He awarded $10,000 for non-economic loss as a result of the breaches of privacy but considered that there was no basis for the award of aggravated damages.
The task before the Tribunal is a merits review de novo of the Applicant’s claims, not a review of the Commissioner’s original decisions per se. Nonetheless, in determining whether an award against Defence of $10,000 for non-economic loss is appropriate, it may be useful to compare the factual landscape as it appeared before the Commissioner with that which appeared before the Tribunal.
The Commissioner noted that Defence moved promptly to have the Applicant’s personal information taken down from the Comcare website, advised staff to destroy copies of the report they may have downloaded, and restricted folder access to the report within its own systems. He discounted the Applicant’s submission that Defence had knowingly provided misinformation in the course of his investigation. Having considered the material put before the Tribunal with respect to what occurred prior to the discovery of the privacy breaches, and what occurred in the days following, I consider that there is no reason to take any different view of the evidence than that taken by the Commissioner.
There is no evidence of any malicious intent with respect to Defence’s handling of the Applicant’s personal information prior to 10 August 2012, though it was certainly guilty of a measure of carelessness. Nor, in my assessment, is there any persuasive evidence for such intent in the period following the discovery of the breaches. It appears that the discovery within LSD occurred early on the morning of 10 August; within a few hours, access to the Applicant’s personal information had been substantially restricted, achieved through what appears to be swift and diligent action by staff at LSD. Although it is not entirely clear at what point access to the information was wholly shut down to unauthorised persons, that point appears to have been only a few days, at most, after 10 August. The slight lag in executing this shutdown – given the technical issues and the large number of people whose access was being revoked – does not seem to be a matter of any significance, given the lack of any indication that more than a couple of people might have seen the information during this time.
The Applicant submitted that Defence was at fault in focusing initially on the removal of the poorly redacted report from the Comcare website, rather than advising LSD staff immediately that the website should not be accessed and that downloaded copies of the report should be destroyed. I cannot accept the logic of that submission. To have drawn attention to a report on the Comcare website which was, early on 10 August, still accessible would have been to invite curious staff to go to the website to discover why the report was attracting this attention from their superiors. It made sense, firstly, to take down the report from the website and, secondly, to advise staff to destroy any copies of the report they may have made. This is the approach taken by General Cavenagh and his staff.
Evidence of malice on the part of LSD staff is thin, to the point of invisibility. The Applicant suggested that the fact Ms Isaacs, General Cavenagh’s chief of staff, accessed the poorly redacted report on 8 and 9 August 2012 demonstrates that she must have known it breached the Applicant’s privacy and therefore there was some intent to harm her behind the decision to include a link to it in General Cavenagh’s email of 9 August. But this claim is tenuous. The version of the report appearing on the T-documents ran to 220 pages; it is not inevitable in opening the document (presumably for the purpose of preparing the general’s email) that Ms Isaacs would have dwelt on any particular page featuring the Applicant’s name. Nor is it inevitable, had she done so, that she would have realised the significance, in privacy terms, of the report being linked to General Cavenagh’s email. No reason, plausible or otherwise, was advanced by the Applicant as to why General Cavenagh or anyone on his staff would have wanted to harm her in this way; the prompt and vigorous activity of those same persons in mitigating the privacy breaches soon afterwards would suggest the opposite intent.
A similar air of implausibility surrounds the Applicant’s allegations that figures within LSD were attempting to disseminate her personal information following 10 August 2012. She devoted considerable energy during the hearing to highlighting what she characterised as opportunities for staff in LSD to on-forward the poorly redacted report, or some version thereof, to third parties. I accept, at least for want of any evidence to the contrary, that it is possible that staff within the WHS team, and possibly others, could have achieved this outcome and evaded the electronic log had they wished to do so. But the evidence that this actually occurred at any time is non-existent. The highest this evidence rose was when, at 4:52pm on 17 May 2013, Mr Jonkergouw, exported a copy of the report to his desktop. There is no evidence that the report went any further than that. Staff within the WHS team were authorised to access the report on an ongoing basis for the purpose of dealing with broader occupational health issues, bearing in mind that the report was not simply about the Applicant. Mr Legge’s dealings with the report on 3 April 2012 and 15 August 2013 similarly fail, on the balance of probabilities, to demonstrate any on-forwarding or other nefarious uses.
The Applicant claimed repeatedly during the hearing that the analytics of what had happened to the poorly redacted report in terms of occasions of online access to either the Comcare or Objective websites had not been done. On this basis, she submitted, it is possible that there was distribution of her personal information on a wider scale than the evidence actually suggested. However, she conceded that the summonses she had issued to Defence and Comcare prior to the hearing had been fully complied with, and that these had produced no information on any downloading or on-forwarding of the report beyond those who had a professional reason to see it.
Her submission, in effect, was that the Tribunal should assume – because neither Defence nor Comcare had demonstrated otherwise – that the poorly redacted report must have been distributed, in further violation of her privacy, by those who had the opportunity to do so to unknown parties. The Tribunal infers that the malice which the Applicant alleged motivated her poor treatment at the hands of Defence after August 2012 would have similarly motivated the broader, surreptitious distribution of the report. The Applicant is entitled to entertain these suspicions, but I cannot increase her compensation or award her aggravated damages on this basis. It would be quite improper to do so on the foundation of mere suspicion.
A more nuanced argument about access to the report was also advanced. The Applicant pointed out that (then) IPP 11 required that an entity holding personal information take steps to protect that information from misuse or disclosure, and she argued that Defence breached this obligation by allowing or tolerating the caching by certain staff within the organisation of her personal information in the poorly redacted report.
I have two difficulties with this argument. First, it does not appear to have been advanced before the Commissioner, and is not specifically addressed in his decision. Given that this application before the Tribunal was originally couched in terms of accepting the Commissioner’s findings of fact with respect to breaches of the Applicant’s privacy, I am reluctant to broaden the scope of this hearing by reconsidering those foundational findings. But, secondly, even if I do engage in such a reconsideration, I do not find that there is any evidence of such caching. The transfer of the report from Objective to Mr Jonkergouw’s desktop on 17 May 2013 is, at the very most, a de minimis breach of IPP 11, given that he was a member of the WHS team at the time and authorised to deal with the report. Such a breach cannot have the effect of increasing the Applicant’s entitlement to compensation.
The other basis proposed for an increase in compensation, and the basis on which an award of aggravated damages is principally argued, is Defence’s behaviour toward the Applicant after 10 August 2012. Again, submissions regarding that behaviour were put to the Commissioner by the Applicant in support of a claim for $250,000 for future economic loss (claiming that her privacy complaint could lead to the cutting short of her career) and $150,000 for non-economic loss (claiming that the complaint led to serious medical problems and to constant humiliation and embarrassment in the workplace). The Commissioner noted at least two attempts, through administrative referrals, to terminate her Army career. Relevantly, he made the following observations in his decision:
The complaint also contends that Defence’s breaches will probably result in the termination of her career. She claims that the privacy breaches have resulted in at least two ‘administrative referrals’, that is, referrals made by Defence for the complainant to undertake psychological and psychiatric assessment. The complainant contends that because the referrals are on her record, her supervisor may issue a ‘show cause’ why she should not be dismissed immediately from her employment.
…She claims that if Defence had not breached its privacy obligations, she would not be “fighting for her job”.
…On the information provided, I am not satisfied that the complainant’s career has been “cut short” by the specific conduct of Defence which I have found to be in breach of the Act, or that the breaches have impaired her future earning capacity…I find there is no basis for awarding compensation for future economic loss.
…She claims that when she found out that Defence had made available the redacted Comcare Report on Defence’s DRMS so all LSD staff could readily access it, she suffered “severe shock”. The complainant claims her symptoms, which included migraine, difficulty sleeping, severe depression and anxiety attacks continued for months after she learned of the unauthorised use.
…The complainant contends that because of the misuse of her personal information by Defence she was subjected to serious and sustained bullying and harassment by Defence. I note that allegations of harassment and bullying are outside the operation of section 52 of the Privacy Act and I have no power to consider these further.
The complainant also argues that Defence should pay compensation for non-economic loss resulting from the decision of her commanding officer at Defence to administratively refer her for psychiatric or psychological examination. The complainant has not however provided sufficient evidence to substantiate a causative link between Defence’s privacy breaches and any losses in this respect.
…Because of the material in reports from her treating doctors, and the complainant’s own accounts of her distress caused by Defence’s interferences with her privacy, I am satisfied that it is appropriate to aware damages for non-economic loss in respect of the impact of Defence’s breaches.
…Accordingly, I have determined that $10,000 is an appropriate amount of non-economic compensation for the damage the lack of protection and misuse of her personal information has caused the complainant (at paragraphs [71-81]).
From these extracts it is evident that the Commissioner gave consideration to the claim that Defence was attempting to end the Applicant’s career in Army on account of her having complained about the breaches to her privacy, but considered that such action, if true, could not sound in a payment for future economic loss since she had not, at that point, lost her position in Army. The Commissioner did make an award of $10,000 for non-economic loss, based on the impact on her health and the hurt and embarrassment of having her records accessible to LSD staff, but did not attribute any loss to Defence’s actions in subjecting her to administrative processes on the basis that there was insufficient evidence of a causative link between the privacy breaches and Defence’s actions “against” her.
The Applicant has not pursued a claim for future economic loss before the Tribunal, presumably because she remains an Army officer. Instead, she has focused on the furnishing of what she believes is evidence of the causative link between her pursuit of Defence in the wake of the breaches of her privacy and its subsequent actions which, as she perceives them, are deleterious to her, including attempts to terminate her commission.
I observe at this juncture that the Applicant has advanced quite plausible evidence of adverse treatment at the hands of Defence. Some of the matters of which she gave evidence at the hearing were not contradicted by any other party, at least not directly. On this basis, I am prepared to take on face value her claims about several matters. Her evidence, and that of Mr Felix, would suggest that Ms Isaacs was patronising and unsympathetic when the issue of the Applicant’s privacy breach was first raised on 10 August 2012. I accept her evidence that her supervisor made a quite inappropriate comment about necking herself while she was understandably distressed later that day. I accept, on the balance of probabilities, that over the ensuing years she was subjected to unreasonable demands on her in a professional capacity and that other staff, including superior officers, behaved on occasions in ways that were inappropriate. I further accept, of course, that Defence has initiated steps to have her Army service terminated and has subjected her to administrative processes which have distressed and upset her.
However, there is an important limitation on a decision-maker’s power to award compensation for loss or damage under s 52. The loss or damage must arise from the interference with the complainant’s privacy; there is no notion of compensation “at large” from the complainant’s treatment at the hands of the party responsible for that interference. In the Applicant’s case I am, like the Commissioner before me, unpersuaded that there is a causative link between the breach of privacy and Defence’s subsequent dealings with the Applicant.
The medical and service records collated in Major Richardson’s report of 2014 suggest that there may be other reasons for Defence’s approach toward her. Those records suggest some history of conflict with superior officers and with other staff in various postings, a confrontational and abrasive approach by her toward colleagues, work-related stress attributable to personality or psychological traits such as paranoia and persecution, a tendency to adopt the posture of a victim in workplace conflict and some general susceptibility to mental illness, resonating in workplace performance issues.
Additionally, the Applicant herself suggested other reasons for adverse treatment, specifically cultural issues within Defence around the treatment of women and what she called a pack mentality allowing the harassing behaviour of what she termed idiots to go unchecked in the workplace.
Perhaps inevitably, given the nature of the claims before the Tribunal, little evidence was led by any party giving flesh to the bones of various contentions about working conditions within Defence. Mr Felix and the Applicant’s brother offered evidence about two particular incidents, involving Ms Isaacs and Major Richardson, from neither of which can much be extrapolated generally about conditions in Defence, in my assessment. Overall, the picture before the Tribunal is a confused one, with several possible explanations for the various episodes in her employment history, none of which stands convincingly above the others.
The position remains that I am able to award compensation pursuant to s 52 only where loss or damage can be shown to flow for a breach of a complainant’s privacy. Although in the Tribunal parties do not generally bear any onus to establish their claims, nonetheless if I am not positively satisfied on the evidence before me that the Applicant’s adverse treatment in the workplace is the product of a breach of her privacy, I cannot make an award reflecting this under s 52; see Beezley v Repatriation Commission [2015] FCAFC 165 at [68].
The Applicant’s evidence does not rise to that level of satisfaction. The medical evidence establishes that she was suffering an adjustment disorder for some months following the incident of August 2012. Her own contention was that that period of mental illness may have been even longer. In those circumstances it cannot be regarded as surprising that her employer might consider subjecting her to a psychological assessment of her continuing ability to serve. A further attempt was made in mid-2014 to subject her to administrative termination. This coincided, according to her evidence, with a number of other medical issues coming to a head, together with issues associated with her privacy complaint before the Commissioner. She said she was under considerable stress at this time. Again, the unfortunate confluence of personal circumstances, rather than a conspiracy to dismiss her because of her privacy complaint, may account for her employer’s decision to undertake a psychological assessment at that time.
As was the case with the Applicant’s claims about the malicious use of the poorly redacted report by Defence staff, I discern a propensity to exaggerate and to make mountains out of molehills. For example, she tendered Prof Wright’s report as evidence that Defence’s treatment of her had caused a recurrence of her cancer; however, the report merely notes that it is plausible that workplace stress enhanced the progress of her cancer. She repeatedly contended that the Commissioner had issued a direction to Comcare in early 2012 to take down the poorly redacted report, which Comcare had flouted; she eventually conceded that, if there had been a direction from the Commissioner (none was ever produced), it would have been a general one about reports of a similar kind to the poorly redacted report, and not about the poorly redacted report itself. The tendency to read conspiracies into such matters deprives her evidence of some weight.

The Applicant agreed that no documentation before the Tribunal drew any link between her prosecution of a privacy complaint and Defence’s subsequent actions. As such, the nexus she asserts appears to rely substantially on the proposition post hoc, ergo propter hoc. I do not consider that the claim that she has been victimised in consequence of her privacy complaint is supported by the evidence.
In assessing the appropriate quantum of compensation to which the Applicant is entitled under s 52, the Tribunal is confronted with a factual situation very similar to that considered by the Commissioner.[3] The question now to be considered is whether $10,000 is an appropriate sum to be awarded in compensation for the Applicant’s loss or damage in the context of those facts.
[3] The only substantial difference is that the Tribunal finds that Defence did not supply the poorly redacted report to HBA, but since, as explained above, the Commissioner did not base his award of compensation on such a supply, the difference is immaterial to the Tribunal's considerations.
In Rummery and Federal Privacy Commission and Anor [2004] AATA 1221 the Tribunal considered the relevant principles governing an award of compensation under the Act. Those principles were summarised (in ‘CM’ and Corporation of the Synod of the Diocese of Brisbane [2014] AICmr 86 at [90]) as follows:
(a)where a complaint is substantiated and loss or damage is suffered, the legislation contemplates some form of redress in the ordinary course;
(b)awards should be restrained but not minimal;
(c)in measuring compensation the principles of damages applied in tort law will assist, although the ultimate guide is the words of the statute;
(d)in an appropriate case, aggravated damages may be awarded; and
(e)compensation should be assessed having regard to the complainant’s reaction and not to the perceived reaction of the majority of the community or of a reasonable person in similar circumstances.
Section 52 reflects common law principles around the purpose of damages for non-economic loss. Such damages constitute redress for pain and suffering, loss of amenities of life and loss of enjoyment of life. An award of non-economic loss is an evaluative judgment and is a matter of opinion, impression, speculation and estimation: Dell v Dalton (1991) 23 NSWLR 528. As Wilcox J noted in Hall v A & A Sheiban Pty Ltd [1989] FCA 72 at [42]:
But damages for such matters as injury to feelings, distress, humiliation and the effect on the claimant's relationships with other people are not susceptible of mathematical calculation. The assessor of damages must make a judgment as to an appropriate figure to be allowed in respect of these figures. But to say this is not to denigrate the importance of such non-economic factors in the assessment of damages. It may be unfortunate that the law knows no other way of recognising, and compensating for, such damage; but this is the fact. To ignore such items of damage simply because of the impossibility of demonstrating the correctness of any particular figure would be to visit an injustice upon a complainant by failing to grant relief in respect of a proved item of damage.
Having observed these principles, it is incumbent on a decision-maker under this Act to calibrate any award of damages with similar awards made under the same Act, as opposed to, say, damages awarded in personal injuries cases. This reflects the reality that a different yardstick is required to measure loss or damage flowing from a breach of privacy from harm sustained under other areas of jurisprudence. An award, as noted in Rummery, should be restrained. The Tribunal was referred to several cases for the purpose of establishing the yardstick.
In 'BO’ and AeroCare Pty Ltd [2014] AICmr 32, the Commissioner awarded $8,500 for non-economic loss where the disclosure of details of the complainant’s medical condition occurred in an airport lounge, causing injury to the complainant's feelings and humiliation and distress. The disclosure was in the presence of other passengers and an employee of the complainant. In ‘CM’, cited above, the Commissioner awarded $7,500 for non-economic loss, in particular for pain and suffering and feelings of humiliation, as a result of the distribution of details of an allegation of sexual assault against the complainant as a child to members of the governing Council of that school some years after the assault.
In ‘DK’ v Telstra Corporations Limited [2014] AlCmr 118 the name, home address and phone number of a federal judge in the family law jurisdiction were published in the White Pages online and its hard copy version. The Commissioner awarded him $18,000 to reflect the fears for his safety (he moved interstate on this account) arising from the breach of his privacy. The award for non-economic loss was for the anxiety and distress, and severe disruption to his life, caused by the privacy breach.
In 'LA' and Department of Defence (Privacy) [2017] AICmr 25 Defence released to the complainant’s son the complainant’s complete military medical file. The file included details of a prior gambling addiction of which his son had been unaware. The Commissioner awarded the complainant $12,000 for non-economic loss, taking into account damage to the complainant’s psychological health and to his family relationships.
The Tribunal in Freelancer International Pty Ltd and Australian Information Commissioner [2017] AATA 2426 set aside a decision of the Commissioner to award a complainant $20,000 on the basis that the disclosure of the complainant’s name a particular webpage did not occasion any identifiable and significant hurt or distress, and that remedial steps taken by the respondent were sufficient to dispose of the matter.
For the purpose of assessing a fair quantum of compensation, it is appropriate to aggregate the amounts awarded against both Defence and Comcare, i.e. $30,000. This amount took into account, it seems, the mental illness brought on by the privacy breaches in mid-2012, her experience of severe shock and the humiliation and embarrassment of her personal medical issues being ventilated in her workplace.
Taking decisions like those cited above into account, I consider that this amount represents a reasonably faithful application of the relevant criteria for assessing non-economic loss. In ‘LA’, the Commissioner awarded $12,000 where the disclosure of sensitive health information to the complainant’s son had caused specific harm. I note that, in this applicant’s case, despite the wide availability of her sensitive information to the world at large for a period of more than a year, there was no evidence before the Tribunal of specific harm of this kind. Conversely, there was no specific harm recorded by the Commissioner in ‘DK’ where a judge’s address was published in the White Pages. The generalised risk there – that a disgruntled litigant could go to the home of the judge and do him harm – compares with the generalised risk here that the Applicant might be exposed to identity theft. In ‘DK’ the Commissioner awarded $18,000 for noneconomic loss.
Counsel for Comcare and Defence submitted that the award made by the Commissioner to the Applicant for non-economic loss was amongst the higher awards ever made pursuant to s 52. Counsel also observed that s 52 confers a discretion on the Commissioner, not a right on a complainant. Taking all those considerations into account, I consider that an award of compensation for loss or damage of $30,000 is generous. It appears to be very much of the upper end of the spectrum for awards in comparable circumstances. I am not persuaded that this amount should be increased.
With respect to the question of aggravated damages, the Commissioner observed in his decision (‘LU’) that such an award is warranted:
(a)where the respondent has behaved high-handedly, maliciously, insultingly or oppressively; or
(b)where the manner in which a defendant has conducted his or her case has exacerbated the hurt and injury suffered by the complainant: see ‘BO’ at [57]; ‘HW’ v Freelancer International Pty Ltd [2015] AlCmr 86 at [379].
With respect to the first of those criteria, it is reasonable to read in the qualification with respect to the complaint before the Commissioner. Clearly, it must be reprehensible or egregious behaviour committed in respect of the breach of the complainant’s privacy which would give rise to an award of aggravated damages. Similar conduct with respect to the conduct of a respondent’s case before the Commissioner (or the Tribunal) might enliven the second criterion.
Based on the findings made above, it can be seen that there is no reasonable basis for describing Defence’s behaviour in these terms. As the Commissioner noted in his decision, Defence acted (relevantly to the first criterion) with reasonable speed and diligence to obviate the consequences of the privacy breaches once discovered. Any behaviour by Defence after August 2012 vis-a-vis the complainant, even if it could be described as reprehensible or egregious, is not behaviour with respect to the privacy complaint. No evidence satisfying the second criterion was pointed to by the Applicant.
Application 2017/2393: should the award of compensation against Comcare be increased? Is the Applicant entitled to aggravated damages?
The Commissioner awarded the Applicant $20,000 in non-economic compensation against Comcare. The amount awarded was higher than that awarded against Defence on the basis that the Applicant’s sensitive health information was publicly available for a prolonged period on Comcare’s website. Again, against comparable cases (of which ‘DK’ is the most comparable) the Commissioner’s award of $20,000 seems adequate, even generous. Again, it should be noted that although the sensitive health material was available on the website for more than a year, it appears no one drew that fact to the Applicant’s attention, which may suggest it was viewed by very few people.
As previously mentioned, the Applicant submitted that Comcare had failed to heed a direction from the Commissioner to take down the poorly redacted report from the website. She eventually conceded, however, that there was no evidence that this had happened. In the circumstances, there appears to be no basis to increase the amount awarded by the Commissioner.
The Applicant also conceded that there was no behaviour by Comcare which would satisfy the criteria for aggravated damages.
Whether the amounts of $3,000 payable by each of Comcare and Defence for the Applicant’s legal expenses are reasonable
Subsection 52(3) of the Act provides that, where a privacy complaint is substantiated, the Commissioner may include a declaration that the complainant is entitled to a specified amount to reimburse the complainant for expenses reasonably incurred in connection with the making of the complaint and the investigation of the complaint.
The decision of the Commissioner in 'LA' contains a summary, at [43] to [55], of the considerations generally taken into account in addressing the payment of a complainant’s legal expenses:
43. I have the power under section 52(3) to make a declaration that the Complainant is entitled to a specified amount to reimburse him for expenses reasonably incurred in connection with the making of the complaint and its investigation.
44. The Complainant has sought reimbursement of $8221.62 for:
a.$8001.62 in legal fees he has incurred in relation to the investigation of the Complaint by the OAIC; and
b.$220, being the fees incurred in obtaining a letter from his treating psychiatrist in relation to the effect of the disclosure of his personal information on the Complainant’s mental health.
45. As I addressed in my decision in ‘KB’ and Veda Advantage Information Services and Solutions Ltd [2016] section 52(3) does not have the effect of automatically transferring a complainant’s legal expenses to the respondent. Rather, section 52(3) provides me with a discretion to declare that a complainant is entitled to a specified amount to reimburse the complainant for ‘expenses reasonably incurred ... in connection with the making of the complaint and the investigation of the complaint.’
46. I will not exercise that discretion on every occasion in which a complainant incurs legal or other expenses. Most privacy complaints can be resolved without the need for legal representation, and this position is confirmed in the OAIC’s Guide to privacy regulatory action which states at paragraph [1.13]:
The OAIC provides a free, informal and accessible complaint process. Parties do not require legal representation to participate in the complaint handling process or the determination process. Parties generally bear their own costs in the complaint handling process, including any legal expenses.
47. In this case, the Complainant engaged a solicitor towards the end of the investigation, who prepared submissions on his behalf in relation to compensation, and assisted him in obtaining a letter in support from his treating psychiatrist.
48. I am satisfied that it was appropriate for the Complainant to engage a lawyer at that stage of the complaint process, and that the expenses incurred are not disproportionate to the harm he suffered or the remedy I have determined to award.
49. However, the discretion I have under s 52(3) does not mean I must make a declaration for all or any costs reasonable [sic] incurred by a Complainant. In order to assist me on what amount would be appropriate to reimburse the Complainant for costs incurred in making the complaint I have had regard to the general principles of the determination of costs.
50. The determination of costs is primarily regulated by statute and court rules. Where a court or tribunal has discretion in relation to costs, it may award costs on a party/party or indemnity basis. Indemnity costs are usually defined as all costs other than those which appear to have been unreasonably incurred or are unreasonable in amount. Conversely, party/party costs are defined as those costs that are “fair and reasonable”. There are various considerations as to what is “fair and reasonable”, and this will depend on the circumstances and nature of the matter. An assessment of what is “fair and reasonable” will have regard to:
a.the level of skill, experience, specialisation and seniority of the lawyers concerned;
b.the level of complexity, novelty or difficulty of the issues involved, and the extent to which the matter involved a matter of public interest;
c.the labour and responsibility involved; and
d.the circumstances in acting on the matter.
51. There is no firm rule as to what costs would be allowed on assessment and it is generally accepted that party/party costs will be assessed in the range of 40 to 60 percent of solicitor-client costs, and indemnity costs will be between 60 and 80 percent of solicitor-client costs.
52. In this case, I have the power to make a declaration that the Respondent pay to the Complainant a specific amount. I do not have power to make a costs order. Nonetheless, I am guided by the above principles in relation to costs orders in deciding what amount is appropriate to reimburse the Complainant for expenses incurred in making the complaint and in the investigation of the complaint.
53. Having considered the invoices provided, I am not satisfied that it would be appropriate to reimburse the Complainant for the whole of the legal expenses incurred, where a number of those costs would not be recoverable on either an indemnity or party-party basis if a costs assessment applied.
54. I have decided that a portion of the Complainant’s legal expenses were reasonably incurred in connection with the complaint, and have elected to exercise my discretion to declare that the Complainant should be reimbursed for a portion of those expenses. As such, I declare under s 52(3) that Defence should pay the Complainant an amount of $3,200 as reimbursement.
55. In relation to the cost incurred in obtaining a psychiatric report, this was prepared in response to the Respondent’s request for further information in respect of the Complainant’s physical and mental condition. I have determined that it is an expense reasonably incurred in connection with the complaint. As such, I have determined that under section 52(3) of the Privacy Act, Defence should pay the Complainant an amount of $220 as reimbursement.
(references omitted.)
There was no submission by the Applicant that principles of this kind should not be applied to a decision about the reimbursement of legal expenses.
In his decision here, the Commissioner considered that it was appropriate for the Applicant to engage a legal professional in the circumstances of this case, and thus appropriate that she be reimbursed for legal expenses reasonably incurred. However, he considered that it would not be appropriate to reimburse her for the whole of the expenses, as:
(a)not all the expenses incurred were in connection with the making of the privacy complaint against Defence; and
(b)the expenses are disproportionate to the remedy awarded.
The Commissioner, Comcare and Defence submitted that legal fees relating to the services of Williams Winter Solicitors were incurred in relation to the original complaint to the Commissioner’s office in 2012, which did not proceed, and to a subsequent complaint against Defence in 2014. It was contended that neither proceeding related to the complaints before the Commissioner which were the subject of his decisions in March and June 2017. I agree that those expenses were not incurred in relation to the complaints which were the subject of the decisions in 2017. Even if they were, those expenses are not reasonable according to the principles outlined above. The Applicant should not be reimbursed those expenses.
The parties agreed that it was reasonable for the Applicant to retain Snedden Hall & Gallop. The fees in relation to that retainer were $14,783.72. The Commissioner, submitted, however, that the fees incurred in briefing Defence specialist counsel Lyn McDade ($4,250) were not expenses reasonably incurred in connection with the complaint. It was argued that there was no evidence that it was reasonable to instruct counsel in a matter of this kind.
The Applicant observed that she had been encouraged by Defence to obtain professional legal advice. Her lawyers, in turn, recommended seeking advice from a barrister, and she had not been in a position to second-guess that recommendation. The issues involved in these proceedings were complex, she asserted, and the documentation voluminous. She also said, in connection with the instructing of Defence-specialist barrister Lyn McDade by her solicitors, that a lot of legal firms appear to have difficulty dealing with Defence, so that was why she was specifically engaged.
I accept that the Applicant would have been guided by her solicitors on the question of instructing counsel. However, I must also consider whether it was reasonable overall for counsel to be instructed. I am mindful that proceedings before the Commissioner are intended to be conducted without the need for legal representation. His office provides a free and informal process for resolving complaints. The only basis on which it has been suggested counsel was briefed was to assist her legal advisers to better understand the issues involved in the complaint. Given the presumption that parties will proceed in this jurisdiction without resort to lawyers, the need to involve a barrister requires better justification than that, in my assessment. I understand that the Commissioner’s decisions were made without the need for a hearing; the aid provided by her solicitors was, presumably, the provision of advice on her claims and assistance with the preparation of documents for lodging before the Commissioner. I’m not satisfied that the assistance of counsel was reasonably necessary in that process. I also take into account the Commissioner’s finding that the expenses incurred overall by the Applicant were disproportionate to the remedy which he found to be appropriate, a remedy in which I am now concurring.

I do not propose to disturb the basis on which the Commissioner made his decision to require a proportion of the Applicant’s legal costs be met by Defence and Comcare. The Commissioner appears to have followed the principles outlined in 'LA' and awarded the Applicant approximately 40% of her solicitor-client costs.
Accordingly, I affirm the Commissioner’s decisions of 24 March and 26 June 2017 in respect of the Applicant.

I certify that the preceding 106 (one hundred and six) paragraphs are a true copy of the reasons for the decision herein of Deputy President Gary Humphries AO.

........................................................................
Associate
Dated: 14 June 2019

Date(s) of hearing: 20-21 May 2019

Counsel for the Applicant: In person

Counsel for the Privacy Commissioner: Ms Kristina Mihalic, HWL Ebsworth Lawyers

Counsel for Comcare and the Secretary, Department of Defence: Ms Kristy Katavic

Solicitors for Comcare and the Secretary, Department of Defence: Mr Lino Kim, Sparke Helmore Lawyers