NWFQ and Privacy Commissioner

This matter concerned an application for review of decisions made by the Privacy Commissioner. The applicant, a serving member of the Defence Force, alleged that a data security failure by the Department of Defence and Comcare had led to interferences with her privacy. The Commissioner had previously found the parties liable to pay compensation for non-economic loss and legal expenses, and the applicant sought an increase in these sums, as well as aggravated damages.

The primary legal issues before the Tribunal were whether the compensation awarded by the Commissioner for non-economic loss was inadequate and whether the applicant was entitled to aggravated damages. The applicant contended that the response to the discovery of the poorly redacted report, which contained her personal and medical information, was lackadaisical and that subsequent conduct by Defence constituted harassment and an attempt to terminate her service. Defence and Comcare argued that the disclosure was due to human error and that their subsequent actions were not malicious.

The Tribunal considered the applicant's claims for increased compensation and aggravated damages together, noting they were partly based on Defence's conduct after the breaches were discovered. While acknowledging the applicant's distress and allegations of harassment, the Tribunal found that the evidence did not support an award of aggravated damages. The Tribunal also addressed a separate submission by Defence that it had mistakenly advised the Commissioner that a poorly redacted report had been supplied to HBA Consulting. The Tribunal was satisfied that HBA had not received the report but determined that amending the Commissioner's previous finding was neither desirable nor necessary, as the Commissioner's decision regarding the supply of the report was based on the evidence before him at the time and was irrelevant to the resolution of the other issues before the Tribunal.

The Tribunal affirmed the Commissioner's decision, finding no basis to increase the compensation awarded or to grant aggravated damages. The Tribunal was satisfied that the Commissioner had not misinterpreted or misapplied the relevant privacy principles concerning the disclosure of the report.