Privacy Law & Policy Reporter --- "Cases and complaints" [2004] PrivLawPRpr 37; (2004) 11(3) Privacy Law and Policy Reporter 75

• Cases + Complaints

---

Cases + complaints

All decisions noted, except those of the Victorian Commissioner, are available on AustLII <http://www.austlii.edu.au> by the citation given, unless otherwise stated. (General Editor)

GR v Director General, Department of Housing (GD) [2004] NSWADTAP26

NSW Administrative Decisions Tribunal – Appeal Panel (30 June 2004) Privacy – compensation – causation - duty to self-represented litigant

GR was a tenant of the Department of Housing. He called a talkback radio program to complain about the Department. A researcher from the radio station called the Department about the complaint. The Department’s media liaison officer told the researcher that GR was a “known troublemaker”. The Departmental officer also disclosed other unrelated information about GR to the radio station researcher.

In the original decision (GR v Department of Housing [2002] NSWADT 268), the Tribunal found that the Department’s conduct breached IPP 11 (s18, a disclosure principle) of the PPIP Act.

The only order sought by GR was monetary compensation. In the original hearing GR supplied a report from his GP, which stated GR’s stress had been aggravated by his dealings with the Department. However the report did not mention the specific conduct at issue, namely the disclosure to the radio station. The Tribunal held that the evidence produced by GR was not sufficient to establish that he had suffered financial loss or psychological or physical harm because of the Department’s conduct, as required under s55(4) of the PPIP Act.

In this appeal, GR argued he didn’t understand at the time of the hearing that he needed to put better evidence before the Tribunal on the issue of psychological harm and causation. The Appeal Panel agreed, finding that the Tribunal should have been clearer in explaining to GR the inadequacy of his evidence. This was despite several references by the original Tribunal member to his doubts about the usefulness of GR’s evidence (the GP’s report), its low ‘weight’, and the need for the claimed harm to have been ‘caused by the conduct’. However the precise terms of the Act, which requires a direct causal connection to be shown, were not explained to GR.

GR’s case was therefore remitted back to the Tribunal to allow further filings of medical evidence relating to harm and how it was directly attributable to the conduct proven.

General principles as to self-represented litigants

The Appeal Panel quoted at [16]-[18] the leading statements under the common law in relation to a court’s duty to the self-represented litigant, but then suggested that:

“(the) requirements bearing on the Tribunal are, arguably, stricter than those applying at common law.” [21]

The Panel came to this view because section 73(4) of the Administrative Decisions Tribunal Act 1997 (the ADT Act) requires the Tribunal to take such steps as are reasonably practicable to ensure an applicant understands assertions made in the proceedings and the legal implications arising, and to ensure the applicant has the fullest opportunity practicable to be heard or have their submissions considered.

The Appeal Panel noted that the present case was typical of review cases in the Tribunal, in that the self-represented litigant was seeking review of conduct by a well-represented government agency. The Panel noted at [22] that “Causation is not an easy concept to grasp.”

The interventionist approach was discussed further thus:

“In regard to the issue of how far this Tribunal should go in giving assistance to a self-represented party, a distinction should be drawn between truly adversarial proceedings ... and those, like the present, that are in the nature of review proceedings directed to the quality of public administration.” [34]

The Appeal Panel then quoted at [36] with approval the following observation from an 1999 Australian Law Reform Commission report:

“Where the applicant is unrepresented the tribunal generally will have to adopt a more interventionist approach and apprise itself about the facts and the law. Some of the tasks may be undertaken by the respondent agency, if the agency is a party and participates in the proceedings.”

The Appeal Panel went on to suggest that both the respondent agency and the Tribunal must “ensure insofar as it is reasonably possible that all relevant material is placed before it in relation to the conduct in issue” [37].

Interaction with State Records Act

The Appeal Panel also made some obiter comments following an argument by the agency seeking to justify its information collection and retention practices by reference to the State Records Act 1998 (NSW), to escape the application of the PPIP Act: “In our view every attempt should be made to read the provisions of the Privacy Act (sic) and the State Records Act harmoniously.” [57]

Comment

Through this case the Appeal Panel has sounded a note of warning to agencies that their conduct of the earlier internal review will be critical to enabling procedural fairness to the applicant, by providing “full particulars of the conduct in issue” [37].

The Appeal Panel has in particular suggested that respondent agencies have a role to play in ensuring all relevant material is placed before the Tribunal. The rationale for this duty on respondent agencies is a public interest one - that review proceedings are aimed at ensuring “correct or preferable decision making” and thus “correct and fair administration”, quoting from the ALRC at [36].

In terms of procedure, it would appear that when dealing with self-represented litigants, the Tribunal may be more willing to grant adjournments to allow the applicant further time to prepare and present their case.

It would also appear that the Tribunal is now more likely to split proceedings, such that compensation will not be argued unless a breach has first been proven.

Anna Johnston

Complainant v Statutory Entity Respondent [2004] VicPCmr 3

Victorian Privacy Commissioner

Public Registers – publication of complainant’s name on Respondent’s website as holder of a licence for sensitive trade activity – IPP 1 – collection – reasonable steps to let Complainant know register was public and online – IPP 3 – data quality – reasonable steps to ensure accuracy – IPP 4 – data security – reasonable steps where personal safety a concern

Complainant, a female, held a statutory licence administered by the Respondent. She held the licence in relation to a sensitive trade activity where personal safety was a potential concern. She registered with the Respondent in January 2001 but did not know that the register was a public register until May 2003, when she received a letter from the Respondent advising her that the register could be publicly accessed by visiting its website. The Respondent’s website included her full name listed in a searchable directory of licence holders.

When she then searched for her surname using the Google internet search engine, the third result in the list of hits was a link to her entry on the Respondent’s website. The link contained a description of a different but related and more sensitive trade activity, also regulated by the Respondent, causing humiliation at being wrongly associated with that particular trade. The Complainant was also concerned that this information, combined with a telephone directory, would enable her to be located, with possible risk of harm.

After the Complainant complained to the Respondent, it removed the register from its website. However, Google searches still found the old web-page because retained a mirror archive of the original pages from the Respondent’s website. The Complainant raised this with the Respondent and requested Google’s Australian controller to have the link disabled. The Respondent contacted Google’s overseas controller and arranged for the archive pages to be removed.

The Complainant then complained to the Privacy Commissioner. The Respondent then gave the following undertakings to the Complainant: (i) the register would not be placed online without legislation first being amended; (ii) if this happened (which was unlikely), registrants would be notified prior to publication; website content would be designed to prevent confusion about the type of licence an individual held; andregistrants would be advised of their ability to seek suppression of their details. The Respondent also advised that it recently amended its guide, application forms and “notification of registration” letters to include information about what details appear in the public register.

The Commissioner did not investigate further on the basis that the Respondent was adequately dealing with it (s29(1)(h)(i)), but did not dismiss it formally, in case the Respondent’s promised actions were not adequately fulfilled.

Several months later the Commissioner became aware and notified the Respondent that another internet archive still retained abstracts of the original site. The Respondent took immediate steps to have this removed.

(Edited by PLPR Editors from the complaint note published by Privacy Victoria – see www.privacy.vic.gov.au/ for full text)

Comment

This complaint illustrates the significant impact that the Victorian Act is having on the operation of public registers in Victoria, and the potential relevance of various privacy principles. It also illustrates that Internet search engine archives must always be considered whenever a complaint concerns publication on the Internet.

Graham Greenleaf

MG v Director General, Department of Education & Training [2004] NSWADT 137

NSW Administrative Decisions Tribunal (9 July 2004)

Privacy - agency’s discretion to refuse out-of-time internal review applications – s53 PPIP Act (NSW)

MG had an on-going dispute with the Department about the names under which their children were enrolled at school. MG had previously applied for review by the Tribunal, which was dismissed because there had been no prior internal review. Following the earlier decision, MG then applied with the Department for an internal review. The Department declined to conduct an internal review on the basis that it was lodged out-of-time.

This case turned on whether the Tribunal could review the Department’s decision to decline to deal on the basis of being out-of-time.

MG argued that the decision to decline to deal on the basis of being out-of-time was a ‘finding’ and thus reviewable under s55(1)(a) of the Privacy and Personal Information Protection Act 1998 (the PPIP Act).

The Privacy Commissioner made submissions, in which he sought to distinguish this case from an earlier case, Y v Department of Education & Training [2001] NSWADT 149. He argued that the Department’s decision to decline to deal on the basis of being out-of-time could be seen as an ‘action taken by the public sector agency in relation to the application’, and thus reviewable under s55(1)(b).

The Department argued for the clear intention of s53(3)(d), which sets a 6 month time limit in which an applicant may lodge internal review applications, unless the agency allows longer. The Department argued that the exclusion of the Tribunal’s power to allow a late internal review application must be accepted as a deliberate choice on the part of the legislature.

The Tribunal ruled in favour of the Department, noting

“it is my view that the legislature did not intend that the Tribunal should have the power to review the exercise of a discretion to refuse to accept an application for internal review, where the application is out of time.” [41]

The rationale for the lack of jurisdiction to review out-of-time decisions was described as ensuring that

“an agency’s exposure to a privacy complaint that is too old to be properly investigated is limited.” [40]

Comment

This case confirmed the approach taken by the Tribunal since its first decision under the PPIP Act, Y v DET, that agencies have absolute (ie. non-reviewable) discretion to not allow an applicant longer than 6 months in which to lodge their application for internal review. (The 6 months commences to ‘run’ when the applicant first becomes aware of the conduct at issue.) No matters may proceed to the Tribunal unless the applicant is first able to successfully lodge an internal review request.

Anna Johnston

U v Major Banking Institution [2004] PrivCmrA 9

Federal Privacy Commissioner

Disclosure of personal information and credit worthiness information (NPP 2.1 and s18N(1)) - compensation claim - respondent had adequately dealt with matter (s41(2)(a)) - Privacy Act 1988 (Cth)

A default notice regarding the complainant’s overdue private bank account was disclosed by the respondent to the complainant’s spouse, from whom she was separated. U complained to the respondent (R)). R stated that the error was caused by out-of-date information on its database concerning U’s changed circumstances, and apologised for the incident. U complained to the Commissioner seeking compensation.

As the account was a private bank account, and the complainant’s spouse from whom she was separated was never an account holder, it appeared that, in disclosing information about the complainant’s overdue account to the spouse, the respondent had breached National Privacy Principle 2.1 (use and disclosure limitation) and section 18N(1) (prohibiting credit providers from disclosing information about individual’s credit worthiness, credit standing or credit history to unauthorised third parties.).

The Commissioner considered that the complainant had not substantiated a claim for compensation. The Commissioner’s practice is that where the Commissioner finds a breach of the Act, the compensation sought (which can include compensation for injury to the complainant’s feelings or humiliation suffered (s52(1A)) for the damage or loss suffered must be a direct result of the particular action that was a breach of the Act. An individual is usually only compensated for actual loss or damage rather than potential loss or damage (eg income not generated) unless it was reasonably foreseeable at the time of the breach that this future loss or damage would occur.

Here, the complainant had not established a clear nexus between any loss suffered and the breach by the respondent which resulted in the account information being passed to the complainant’s spouse, from whom she was separated. In the absence of any supporting documentation as to why the complainant believed she was entitled to compensation, the Commissioner was of the opinion that an apology from the respondent was an appropriate response to the complaint. The Commissioner exercised his discretion under section 41(2)(a) of the Act to decline to investigate a complaint where he or she is of the view that the respondent has adequately dealt with the complaint.

(Edited by PLPR Editors from the complaint note published by the Office of The Federal Privacy Commissioner – see www.privacy .gov.au for full text)

Given s52(1A), it is surprising that a complainant would not, in a case like this, be able to provide any evidence of humiliation arising from disclosure to an ex-spouse of non-payment of debts sufficient to justify at least a nominal compensation payment. In this case the complainant had already received an apology, and was specifically seeking compensation.

It appears that the only prudent course for a complainant to take is (a) to specify injury to feelings or humiliation in writing, as they will not be assumed; and (b) to specify this to the respondent before complaining to the Commissioner, or it is likely that an apology by the respondent will be regarded as adequate.

Graham Greenleaf

Department of Education and Training v GA, GB, GC, GD & GE (No 2) [2004] NSWADTAP 36

NSW Administrative Decisions Tribunal – Appeal Panel (2 September 2004)

Privacy – appeal – time for lodging

This judgment replaces the Appeal Panel’s earlier decision in NSWADTAP 34 (4 August 2004). This was because an error was subsequently found (GA’s papers had been wrongly filed and thus not considered) and the matter re-considered. Nonetheless the Panel came to the same conclusions.

The Appeal Panel may allow extra time to lodge an appeal against a ruling of the Tribunal, if the Panel sees fit.

In the original case, GA wanted the hearing to include consideration of a collection issue. The respondent Department argued against, on the basis that collection was not identified in GA’s review application. The Tribunal determined orally on 11 June 2003 that it had jurisdiction. DET did not appeal immediately, waiting for the substantive matter to be finalised. However in its written judgment of 12 January 2004 (GA and Ors v Department of Education and Training and NSW Police [2004] NSWADT 2) on the substantive matter, the Tribunal found, contrary to its earlier determination, that it had no jurisdiction.

GA appealed. The Appeal Panel found on 25 May 2004 (GA & Ors v Department of Education and Training and NSW Police [2004] NSWADTAP 18) that the Tribunal had made an invalid decision in its written decision of 12 January 2004, as it contradicted its own earlier oral determination. The Appeal Panel found the oral determination was the operative one, and invited the Department to now consider an appeal against the original oral determination of 11 June 2003.

The decision here was thus only to determine whether or not the Department ought be allowed to lodge an appeal against the oral determination of 11 June 2003. Having reviewed the merits, the Panel determined to allow the Department’s late lodging of its appeal against the original oral determination of 11 June 2003.

Anna Johnston