Allens

Data Governance, Data Services, Privacy & Cyber

Increase text sizeDecrease text sizeDefault text size

Focus: A newly determined Privacy Commissioner

13 December 2011

In brief: The Australian Privacy Commissioner has made its first determination in response to a complaint since 2004. Partner Michael Pattison and Lawyer Margaret Walsh report on this decision, where an organisation was required to pay damages, issue a written apology and provide privacy training to staff.

How does it affect you?

  • The Australian Privacy Commissioner's (the Commissioner) willingness to exercise its power on this occasion (rather than follow its traditional approach of conciliation), together with the recently announced investigation into Telstra's data breach, shows a more proactive approach to enforcing privacy obligations than has been the case previously.
  • In a speech earlier this month, the Commissioner foreshadowed an intention to make greater use of the determination powers.
  • In light of the tougher approach being taken now by the Commissioner, organisations should ensure that their privacy practices and procedures comply with their legal obligations.

Background

The complainant was a member of the Wentworthville Leagues Club (the club). In August 2007, the club received a letter from the complainant's former partner attaching a subpoena that had been issued by the Federal Magistrates Court during family law proceedings in 2005. The subpoena required that the club provide to the court by 28 November 2005:

All gambling records, or records of transactions linked to any gambling cards related to or held in the name of [complainant's name, address and date of birth] or the [complainant's company].

The letter requested that the club provide the records referred to in the subpoena to the complainant's former partner.

The club provided the records to the complainant's former partner who then disclosed them to various people including the complainant's friends, family, previous neighbours, parents of their children's friends and work colleagues.

The complainant alleged that, as a result of the unauthorised disclosures, he suffered stress, anxiety and decreased performance at work .

The complainant sought $19,483 in compensation for economic loss and unspecified amounts for both non-economic loss and punitive damages.

The Commissioner's declaration

The Commissioner declared that the club had breached National Privacy Principle 2.1 (NPP 2.1) and required that the club:

  • issue a written apology;
  • review its training on the handling of personal information (with a particular focus on responding to subpoenas); and
  • pay $7,500 in compensation for non-economic loss.1

The disclosure

NPP 2.1 relates to the disclosure of personal information and provides that an organisation must not use or disclose personal information about an individual for a purpose other than the primary purpose of collection, unless an exception set out in NPP 2.1(a) – (h) applies.

Following the initial complaint, the club sought to rely upon the exception in 2.1(g) – that the use or disclosure was required or authorised by or under law. The club argued that it disclosed the information in a good faith attempt to comply with the terms of the subpoena. However, the club later acknowledged that the disclosure interfered with the complainant's privacy.

The Commissioner found that the disclosure was not in accordance with the subpoena, as the information should have been provided to the court, not to the former partner, and was provided in 2007, rather than by the required date in 2005. As a result, the disclosure was declared to be a breach of NPP 2.1.

The Commissioner's power to award compensation

The Commissioner is entitled under section 52(1)(b)(iii) of the Privacy Act 1988 (Cth) (the Act) to make a determination which includes a declaration that the complainant is entitled to be paid compensation for 'any loss or damage suffered by reason of the act or practice the subject of the complaint'. Under the Act, loss or damage may include injury to a complainant's feelings or humiliation suffered by the complainant. A determination that a complainant is entitled to compensation is not directly enforceable by the complainant. However, the complainant may apply to the Federal Court for an order that the compensation be paid.

In deciding on the amount of compensation to be paid, the Commissioner referred to the principles on awarding compensation set out in the Administrative Appeals Tribunal decision in Rummery and Federal Privacy Commissioner2:

  • where a complaint is substantiated and loss or damage is suffered, the legislation contemplates some form of redress in the ordinary course;
  • awards should be restrained but not minimal;
  • in measuring compensation, the principles of damages applied in tort law will assist, although the ultimate guide is the words of the statute;
  • in an appropriate case, aggravated damages may be awarded; and
  • compensation should be assessed having regard to the complainant's reaction and not to the perceived reaction of the majority of the community or of a reasonable person in similar circumstances.

The Commissioner noted that s52(1)(b)(iii) of the Act provides for an award of 'compensation' (which may include aggravated damages) but not for an award of punitive damages.

Claim for non-economic loss

The complainant argued that the disclosure caused psychological and physical harm, resulting in symptoms of stress and emotional disturbance. The complainant produced evidence to support the claim, including medical certificates and a psychologist's report.

The medical certificates showed that the complainant suffered from anxiety, panic attacks and physical symptoms after becoming aware of the disclosure. The Commissioner found that these symptoms were caused, in part, by the disclosure. However, the psychologist's report showed that some symptoms pre-dated the disclosure.

In determining what level of compensation to award, the Commissioner considered all the evidence, together with previous determinations and awards in discrimination cases. The Commissioner determined that the complainant was entitled to compensation of $7,500.

Claim for economic loss

The complainant claimed that the disclosure caused his performance at work to decrease and that he therefore suffered economic loss in the form of reduced sales commissions.

The Commissioner was not satisfied, on the evidence available, that the loss suffered by the complainant was caused by the disclosure. As a result, no compensation for economic loss was awarded.

Claim for punitive and aggravated damages

The complainant also sought punitive damages. However, the Commissioner does not have power under the Act to award punitive damages.

Although the complainant did not seek aggravated damages, the Commissioner considered whether they ought to be awarded. The Commissioner stated that aggravated damages may be awarded where the respondent behaved 'high-handedly, maliciously, insultingly or oppressively in committing the act'.

No aggravated damages were awarded, as the club said that it had acted in good faith in disclosing the information and had subsequently made an unconditional apology.

Other remedies

The Commissioner is entitled under s52(1)(b)(ii) of the Act to declare that the respondent perform any reasonable act or course of conduct to redress any loss or damage suffered by the complainant. In this case, the Commissioner required the club to issue a written apology within three weeks of the determination, review its training of staff in the handling of personal information, and confirm that the review of training has been completed within six months of the determination.

Footnotes
  1. 'D' and Wentworthville Leagues Club [2011] AlCmr 9 (9 December 2011).
  2. Rummery and Federal Privacy Commissioner and Anor [2004] AATA 1221, [32].

For further information, please contact:

Share or Save for later

What are these?

 

To save this publication on your smartphone or
tablet for off-line reading (eg on a plane flight),
we recommend Pocket.

 

 

You can leave a comment on this publication below. Please note, we are not able to provide specific legal advice in this forum. If you would like advice relating to this topic, contact one of the authors directly. Please do not include links to websites or your comment may not be published.

Comment Box is loading comments...