A determination recently issued by the Office of the Federal Privacy Commissioner (OFPC) has highlighted the need for Federal Government agencies to carefully consider the best way to balance the competing obligations of protecting the privacy of their employees and customers, and the need to cooperate and share information with regulators.
Complaint Determination No 5 of 2004 (Determination) involves a complaint lodged by an employee (complainant) of the Australian Capital Territory Department of Justice and Community Safety (JACS) under section 36 of the Privacy Act 1988 (Cth) (Privacy Act). The complainant alleged that JACS engaged in conduct constituting an interference with the complaint's privacy by disclosing personal information about the complainant to the Australian Capital Territory Ombudsman (Ombudsman) without proper authorisation under the Privacy Act. The complainant sought a letter of apology from the JACS officer involved and financial compensation of $20,000 for damages caused to the complainant's reputation which allegedly ruined the complainant's employment opportunities in the public service.
The Privacy Commissioner found in favour of the complainant and determined that the disclosure by JACS of certain personal information about the complainant to the Ombudsman breached Information Privacy Principle (IPP) 11. However the Commissioner declined to grant the complainant the $20,000 compensation requested because the complainant was not able to satisfactorily demonstrate that the complainant had suffered the alleged damages.
The complainant was employed by JACS and has since accepted a voluntary redundancy. During the course of working for JACS, the complainant made a public interest disclosure (PID) to the Ombudsman alleging that JACS had failed to adequately enforce provisions of the Liquor Act 1975 (ACT) in relation to offences concerning minors and associated issues of public safety. These allegations were similar to allegations that the complainant had already raised internally with JACS.
In response, the Ombudsman's Office wrote to JACS stating that the Ombudsman intended to investigate the complainant's PID and requested JACS provide copies of any relevant information. In meeting this request, a JACS employee (JACS officer) spoke with the Ombudsman on two occasions. During the course of these conversations, the identity of the complainant and a range of personal information about the complainant, including employment-related issues, were revealed and file notes were made by the Ombudsman Officers detailing these revelations. The complainant eventually became aware of the file notes and made a complaint to the OFPC.
Federal Government agencies are bound by the IPPs contained in section 14 of the Privacy Act, which provide the standards for handling personal information. This particular complaint raised the issue of whether there was an improper disclosure of personal information.
In general, IPP 11 prohibits agencies from disclosing information to a person, body or agency (other than the individual concerned) except under a few prescribed circumstances. Most relevantly, JACS argued that the disclosures it made about the complainant fell within two exceptions under IPP 11, namely those provided under IPP 11.1(a) and IPP 11.1(d).
IPP 11.1(a) permits disclosure where the individual concerned is reasonably likely to have been aware that the information is of the kind that is usually passed to the agency (ie the Ombudsman) and IPP 11.1(d) permits disclosure where it is required or authorised by or under law.
The Commissioner found that the JACS officer had disclosed to the Ombudsman that the complainant had experienced work problems and had sought a voluntary redundancy without success. The JACS officer also disclosed personal information about the complainant's racing industry activities and about the complainant's requests to JACS for the complainant to hold a bookmakers licence.
In deciding whether the above disclosure fell within the exceptions in IPP 11.1(a) or IPP 11.1(d), the Commissioner found that a reasonable person in the complainant's position, ie an experienced employee of JACS with reasonable familiarity with grievance and investigation, would be 'reasonably likely to be aware' that IPP 11.1(a) did permit JACS to disclose personal information about the complainant's identity and the fact that the complainant had previously made the same complaints internally. However, the Commissioner found that the other information disclosed in relation to the disputes, grievances and complaints between the complainant and JACS in relation to employment matters, and the complainant's bookmaking interests (Additional Disclosures) were not sanctioned by IPP 11.1(a) because they are not inherently related to the PID.
With respect to JACS' second contention that IPP 11.1(d) permitted its disclosure because they were of a kind 'required or authorised by law', JACS argued that the Additional Disclosure was needed in order to allow the Ombudsman to decide whether the PID made was frivolous, vexatious or not made in good faith. This would in turn assist the Ombudsman in deciding whether to proceed with the complaint. The Commissioner found that the authority for disclosure given by the relevant legislation is not unlimited but rather restricted by a test of relevance. The issue is whether the personal information disclosed by JACS went beyond what was relevant to the Ombudsman in deciding whether to proceed with the PID. The Commissioner reached the conclusion that the Additional Disclosures did not add to the question of whether the PID was made in bad faith and they went beyond the provision of personal information to the Ombudsman.
Hence, the Commissioner issued the Determination that the Additional Disclosures made by JACS to the Ombudsman interfered with the complainant's privacy. He also declared that JACS should not repeat such conduct and should apologise to the complainant for disclosing the complainant's personal information.
In relation to the complainant's request for compensation, Commissioner found that the disclosures did not occur outside the boundaries of the Ombudsman's investigating team and were not known more widely in the community. As a result, the Commissioner declined to make a declaration as to compensation because the complainant did not satisfactorily demonstrate the complainant suffered the alleged damages.
Implications of the Determination for privacy in generalFrom the perspective of Federal Government agencies, the decision emphasises the fact that when an agency provides information about an employee or customer as part of meeting the request of a regulator, it must carefully consider whether such disclosure is relevant and does not go beyond the purpose for which the information was requested. Otherwise the agency may find itself liable for damages if it is found that the disclosure breached IPP 11.
For the individual whose information has been disclosed as part of a regulator's investigative functions, this Determination demonstrates the remedy available to them when such disclosures are found to be unauthorised. While in this particular case, the Commissioner had declined to make a declaration as to compensation, it follows that had the complainant been able to show that he/she suffered injury to reputation and future employment opportunities as a result of the disclosures, the Commissioner may very well have awarded damages.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.