23 September 2014
Recent decision indicates likely compensation range for breach of privacy
The recent decision by the Privacy Commissioner in 'CP' and Department of Defence [2014] AICmr 88, on 2 September 2014, gives some guidance on the level of compensation likely to be awarded for damages as a result of breaches of privacy.
Background
The complainant, who was employed by the Department of Defence, had lodged a compensation claim.
The complainant was required to undertake a medical assessment with an independent medical practitioner to determine his fitness for duty. The complainant alleged that Defence breached his privacy by disclosing his sensitive personal information to his general practitioner without his consent. A key fact in the breach claim was that he had expressly revoked his prior consent for certain medical information to be shared with his GP.
Defence accepted that it had breached Information Privacy Principle 11 (IPP 11) (limiting the disclosure of personal information), thereby contributing to the complainant's existing psychological disorder and associated emotional suffering. (As the conduct occurred before 12 March 2014, it was the IPPs, rather than the new Australian Privacy Principles, that applied.) The Privacy Commissioner considered whether it was an appropriate case to order compensation as a remedy under s 52(1)(b)(iii) of the Privacy Act 1988.
What amount of compensation was appropriate?
In assessing compensation the Privacy Commissioner had regard to the principles established in Rummery and Federal Privacy Commissioner [2004] AATA 1221(which itself considered Hall v A & A Sheiban Pty Ltd [1989] FCA 65) at [32], including:
- that the legislation contemplates some form of redress where a complaint is substantiated and loss or damage suffered
- awards should be restrained but not minimal
- principles of damages applied in tort law will assist, but the ultimate guide is the statute
- any assessment should have regard to the complainant's reaction and not the perceived reaction of the majority of the community or a reasonable person in similar circumstances
- aggravated damages may be awarded in appropriate cases.
The Privacy Commissioner also had regard to his previous compensation determinations, particularly 'D' v Wentworthville Leagues Club [2011] AICmr 9 ('D') and 'BO' v Aerocare Pty Ltd [2014] AICmr 37 ('BO'), as well as discrimination cases that have considered compensation for non-economic loss, and also the nature of the personal information that was disclosed.
The Commissioner held that the disclosure by Defence had an impact upon the complainant's disorder and suffering, even if there were other contributory causes. The Commissioner took into account that disclosure was limited to the complainant's treating doctor, who has obligations to safeguard the privacy and confidentiality of patient medical information. An award of $5,000 was made in favour of the complainant for non-economic damage. Aggravated damages were held not to be appropriate, as Defence did not engage in 'high-handed, malicious, insulting or oppressive' conduct (see 'BO' at [57]).
Significance for clients
This is the most recent determination looking at principles of compensation for interferences with privacy under the Privacy Act. Together with the cases it refers to ('D' and 'BO') it gives a good indication of the likely ranges of compensation that the Privacy Commissioner may award under the Privacy Act.
Important: The material in Express law is provided to clients as an early, interim view for general information only, and further analysis on the matter may be prepared by AGS. The material should not be relied upon for the purpose of a particular matter. Please contact AGS before any action or decision is taken on the basis of any of the material in this message.
