19 October 2016
Administrative Appeals Tribunal awards $8,000 in compensation for interference with privacy
In EQ and Office of the Australian Information Commissioner (Freedom of information) [2016] AATA 785, the Administrative Appeals Tribunal (the Tribunal) set aside an award of damages of $5,000 for an interference with privacy under the Privacy Act 1988. The Tribunal found the applicant was entitled to $8,000 in compensation for non-economic loss.
This is only the second Tribunal decision on compensation under the Privacy Act, and there is no judicial authority on point. Although the decision concerns the Information Privacy Principles (IPPs) (which were replaced by the Australian Privacy Principles in March 2014), it provides useful guidance to agencies on the approach to assessing compensation under the Privacy Act.
Background
In February 2013, Queensland Parks and Wildlife Service (QPWS) rangers observed the applicant fishing from a marine conservation research boat in a 'green zone' of the Great Barrier Reef Marine Park. At the time of the incident, the applicant was employed as a marine conservation research assistant. The boat was owned by his employer and funded by external sponsor organisations. QPWS rangers provided a compliance incident report to the Great Barrier Reef Marine Park Authority (GBRMPA) and the matter was investigated by GBRMPA. The applicant was interviewed and subsequently issued with an infringement notice.
On 5 April 2013, GBRMPA received an email from a journalist at News Corp Australia in which the journalist identified the applicant and the incident. On 6 April 2013, GBRMPA responded to News Corp, also identifying the applicant and his employer and noting that the matter was still under investigation.
On 7 April 2013, a newspaper published an article which included information GBRMPA had supplied to the journalist on 6 April 2013. That story prompted a series of further media articles, including an article in the Queensland Seafood Industry Association (QSIA) newsletter. In addition to restating information that GBRMPA disclosed on 6 April 2013, the QSIA article revealed information said to have come from GBRMPA about the infringement notice issued to the applicant.
Privacy Commissioner's determination
The applicant lodged a complaint with the Office of the Australian Information Commissioner. He alleged that GBRMPA had interfered with his privacy by disclosing his personal information to third parties. Specifically, the applicant made the following allegations:
- GBRMPA or QPWS (acting as the agent of GBRMPA) disclosed his personal information to News Corp Australia on or before 5 April 2013 (the first alleged breach).
- GBRMPA disclosed his personal information to News Corp Australia on 6 April 2013 (the second alleged breach).
- GBRMPA disclosed his personal information to the QSIA on or before July 2013 (the third alleged breach).
GBRMPA acknowledged that it had disclosed personal information about the applicant to News Corp on 6 April 2013 and accepted that this disclosure was a breach of IPP 11.1. GBRMPA denied the disclosures in the first and third alleged breaches.
The Privacy Commissioner found the complaint substantiated on the basis of the second breach but determined there was insufficient information to find that GBRMPA made the disclosures in the first and third alleged breaches. The Privacy Commissioner ultimately awarded $5,000 in compensation for non-economic loss but refused to award compensation for economic loss.
Administrative Appeals Tribunal determination
The applicant sought review of the Privacy Commissioner's determination in the Tribunal.
Findings on breach
The Tribunal affirmed the Privacy Commissioner's finding on the first alleged breach. The Tribunal agreed that, although it was likely that either GBRMPA or QPWS was responsible, it was not possible to determine which entity was responsible on the evidence. The Tribunal went on to find that, in any event, GBRMPA could not be held responsible under the Privacy Act for actions of QPWS employees because of the distinct and separate nature of their employment arrangements.
The Tribunal affirmed the Privacy Commissioner's finding on the second breach, which GBRMPA did not challenge in the proceedings.
On the third alleged breach, GBRMPA acknowledged that information had come to light that an employee had supplied information to QSIA. GBRMPA contended that this disclosure was permitted under IPP 11.1(d), as it was authorised by s 61AFA of the Great Barrier Reef Marine Park Act 1975. Section 61AFA(1)(c) of the Act permits 'the Authority' to publicise, in any way it thinks appropriate, a penalty imposed on a person for an offence or contravention of a civil penalty provision. GBRMPA argued that, based on a plain reading of the words of the statute and the stated legislative purpose, s 61AFA(1)(c) extends to disclosures about offences for which no conviction is ultimately recorded. (In this case, the applicant had paid the fine for the offence, thus avoiding further proceedings being taken on the offence and a conviction.)
The Tribunal agreed with GBRMPA's submission, finding that the disclosure to QSIA fell within the terms of s 61AFA and was permitted under IPP 11.1(d).
Findings on damages
The applicant claimed significant damages for economic loss arising from loss of employment and future work opportunities within the industry, as well as damages for non-economic loss.
In assessing compensation, the Tribunal had regard to the decision in Rummery and Federal Privacy Commissioner (2004) 85 ALD 368 and the ordinary principles of damages as applied in tort law.
The Tribunal affirmed the Privacy Commissioner's reasoning and conclusion on the economic loss claim on the established breach, citing the difficulty in separating the effect of a disclosure to News Corp on 5 April 2013 from GBRMPA's disclosure the following day. (An important factor in the Privacy Commissioner's decision on the economic loss claim which was not referred to in the Tribunal's assessment was the applicant's own actions in committing the offence of fishing in a green zone and his own direct contribution to any economic loss).
With respect to the non-economic loss claim, the Tribunal held that, in all the circumstances of the case, the applicant should be awarded $8,000 in compensation. In assessing damages for non-economic loss, the Tribunal had regard to the applicant's feelings of humiliation as a direct result of the privacy breach and his own character (for example, his 'natural shyness'), which may have influenced the severity of his reaction to the breach. Further, the Tribunal noted that, had it found in favour of the applicant on the third alleged breach, the Tribunal would have awarded $8,000 in compensation for non-economic loss for that breach.
Referring to the decision in 'CP' and Department of Defence [2014] AICmr 88, the Tribunal noted that the applicant's evidence of an assurance that the amount of the fine and the fact he had paid it would not be published would be particularly relevant to the assessment of damages flowing from the third alleged breach.
Finally, the Tribunal found that this was not an appropriate case for the award of exemplary damages, stating that there was no evidence of high-handed or malicious intent on the part of GBRMPA in respect of the established breach. In that context, the Tribunal noted that GBRMPA had attempted in good faith to mediate with the applicant when the breaches were brought to its attention.
Implications for agencies
The decision highlights important points for agencies about the way that the Tribunal is likely to approach compensation under the Privacy Act as well as the value of proactive management of privacy complaints. In particular:
- The decision confirms that, where a breach is substantiated and loss or damage can be shown to have been suffered as a result, the Tribunal is likely to find that an amount of financial compensation should be awarded.
- For compensation to be awarded, a complainant must establish a causal connection between the agency's breach and the loss suffered. This is particularly important in the case of damages for economic loss, where other factors outside of the agency's control (for example, the complainant's own conduct) may in fact be the real cause of the complainant's loss.
- The decision serves as a timely reminder to agencies about the value in proactively managing privacy complaints, especially where it is apparent from an early stage that a breach has occurred. An early apology and other offers of redress as appropriate in the circumstances will be likely to stand the agency in good stead before the Commissioner and the Tribunal.
Important: The material in Express law is provided to clients as an early, interim view for general information only, and further analysis on the matter may be prepared by AGS. The material should not be relied upon for the purpose of a particular matter. Please contact AGS before any action or decision is taken on the basis of any of the material in this message.
