Express law No. 274

30 November 2018

AIT18 v Australian Information Commissioner [2018] FCAFC 192

The Full Court of the Federal Court has handed down an important decision on the Privacy Act 1988. The decision delivers significant clarity around concepts of 'required or authorised by or under law' and reasonable expectation, as well as providing general guidance on the correct approach to construing the Act.

Background

At the relevant time, AIT18 was a member of the Royal Australian Air Force (RAAF) who had lodged a claim for compensation under the Military Rehabilitation and Compensation Act 2004 (Cth). Dissatisfied with the processing of his claim, he created a website on which he posted criticisms of the Department of Veterans' Affairs (DVA), its staff and the responsible Minister. He also sent phone, SMS and email messages to DVA personnel in terms which DVA considered threatening and offensive.

In the course of responding to this conduct, DVA disclosed AIT18's personal information to an ADF Senior Medical Officer, the Head of Joint Health Command in the Department of Defence and the Chief of Air Force. AIT18 made a complaint to the Australian Information Commissioner (the IC), who found that DVA had breached Information Privacy Principle (IPP) 11.1: Re DO and Department of Veterans' Affairs [2014] AICmr 124. The IC declined to award compensation.

The Tribunal's decision

AIT18 lodged an application for review with the Administrative Appeals Tribunal. The Tribunal set aside the IC's decision and substituted a decision dismissing the privacy complaint: Re TYGJ and Information Commissioner [2017] AATA 1560. It found that the disclosures were permitted under IPP 11.1(a) – a disclosure that the individual concerned would be reasonably likely to be aware was usual. The Tribunal also found that the disclosures were permitted under IPP 11.1(d) – required or authorised by or under law, finding that s 16 of the then Occupational Health and Safety Act 1991 (Cth) (the OHS Act) impliedly authorised the disclosures.

The decision of the Full Court and significant takeaways

AIT18's appeal was heard by a Full Court (Logan, Griffiths and Farrell JJ), who unanimously dismissed the appeal. There are 4 significant takeaways from the Full Court's decision for privacy law practitioners and decision-makers.

First, while the Act is beneficial or remedial legislation and should, as a matter of general principle, be construed liberally, close attention should be paid to the relevant statutory terms of the Act being interpreted: at [82]. The Court held that the Act protects privacy from unlawful or arbitrary interference, but also provides exceptions that should be construed in a way that reflects Parliament's balancing of competing community interests: at [85]. The Court rejected a submission that equated the right to privacy with a fundamental common law right: at [83].

Second, the Court rejected arguments from AIT18 that the term 'usually' in IPP 11.1(a) meant 'frequently' and found that there was no error in the Tribunal's construction of 'ordinarily': at [102]–[107]. While the term 'usually' is not used in equivalent Australian Privacy Principles (APPs) 6.1 and 6.2, the Court's reasoning on this term may be of ongoing relevance to collection notices and the requirement in APP 5.2 for an agency to disclose the APP entities, bodies or persons to which they 'usually' disclose personal information of the kind collected.

Third, the Court upheld the subjective approach taken by the Tribunal in considering whether the individual concerned was reasonably likely to be aware that such disclosures were usual. The Court held that IPP 11.1(a) is focused on the 'individual concerned'. As such, the personal characteristics of that individual (such as experience or education) are very relevant to assessing what they are 'reasonably likely' to be aware of: at [115]–[116] and [118]. Although APP 6.2(a) is now framed in terms of what an 'individual' would 'reasonably expect', it seems likely that the subjective assessment remains appropriate due to the explicit retention of assessing the disclosure through the lens of the 'individual'.

Finally, the Court rejected a submission by the Applicant that the exception in IPP 11.1(d) (replicated almost identically in APP 6.2(b)) only applied to disclosures explicitly required or authorised by law: at [123]. Disclosures can be provided 'under' a law by necessary implication from a law directed to a purpose unrelated to the disclosure of records or information: at [125]. The Court held that the Tribunal had correctly found that s 16 of the OHS Act implicitly required or authorised disclosure in the circumstances as DVA was required to take all reasonably practicable steps to protect the health and safety of its employees: at [126]. The Court noted that this exception does not extend to disclosure in circumstances where it would be merely incidental, convenient or conducive to fulfilling a statutory obligation. Rather, the implication arises where it is necessary to give effect to a statutory scheme or avoid frustrating a statutory scheme: at [129].

For further information please contact:

Important: The material in Express law is provided to clients as an early, interim view for general information only, and further analysis on the matter may be prepared by AGS. The material should not be relied upon for the purpose of a particular matter. Please contact AGS before any action or decision is taken on the basis of any of the material in this message.