Australian Information Commissioner
‘WZ’ and CEO of Services Australia (Privacy) [2021] AICmr 12 (13 April 2021) – Australian Information Commissioner
‘Audit of policies, procedures and systems’ – ‘Complainant had notified of separation from partner’ – ‘Following, harassing and monitoring’ – ‘Privacy’ – ‘Protection orders’ – ‘Residential address disclosed to the complainant's former partner’
Proceedings: Complaint under s 36(1) of the Privacy Act 1988 (Cth) (Privacy Act).
Facts: The female complainant was receiving Centrelink payments administered by Services Australia (the respondent) while living with her former male partner. She obtained an Apprehended Violence Order (which her partner was imprisoned for breaching). The complainant notified the respondent of her separation from the partner, but the respondent considered the separation unverified. Their online records continued to be linked meaning that if the complainant updated her address online, her partner’s address would also be updated. Her former partner posted a screenshot of the complainant’s new address to social media and made threats against her and her current partner.
Issues: Whether Services Australia interfered with the complainant’s privacy as defined in the Privacy Act 1988 (Cth).
Decision and reasoning: The Commissioner found that the respondent interfered with the complainant’s privacy by:
1.
Disclosing the complainant’s personal information, namely, her new address to her former partner, for a purpose other than that for which it was collected, in breach of Australian Privacy Principle (APP) 6.
2.
Failing to take reasonable steps to ensure that it used accurate and up-to-date personal information of the complainant in the form of her relationship status having regard to the purposes of its use, being to update her former partner’s address, in breach of APP 10.2.
3.
Failing to take reasonable steps to ensure that it used accurate and up-to-date personal information of the complainant in the form of her address at which she could be contacted in breach of APP 10.2.
4.
Failing to take reasonable steps to protect the complainant’s personal information, being her updated address, from unauthorised disclosure to her former partner in breach of APP 11.1.
In addition to ordering compensation for non-economic loss (including re-activation of psychological symptoms and distress) and expenditure incurred in association with the privacy complaint, and ordering an apology, the Agency was required to undertake an audit of policies, procedures, and systems to ensure the privacy breach was not repeated or continued. The Commissioner noted at [156]-[160]:
The effect of this privacy breach on the complainant has been significant. This is in large part due to the fact that she feared harm from the former partner… While the changes the respondent has made are encouraging, I remain concerned that individuals are at risk of their personal information being disclosed to former partners.
[…]
It is appropriate for the respondent to put in place more robust measures where the consequences for individuals are more significant. It is therefore appropriate to have special measures in place to protect individuals identified as being at risk of domestic violence. However, I remain concerned about the risks to individuals seeking to update their own address and not that of their former partner, where the respondent is not satisfied that the individual has in fact separated from their partner, regardless of whether they have a history of family or domestic violence. The ‘reasonable steps test’ is one that takes into account all relevant circumstances, including what is practical and what is required where the adverse consequences to particular individuals are significant.
I therefore see no reason to limit the audit to a particular cohort of individuals, including those at risk of family domestic violence. It is appropriate in order to address the grievance to target the situation where an individual makes unverified claims to have separated from, or to be no longer living with, their partner, and seeks to update their address, whether online or in person.”
‘ST’ and Chief Executive Officer of Services Australia (Privacy) [2020] AICmr 30 (30 June 2020) – Australian Information Commissioner
‘Damages for non-economic loss’ – ‘Disclosure for tribunal proceedings’ – ‘Following, harassing and monitoring’ – ‘Information privacy principles’ – ‘Privacy’
Proceedings: Complaint under s 36(1) of the Privacy Act 1988 (Cth) (Privacy Act).
Facts: The female complainant’s complaint concerned the disclosure of her personal information, collected by the former Child Support Agency for a Tribunal hearing, to the complainant’s ex-partner. She claimed that the personal information revealed the places she visited which she had attempted to keep hidden from the ex-partner as she feared harm.
Issues: Whether Services Australia interfered with the complainant’s privacy as defined in the Privacy Act.
Decision and reasoning: Services Australia interfered with the complainant’s privacy, breaching the Information Privacy Principles (IPP), by disclosing the complainant’s personal information in breach of IPP 11. The locational information disclosed was not relevant to the decision under review by the Tribunal and the complainant was therefore not likely aware that information of its kind would be disclosed.
In terms of damages, the Commission accepted that the complainant had already disclosed some of the places she had frequented through other processes. The Commissioner noted at [75]-[76]:
“I do not consider that the previously disclosed information negates the complainant’s claim to have feared the ex-partner locating her. The complainant clearly went to some lengths to redact certain information from the documents she provided in the primary decision process and I accept her claim that she thought carefully about what information to disclose.”
“However, I am of the view that in all the circumstances, the degree by which the disclosure contributed to the complainant’s fear of being located by the ex-partner was not significant. I place weight on the fact that the complainant had disclosed some locations to the ex-partner during the COA process and that she continued to maintain a PO Box at the same post office as the ex-partner. I also note the absence of any evidence showing that the complainant sought the assistance of police. While I accept the complainant’s claims to have feared being located by the ex-partner, these claims are not so specific and detailed (nor are they supported by specific and detailed corroborating evidence) as to cause me to form the view that the disclosure exacerbated her fear of being located to a significant extent.”
The Commissioner was satisfied that the privacy breach had caused the complainant distress, but no other claimed damage. She was awarded $3,000 for non-economic loss.
‘PJ’ and Australian Federal Police (Freedom of Information) [2018] AICmr 64 (10 September 2018) – Australian Information Commissioner
‘Confidentiality’ – ‘Freedom of information’ – ‘Public interest’ – ‘Systems abuse’ – ‘Whether disclosure of personal information unreasonable’
Proceedings: Review of refusal access decision under Freedom of Information Act 1982 (Cth).
Facts: The applicant applied to the Australian Federal Police (AFP) for access to “any notes made on myself by the Australian Federal Police. Not criminal records, but any and all police files/notes made on me.” The AFP exempted access to 13 folios in part under s 47F (the personal privacy exemption) of the Freedom of Information Act 1982 (Cth). Some exempt material included names, dates of birth and contact details of third party individuals, and information pertaining to an alleged domestic violence incident.
Issues: Whether the material the AFP found to be exempt under s 47F was conditionally exempt. If so, whether giving the applicant access to conditionally exempt documents would, on balance, be contrary to the public interest (s 11A(5)).
Decision and reasoning: Access to personal information of third party individuals and about an alleged domestic violence incident involving the applicant was refused.
Taking into account the nature of the information, that the information was provided for a limited purpose and was not well-known or available from other public sources, the Commissioner accepted the AFP’s submission that disclosure could undermine a range of processes intended to protect individuals and could discourage those who may be affected by domestic violence from coming forward to police. The Commissioner was satisfied disclosure would be unreasonable and the relevant material was conditionally exempt under s 47F. It was also contrary to the public interest to give the applicant access to the conditionally exempt documents at this time.
‘DK’ and Telstra Corporation Limited [2014] AICmr 118 (30 October 2014) – Australian Information Commissioner
‘Family law judge’ – ‘Following, harassing and monitoring’ – ‘Non-economic loss’ – ‘Privacy’
Proceedings: Complaint under s 36(1) of the Privacy Act 1988 (Cth) (Privacy Act).
Facts: The complainant worked as a judge in the family law jurisdiction. He requested that Telstra connect a phone line to his home for the sole purpose of an alarm system installed by the Court. Telstra set up the phone line and published the complainant’s name, address and the phone number in both the White Pages online and in the hard copy directory.
Issues: Whether Telstra had breached the complainant’s privacy.
Decision and reasoning: Telstra interfered with the complainant's privacy by failing to take reasonable steps to provide notice to the complainant that it would use and disclose his personal information for the purpose of publishing it in the White Pages, in breach of National Privacy Principle (NPP) 1.3. Telstra was ordered to apologise, review its processes and review its Privacy Statement.
Telstra was also ordered to pay the complainant $18,000 for non-economic loss. In reaching this amount, the Commissioner noted the following evidence from the complainant:
“Since the publication of my details a litigant from a matter decided by me has begun to loiter at and about our home. As my details and those of my partner are suppressed on every public register I infer his knowledge of our address is the White Pages site…
“We have just moved to our home and our enjoyment of it has been rudely interrupted…We both jump whenever the street bell rings. I have applied to be transferred interstate. On moving we will incur moving costs, expenses re sale of our home and costs of resettling… We will both have expenses travelling to visit family and friends as our lives, to date, have been in [omitted]…
“The invasion of and prejudice to my privacy and personal safety can be readily envisioned as arising for others such as victims of crime, women fleeing domestic violence and the like.”
In awarding compensation, the commissioner was guided by severity of the impact of the privacy breach on the complainant (with concerns for his/his partner’s safely leading him to move interstate); the added security threat he/his partner were exposed to; the responsibility of Telstra as an organisation to have appropriate measures in place; and the extent of the publication to a very wide audience in both online and hard copy form.
‘AG’ and Department of Immigration and Citizenship [2013] AICmr 55 (26 April 2013) – Australian Information Commissioner
‘Freedom of information’ – ‘Material obtained in confidence’ – ‘Personal privacy exemption’ – ‘Request for access to documents’ – ‘Visa application’
Proceedings: Review of refusal access decision under Freedom of Information Act 1982 (Cth).
Facts: The applicant applied to the Department to access specific documents related to his ex-wife. The Department refused access to 11 documents saying disclosure would reveal information provided in confidence and personal information about third parties, of which disclosure would be unreasonable and contrary to public interest.
Issues: Whether the documents were exempt under ss 45 (material obtained in confidence) and 47F (personal privacy exemption) of the FOI Act.
Decision and reasoning: Access refused.
Documents exempt under s 45 included statutory declarations made by the applicant’s ex-wife and other third parties in relation to her application for permanent residency in Australia, as well as a record of interview with the ex-wife and letter sent by a third party. The commissioner was satisfied that disclosure of the documents sought would cause detriment to the applicant’s ex-wife. The Commissioner was satisfied that disclosure of the documents sought would be a breach of confidence and the documents were exempt under s 45.
Documents exempt under s 47F were general correspondence in relation to the applicant’s ex-wife visa applications. The documents contained personal information of the applicant’s ex-wife, the applicant and or third parties, which was of a sensitive and personal nature (including names/other information). Disclosure could reasonably be expected to prejudice the protection of an individual’s right to privacy, and an agency’s ability to obtain confidential information and to obtain similar information in the future. Giving the applicant access to the documents was contrary to the public interest.
In reaching the decision, Acting Information Commissioner Pirani stated:
“[20] The Department has created Form 1040 for the purposes of a visa applicant providing documentation in relation to family violence matters. This was the form used by the applicant’s ex-wife in support of the visa application. Form 1040 states that the information provided in the form ‘is given and received on the understanding that it will be treated in confidence’.”
‘AF’ and Department of Immigration and Citizenship [2013] AICmr 54 (26 April 2013) – Australian Information Commissioner
‘Freedom of information’ – ‘Material obtained in confidence’ – ‘Request for access to documents’ – ‘Visa application’
Proceedings: Review of refusal access decision under Freedom of Information Act 1982 (Cth).
Facts: The applicant’s relationship with his former partner ended and she applied for a Subclass 100 visa on domestic violence grounds. The applicant applied to the Department for access to all material in any form relating to his former partner. The Department applied the material obtained in confidence exemption (s 45) and the personal privacy exemption (s 47F) to statutory declarations made by the applicant’s former partner and a competent person in relation to a visa application made by the applicant’s partner under the family violence provisions of the Migration Regulations.
Issues: Whether the documents were, inter-alia, exempt under s 45 (material obtained in confidence).
Decision and reasoning: Access refused. In particular, the Commission was satisfied that the statutory declarations were communicated and received on the basis of a mutual understanding of confidence between the applicant’s former partner and the Department and the competent person. Disclosure “would result in detriment to the authors of the statutory declarations as it would reveal private matters relating to the allegations of family violence. The disclosure of this information may cause a level of embarrassment and discomfort to the authors of the statutory declarations”. The Commissioner was satisfied that unauthorised disclosure of the information contained in the documents would cause detriment to the applicant’s former partner and the competent person.
Australian Information Commissioner
‘WZ’ and CEO of Services Australia (Privacy) [2021] AICmr 12 (13 April 2021) – Australian Information Commissioner
‘Audit of policies, procedures and systems’ – ‘Complainant had notified of separation from partner’ – ‘Following, harassing and monitoring’ – ‘Privacy’ – ‘Protection orders’ – ‘Residential address disclosed to the complainant's former partner’
Proceedings: Complaint under s 36(1) of the Privacy Act 1988 (Cth) (Privacy Act).
Facts: The female complainant was receiving Centrelink payments administered by Services Australia (the respondent) while living with her former male partner. She obtained an Apprehended Violence Order (which her partner was imprisoned for breaching). The complainant notified the respondent of her separation from the partner, but the respondent considered the separation unverified. Their online records continued to be linked meaning that if the complainant updated her address online, her partner’s address would also be updated. Her former partner posted a screenshot of the complainant’s new address to social media and made threats against her and her current partner.
Issues: Whether Services Australia interfered with the complainant’s privacy as defined in the Privacy Act 1988 (Cth).
Decision and reasoning: The Commissioner found that the respondent interfered with the complainant’s privacy by:
1.
Disclosing the complainant’s personal information, namely, her new address to her former partner, for a purpose other than that for which it was collected, in breach of Australian Privacy Principle (APP) 6.
2.
Failing to take reasonable steps to ensure that it used accurate and up-to-date personal information of the complainant in the form of her relationship status having regard to the purposes of its use, being to update her former partner’s address, in breach of APP 10.2.
3.
Failing to take reasonable steps to ensure that it used accurate and up-to-date personal information of the complainant in the form of her address at which she could be contacted in breach of APP 10.2.
4.
Failing to take reasonable steps to protect the complainant’s personal information, being her updated address, from unauthorised disclosure to her former partner in breach of APP 11.1.
In addition to ordering compensation for non-economic loss (including re-activation of psychological symptoms and distress) and expenditure incurred in association with the privacy complaint, and ordering an apology, the Agency was required to undertake an audit of policies, procedures, and systems to ensure the privacy breach was not repeated or continued. The Commissioner noted at [156]-[160]:
The effect of this privacy breach on the complainant has been significant. This is in large part due to the fact that she feared harm from the former partner… While the changes the respondent has made are encouraging, I remain concerned that individuals are at risk of their personal information being disclosed to former partners.
[…]
It is appropriate for the respondent to put in place more robust measures where the consequences for individuals are more significant. It is therefore appropriate to have special measures in place to protect individuals identified as being at risk of domestic violence. However, I remain concerned about the risks to individuals seeking to update their own address and not that of their former partner, where the respondent is not satisfied that the individual has in fact separated from their partner, regardless of whether they have a history of family or domestic violence. The ‘reasonable steps test’ is one that takes into account all relevant circumstances, including what is practical and what is required where the adverse consequences to particular individuals are significant.
I therefore see no reason to limit the audit to a particular cohort of individuals, including those at risk of family domestic violence. It is appropriate in order to address the grievance to target the situation where an individual makes unverified claims to have separated from, or to be no longer living with, their partner, and seeks to update their address, whether online or in person.”
‘ST’ and Chief Executive Officer of Services Australia (Privacy) [2020] AICmr 30 (30 June 2020) – Australian Information Commissioner
‘Damages for non-economic loss’ – ‘Disclosure for tribunal proceedings’ – ‘Following, harassing and monitoring’ – ‘Information privacy principles’ – ‘Privacy’
Proceedings: Complaint under s 36(1) of the Privacy Act 1988 (Cth) (Privacy Act).
Facts: The female complainant’s complaint concerned the disclosure of her personal information, collected by the former Child Support Agency for a Tribunal hearing, to the complainant’s ex-partner. She claimed that the personal information revealed the places she visited which she had attempted to keep hidden from the ex-partner as she feared harm.
Issues: Whether Services Australia interfered with the complainant’s privacy as defined in the Privacy Act.
Decision and reasoning: Services Australia interfered with the complainant’s privacy, breaching the Information Privacy Principles (IPP), by disclosing the complainant’s personal information in breach of IPP 11. The locational information disclosed was not relevant to the decision under review by the Tribunal and the complainant was therefore not likely aware that information of its kind would be disclosed.
In terms of damages, the Commission accepted that the complainant had already disclosed some of the places she had frequented through other processes. The Commissioner noted at [75]-[76]:
“I do not consider that the previously disclosed information negates the complainant’s claim to have feared the ex-partner locating her. The complainant clearly went to some lengths to redact certain information from the documents she provided in the primary decision process and I accept her claim that she thought carefully about what information to disclose.”
“However, I am of the view that in all the circumstances, the degree by which the disclosure contributed to the complainant’s fear of being located by the ex-partner was not significant. I place weight on the fact that the complainant had disclosed some locations to the ex-partner during the COA process and that she continued to maintain a PO Box at the same post office as the ex-partner. I also note the absence of any evidence showing that the complainant sought the assistance of police. While I accept the complainant’s claims to have feared being located by the ex-partner, these claims are not so specific and detailed (nor are they supported by specific and detailed corroborating evidence) as to cause me to form the view that the disclosure exacerbated her fear of being located to a significant extent.”
The Commissioner was satisfied that the privacy breach had caused the complainant distress, but no other claimed damage. She was awarded $3,000 for non-economic loss.
‘PJ’ and Australian Federal Police (Freedom of Information) [2018] AICmr 64 (10 September 2018) – Australian Information Commissioner
‘Confidentiality’ – ‘Freedom of information’ – ‘Public interest’ – ‘Systems abuse’ – ‘Whether disclosure of personal information unreasonable’
Proceedings: Review of refusal access decision under Freedom of Information Act 1982 (Cth).
Facts: The applicant applied to the Australian Federal Police (AFP) for access to “any notes made on myself by the Australian Federal Police. Not criminal records, but any and all police files/notes made on me.” The AFP exempted access to 13 folios in part under s 47F (the personal privacy exemption) of the Freedom of Information Act 1982 (Cth). Some exempt material included names, dates of birth and contact details of third party individuals, and information pertaining to an alleged domestic violence incident.
Issues: Whether the material the AFP found to be exempt under s 47F was conditionally exempt. If so, whether giving the applicant access to conditionally exempt documents would, on balance, be contrary to the public interest (s 11A(5)).
Decision and reasoning: Access to personal information of third party individuals and about an alleged domestic violence incident involving the applicant was refused.
Taking into account the nature of the information, that the information was provided for a limited purpose and was not well-known or available from other public sources, the Commissioner accepted the AFP’s submission that disclosure could undermine a range of processes intended to protect individuals and could discourage those who may be affected by domestic violence from coming forward to police. The Commissioner was satisfied disclosure would be unreasonable and the relevant material was conditionally exempt under s 47F. It was also contrary to the public interest to give the applicant access to the conditionally exempt documents at this time.
‘DK’ and Telstra Corporation Limited [2014] AICmr 118 (30 October 2014) – Australian Information Commissioner
‘Family law judge’ – ‘Following, harassing and monitoring’ – ‘Non-economic loss’ – ‘Privacy’
Proceedings: Complaint under s 36(1) of the Privacy Act 1988 (Cth) (Privacy Act).
Facts: The complainant worked as a judge in the family law jurisdiction. He requested that Telstra connect a phone line to his home for the sole purpose of an alarm system installed by the Court. Telstra set up the phone line and published the complainant’s name, address and the phone number in both the White Pages online and in the hard copy directory.
Issues: Whether Telstra had breached the complainant’s privacy.
Decision and reasoning: Telstra interfered with the complainant's privacy by failing to take reasonable steps to provide notice to the complainant that it would use and disclose his personal information for the purpose of publishing it in the White Pages, in breach of National Privacy Principle (NPP) 1.3. Telstra was ordered to apologise, review its processes and review its Privacy Statement.
Telstra was also ordered to pay the complainant $18,000 for non-economic loss. In reaching this amount, the Commissioner noted the following evidence from the complainant:
“Since the publication of my details a litigant from a matter decided by me has begun to loiter at and about our home. As my details and those of my partner are suppressed on every public register I infer his knowledge of our address is the White Pages site…
“We have just moved to our home and our enjoyment of it has been rudely interrupted…We both jump whenever the street bell rings. I have applied to be transferred interstate. On moving we will incur moving costs, expenses re sale of our home and costs of resettling… We will both have expenses travelling to visit family and friends as our lives, to date, have been in [omitted]…
“The invasion of and prejudice to my privacy and personal safety can be readily envisioned as arising for others such as victims of crime, women fleeing domestic violence and the like.”
In awarding compensation, the commissioner was guided by severity of the impact of the privacy breach on the complainant (with concerns for his/his partner’s safely leading him to move interstate); the added security threat he/his partner were exposed to; the responsibility of Telstra as an organisation to have appropriate measures in place; and the extent of the publication to a very wide audience in both online and hard copy form.
‘AG’ and Department of Immigration and Citizenship [2013] AICmr 55 (26 April 2013) – Australian Information Commissioner
‘Freedom of information’ – ‘Material obtained in confidence’ – ‘Personal privacy exemption’ – ‘Request for access to documents’ – ‘Visa application’
Proceedings: Review of refusal access decision under Freedom of Information Act 1982 (Cth).
Facts: The applicant applied to the Department to access specific documents related to his ex-wife. The Department refused access to 11 documents saying disclosure would reveal information provided in confidence and personal information about third parties, of which disclosure would be unreasonable and contrary to public interest.
Issues: Whether the documents were exempt under ss 45 (material obtained in confidence) and 47F (personal privacy exemption) of the FOI Act.
Decision and reasoning: Access refused.
Documents exempt under s 45 included statutory declarations made by the applicant’s ex-wife and other third parties in relation to her application for permanent residency in Australia, as well as a record of interview with the ex-wife and letter sent by a third party. The commissioner was satisfied that disclosure of the documents sought would cause detriment to the applicant’s ex-wife. The Commissioner was satisfied that disclosure of the documents sought would be a breach of confidence and the documents were exempt under s 45.
Documents exempt under s 47F were general correspondence in relation to the applicant’s ex-wife visa applications. The documents contained personal information of the applicant’s ex-wife, the applicant and or third parties, which was of a sensitive and personal nature (including names/other information). Disclosure could reasonably be expected to prejudice the protection of an individual’s right to privacy, and an agency’s ability to obtain confidential information and to obtain similar information in the future. Giving the applicant access to the documents was contrary to the public interest.
In reaching the decision, Acting Information Commissioner Pirani stated:
“[20] The Department has created Form 1040 for the purposes of a visa applicant providing documentation in relation to family violence matters. This was the form used by the applicant’s ex-wife in support of the visa application. Form 1040 states that the information provided in the form ‘is given and received on the understanding that it will be treated in confidence’.”
‘AF’ and Department of Immigration and Citizenship [2013] AICmr 54 (26 April 2013) – Australian Information Commissioner
‘Freedom of information’ – ‘Material obtained in confidence’ – ‘Request for access to documents’ – ‘Visa application’
Proceedings: Review of refusal access decision under Freedom of Information Act 1982 (Cth).
Facts: The applicant’s relationship with his former partner ended and she applied for a Subclass 100 visa on domestic violence grounds. The applicant applied to the Department for access to all material in any form relating to his former partner. The Department applied the material obtained in confidence exemption (s 45) and the personal privacy exemption (s 47F) to statutory declarations made by the applicant’s former partner and a competent person in relation to a visa application made by the applicant’s partner under the family violence provisions of the Migration Regulations.
Issues: Whether the documents were, inter-alia, exempt under s 45 (material obtained in confidence).
Decision and reasoning: Access refused. In particular, the Commission was satisfied that the statutory declarations were communicated and received on the basis of a mutual understanding of confidence between the applicant’s former partner and the Department and the competent person. Disclosure “would result in detriment to the authors of the statutory declarations as it would reveal private matters relating to the allegations of family violence. The disclosure of this information may cause a level of embarrassment and discomfort to the authors of the statutory declarations”. The Commissioner was satisfied that unauthorised disclosure of the information contained in the documents would cause detriment to the applicant’s former partner and the competent person.