DQA v Secretary, Department of Family and Community Services [2019] NSWCATAD 156
Read the full decision here DQA v Secretary, Department of Family and Community Services [2019] NSWCATAD 156
Summary
In November 2018, the applicant ‘DQA’ lodged an application with the Tribunal for administrative review of an internal review by the Department of Family and Community Services (FACS) (the respondent) under the Privacy and Personal Information Protection Act 1998 (PPIP Act). The respondent’s internal review found that FACS had unlawfully disclosed DQA’s personal information and breached section 18 of the Privacy and Personal Information Protection Act 1998 (PPIP Act), but did not breach the Information Protection Principle (IPP) under section 16. The central issue in the Tribunal proceedings was whether the respondent took reasonable steps to ensure the accuracy and relevance of personal information. The applicant also sought damages for economic loss and contended that her work situation changed significantly following the disclosure of her personal information, and that it caused her to resign from her employment. The Respondent contended that there was no causal link between its breach of section 18 and the financial loss claimed by DQA. The Tribunal affirmed the respondent’s breach of section 18 and also found that the respondent breached the IPP under section 16. The Tribunal did not award damages, but ordered the respondent to provide a written apology to DQA.
What you need to know
This matter involves the Tribunal’s review of the conduct of the respondent which is a ‘public sector agency’ subject to the PPIP Act. That conduct was reviewed by the respondent under Part 5 of the PPIP Act. The Tribunal’s findings on the conduct of the agency, and its orders, are summarised as follows:
- The FACS Housing Services Manager, Ms M, obtained information about DQA’s living arrangements from DQA’s housing officer, Ms S, after she overheard Ms S’s conversation with a FACS Customer Service Officer. Ms M then disclosed this information to DQA’s employer in a different context in which she was enquiring about who would perform casework if DQA was living in Sydney.
- Ms M used DQA’s personal information for the purpose of obtaining work-related information; Ms M did not contact DQA to attempt to confirm the accuracy of the information relating to her relocation or her employment status which was required by section 16.
- The breaches of the PPIP Act did not cause DQA to lose her employment, which meant there was no award of damages for economic loss pursuant to section 55(2) of the PIPP Act. The Tribunal ordered the agency to make a formal written apology to the applicant for the breach of section 16 of the PPIP Act.
Legislative background
Information Protection Principles (IPPs)
Section 16 Check accuracy of personal information before use (IPP 9)
Section 17 Limits on use of personal information (IPP 10)
Section 18 Limits on disclosure of personal information (IPP11).
Review requirements and jurisdiction
Section 53 Internal review by public sector agencies
Section 55 Administrative review of conduct by Tribunal (and consideration of damages)
Factual background
DQA was a crisis caseworker for a non-government organisation and was providing support to several families who were FACS tenants participating in a therapy program. DQA was also a FACS tenant living in a country town, but began the process of relocating to Sydney in March 2018. DQA was travelling between these locations from April to May 2018 to attend work, but did not intend to resign from her employment or inform FACS of her relocation until the housing transfer was finalised. The FACS Manager for Housing Services (“Ms M”) became aware of information that DQA’s housing officer had received about the transfer, and disclosed this to DQA’s employer. The Operations Manager with DQA’s employer contacted DQA, querying whether she had resigned. DQA advised her employer that this information was incorrect. DQA complained to FACS, and Ms M made a verbal apology to DQA in person. In June 2018, DQA sought an explanation of how or why the breach occurred through internal review; DQA also resigned from her employment. The internal review decision was made in October 2018 and found that FACS had breached section 18 of the PPIP Act, but found that given the circumstances and purpose for which the information was used, it was accurate and relevant (at [13]).
Tribunal findings
Issue 1 – Consideration of whether the agency breached section 18 of the PPIP Act
The Tribunal agreed with the Respondent’s concession that it breached section 18(1) of the PPIP Act by disclosing DQA’s personal information to her employer (at [93]). The Tribunal considered that the information was only obtained by FACS because DQA was a client of FACS, and it was collected in relation to her housing situation. The disclosure was not related to the purpose for which it was collected, and was not information of a kind that is usually disclosed (at [92]).
Issue 2 – Whether the Respondent breached section 16 of the PPIP Act
This issue was the subject of most of the evidence and pleadings at the Tribunal hearing. The Respondent argued that it did not use the personal information.
The Tribunal (at [31]-[32]) considered the meaning of the “use” IPP for the purposes of section 16 of the PPIP Act. The Tribunal referred to authority in FM v Vice Chancellor, Macquarie University [2003] NSWADT 78 at [42], in which ‘use’ is understood by its ordinary meaning “to avail oneself of; apply to one’s own purposes”. The Tribunal also noted the NSW Privacy Commissioner’s submissions in GL v Director-General, Department of Education and Training [2003] NSWADT 166 at [41]-[42], in which use may be demonstrated by the act of sending a facsimile, whether or not it is read is irrelevant to the use.
The Tribunal considered that the evidence showed that Ms M used DQA’s personal information for the purpose of obtaining information that was relevant to the casework submission, but the part of the conversation between Ms M and DQA’s supervisor that concerned DQA’s personal information would not have occurred if DQA was not a FACS client (at [95]). The Tribunal also found that this information was incomplete in that it failed to indicate that DQA was only working in Sydney temporarily (at [97]).
The Tribunal considered (at [95]-[97]):
“… I do not agree with the Respondent that it did not use DQA's personal information. In my view, Ms M used DQA's personal information in an effort to pursue her query about the provision of MST-CAN’s contribution to the submission that was to be sent to Mr Mc. Ms M conceded that this was the case.
Ms M conceded that she did not attempt to contact DQA to confirm the accuracy of the information. The evidence before me suggests that the information was not complete and because it was not complete, it was misleading.
In considering the obligation on the respondent under the IPP in section 16, the Tribunal considered (at [98]-[99]):
“… the answer to the question of what steps were ‘reasonable’ in the circumstances will vary. In this matter, the issue of whether DQA had resigned her position could have been clarified by calling DQA to check the accuracy of the information. Ms M conceded that the issue relating to MST-CAN’s contribution to the submission that was to be made to Mr Mc was not so urgent that it prevented her from calling DQA.”
Issue 2 – Which orders, if any, should the Tribunal make in regard to the Respondent’s conduct and consideration of claim for damages?
The Tribunal noted Ms M’s prompt response to the privacy grievance by way of a verbal apology in person to DQA. However, the Tribunal did not consider that this addressed the breach of section 16, or DQA’s assertion that she has suffered loss from the breaches for which damages are warranted (at [102]).
However, on the issue of causation, the Tribunal found (at [110]):
“… I agree with the Respondent that there is no causal link between the breaches of the PPIP Act and the loss that DQA claims that she has suffered. I am satisfied that DQA probably resigned from her position because she had suffered a loss of income as a result of the changed employment conditions and she wanted to relocate for family and other personal reasons. I am not satisfied that the conduct of the agency has caused the harm that DQA identified. In my view, the agency’s conduct was neither the only cause nor the most immediate cause of the financial harm of which DQA complains.”
The Tribunal also noted (at [111]) that the award of statutory damages in PPIP Act matters remains a discretionary one, even where a causal link sufficient to satisfy section 55(4) of the PPIP Act is established; and that the Tribunal might find a causal link between the contravention and the harm suffered, and still make no order (NW v NSW Fire Brigades (No 2) [2006] NSWADT 61 at [24]).
In the circumstances of this case, the Tribunal did not consider that an award of damages was appropriate, even if a causal link was established ([112]); and rather determined that a formal apology for the breach of section 16 was appropriate (at [113]).
Tribunal outcome
The Tribunal ordered:
The Secretary, Department of Family and Community Services is to provide a written apology to the Applicant in regard to the agency’s breach of section 16 of the Privacy and Personal Information Protection Act 1998.
