Privacy Case note: CRP v Department of Family and Community Services [2017] NSWCATAD 164

The IPC Privacy Case Note for CRP v Department of Family and Community Services [2017] NSWCATAD 164 appears below. For the full decision click here 

Summary

In considering whether a work address is personal information the test is the content of the information and the context in which it can be said to be about an individual.

What you need to know

The Applicant complained that the Department of Family and Community Services (the Respondent) had disclosed his personal information to a third party and had breached his privacy in the way it dealt with that information. The information at issue was the address where the Applicant worked as a caseworker. The Respondent after conducting an internal review concluded that there was no breach of an Information Privacy Principle or any breach of the Privacy and Personal Information Protection Act 1998 (PPIP Act).

The Tribunal at [72] in considering whether the work address was personal information, was guided by cases referring to the correct approach to the issue:

• The test is the content of the information and the context in which it can reasonably be said to be about an individual EG v Commissioner of Police, NSW Police Service [2003] NSWADT 150 at [24].
• The Tribunal should not adopt an overly technical approach JD v New South Wales Medical Board [2008] NSWADT 67 at [24].

The Tribunal was of the view that the Applicant’s work address is about an individual in that the information was requested and provided in a context solely concerning the Applicant, where his identity was apparent [75].

The Tribunal observed information released was held in the information holdings of the Respondent so the ‘exemption’ offered by Vice Chancellor Macquarie University v FM [2005] NSWCA 192 where the disclosure was gleaned through a conversation would not apply [78].

The Tribunal also observed that the basis and purpose of the request by the third party for the work address were not factually apparent to the Respondent at the time of release. The Tribunal concluded that it was doubtful that the address was provided in direct connection with the Applicant’s role as a caseworker [71]. The exemptions in section 18 could not apply.

The evidence was that the Applicant’s work address in this matter was not information that was publicly available, other than being available to clients of the centre where the Applicant was a caseworker. The context of the third party’s seeking the information was as a member of the public [84].

The Tribunal concluded that the Respondent had breached the Applicant’s privacy in using and disclosing the Applicant’s work address to the third party.

Legislative background

Section 4 Definition of personal information.

Section 17 Limits on use of personal information (IPP 10)

Section 18 Limits on disclosure of personal information (IPP 11).

Section 55(2) remedies of the Tribunal for privacy breaches.

Section 63 Administrative Decisions Review Act 1997, set aside decision of agency and remit matter for reconsideration.

Factual background

The Applicant is an employee of the Department and the disclosure of information was made to a family member from whom the Applicant was estranged. The conduct complained about occurred whilst the Applicant was at work. A colleague had disclosed the Applicant’s work location to the family member, who then confronted the Applicant at that location.

Tribunal findings: Breaches

The Tribunal found that the Applicant’s work address was personal information and had been released to a third party who wished to locate the Applicant for a private purpose and serve some material on him at his workplace. The Tribunal noted at [82] that there was no evidence that the process (serving the material on the Applicant) was in accordance with any process sanctioned by law, which would have enlivened the provisions of section 25 of the PPIP Act. The Tribunal found at [84] there was no evidence that the Applicant’s work address was publicly available, other than for clients as the Applicant was a caseworker.

The Tribunal found at [88] and [90] that:

• there was a breach of section 17(a) of the PPIP Act in that the Respondent  did not provide the address for the purpose it was collected; and
• the evidence did not support that the exemption in section 17(b) would apply in the alternative, that is the other purpose the information was used is directly related to the purpose for which the information was collected. The private purpose that the information was sought for was not related to any official purpose or function of the Respondent.

In respect of section 18 of the PPIP Act, the Tribunal at [96] observed that there was ample evidence that the Respondent should have understood that the information was not directly related to the purpose for which it was collected and that the Applicant would object to the disclosure of the information. The Tribunal therefore found a breach of IPPs 10 and 11.

Tribunal findings: Outcome

The Respondent submitted that if the Tribunal found breaches then one of the remedies sought by the Applicant was not within the jurisdiction of the Tribunal, being the Applicant’s request concerning a transfer to another work location.

The Tribunal considered section 55(2) of the PPIP Act and in particular section 55(2)(g) which provides for such ancillary orders as the Tribunal thinks appropriate. The Tribunal observed at [99] that it would be appropriate to require the agency to put in place such steps as are necessary to ensure details (such as individual work location, work phone number etc) are only given out to clients with legitimate business with the agency and appropriately referred or allocated to the individual staff member. The Tribunal considered that Privacy Management Plans need to ensure that personal information of both employees as well as clients should be managed in accordance with the IPPs. The Tribunal made orders in this regard under section 55(2) of the PPIP Act.

The Tribunal also considered an apology was appropriate, even though the conduct was unintended, and made an order under section 55(2) of the PPIP Act in this regard.

In deciding how to address the request for transfer, the Tribunal was of the view that an order in terms of section 63(3) of the Administrative Decisions Review Act 1997 (ADR Act) was appropriate. The Tribunal made an order remitting the residue of the matter to the administrator to allow the agency to reconsider the Applicant’s request for transfer.