VCAT decision: Polkinghorne v Warrnambool City Council

The Victorian Civil and Administrative Tribunal (VCAT) recently ruled on two complaints made under the Privacy and Data Protection Act 2014. The complaints related to the preparation and distribution of an investigation report that the Council had commissioned in response to an earlier, unrelated complaint by Mr Polkinghorne about the conduct of a Council employee.

The Complainant alleged breaches of the following Information Privacy Principles (IPPs):

• IPP 1.2, which relates to the collection of personal information by lawful and fair means;
• IPP 1.3(d), which requires organisations to take reasonable steps to inform individuals of the types of individuals and organisations to which they usually disclose personal information; and
• IPP 2.1, which relates to the circumstances in which personal information may be used or disclosed.

Mr Polkinghorne also made arguments before the Tribunal in relation to IT security and IPP 4. However, the Tribunal found that it did not have jurisdiction to consider the issue, as it had not formed part of Mr Polkinghorne’s complaints to the Office of the Victorian Information Commissioner (and so was not the subject of a referral from the Information Commissioner).

VCAT ultimately dismissed both complaints, finding that:

• The Council’s use and disclosure of the report was consistent with IPP 2.1, and the relevant Council employees had a reasonable and appropriate need of access to the report as part of their role with the Council.
• There was no obligation under IPP 1.3 to notify Mr Polkinghorne about disclosures internal to the Council. (This is because IPP 1.3(d) only imposes a general obligation to notify an individual about the kinds of people to whom the information may be disclosed, and does not require notice of every single person the personal information might be disclosed to, or of specific employees who might have access to the personal information in the course of performing their duties.)
• As Mr Polkinghorne was unable to produce evidence to satisfy the Tribunal that the investigator was biased, he failed to discharge the onus of proof required to establish his claim under IPP 1.2 that the investigator had collected personal information by unlawful and unfair means.

You can read the decision on Austlii here.