Huang v Frankston City Council (Human Rights) [2022] VCAT 24

Lessons

• When handling complaints agencies should be careful when sharing information with individuals who report concerns. While it’s important to share information with the complainant to respond to their concern, agencies should be careful to protect the privacy of any individual the complaint is about when doing so.
• OVIC reminds agencies that what constitutes ‘personal information’ will depend on the particular circumstances of each case. When uncertain, organisations should treat information as personal information and handle it in accordance with the IPPs.
• Assessing whether information is a ‘generally available publication’ for the purposes of section 12 of the Privacy and Data Protection Act 2014 (Vic) (PDP Act) also depends on a consideration of the facts and circumstances as a whole. The nature of the information, the prominence of [its location], the likelihood of the access and the steps needed to obtain that access are relevant considerations, amongst others.

VCAT considered two privacy complaints:

1. After the Complainant reported issues about their neighbour’s (Person A’s) fencing and alleged illegal dumping of waste to the Respondent, the Complainant alleged that the Respondent inappropriately disclosed their personal information to that neighbour when handling the complaint (the first complaint).
2. The Complainant operated their property as a short-term rental and neighbours complained about this use and associated noise to the Respondent. The Complainant alleged that the Respondent inappropriately disclosed their personal information to the neighbours, Airbnb Pty Ltd and a journalist (the second complaint).

The first Complaint – The fencing and dumping complaints

 The Complainant alleged the Respondent revealed their identity as the source of the fencing and dumping complaints to their neighbour via letter to the neighbour and in conversations during a site inspection.

VCAT found in both instances that the Respondent did not disclose the Complainant’s personal information and, given the history of the relationship, it was more likely that the neighbour identified the source of the complaints on their own.

The second Complaint – disclosure of information about Respondent’s actions regarding Complainant’s rental property

Disclosures to the Complainant’s neighbours

The Complainant alleged that the Respondent inappropriately provided updates about its investigations into their use of their property to neighbours who had complained about the issue.

Person A initiated a complaint by sending the Respondent an email that included the Complainant’s address and described the owner’s use of the property. The Respondent replied by email setting out the steps it would take to investigate the matter, without naming the Complainant. The neighbour requested several updates and the Respondent provided information in reply (the email chain).

VCAT found that the Respondent’s emails did not contain the Complainant’s personal information because the Complainant’s identity was not apparent or reasonably ascertainable from the content of the emails.

VCAT also found that even if the email chain had contained the Complainant’s personal information, the disclosure would have been authorised under Information Privacy Principle (IPP) 2.1(a). This was because the Respondent disclosed the Complainant’s personal information for the purpose of complaint handling and this would have been reasonably expected by the Complainant.

Disclosures to police

VCAT also examined emails from the Respondent to a police officer containing the Complainant’s address and information about noise complaints that had been made about their property.

VCAT held that these emails did contain the Complainant’s personal information, because the use of extraneous materials, such as a title search, would make the Complainant’s identity reasonably ascertainable.

VCAT held that the primary purpose of collection was to handle the noise complaints. VCAT held these disclosures were authorised as they were for a reasonably expected related secondary purpose: seeking Police assistance for the investigation and attempted resolution of the complaints.

Disclosure to Airbnb Pty Ltd

The Complainant alleged that the Respondent wrote a letter to Airbnb setting out its concerns about short term rentals in the municipality and inappropriately disclosed their personal information in this letter.

VCAT considered the letter and found that it did not contain the Complainant’s personal information as it did not contain the Complainant’s name or address.

Disclosure to journalist

The Complainant alleged that the Respondent responded via email to a journalist’s enquiries and inappropriately disclosed the Complainant’s personal information. In the emails the Respondent included some details relating to the Complainant’s Magistrates’ Court Hearing.

VCAT found that the Respondent had not disclosed the Complainant’s personal information because the email contents made it clear that the journalist already knew the Complainant’s identity.

VCAT also found that in any case the information relating to the Complainant’s court hearing was available in the Magistrates’ Court lists and related public documents. VCAT held that these were generally available publications under section 12 of the PDP Act and therefore exempt from the application of the IPPs.