Kaliszewski v Department of Justice and Community Safety (Human Rights) [2020] VCAT 27

In this case, Mr Steven Kaliszewski (the Complainant) alleged the Department of Justice and Community Safety (the Respondent) interfered with his privacy by failing to comply with Information Privacy Principle (IPP) 1.3 and 2.1 when capturing his image on CCTV cameras. On 8 January 2020, the Victorian Civil and Administrative Tribunal (the Tribunal) found the Respondent did not breach IPP 1.3 nor 2.1. The decision can be accessed here.

Key points

1. Factors the tribunal considered when determining if the Respondent had taken reasonable steps to provide notice of the collection of personal information via CCTV included:

• (i) the complainant’s prior knowledge of and exposure to the use of CCTV footage by the organisation;
• (ii) the quantity and visibility of CCTV cameras; and
• (iii) that the organisation had published guidelines or policies about its use of CCTV footage.

1. CCTV footage taken for the primary purpose of maintaining security and good order could, in this case, also be used for the secondary purpose of investigating allegations of misconduct.

The Complaint

The Complainant was employed by the Respondent and worked at Hopkins Correctional Centre. Following an investigation in 2017, the Complainant was found guilty of misconduct for jeopardising the security of the prison on three occasions by spending excessive periods of time in the break room during night shifts. He was demoted from senior prison officer to prison officer.

In May 2017, the Complainant complained to the Respondent that by viewing CCTV footage as part of its investigation, the Respondent breached his privacy. He alleged the footage was taken in a covert manner, without his knowledge and in breach of the Information Privacy Principles (IPPs). The Respondent investigated and found that the allegations were without foundation.

The Complainant then complained to the Office of the Victorian Information Commissioner (OVIC). OVIC was unable to conciliate the complaint successfully and the matter was referred to the Tribunal under section 71(4) of the Privacy and Data Protection Act 2014 (Vic) (the PDP Act).

IPP 1.3

The Complainant alleged that the Respondent contravened IPP 1.3 in that, at or before the time his personal information was collected via CCTV, it failed to take reasonable steps to make him aware of the fact of the collection of his information and the purposes for which it was collected.

The Complainant asserted that the Respondent’s relevant policy on the use of CCTV throughout the prison was “vague and generalised”, that he had not received an orientation when he was assigned to the post of senior prison officer gatehouse, and that he “had a reasonable expectation of privacy whilst moving around this private and secure part of the prison”.

IPP 2.1

The Complainant alleged that the Respondent contravened IPP 2.1 in that, by viewing the CCTV footage and using it to investigate allegations of workplace misconduct, it used his personal information for a purpose other than the primary purpose of collection. He asserted that the use was not otherwise authorised under any of the exceptions in IPP 2.1(a) – (h).

In support of this assertion, he claimed that the Respondent’s relevant policy was silent on the topic of monitoring staff and that, given the permission of the general manager was required before monitoring prisoners could occur, it was reasonable to conclude that the same permission would be required before monitoring staff.

The Decision

IPP 1.3

The Tribunal was satisfied that the Complainant had previously been advised that CCTV footage had been used to investigate allegations of misconduct against him; that he knew there were hundreds of CCTV cameras around the prison that were not disguised or hidden; and that the Respondent had published guidelines and policies about the use of CCTV within the prison system.

The Tribunal accepted that the Complainant was aware that his personal information was being collected and could be used for the purpose of investigating a complaint of a security breach, including the investigation of a staff disciplinary matter.

The Tribunal therefore held that the Respondent had not breached IPP 1.3.

IPP 2.1

The Tribunal accepted that the primary purpose of collecting the CCTV footage within the prison was to maintain the security of the prison.

It found that the Respondent had used the CCTV footage for a secondary purpose of investigating allegations of misconduct which was closely related to the primary purpose of collection. It also found that the use of the Complainant’s personal information for this related secondary purpose was reasonably foreseeable in the circumstances.

The Tribunal therefore held that the Respondent had not breached IPP 2.1 as both conditions set out in the IPP 2.1(a) exception had been fulfilled.

Orders

The Tribunal found the complaint was not proven and consequently dismissed the application.