Kerig v Victoria University [2020] VCAT 469 (28 April 2020)

• Privacy

The Complainant alleged that the Respondent breached Information Privacy Principles (IPP) 1.1, 1.2, 1.3, 2.1, 3.1, 4.1, 5.1 and 10 of Schedule 1 of the Privacy and Data Protection Act 2014 (Vic) when the Respondent collected and used his personal information from his work computer as part of an investigation into its configuration. The Victorian Civil and Administrative Tribunal (VCAT) found that the Respondent did not breach any of the IPPs and accordingly dismissed the application. You can read the decision here.

Background

The Complainant was employed by the Respondent. He was provided with a computer to perform his work and agreed to abide by the Respondent’s information and communications technology (ICT) policies which required employees not to reconfigure their ICT equipment, permitted reasonable private use and prohibited the use of offensive content.

While the Complainant was on leave, the Respondent discovered that his computer had been reconfigured and so it conducted a further investigation. The Respondent discovered that the computer contained over 20,004 JPG images, 1,082 MP4 videos and 9 video games that the Respondent considered exceeded permitted reasonable private use. The Respondent also discovered 120 JPG images and one video which the Respondent considered offensive.

Submissions and VCAT’s decision

IPP 1.1

The Complainant alleged that the function of the Respondent was to provide educational services and so the collection of his personal information was not necessary. VCAT held that there had been no breach of IPP 1.1. VCAT held the function of an employer included monitoring employee compliance and conducting investigations of misconduct. It found that it was necessary for the Respondent to collect the Complainant’s personal information to ascertain what was contained on the computer and whether it was authorised under the Respondent’s policies.

IPP 1.2

Unlawful: The Complainant alleged that the collection of his personal information was unlawful because the Respondent’s policies stated that only its IT Department could conduct an audit of ICT equipment, yet his personal information was collected by the People and Culture team. VCAT held that there was nothing unlawful about the collection and the Respondent’s policies supported the authority of the Respondent to inspect and audit the contents of the computer.

Unfair: The Complainant alleged that the collection was unfair because the Respondent dealt with the computer reconfiguration issue in an unreasonably hasty and severe fashion. VCAT held that there was nothing unfair about the collection as the Respondent had not collected the personal information in an ‘unjust, inequitable or discriminatory’[1] way.

Unreasonably intrusive: The Complainant alleged that the Respondent collected his personal information in an unreasonably intrusive way by allowing multiple employees to view his files and collecting his files whilst he was under the impression that the reason the computer was being investigated was due to a technical issue. VCAT held that given the Complainant had placed the files on the computer and the Respondent had no knowledge of them, it was not unreasonably intrusive for the Respondent to go through the files as part of an investigation relating to an information technology breach.

IPP 1.3

The Complainant alleged that the Respondent had failed to take reasonable steps to make him aware of the requirements in IPP 1.3 when collecting his personal information from the computer. VCAT held that the Respondent had not breached IPP 1.3 because the Complainant was already aware of the organisation and knew to contact his Supervisor for further information. Further, he was provided with access to his personal information after the computer was released from the IT Department, and was made aware of the purpose for which the Respondent would be collecting his personal information upon returning from leave.

IPP 2.1

The Complainant alleged that the Respondent used his personal information for a purpose other than administering his employment.  However, VCAT held that the Respondent’s use of personal information was for the primary purpose of administering employment and conducting an investigation.

IPPs 3.1 and IPP 4.1

The Complainant alleged that other employees could have accessed or modified his personal information or caused it to be inaccurate, incomplete or not up to date. The Respondent argued that it had strong policies and procedures in place around the handling, storage, use and disclosure of personal information. However, the Respondent was unable to demonstrate that it had followed these policies and procedures in handling the Complainant’s personal information. Nevertheless, VCAT held that there had been no breach of IPPs 3.1 and 4.1 on the basis that the Complainant had not discharged his onus of proof on the balance of probabilities.

IPP 5.1

The Complainant alleged that the Respondent had not made him aware of any policy it had in place on the management of personal information it held. VCAT held that there had been no breach of IPP 5.1 as it was not open to the Complainant to claim he did not know about the Respondent’s policies when he had acknowledged being aware of them during cross examination.

IPP 10

The Complainant alleged that the Respondent breached IPP 10 when it collected a video (showing a woman on a secluded beach making sexualised movements) and several photographs (portraying unclothed males and females in different positions) which were his sensitive information. VCAT held that the videos and photographs were not sensitive information because there was no clear theme that would suggest to the ‘average reasonable person’[2] that the video or photographs demonstrated that the Complainant was a person who held any particular philosophical belief or sexual preference or practice.

VCAT found the complaint was not proven on all grounds and dismissed the application.

[1] [60].

[2] [116] and [118].