NLD v Department of Families Fairness and Housing (Human Rights) [2023] VCAT 544

Lessons

• This case shows the importance of the limits placed on the use and disclosure of personal information by IPP 2.1. Organisations that wish to use or disclose personal information for a secondary purpose must clearly establish that one of the exceptions to the primary purpose rule – as set out in IPP 2.1(a)-(h) – apply.
• When preparing reports, organisations should be mindful of the amount of personal information collected for, and included in a report. Including information that is not relevant or including a disproportionate amount of information may interfere with a person’s privacy.
• Non-economic loss (sometimes described as hurt feelings or emotional harm) is the most claimed type of harm in privacy complaints. Community standards now accord a higher value to compensation for pain and suffering than before. As such, organisations should assess compensation claims for loss in privacy complaints on a case-by-case basis factoring in the relevant circumstances of the incident and impact to the individual.

Background

In 1997, the Complainant experienced a sexual assault. During 2021, Child protection officers of the Department of Families, Fairness and Housing (the Respondent) wrote a protection report (the Report) about the Complainant’s granddaughter that mentioned the Complainant’s historical sexual assault.

The Report was then shared with the Complainant’s daughter, the father of their grandchild, their lawyers and the Children’s Court as required by the Children Youth and Families Act 2005 (Vic) (CYF Act).

The Complainant had not told her daughter about the historical sexual assault and complained that the Respondent’s inclusion of details about it in the Report was unnecessary and a breach of Information Privacy Principle (IPP) 2.1.

The Decision

VCAT found that the Respondent failed to comply with IPP 2.1 when it included information about the Complainant’s historical sexual assault as none of the exceptions relied on by the Respondent applied.

In making this decision, VCAT considered the exemptions set out in IPP 2.1(a), IPP 2.1(d) and IPP 2.1(f) that were relied on by the Respondent.

IPP 2.1(a) – Reasonably expected secondary purpose

The Respondent submitted that the use and disclosure was permitted by IPP 2.1(a), as the Complainant would have reasonably expected the inclusion of the historical sexual assault in the Report.

VCAT accepted the Respondent’s submissions that the secondary purpose of assessing the Complainant’s suitability to care for their grandchild was related to the primary purpose of collection in a broad sense. Details of the sexual assault had originally been collected by the Respondent in 1997 and 2000 regarding protective concerns then held about the complainant’s care for her daughter.

However, VCAT was not satisfied that the Complainant would have reasonably expected the use or disclosure of this information and stated. It did not accept the Respondent’s position that the Complainant was informed in 1997 and 2000 that information she provided may be used in a report.

Further, VCAT considered that even if the Complainant had been informed of this in 1997 and 2000, it would not follow that they would reasonably expect for that information to be included in a child protection report over 20 years later relating to her granddaughter.

VCAT determined that the exemption in IPP 2.1 (a) did not apply to authorise the Respondent to use or disclose the Complainant’s personal information about their historic sexual assault.

IPP 2.1(d) – Necessary to lessen or prevent serious threats to health or safety

The Respondent asserted that the use and disclosure was permitted because it reasonably believed that is was necessary to lessen or prevent a serious threat to the life, health, safety, or welfare of the child.

VCAT did not accept this position. It considered the Respondent’s concerns for the welfare of the child set out in the Report and noted that the Complainant’s historical sexual assault was not mentioned as a cause for concern about the child’s welfare. Further, the Report made no analysis or attempt to relate the fact of the historic sexual assault to the safety of the child or establish a reasonable belief that the information was necessary to lessen or prevent a serious threat to the child.

IPP 2.1(f) – Required or authorised by or under law

Finally, the Respondent argued that the use and disclosure was permitted because it was required or authorised by or under law, specifically section 555 of the CYF Act.

VCAT noted that section 555 of the CYF Act restricts the content of the Report to matters that are relevant to whether a child needs protection.

VCAT found that while the Respondent had included information about the Complainant’s historical sexual abuse, it did not establish why that information was relevant to the question of whether the child was in need of protection.

VCAT also noted that the Respondent did not identify any provision of the CYF Act that indicated that a Report must include every document about the history of interventions in an earlier generation of the child’s family. VCAT stated that, even if it had been relevant, it would have been possible for the Respondent to demonstrate it had concerns about the Complainant’s parenting skills without including the information she had been a victim of a sexual assault.

VCAT found that the Respondent did not establish that the complainant’s historical sexual assault was relevant to establishing that their granddaughter needed protection, as required by s 555 of the CYF Act and that the use and disclosure of the information was not required or authorised by or under law.

Compensation

VCAT noted that the Respondent provided an apology to the Complainant and committed to a change of process which may avoid a similar occurrence in the future. However, VCAT found the Respondent was responsible for compensating for the harm it had caused the Complainant.

When determining compensation, VCAT noted that there was a lack of cases decided under the Privacy and Data Protection Act 2014 (Vic)(PDP Act) that offered guidance on determining compensation for distress, hurt and humiliation.

VCAT instead considered cases where compensation was awarded for injury to the complainant’s feelings under the Health Records Act 2001 (Vic)(HR Act) and. The applicable principles for orders made for economic and non-economic loss under section 125 of the Equal Opportunities Act 2010 (Vic) were drawn upon as part of this consideration.

VCAT stated that the Respondent must take the Complainant as it finds them, but is not liable for the harm caused to them by others. VCAT acknowledged that the Complainant’s distress may be because they had not accessed any counselling services about the historical sexual assault, and noted the Respondent is not responsible for the Complainant’s long term distress about the crime.

However, VCAT found that the Respondent had some responsibility for the distress and was liable for the humiliation and distress the Complainant experienced because of the disclosure of the historical sexual assault to her family and others.

The Orders

VCAT ordered the Respondent to pay the Complainant the sum of $9,000, which includes some amount for the re-igniting of the Complainant’s distress about the historical incident.

The Complainant had also sought compensation for the cost of medications and non-bulk-billed appointments. However, VCAT did not award compensation as the Complainant did not provide evidence to support this claim.