Tucker v State Revenue Office (Human Rights) [2020] VCAT 53 (17 January 2020)

Overview

On 17 January 2019, the Victorian Administrative Tribunal (the Tribunal) held that the State Revenue Office (the Respondent) had not interfered with the Complainant’s privacy.

The Complainant alleged that that the Respondent had disclosed his mobile phone number to a private investigator and had used his birth certificate to ascertain details of his family members without his consent. He further alleged that the Respondent had failed to provide him with adequate responses to his questions about what personal information the Respondent held about him.

The case centres around Information Privacy Principles (IPP) 1.1, 1.2, 1.3, 2.1 and 5.2. Ultimately, the Tribunal found that the Respondent had not breached any of the IPPs and dismissed the application. The decision can be accessed here.

The decision provides useful guidance on when an employer, when conducting a disciplinary investigation, may use or disclose information collected during the course of an employee’s onboarding process.

The Complaint

The Complainant was employed as a solicitor and senior solicitor by the Respondent. On 9 June 2019, following an allegation into the Complainant’s conduct towards another employee and an allegation that the Complainant had accessed 23 taxpayers’ data without authorisation, the Complainant’s employment was suspended. The Respondent commenced a formal investigation and appointed an external investigator to conduct part of the investigation.

As part of the investigation, it was alleged that one of the unauthorised searches of taxpayer’s data performed by the Complainant had been for a taxpayer with the same surname. The Respondent used the Complainant’s birth certificate to ascertain that this person was the complainant’s father.  The birth certificate had been provided by the Complainant as part of his employment onboarding in order to establish proof of residency when he first commenced employment.

The respondent had also disclosed the Complainant’s mobile phone number to the external investigator as part of the investigation so that they could contact the Complainant. The Complainant had provided his mobile phone number to the Respondent as part of his employment onboarding when he first commenced employment.

IPP 1.1

The Complainant alleged that the Respondent had breached IPP 1.1 because collecting his birth certificate was not necessary for the purpose of evidencing his proof of residency. He asserted that collecting a copy of his passport or citizenship certificate would have been sufficient.

IPP 1.2

The Complainant alleged that the respondent had collected his personal information in an unfair, unlawful or unreasonably intrusive way as it did so without his knowledge or consent.

IPP 1.3

The Complainant alleged that when the Respondent disclosed his mobile phone number and birth certificate to the external investigator, the Respondent had breached IPP 1.3 because it had not made him aware that such disclosures of his personal information would occur.

IPP 2.1

The Complainant argued that it was not necessary to provide the external investigator with his phone number as he had engaged legal representatives to act on his behalf.

The Complainant also asserted that the fact that the investigation ultimately showed that he had not conducted a search for his father’s name, demonstrated that the investigation was based on a false allegation and that there was no proper reason or probative basis to access his birth certificate.

IPP 5.2

On 1 October 2018, the Complainant emailed the Respondent requesting a detailed list of the personal information the Respondent held regarding him. The Respondent responded in a letter dated 30 November 2018 outlining the general information they held regarding the Complainant. The Complainant argued that the generality of the responses breached IPP 5.2.

The Decision

IPP 1.1

The Tribunal followed what it noted as a ‘relaxed meaning of ‘necessity’’ which was adopted in the 2005 Tribunal decision of NG v Department of Education[1]. In that case, the Tribunal found that necessity meant whether the collection is ‘reasonably required or legally ancillary’ to the organisation’s functions.

The Tribunal was therefore satisfied that the requirement to provide a birth certificate was ‘necessary’ to carry out the Respondent’s functions as an employer. The Tribunal noted that the fact that Respondent  offered alternative ways of proving one’s residence did not alter the necessity of the collection of the Complainant’s birth certificate.

IPP 1.2

The Tribunal found that the Respondent came into possession of the birth certificate because the Complainant had provided it with a copy at the start of his employment. It held that there was nothing unfair, unlawful or unreasonably intrusive about such a collection.

IPP 1.3

The Tribunal took a narrow interpretation of IPP 1.3 by holding that its relevance was limited to the point of collection of information from the Complainant. This occurred during the Complainant’s initial employment onboarding so the Respondent was not under an obligation several years later to notify the Complainant that the disclosure occurred. Rather, the Tribunal found that the Complainant’s concerns in this regard raised issues around use and disclosure (thus engaging IPP 2.1) but not collection.

IPP 2.1

The Tribunal found that the primary purpose of collecting the Complainant’s phone number was to contact him about important work-related matters when he was not at work and that it was then disclosed to the investigator for this primary purpose.

The Tribunal found that the primary purpose of collecting the Complainant’s birth certificate was to verify his identity and proof of residency. It found that it was then used for a secondary purpose of identifying the complainant’s father.

The Tribunal considered that this was related to the primary purpose as it occurred ‘within the context of a workplace investigation and therefore related to the complainant’s ongoing status as an employee’. It rejected the Complainant’s assertion that if there is no finding of misconduct then then the investigation should not have occurred, noting that the ability for employers to investigate allegations of employee misconduct was necessary for the effective operation of the employment relationship.

The Tribunal also found that an employee under investigation would reasonably expect such a secondary use in the form of all relevant personal information on their personnel being made available to an investigator.

IPP 5.2

The Tribunal rejected the Complainant’s argument, holding that IPP 5.2 only required the Respondent to inform the Complainant ‘generally, what sort of information’ it held. IPP 5.2 did not require the Respondent to undertake ‘an inventory or audit of the personal information held’.

Orders

The Tribunal found the complaint was not proven on all grounds and dismissed the application.

[1] [2005] VCAT 1054 [4]