Zeqaj v Victoria Police (Human Rights) [2018] VCAT 1733 (20 November 2018)

In this case, Mr Visho Zeqaj (Complainant) alleged Victoria Police (Respondent) interfered with his privacy by disclosing personal and sensitive information about him to third parties.  On 20 November 2018, the Victorian Civil and Administrative Tribunal (VCAT) found the Respondent did not breach Information Privacy Principle (IPP) 2.1 of Schedule 1 of the Privacy and Data Protection Act 2014 (Vic) (Act) but held that it did breach IPP 3.1.  The decision can be accessed here.

Lessons

This is a noteworthy decision for Victorian public sector agencies (VPS agencies) for the following reasons:

1. The decision is a reminder for VPS agencies that rely on the law enforcement exemption that they may only depart from the IPPs where they believe on reasonable grounds that the departure is necessary.
2. Compensation in this case was awarded where the only harm demonstrated was ‘hurt feelings’. Given this is the first occasion where VCAT has awarded monetary compensation for a breach of the IPPs, it may serve as a benchmark in future privacy complaints where a similar harm is alleged.
3. When considering whether to provide compensation to a Complainant or when assessing the quantum of any compensation in response to a privacy complaint, VPS agencies may find it helpful to refer to the general principles considered by VCAT at paragraphs 155 to 158 of the decision.
4. The decision highlights the importance of VPS agencies checking the accuracy of information about an individual prior to disclosing it.

The Complaint

The ATO disclosures

The Complainant alleged that the Respondent told the Australian Taxation Office (ATO) that he:

1. was the subject of an investigation. This occurred when the Respondent sent a notice to the ATO requesting information about the Complainant in 2011; and
2. had been identified as being involved in the cultivation, distribution and sale of cannabis. This occurred when the Respondent responded to a request for information about the Complainant from the ATO in 2012.

The Firearms Act disclosure

The Complainant also alleged that in 2016, the Respondent disclosed to a third party (a relative of the Complainant, A) that the Respondent considered the Complainant to be a ‘known criminal identity’. The disclosure was made in the context of an assessment of A’s firearms licence under the Firearms Act 1996 (Vic) (Firearms Act).

The Complainant became aware of the ATO disclosures after obtaining documents from the ATO under the Freedom of Information Act 1982.  A informed him of the Firearms Act disclosure.

The Decision

The Law Enforcement Exemption to IPP 2.1

The Respondent submitted the ATO disclosures fell within the law enforcement exemption under section 15(a) of the Act as they were both activities for the purposes of one or more of the Respondent’s law enforcement functions or activities.  It also submitted the Firearms Act disclosure occurred in the context of community policing activities under section 15(d) of the Act.

VCAT was not satisfied that the law enforcement exemption under section 15 of the Act applied despite the fact that the disclosures related to policing activities.  VCAT noted that for the exception to apply, the Respondent would need to demonstrate that it held a belief on reasonable grounds that noncompliance with the IPPs was necessary as per section 15 of the Act.  The Respondent was unable to provide evidence of this.

IPP 2.1

VCAT held the Firearms Act disclosure and the ATO disclosures were consistent with the Respondent’s primary purpose of the collection of personal information under IPP 2.1.  It noted even if the disclosures were not consistent with the Respondent’s primary purpose, the ATO disclosures would fall under the IPP 2.1(e) and 2.1(f) exemptions and the Firearms Act would fall under the IPP 2.1(f) exemption.

IPP 3.1

The Respondent has an obligation under IPP 3.1 to take reasonable steps to make sure that the personal information it collects, uses or discloses is accurate, complete and up to date. In relation to the ATO disclosures, VCAT accepted the Respondent’s statements about the Complainant in 2011 and 2012 ‘might fairly be regarded as accurate at that time’ and accordingly it did not find that the Respondent had breached IPP 3.1.

In relation to the Firearms Act disclosure, VCAT found the Respondent’s statement to the ATO that it considered the Complainant to be a ‘known criminal identity’ to be a breach of IPP 3.1 as the Respondent could not provide evidence the Complainant was known (as opposed to suspected) to be involved in criminal activity.

Orders

VCAT ordered the Respondent to do the following:

1. Rectify the breach by:
   a. providing A with a copy of VCAT’s orders and reasons; and
   b. attaching a copy of the VCAT orders and reasons to its physical and electronic records of the Firearms Act disclosure.
2. Pay the Complainant $1,000 by way of compensation.

Although it was requested by the Complainant, VCAT did not order that the Respondent apologise to the Complainant for the breach as it considered this would serve no utility.

Disclaimer

This case note is general in nature and does not constitute legal advice.