Assessing compensation claims for loss in privacy complaints

This guidance assists parties in privacy complaints where an interference with privacy has been established and the individual seeks compensation to resolve the complaint.

This will not be relevant in all complaints as they can often be resolved by other means (such as an apology or a respondent agreeing to a change of practice or procedure). But it will be useful for parties to consider when grappling with the difficult issues of harm and compensation.

The PDP Act and powers of VCAT

One of the purposes of the Privacy and Data Protection Act 2014 (Vic) (PDP Act) is ‘to provide remedies for interferences with the information privacy of an individual’.¹ As such, if VCAT finds an interference with privacy, it can make an order under s 77(1)(a)(iii) that:

the complainant is entitled to a specified amount, not exceeding $100 000, by way of compensation for any loss or damage suffered by the complainant, including injury to the complainant’s feelings or humiliation suffered by the complainant, by reason of the act or practice the subject of the complaint;

As conciliator, OVIC often asks parties to consider the strengths and weaknesses of their case should the matter proceed to VCAT, including on questions of harm and compensation. This is to encourage parties to resolve matters through conciliation with OVIC without having to resort to VCAT – by considering fair, reasonable and proportionate compensation as one way to redress harm.

To assist this exercise, OVIC has identified general principles and guidance around the assessment of harm and damages in privacy complaints.

These draw on VCAT commentary but, noting that there is currently only one case where VCAT has awarded compensation after a final hearing – Zeqaj v Victoria Police² , we have also drawn on decisions from other jurisdictions as well as our own experiences of conciliation involving issues of assessing harm and appropriate compensation amounts.

The two main categories of harm that have resulted in awards of compensation following privacy complaints are:

1. economic loss; and
2. non-economic loss (sometimes described as emotional harm).

Economic loss

VCAT may award compensation where a privacy breach has caused a complainant to suffer economic loss. This involves a complainant suffering loss of a financial nature caused by a breach. Awards for economic loss seek to restore an individual to ‘the same position as he would have been in if he had not sustained the wrong for which he is now getting his compensation’ ³.

While there is no Victorian case law under the PDP Act where this has been granted, other jurisdictions and conciliation settlements at OVIC have included compensation for medical or counselling expenses;⁴ a subscription to identity monitoring services; or payment for lost income where a disclosure forced an individual to resign from their job.⁵

Non-economic loss

Non-economic loss (sometimes described as emotional harm) is the most commonly claimed type of harm in privacy complaints but can be the most difficult to grapple with given its nature.

It is important to first point out that the PDP Act allows compensation to be paid as a remedy for non-economic loss like injury to the complainant’s feelings or humiliation.

This is because interfering with an individual’s right to privacy can involve harm which is somewhat less tangible but is nevertheless real to a complainant. The New Zealand High Court has described injury to feelings as follows:

The feelings of human beings are not intangible things. They are real and felt, but often not identified until the person stands back and looks inwards. They can encompass pleasant feelings (such as contentment, happiness, peacefulness and tranquillity) or be unpleasant (such as fear, anger and anxiety). However a feeling can be described, it is clear that some feelings such as fear, grief, sense of loss, anxiety, anger, despair, alarm and so on can be categorised as injured feelings. They are feelings of a negative kind arising out of some outward event. To that extent they are injured feelings.⁶

In fact, VCAT made an order of compensation where the harm demonstrated by the complainant was ‘hurt feelings’.⁷ Similarly, under the Privacy Act 1988 (Cth), the Federal Privacy Commissioner has made awards for compensation that have taken account of hurt feelings.⁸

Assessing severity of non-economic loss

Assessing the level of severity of non-economic loss is not an exact science given it involves a subjective element and quantifying a loss of a non-financial nature. However, the following principles may assist parties when trying to quantify compensation for non-economic loss.

Non-economic loss should be assessed by looking at the particular complainant’s reaction and not to the perceived reaction of the majority of the community or of a reasonable person in similar circumstances.⁹ This may be seen as taking the complainant as you find them, in that one person may react to a privacy breach differently to another for a multitude of reasons.

Similarly, it is the effect of the conduct which should be examined, rather than the conduct itself.¹⁰ So, even if a breach occurs without malice, that should not detract from an assessment of the harm it caused.

In addition, non-economic loss does not always need to result in a medical condition and a complainant will not always need to provide medical evidence to warrant compensation.¹¹ This is demonstrated by varying financial awards made by VCAT¹² and other jurisdictions¹³ .

However, where a complainant seeks a large amount of compensation for non-economic loss, there is a greater expectation that they will support this with medical evidence.¹⁴

Levels of compensation for non-economic loss

All cases will turn on their specific circumstances and it is impossible to establish an absolute metric for determining amounts of compensation.

However, based on privacy decisions¹⁵ and our own experience:¹⁶ the below table provides a general guide of OVIC’s view about compensation for different levels of non-economic loss:¹⁷

Expenses incurred in making the complaint

Under s 77(1)(d) of the PDP Act, VCAT has power to:

in any case, make an order that the complainant is entitled to a specified amount to reimburse the complainant for expenses reasonably incurred by the complainant in connection with the making of the complaint and the proceedings held in respect of it under this Act.

As such, when parties are discussing levels of compensation to settle privacy complaints, they may wish to factor in the payment of any expenses that the complainant has incurred in pursuing the matter.

While there is no Victorian decision about whether legal fees incurred in pursuing a matter at VCAT can be claimed,¹⁸ this has been ordered in other jurisdictions.¹⁹

Where costs were ordered for legal expenses in other jurisdictions, it has been noted that this will not be the case in all matters where a complainant seeks legal representation (since privacy complaints can generally be made without this) and that legal representation must be deemed to have been reasonably necessary and proportionate in the circumstances.²⁰

Other expenses that may be reasonably incurred in pursuing a privacy complaint at OVIC or VCAT may also include medical examinations or expert reports.²¹

Causation – linking harm to the breach

Not all privacy breaches will warrant compensation – it is expected that that a complainant first demonstrate that they have suffered harm as a result of the breach. This reflects that compensation is aimed at redressing harm rather than punishing an organisation.

However, VCAT has noted that where harm has been established, ‘the legislation contemplates some form of redress in the ordinary course’.²²

Of course, the harm must be shown to have been caused by the breach. While judging causation will be a matter of common sense and will depend on the facts of the case,²³ some general comments may be made:

• Causation is a question of identifying where legal responsibility should lie, rather than examining the cause of the event from a scientific or philosophical viewpoint.²⁴
• But for’ analysis is not a sufficient test for causation although it may be a guide. This means parties might be assisted by considering whether the harm would have occurred if the breach had not happened.²⁵
• Where there are multiple elements, each one is sufficient on its own to have caused the loss, the causation test may be considered satisfied by each one of them.²⁶
• Assessing causation may involve disentangling harm caused by the breach with other causes of harm that a complainant has suffered. This is particularly the case where there is a pre-existing acrimonious relationship between the parties²⁷ or where the complainant is affected by other stressors.²⁸ In these cases, compensation may reflect the proportion of harm caused by the breach.²⁹ It should also be borne in mind that a breach can exacerbate or worsen a complainant’s situation, such as a pre-existing psychological issue.
• Actions that occur after a breach may become the subject of discussion around causation. It has been held that harm due to an unauthorised recipient on-disclosing information was caused by the breach.³⁰ In cases of complainant’s taking actions in response to a breach, there have been findings that relocation by the complainant has been a cause of the breach³¹ where in others – such as a complainant claiming they were forced to sell their house, it has been found that the link to the breach is too remote to be considered a cause.³²
• It is difficult to establish potential future losses that are speculative in nature or where no evidence has been offered to show how this could eventuate. For example, in Zeqaj the complainant referred to inaccurate disclosures leading to possible job losses or an inability to travel. However, VCAT noted that the complainant had not provided any evidence that these harms had eventuated.³³
• In assessing causation, a complainant’s own conduct may be relevant. For example, in ‘EQ’ and Great Barrier Reef Marine Park Authority,³⁴ the complainant claimed economic loss and non-economic loss relating his employer’s disclosure about an offence he had committed to a journalist. The Australian Information Commissioner found that the complainant’s own actions by committing the offence had been the main cause of the economic loss rather than the breach and also factored this into its award for non-economic loss.

Aggravated damages

VCAT has noted that it can award ‘aggravated damages’ in appropriate cases.³⁵ That means it may increase an award of compensation to account for aggravation caused by a respondent, either in its conduct in carrying out a breach or in how it has responded to a complaint.

While there has been no detailed consideration of this issue, the Australian Information Commissioner has noted that:

• aggravated damages may be awarded where the respondent behaved ‘high-handedly, maliciously, insultingly or oppressively in committing the act of discrimination’³⁶
• the ‘manner in which a defendant conducts his or her case may exacerbate the hurt and injury suffered by the plaintiff so as to warrant the award of additional compensation in the form of aggravated damages.’³⁷
• the conduct necessary as a basis for an award of aggravated damages can be described as being ‘improper, unjustifiable or lacking in bona fides’.³⁸
• the circumstances in which the respondent’s conduct takes place, such as in an employment relationship, may themselves give rise to an element of aggravation.³⁹

The possibility of aggravated damages being awarded means that respondents should ensure that they engage with privacy complaints in an open and responsive manner that does not aggravate any damage caused by a privacy breach.

1. This is consistent with Australia’s international human rights treaty obligations under the International Covenant on Civil and Political Rights, 1966, Article 2(3) which makes specific reference to a duty to provide ‘an effective remedy’ to persons whose rights have been violated.
2. [2018] VCAT 1733.
3. Livingstone v Raywards Coal Company [1880] UKHL 3
4. CH v Queensland Police Service [2019] QCAT 297
5. Hammond v Credit Union Baywide [2015] NZHRRT 6.
6. Director of Proceedings v O’Neil [2001] NZAR 59 at [29] as cited in the privacy matter of Hammond at [153].
7. Zeqaj.
8. See, for example, ‘D’ v Wentworthville Leagues Club [2011] AlCmr 9 and ‘BO’ v AeroCare [2014] AlCmr 32.
9. At [155] citing principles from Hall v A & A Sheiban Pty Ltd [1989] FCA 92 and adopted by the Administrative Appeals Tribunal of Australia in Rummery and Federal Privacy Commissioner and Anor [2004] AATA 1221.
10. See n.9 above
11. Zeqaj at [166].
12. In Zeqaj, VCAT awarded $1000 where it partially accepted the complainant’s ‘evident upset and frustration’ was caused by the breach in question, without having provided medical evidence.

13. In AA v State of Queensland (Office of Industrial Relations)[2021] QCAT 258, QCAT awarded $20,000 after accepting that the complainant ‘suffered injury to his feelings and experienced humiliation’. In this case, the complainant’s employer made 3 phone calls to his super fund seeking assistance in having the complainant return to work and, during these, inappropriately disclosed work-associated information about him.

    In Hammond v Credit Union Baywide [2015] NZHRRT, the New Zealand Human Rights Review Tribunal awarded $98,000NZ for humiliation, loss of dignity and injury to feelings. The complainant had posted a photo privately on Facebook of a cake with written obscenities referring to her employer. The employer coerced a junior member of staff to reveal the photo then sent screenshots of the post to several employment agencies in the local area warning against employing the complainant.

14. Zeqaj at [166].
15. When considering previous cases, the passage of time should be noted. Awards that were made several years ago may need to be adjusted for inflation.
16. It is important to note that judging levels of appropriate redress by reference only to privacy decisions may only provide a partial picture. This is because relatively few numbers of privacy matters eventuate in a privacy decision, noting that the greater number of matters that are settled by way of compensation are done so through conciliation.

17. The example for ‘no harm or trivial harm’ references Whitfield v Greater Bendigo CC [2005] VCAT 1756. In this case, the complainants found a lost dog and reported it to the Council. The Council provided the complainants’ phone number to the owners of the lost dog who contacted them. The complainants claimed compensation of $50,000 without producing any medical evidence but VCAT did not accept that the complainants had suffered any non-economic loss.

    The example for ‘low harm’ references ‘S’ and Veda Advantage Services and Solutions Limited [2012] AICmr 33 at [83]. This involved a credit reporting agency providing inaccurate information about the complainant to credit providers and $3500 in compensation was ultimately awarded.

    The example for ‘moderate harm’ references ‘BO’ at [52] and ‘WZ’ and Chief Executive Officer of Services Australia [2021] AICmr 12 at [113]. The former case involved airport staff inappropriately collecting medical information from the complainant in the presence of their Sighted Guide and other passengers and $8500 was ultimately awarded. The latter case involved the respondent disclosing details of the complainant’s new address to her former partner who she claimed had previously perpetrated family violence and $10,000 compensation was ultimately awarded. See also ‘CM’ and Corporation of the Synod of the Diocese of Brisbane [2014] AICmr 86 where $7500 was awarded for pain and suffering and feelings of humiliation.

    The example for ‘serious harm’ references PB v WorkCover Queensland [2020] QCA 278. This involved unfair collection of irrelevant medical information from the complainant’s doctors where there was no authority to do so. On appeal, the complainant was awarded $15,000. See also ‘DK’ and Telstra Corporation Limited [2014] AICmr 118 where $18,000 compensation was awarded for significant anxiety and distress including a well-founded fear for physical safety and ‘HW’; and Freelancer International Pty Limited [2015] AICmr 86 where $15,000 compensation (and $5000 aggravated damages) was awarded for the significant impact on the complainant’s emotional wellbeing which was heightened and intensified by the repetition of the breaches

    The example for ‘severe harm’ references Hammond (see n. 13 above) at [16]. See also Hamilton v The Deanery 2000 Ltd [2003] NZHRRT 28 where $40,000 was awarded for non-economic loss where a private alcohol treatment clinic disclosed details of the complainant’s engagement with its services to New Zealand Immigration Service and several newspapers.

18. The issue was briefly discussed in Roberts v Anglicare Victoria [2014] VCAT 1515 but was not fully argued or decided upon. In that matter, the respondent put the complainants on notice of its view that legal costs do not fall within the s 77(1)(d) because s 109 of the Victorian Civil and Administrative Tribunal Act 1998 (Vic) has as its starting point an expectation that all parties bear their own costs.
19. See, for example, ‘KB’ and Veda Advantage Information Services and Solutions Ltd [2016] AICmr 81; LA Department of Defence [2017] AICmr 25; RM v Queensland Police Service [2017] QCAT 071; and ‘WZ’.
20. ‘KB’ [95] – [97]
21. ‘LA’.
22. See n.9 above.
23. ‘QP’ and the Commonwealth Bank of Australia Limited [2019] AICmr 48 [75]
24. QP [75].
25. QP [75].
26. QP.
27. Zeqaj [167] & [168].
28. See WOS v Victoria Police [2021] VCAT 1540 [153]; and ‘D’ [36].
29. Wentworth [36] – [38]; Cook v Manawatu Community Law Centre, [2021] NZHRRT 10 [128.3].
30. Wentworth.
31. DK and Telstra Corporation Limited [2014] AICmr 118.
32. ST and Chief Executive Officer of Services Australia [2020] AICmr 30; See also QP and the Commonwealth Bank of Australia Limited [2019] AICmr 48; ‘S’ ; and ’WZ’.
33. At [163]. See also ‘EQ’ and Great Barrier Reef Marine Park Authority [2015] AICmr 11 at [68].
34. [2015] AICmr 11 at [68] & [81].
35. See n.9 above.
36. ‘BO’ at [57], citing Hall at [75].
37. ‘BO’ at [57], citing Elliott v Nanda & Commonwealth [2001] FCA 418 at [180].
38. ‘QF’ & Others and Spotless Group Limited [2019] AICmr 20 at [166] citing Triggell v Pheeney [1951] HCA 23 at [514]. In the matter of QF, the Australian Information Commissioner added an award of aggravated damages to the complainants in the amount of $1500 due to the conduct of the respondent, particularly its indifference towards its privacy obligations in the context of an employment relationship. See also ‘HW’ where the Australian Information awarded aggravated damages of $5000 based on the respondent’s indifference towards the impacts on the complainant and its high-handedness including by continuing to publish the complainant’s information online despite being made aware by the complainant that such action breached privacy legislation.
39. QF at [136] noting Rummery at [376].