Case Note: Authorised Disclosures of Personal Information


AIT18 v Australian Information Commissioner [2018] FCAFC 192

Introduction

In this case, the Federal Court found that the Department of Veterans’ Affairs (DVA) did not breach the Information Privacy Principles (IPPs) which, at the relevant time, were contained in the Privacy Act 1988 (Cth) (Privacy Act), in relation to 3 disclosures of personal information made by DVA.

The key question for the Court was whether the 3 disclosures were permitted under the exceptions set out in IPP 11.1 of the Act.

Subscribers should note that the IPPs, which regulated the handling of personal information by Commonwealth agencies, have since been replaced by the Australian Privacy Principles (APPs) set out in Schedule 1 of the Privacy Act. Although the legislative scheme has changed, the APPs have preserved some of the protections and exceptions set out in the IPPs. In this way the principles discussed in this case are relevant to the interpretation and application of particular provisions of the APPs.

Facts

AIT18 (Applicant) was enlisted in the Royal Australian Air Force (RAAF) and so was a member of the Australian Defence Force (ADF).

In June 2011 the Applicant lodged a claim for compensation with DVA related to injuries he suffered during his military service. The Applicant, dissatisfied with the processing of his claim, created a website dedicated to criticising DVA and the responsible Minister. The Applicant also sent a series of emails, calls and text messages to DVA personnel, which included vitriolic, threatening and offensive language.

In October 2011, in the course of responding to the Applicant’s complaints and threatening conduct, the DVA disclosed the Applicant’s personal information to:

  • an ADF Senior Medical Officer (Disclosure 1);
  • the Head of Joint Health Command in the Department of Defence (Disclosure 2); and
  • the Chief of Air Force (Disclosure 3).

The Disclosures revealed that the Applicant had claimed compensation, that his correspondence with DVA staff had become increasingly abusive and that he had contacted DVA staff outside of ordinary business channels.

In response to the Disclosures the Applicant submitted a complaint to the Information Commissioner in November 2011. The Information Commissioner found that DVA had breached IPP 11.1 and directed DVA to apologise to the Applicant and review how it manages privacy complaints. However, the Information Commissioner declined to award compensation for the breach.

The Applicant subsequently applied to the Administrative Appeals Tribunal (AAT) for review of the Information Commissioner’s decision not to award compensation.

The AAT’s Decision

Although the Applicant intended for the scope of the review to only extend to the question of compensation, the AAT determined that the nature of the review was such that all of the matters relating to the original privacy complaint were put in issue. As such, the AAT heard substantive arguments as to whether DVA had in fact breached the IPPs.

The AAT found against the Applicant and set aside the decision of the Information Commissioner. The AAT found that the Disclosures came within the exceptions in IPP 11.1 (a) and (d) of the Privacy Act.

IPP 11.1 relevantly provided that:

A record‑keeper who has possession or control of a record that contains personal information shall not disclose the information to a person, body or agency (other than the individual concerned) unless:

(a) the individual concerned is reasonably likely to have been aware, or made aware under Principle 2, that information of that kind is usually passed to that person, body or agency; or …

(d) the disclosure is required or authorised by or under law…

The AAT’s consideration as to IPP 11.1(a)

In relation to IPP 11.1(a), the AAT held that it must first determine the ‘kind’ of information that was disclosed and then consider whether information of that kind is usually passed on to those to whom the disclosures were made.

The AAT found that all 3 disclosures reflected DVA’s concern for the Applicant’s health, for the wellbeing of its own staff and for the integrity of the ADF. In particular, the Disclosures were characterised as being necessary to enable DVA to ascertain whether it should be concerned about the Applicant’s behaviour and what its response should be. To that end, DVA sought the opinion of ADF medical practitioners to assess whether the Applicant required a psychiatric evaluation and proceeded to notify the Chief of Air Force that the Applicant’s conduct was such that he might be bringing discredit to the ADF. On this basis, the AAT was satisfied that the disclosures were the ‘kind’ of information that was usually passed on to the relevant parties.

Further, the AAT concluded that the Applicant was reasonably likely to have been aware that the Disclosures were the kind of information that is usually passed on to medical practitioners and the Chief of Air Force. In particular, the AAT noted that the Applicant held a senior rank in the RAAF, had earned tertiary qualifications and was considered an expert in his field. It held that a person of the Applicant’s experience, education and rank was reasonably likely to have been aware that if he engaged in a course of increasingly abusive conduct, there would be those who would seek the advice of medical practitioners in the ADF regarding his mental health and that his behaviour would be brought to the attention of his superiors.

The AAT’s consideration as to IPP 11.1(d)

In relation to whether the Disclosures were ‘required or authorised under law’, the AAT found that it was possible for a law, such as the now repealed Occupational Health and Safety Act 1991 (Cth) (OHS Act), to impliedly authorise the use or disclosure of personal information.

In particular, the AAT held that the power of an employer to release personal information must be implied from the nature of the employer’s obligation set out in section 16 of the OHS Act to ‘take all reasonably practicable steps’ to protect the health and safety of its employees (section 16 has been substantially replaced by section 19 of the Work Health and Safety Act 2011 (Cth) (WHS Act)). In this case, the AAT was satisfied that the Applicant’s conduct was such that DVA was rightly concerned about the safety and wellbeing of its employees and that a proper assessment was required to ensure that they were not being exposed to an OHS risk. In such circumstances, the Disclosures were an appropriate and necessary step taken by DVA to protect the health and safety of its employees.

Conclusion of the AAT

On the above basis the AAT held that DVA had not breached IPP 11.1 and consequently dismissed the Applicant’s appeal.

The Applicant subsequently appealed the AAT’s decision to the Federal Court.

Appeal to the Federal Court

The Applicant identified 14 questions of law arising from the AAT’s decision which the Applicant contended gave rise to 23 grounds of appeal.

The Applicant’s core argument was that the AAT incorrectly construed the exception provisions in IPP 11.1(a) and (d), as such the grounds of appeal largely concerned technical questions of statutory interpretation.

The Court dealt with the Applicant’s submissions under three broad categories.

Whether the Privacy Act should be interpreted liberally

The Applicant sought to rely on the established general principle of statutory interpretation that remedial or beneficial legislation should be accorded a fair, large and liberal interpretation and should not be unnecessarily confined. The Applicant argued that by interpreting the exception provisions according to their ordinary meaning, the AAT erred by taking a restrictive approach.

The Court agreed that the Privacy Act is remedial or beneficial legislation and should, in general be construed liberally. However, the Court was careful to emphasise that close attention must be given to the relevant statutory terms which require interpretation.

In this case, the Court held that the Privacy Act does not confer an absolute right to privacy, rather it creates a right not to be subjected to arbitrary or unlawful interference with one’s privacy. Further, the Privacy Act specifically identifies exceptions, such as IPP 11.1(a) and (d), in which interference with a person’s privacy is not arbitrary or unlawful. The Court held that these exceptions reflected Parliament’s balancing of the competing interests of protecting privacy and authorising disclosure where it is in the community interest.

In accordance with the above, the Court held that the AAT did not err by interpreting the exceptions to the IPPs according to their ordinary meaning as not every provision of the Privacy Act must be construed broadly.

Whether the AAT erred in interpreting IPP 11.1(a)

The Applicant made a number of submissions relating to the AAT’s construction of IPP 11.1 (a). In particular the Applicant argued that the AAT had erred in:

  • its construction of the term ‘usually’; and
  • in its interpretation of what an individual concerned is ‘reasonably likely to be aware’.
Whether information of that kind is ‘usually’ passed on

The Applicant challenged the AAT’s conclusion that the word ‘usually’, in the context of IPP 11.1(a), meant ‘customarily’ or ‘ordinarily’. Rather, the Applicant submitted that ‘frequently’ should be the preferred construction.

The AAT rejected the Applicant’s argument and accepted the interpretation that was preferred by the AAT. The Court held that the AAT’s construction is supported by the text and context of the provision, the purpose of the Privacy Act as well as by common sense. In particular, the Court stated that the AAT’s construction took account of the fact that some kinds of information will be regularly or routinely collected by agencies and passed on. However, there will also be other kinds of information that only comes into an agency’s possession occasionally or rarely, but that information may still customarily or ordinarily be passed on. The Applicant’s preferred construction of ‘frequently’ provides for no such flexibility.

Having found that the AAT did not err in its interpretation of the term ‘usually’, the Court also found that the AAT did not err in finding that the disclosure of the information that was the subject of the Disclosures was customarily or ordinarily passed on.

The Court agreed with the AAT that it would be normal or ordinary for an agency in the position of DVA to pass information regarding a person’s seemingly erratic and increasingly aggressive behaviour to those engaged in, or responsible for, the person’s medical care and treatment, in this case being the ADF Senior Medical Officer and Joint Health Command.

Further, the Court agreed that it was usual for a Commonwealth agency to inform another agency if it has formed a view that an employee of the latter agency may have engaged in criminal conduct. In this case, it would not be unusual for an agency such as DVA, which had good reason to believe that a member the ADF was behaving irresponsibly and potentially criminally, to draw the attention of the Chief of Air Force to that conduct.

What the individual concerned is ‘reasonably likely to have been aware’

The Applicant submitted that the AAT was required to apply an objective standard when determining what the individual concerned was ‘reasonably to have been aware’ and that the AAT erred in taking account of the Applicant’s subjective knowledge, education and other personal characteristics.

The Court rejected this submission and found that it was inconsistent with the plain text of IPP 11.1(a), which makes explicit reference to what the ‘individual concerned’ is reasonably likely to be aware of. On that basis the Court was satisfied that this must necessarily be a reference to the subjective knowledge of the individual themselves and not a hypothetical reasonable person.

In accordance with the above, the correct approach involves taking into account the relevant personal characteristics of the individual which were known to the decision-maker and then asking what that individual, as a matter of reason and awareness, was reasonably likely to have been aware of in the circumstances.

In this case, the Court was satisfied that the AAT was correct in considering what the Applicant was actually reasonably likely to be aware of, by reference to the Applicant’s education, background, experience and behaviour insofar as they were known to DVA. Further, the Court concluded that the AAT did not err in finding that the Applicant, having regard to his subjective knowledge, was reasonably likely to be aware that in the ordinary course of events, it was usual for the information of the kind contained in the Disclosures to be passed onto the people to whom the Disclosures were made in the circumstances.

Whether the AAT erred in interpreting IPP 11.1(d)

The Applicant submitted that IPP 11.1(d) should be read narrowly so as to only apply to disclosures which are explicitly required or authorised by law.

The Court rejected this submission, finding that such a construction is inconsistent with the plain text of the provision which includes the phrase ‘by or under’. The Court held that this language indicates that there is scope for disclosures to be directly provided for by a law, as well as those which are indirectly provided for under a law.

The AAT found that the general employer’s duty at section 16 of the OHS Act implicitly authorised disclosure in this case, as the inability to disclose information would frustrate the operation of the scheme. The employer is required to take all reasonably practicable steps to protect the health and safety of its employees in the workplace.

In this case the Court accepted that the Disclosures formed a ‘reasonably practicable step’ in protecting the health and safety of DVA employees as part of a process of assessing the risk which the Applicant posed to those employees and as such were covered by the exception under IPP 11.1(d).

Additonally, the Court noted that the exception does not extend to authorising any disclosure that is merely incidental or convenient, the essential factor is the necessity of drawing the necessary implication to give effect a statutory scheme or to avoid frustrating the statutory scheme.

Conclusion

On the basis of the above, the Court held that the AAT had not erred in construing or applying the relevant exceptions set out in IPP 11.1(a) or (d) and dismissed the Applicant’s appeal.

Compliance Impact

As stated above, the IPPs have been repealed and replaced by the APPs, which regulate the management of personal information by Commonwealth agencies and the private sector. However, the APPs have preserved some of the protections and exceptions set out in the IPPs. Significantly, APPs 6.1 and 6.2 are substantially equivalent to IPP 11.1(a) discussed above. Additonally, IPP 11.1(d) has been almost identically replicated in APP 6.2(b).

In relation to APPs 6.1 and 6.2, although the term ‘usually’ does not appear in these provisions as it did in IPP 11.1(a), the Court’s finding that the term ‘usually’ is to be interpreted as meaning ‘customarily’ or ‘ordinarily’ may inform how an APP entity prepares collection notices for the purpose of APP 5.1, and may be of particular relevance to the requirement under APP 5.2(f) to disclose ‘any other APP entity, body or person, or the types of any other APP entities, bodies or persons, to which the APP entity usually discloses personal information of the kind collected by the entity’.

Additonally, the phrase ‘reasonably likely to have been aware’ which appeared in IPP 11.1(a) has been replaced in APP 6.2(a) with what the individual ‘would reasonably expect’. Despite the change in framing, the finding of the Court that a subjective assessment was required may be applicable to APP 6.2(a). APP 6.2(a) still provides for a disclosure to assessed in relation to what the particular individual would reasonably expect. In this way, a subjective assessment of the individual’s awareness may still be appropriate.

Further, given that IPP 11.1(d) has been replicated in APP 6.2(b), the Court’s finding that ‘required by or under a law’ extends to legislative provisions which implicitly authorise disclosure, including section 16 of the OHS Act (now section 19 of the WHS Act), may be relevant to any APP entity that is considering whether a particular disclosure may be permitted in the circumstances.