Privacy Law and Policy Reporter
|
|
Home
| Databases
| WorldLII
| Search
| Feedback
Privacy Law and Policy Reporter |
|
Privacy Act 1998 (Cth) — application to ACT government — whether collection irrelevant or unreasonably intrusive — remedies for breach of Privacy Act — IPP 3 (collection) — s 98 injunctions.
Mr Ibarcena was in a long running dispute with the ACT Commissioner for Housing over his eligibility for a rent rebate. The Commissioner withdrew a rental rebate of $58 per week after Mr Ibarcena refused to (a) give permission for the Commissioner to obtain access to his social security records and (b) provide copies of documents relevant to calculation of his income for tax purposes.
Among other claims, Mr Ibarcena claimed that the Commissioner had breached the Privacy Act. The complaint was initially made in the Federal Court of Australia. Finn J dismissed the application on the ground that it disclosed no reasonable cause of action. In relation to the Privacy Act claim, Finn J said:
Mr Ibarcena makes complaints of breaches of the Information Privacy Principles of the Privacy Act 1988 (Cth) on a number of bases. He has, I understand, subsequently made a complaint to the Privacy Commissioner in respect of his complaints under the Privacy Act 1988. But no proceeding has been brought in this Court relating to the actions of the Privacy Commissioner, consequent upon those complaints. Mr Ibarcena has sought, in this application, to invoke the jurisdiction of this Court directly. The respondent has submitted, in relation to this, that no action lies directly in this Court for breaches of the Privacy Act, save under the provisions of the Privacy Act itself or, I would add, if another statute allows for challenge to be made. That argument undoubtedly is correct for the purposes of the present case. Mr Ibarcena may have proper ground for complaint against the Privacy Commission in respect of his dealings with the complaint made to him. About that matter, I express no opinion. What is clear though, is that Mr Ibarcena cannot simply allege a breach of an Information Privacy Principle of the Privacy Act for the purpose of enlivening this Court’s jurisdiction and for the grant of relief ...
While it is clear that Mr Ibarcena was not legally represented and his claims were either misconceived or poorly drafted, Finn J’s conclusion in respect of the Federal Court’s jurisdiction under the Privacy Act is wrong. Section 98 of the Privacy Act confers jurisdiction on the Federal Court to grant injunctions to restrain breaches of the Act or to take positive steps to act consistently with the legislation. (This jurisdiction was recognised by Burchett J in Austen v Ansett (1994) 1 PLPR 32; affirmed on appeal in Austen v Civil Aviation Authority (1994) 1 PLPR 150; 50 FCR 272.)
After Finn J dismissed the Federal Court proceedings, Mr Ibarcena commenced proceedings in the Supreme Court of the ACT against the ACT Urban Services Minister and the ACT Housing Commissioner. In those proceedings Mr Ibarcena particularised the Privacy Act claims in some more detail, alleging breaches of s 18G(b) and Information Privacy Principle (IPP) 3. The claim under s 18G was dismissed, because that provision regulates the actions of credit reporting agencies and it is obvious that neither defendant is a ‘credit reporting agency’. IPP 3 requires ‘collectors’ of personal information to take reasonable steps to ensure that the information collected is relevant to the purpose for which it is collected (IPP 3(c)) and that the collection does not intrude to an unreasonable extent upon the personal affairs of the individual concerned (IPP 3(d)). Cooper J found that neither defendant was a ‘collector’ of information for the reason that they were not an ‘agency’. The consequence was that IPP 3 did not apply. No doubt Cooper J’s attention was not drawn to the obscure provisions of the Australian Capital Territory Government Service (Conseq-uential Provisions) Act 1994 (Cth), which has the effect of applying the Privacy Act to the ACT government. However, it is rather surprising that counsel for the ACT Minister and the Commissioner did not concede at trial that the defendants were bound by the Act. By the time of Mr Ibarcena’s application for leave to appeal, this concession was made.
Cooper J went on to say:
as pointed out by Justice Finn, the Privacy Act, even if it applied to the defendants, gives no personal rights of action. The only remedy provided under the Privacy Act to a person who alleges a breach of a provision of it is the right to complain to the Privacy Commissioner.
It is unfortunate that Finn J’s erroneous opinion in the original proceedings was uncritically accepted and repeated by Cooper J. If Mr Ibarcena had been represented by counsel who were familiar with the legislation, it is unlikely that either court would have made this fundamental mistake.
After Cooper J dismissed the claim, Mr Ibarcena applied for leave to appeal to the Full Federal Court. Leave to appeal was refused unanimously. As noted above, by this point the defendants had conceded that, contrary to Cooper J’s findings, IPP 3 applied to them. However, the defendants argued that this error should not affect the ultimate position because there was no evidence that IPP 3 had been breached in any way. This submission was accepted by the Full Court: as O’Loughlin J explained, the request for accounting and financial information was perfectly normal and reasonable to allow the housing authorities to ensure that Mr Ibarcena was eligible to receive rent assistance. This is the true basis on which Mr Ibarcena’s claim of invasion of privacy should have been dismissed from the outset. Justice Finn ought to have held that:
Unfortunately, this did not happen. Rather, Justice Finn proceeded on a misconceived view of the scheme for enforcement of the Privacy Act and that view was adopted by Justice Cooper. Further, the error was not identified in the Full Court’s reasons for refusing leave to appeal.
It is hard to say why these errors occurred. There were probably a number of factors. Few counsel and judges are familiar with the Privacy Act. Mr Ibarcena was unrepresented and his claims were poorly articulated. Further, the claims were essentially without merit. In this context it is not surprising that busy counsel and judges are quick to conclude that a claim should be dismissed but make errors in their process of reasoning to justify the result.
Patrick Gunning, Solicitor, Mallesons Stephen Jaques.
Privacy Act 1998 (Cth) — alleged disclosure of confidential information — whether damages recoverable under the Privacy Act — s 98 injunctions.
Mr Goldie was a UK citizen who was in dispute with the Department of Immigration. In 1998 he was taken into immigration detention for three days as a result of an error in a departmental computer record which conveyed the impression that he had no current visa. He commenced proceedings claiming damages for, among other things, misfeasance in public office, false imprisonment, negligence, breach of statutory duties and contravention of the Privacy Act 1988.
The claim for breach of the Privacy Act was pleaded strangely. It was claimed that the respondents owed a duty to comply with the provisions of the Migration Act and the Privacy Act and to ‘take reasonable care in the administration of those acts’. The alleged breaches of this duty were said to have occurred when certain departmental officers released confidential information with respect to Mr Goldie’s migration matters on several occasions. This was said to have caused Mr Goldie to have suffered harm and loss.
In relation to the Privacy Act claim, French J said:
I accept the submission for the respondents that, even if the plea of a breach of the Privacy Act 1988 were made out, there is no relevant claim for relief apparent from the amended statement of claim. The Privacy Act itself provides for complaints to be made to the Privacy Commissioner (s 36), investigation by the Commissioner of the act or practice complained of (s 41) and a determination by the Commissioner dismissing the complaint or finding it substantiated (s 52). The determination may include a declaration that the complainant is entitled to a specified amount by way of compensation for any loss or damage suffered by reason of the act or practice the subject of the complaint (s 52(1)(b)(iii)). The Commissioner or the complainant may commence proceedings in the Federal Court for an order to enforce a determination under the provisions just referred to (s 55). This establishes a process which has not been followed in this case. Part VIII of the Act deals with the breach of obligations of confidence to which an agency or a Commonwealth officer is subject, however that obligation arose, and provides for a ‘confider’ to recover damages from a ‘confidant’ in respect of a breach of an obligation of confidence with respect to personal information (s 93). I accept the respondents’ submissions that there is nothing pleaded nor do the facts disclose the release of confidential information about Goldie to a third party in a way that would attract the application of Part VIII.
Insofar as the relief sought by Mr Goldie for breach of the Privacy Act was damages (and it appears that this was the only relief sought by Mr Goldie for breach of privacy), French J’s analysis of the way in which such a claim must be framed under the Act is correct. However, it will be important to ensure that judges of the Federal Court do not take this passage as a complete description of the scheme for enforcement of the Act, because it does not discuss s 98, which confers jurisdiction on the Federal Court to issue injunctions to restrain contraventions of the Act, or to require a person who is refusing to take steps which are required by the Act to take those steps.
It appears that Mr Goldie did not allege a breach of IPP 3(c) (failure to take reasonable steps to ensure, when collecting personal information, that the information is up to date and complete) or IPP 8 (using personal information without taking reasonable steps to ensure that, having regard to the purpose for which the information is proposed to be used, the information is accurate, up to date and complete). French J found that:
All that is known is that at some point a passport identification number was wrongly entered upon Goldie’s return to Australia thus creating the false impression in the computer records that he had not returned, on the basis of which his Bridging Visa B was recorded as having ceased in February 1996. The circumstances in which that error arose do not emerge from the evidence. Nothing is known of who was responsible for the error nor the systems in place for the entry of the relevant identification numbers.
Without such facts it is not possible to fully assess the merits of a claim for breach of IPP 3(c) or IPP 8, but it seems to me that these grounds deserve further exploration. In particular in assessing a claim under IPP 8, the reasonableness of the steps taken by the department to ensure that the records concerning Mr Goldie were accurate before acting on that information to detain him must be determined with regard to the purpose for which the information was used. Obviously it is a serious matter to place someone in detention.
In this instance, the officer who actually placed Mr Goldie in detention made repeated enquiries of other departmental officers as to Mr Goldie’s migration status before detaining him. This led French J to find that the officer’s suspicion that Mr Goldie was an ‘unlawful non-citizen’ was reasonable and that he was, therefore, under a statutory duty to detain Mr Goldie. However, his Honour observed that ‘the argument that a departmental computer error provides grounds for a reasonable suspicion that warrants the detention of an individual is an unattractive one’, and went on to say that the relevant provision of the Migration Act ‘provides inadequate protection to individuals against wrongful detention in circumstances such as those which have arisen in this case’. It may be that IPP 8 is a way to overcome this inadequacy, as the obligation to abide by IPP 8 is placed on the ‘recordkeeper’ (meaning the department as a whole) as opposed to the individual officer who acts on the information contained in the record.
Mr Goldie appears to be a determined litigant (in his judgment French J describes several other actions against the department), so he may well pursue this avenue with the Privacy Commissioner.
Patrick Gunning, Solicitor, Mallesons Stephen Jaques.
AustLII:
Copyright Policy
|
Disclaimers
|
Privacy Policy
|
Feedback
URL: http://www.austlii.edu.au/au/journals/PrivLawPRpr/2001/11.html