Queensland government agencies1 are required to comply with the privacy principles in the Information Privacy Act 2009 (Qld) (IP Act) when collecting, storing, using and disclosing personal information.
Personal information is any information or opinion about an individual whose identity is apparent or can reasonably be ascertained.2
The general rule3 is that personal information cannot be disclosed to a third party. One of the exceptions is where the disclosure is authorised or required by law.4
An agency discloses personal information when it gives it to someone who doesn't know it and can't find it out, and they will no longer control the information.5
Natural justice is the right to be made aware of, and respond to, information which will be used in the course of a decision that will negatively affect the person.6 For example, a decision to discipline an employee, fine someone for a breach of the law, refuse to give someone a licence or take away a benefit, such as a travel concession.
In the context of a complaint, natural justice requires that the subject of the complaint be given enough information that they can understand and respond to the complaint made against them. This will generally be only a small part of the information collected in the course of the complaint process.
Non-adverse information, adverse information which is not being relied on, and information that would merely be of interest7 to the person does not trigger a natural justice obligation to provide the person with the information.
The obligation to accord natural justice8 is a requirement of the government decision making process. It applies before the agency relies on the adverse information to make the decision; once the decision has been finalised, the obligation no longer applies.
Agencies that fail to comply with the requirements of natural justice risk having their decisions declared invalid by a court or tribunal. However, the obligation to accord natural justice does not oblige the agency to disclose all relevant material.9 The agency is only required to disclose enough information—which must be credible, relevant and significant to the adverse finding—about the material to allow the recipient to effectively respond.10
The obligation to accord natural justice is required by law, but only the minimum amount of personal information necessary can be disclosed; any irrelevant personal information must be removed or held back.
The onus will be on the agency to establish that the disclosure is necessary. If natural justice can be given using de-identified information the disclosure of personal information will not be authorised.
Regardless of the complexity and circumstances, all complaint processes will involve natural justice obligations, for example:
Where a complaint is made by one individual against another individual, the complainant or their interests will not necessarily be directly12 affected by the outcome of the complaint. For these complaints, while natural justice will always apply to the person complained about, it will rarely apply to the complainant or witnesses.
In a complaint process, the authorisation will only apply to disclosures that are necessary to satisfy natural justice and it will only apply to information that is credible, relevant, and significant to that complaint.
If an agency discloses personal information which is not required to give someone natural justice, that disclosure may be a breach of the privacy principles and could give rise to a separate privacy complaint.
For many complaints, the identity of the complainant will have no bearing on the subject matter of the complaint. Agencies commonly acknowledge this fact by allowing for complaints to be made anonymously or for the complainant's identity to be treated confidentially.13
In some complaints, for example a complaint about harassment, the complainant’s identity will be relevant to the investigation and will need to be disclosed to the person the complaint is about. However, even with these complaints, only some of the complainant’s personal information will be relevant. Irrelevant information, such as any personal damage the complainant suffered because of the behaviour complained about, should not be provided.
In most cases, information given by a witness concerning the subject matter of the complaint will need to be provided to the person complained about. In some cases the witnesses’ identities may also be relevant to the subject of the complaint. In these circumstances, agencies should advise witnesses the first time they speak with them or when taking their statement of the possibility that their personal information may need to be disclosed to the subject of the complaint.
Natural justice does not automatically require that the subject of a complaint be given with unedited copies of relevant documents. Agencies should consider whether it would be appropriate to provide de-identified information or documents, outlines of the complaint details and relevant allegations, and/or summaries of evidence and witness statements.
Mary Jones has the use of a departmental vehicle on the condition that she only uses it for travel between her home and the office. Another officer of the Department, Michael Smith, makes a complaint that Mary frequently uses the car for personal shopping and to transport her children to and from school.
In investigating the complaint, the Department finds that Mary’s vehicle logs show more kilometres travelled than can be accounted for by the permitted travel. Consequently, the Department commences disciplinary proceedings against Mary.
Before a decision is made in the proceedings, the Department provides the complaint allegation and vehicle logs to Mary to give her the opportunity to respond. Mary demands to know who made the complaint, claiming that natural justice gives her the right to challenge the credibility of the complainant.
The Department refuses to reveal Michael’s identity on the basis that his identity is not information necessary for Mary to understand the allegation made against her or the evidence on which the Department would base a decision to discipline her. If the Department had told Mary that Michael had made the complaint he would have strong grounds on which to make a privacy complaint against the Department.
The outcome of the investigation, the findings of the investigator, and any actions taken against the person the complaint was about are that person's personal information. Natural justice cannot require giving that information to a third party, such as the complainant (if their interests were not the subject of the complaint) or witnesses.
Complainants often have expectations of being provided information on the outcome of a complaint; the best time to address these expectations are when time the complaint is made.
Agencies that want to communicate the personal information of the subject of the complaint to other persons must ensure they do not breach the privacy principles when doing so, and should consult Complaint status and outcomes – what can you tell a complainant? for more information.
Current as at: June 18, 2020