How to put a price on damage suffered as a result of a privacy breach

AA v State of Queensland (Office of Industrial Relations)
[2021] QCAT 258⁹

The complainant - ‘AA’ - was on extended leave from the employment at the Office of Industrial Relations (OIR) for which they were receiving income protection benefit payments from their superannuation fund - QSuper Limited (Super). At approximately 18 months into the leave period, OIR staff made 3 telephone calls to QSuper seeking its assistance in having AA return to work and during the calls they disclosed work-associated information about AA to QSuper. AA had previously specifically refused to provide authorisations to both OIR and QSuper for any exchanges of this information.

The complaint was that OIR had disclosed AA’s personal information to QSuper in breach of Information Privacy Principle 11.

At QCAT, OIR did not contest that they had breached AA’s privacy and the QCAT hearing predominantly dealt with the potential damages suffered by AA and QCAT’s responsive award of financial compensation.

A relatively unusual aspect of the complaint was that QSuper at the relevant time routinely recorded incoming calls. AA sought and was granted access to the recordings through a formal access application. Consequently, AA had not only full information on the content of the calls but also had information on the manner, tone and demeanour of the OIR staff.

AA was seeking aggravated damages of $40,000 – a higher award of damages on the basis that the recordings showed that OIR’s disclosure was both intentional and ‘motivated by malice’. QCAT listened to the recordings but did not find proof of malice. QCAT accepted AA had ‘suffered injury to feelings and experienced humiliation’ and awarded $5,000 per breach for a total of $20,000. QCAT left open the issue on whether AA would be entitled to recover their legal costs.

$20,000 for ‘pain and suffering’, comprised of $5,000 for each of 4 incidents of privacy breach

CH v Queensland Police Service [2019] QCAT 297 (OCL049-18)¹⁰

The complainant, an Australian Defence Force (ADF) Reservist, who was not on active duty or in uniform at the time, was arrested by the Queensland Police Service (QPS). The officer in charge of the watch-house notified the ADF of the arrest which resulted in a follow-up contact the next day. The complaint was that the notification and the consequent follow-up conversation involved a disclosure by the Queensland Police Service (QPS) of the complainant’s personal information to the ADF.

QPS argued its disclosure was in accordance with its Operational Procedural Manual (OPM) and therefore authorised under a law. The complainant’s argument was that the disclosure fell outside of the authority in the OPM as he was a civilian at the time of the arrest.

QCAT accepted QPS’s argument that the OPM and its guidance had the ‘force of law’ but found that while the general notification to the ADF did not constitute a breach, QPS had, in the course of its subsequent communications with the ADF, disclosed more information about the complainant than it had authority for.

$17,806.75

Includes $10,000 for ‘pain and suffering’.

In the course of making a workers’ compensation claim over the telephone, PB was played a recording of a privacy statement. This statement did provide a general authority for his healthcare providers to disclose relevant information from his medical history to WorkCover. PB’s employer subsequently requested a review of the decision to accept his claim. While the matter was being considered by Q-Comp, WorkCover issued a letter to ‘Dr B’ requesting information in relation to PB’s medical history. In compliance with this request, Dr B provided a complete copy of PB’s medical file to WorkCover.

Q-Comp subsequently set aside the decision to accept PB workers’ compensation claim and returned it to WorkCover with a direction that WorkCover obtain further medical records. WorkCover subsequently wrote to ‘Dr W’ using a letter in identical terms to the letter issued to Dr B. Dr W also provided a complete copy of PB’s medical file to WorkCover. PB became aware of the letters sent to his doctors and made a complaint to WorkCover. WorkCover advised that the letters were sent in error and related to Common Law claims, not Statutory matters. WorkCover undertook to destroy this information, but did not go on to do so.

QCAT found that the letters issued to Dr W and Dr B were inaccurate; the legislative authority for requesting the information did not apply in this circumstance and also PB had not provided authority for WorkCover to obtain information about his medical history. QCAT accepted that PB suffered injury to his feelings and experienced humiliation as a result of irrelevant information having been obtained by WorkCover.  QCAT was not prepared to order WorkCover to reimburse PB for his expenses as the manner in which the proceeding had been run before the Tribunal largely stemmed from the extravagant and exorbitant compensation claim made by PB.

$5,000

If the agency has any of the original medical records obtained from Dr W and Dr B that they return them to the respective practices.

$15,000

PB subsequently appealed QCAT’s award of damages in the Court of Appeal¹² who substituted the higher award.

Whilst employed by the Queensland Police Service (QPS), RM made a WorkCover claim. WorkCover notified QPS of the claim and requested an employer’s response, including statements ‘from those involved as you see fit’.

QPS subsequently sent an email to ten QPS employees, which contained RM’s name, RM’s WorkCover claim number, the name of the claimed injury and the causes or factors of the claimed injury.

QPS contended that contacting RM’s nominated witnesses was for complying with the statutory requirement to obtain and the provide information to WorkCover and so was ‘authorised or required under law’.

QCAT found that it was difficult to reconcile this stated intention with the email as it did not seek any information of the recipient but rather, expressly informed that them that they were not required to ‘do anything at this stage’.

$5,000

$4,400 for expenses reasonably incurred

The complainant requested that Comcare investigate whether or not her employment with Defence had caused or contributed to her cancer. Comcare subsequently produced an investigation report, which contained the complainant’s health information.

The complainant requested a copy of this report under the Commonwealth’s Freedom of Information Act 1982. A redacted version of the report was provided to the complainant, and a copy of the redacted report was later published on Comcare’s website through its disclosure log. The redacted report included the complainant’s name, postal address, date of birth, employee number and health information.

The complainant provided a number of documents in support of her claim for non-economic loss, including reports from her treating psychiatrist and psychologist, which the Privacy Commissioner considered along with the complainant’s own accounts of her distress as a result of the breach.

$20,000

Under review: Administrative Appeals Tribunal

The complainant is a former employee of a Commonwealth Bank Mortgage Innovation Agency (MIA). She is also a customer of the Commonwealth Bank of Australia (CBA).

The complainant had brought proceedings against the MIA before the Fair Work Commission (FWC). She alleged that during the FWC proceedings, the principal of the MIA accessed her customer profile through the CBA’s customer management software ‘CommSee’ for the purpose of assisting the principal to advance his defence in those proceedings.

The OAIC was not satisfied that the CBA demonstrated that on the balance of probabilities, all of the principal’s accesses to the complainant’s CommSee profile were for the primary purpose of managing a customer’s banking business.

OAIC also found that given the size of the organisation, and the sensitivity of the information stored on CommSee, that at a minimum, CBA should have processes in place to restrict a user’s access to a CommSee profile immediately when it becomes aware of a potential conflict of interests between the customer and the user.

$10,000

AMP Life Ltd (AMP) provided income protection insurance to the complainant’s wife, who had made a complaint to the Financial Ombudsman Service (FOS) regarding AMP’s administration of a claim she had made.

During the course of the FOS investigation, the complainant became aware that AMP had obtained copies of his income tax returns from a third party without notifying him of this collection, and then disclosed this information to FOS without his consent.

In deciding the appropriate amount of compensation to award in this matter, weight was placed on the sensitive nature of the personal information, that AMP had given assurances to the complainant’s wife that it would not pursue the collection of that information without providing that notice, the responsibility of AMP to have a sound understanding of privacy obligations given the nature of personal information it collects and uses on a daily basis and its position as a leading insurance and financial institution.

The complainant was a patient of the respondent, and had contacted his local police station to report harassment and damage to his property as part of an ongoing neighbourhood dispute. The police contacted the respondent and asked whether in her opinion the complainant was ‘psychotic’ and was advised that ‘it was possible but further assessment was needed’. The complainant alleged that the information should not have been disclosed, that it was inaccurate and that reasonable steps were not taken to protect his health information.

Weight was given to the sensitive nature of the disclosed information and the doctor’s responsibility to have a sound understanding of privacy obligations.  Weight was also placed on the information being disclosed to a police officer who would have been subject to confidentiality obligations, and that the information disclosed was clarified by the respondent in subsequent correspondence with the police.

The complainant was employed as a marine conservation research assistant, and committed an offence by fishing in a prohibited ‘Green Zone’. The respondent received a request for information from News Corp Australia in relation to the incident, and provided a response which included information about the complainant’s name, employment, the incident and status of the investigation. A story about the incident was subsequently published.

The complainant also sought economic loss for lost income, lost future income and loss of future career opportunities, however the fact that the complainant would not have suffered economic loss but for his own conduct (ie by fishing unlawfully in a marine conservation zone) was given significant weight in determining the amount of compensation.

The complainant worked as a judge in the family law jurisdiction.  He contacted Telstra to have a phone line connected to his home, as part of an alarm system that was being installed to address the security implications of his work.  The complainant stated that he advised Telstra that the phone line would not be used for any other purpose.

In the processing of setting up the phone line, Telstra failed to take reasonable steps to provide notice to the complainant that it would publish his name, address and the number of the phone line in both the White Pages online and hard copy directory.

In awarding compensation, the Privacy Commissioner was guided by the impact of the privacy breach on the complainant. ‘Telstra’s breach has had serious consequences for the complainant. The complainant has as a result of the breach suffered significant anxiety and distress including I believe a well-founded fear for his physical safety and that of his partner. The complainant has explained that Telstra’s breach has made it implausible for him to continue to reside at his current home. This is supported by the complainant’s application for an interstate transfer with his job, which I am satisfied, is a direct consequence of the actions of Telstra.’

The complainant was employed by the Department of Defence (Defence) and had lodged a workers’ compensation claim.

A copy of the complainant’s medical report, which had been prepared by an independent medical practitioner, was disclosed to the complainant’s treating general practitioner, after the complainant had been asked for, and expressly refused, permission for his rehabilitation case officer or Defence to contact his treating medical practitioners about his rehabilitation.

The Privacy Commissioner accepted the complainant’s claim that the disclosure of his personal information to his treating GP exacerbated his anxiety and depression, particularly in light of the supporting information provided by his treating psychologist.

However, the Privacy Commissioner stated that from the information provided by both the complainant and his treating psychologist that ‘it is evident that a proportion of the emotional suffering experienced by the complainant was not caused by Defence’s disclosure of his personal information to his treating GP.  A number of workplace incidents impacted on the complainant and contributed to his mood disorder and heightened anxiety and stress.’

It was also noted that the disclosure was limited to providing the complainant’s personal information to his treating doctor, who has obligations to safeguard the privacy and confidentiality of patient medical information and that there was no information to suggest that the complainant’s personal information was disclosed more broadly.

The complainant was travelling on a return flight to Melbourne when an AeroCare Pty Ltd (AeroCare) staff member asked him a series of questions about his medical condition.  The questions were asked in the presence of the complainant’s Sighted Guide, who did not know the details of his medical condition, and a number of other passengers in the departure lounge.

The Privacy Commissioner considered the complainant’s vulnerability as a person with a disability, the highly sensitive nature of the medical information that was collected and disclosed, and the responsibility of AeroCare, as an organisation, to have a sound understanding of its privacy obligations, were factors to consider in deciding the amount of damages to award.

Wentworthville Leagues Club received a letter from the complainant’s ex-partner which attached a copy of a subpoena directing the Club to provide certain documents to the Federal Magistrates Court.

Instead of providing the documents to the Court, the Club presented the documents, which contained the complainant’s membership details and gaming information, directly to the complainant’s ex-partner, who further disclosed the information to the complainant’s family, friends, previous neighbours, parents of children's friends and work colleagues.

The complainant provided medical certificates, a report from a social worker; a psychologist’s report; the complainant’s own statement and statutory declarations from family members in support of the claim for injury to feelings and humiliation.  The Privacy Commissioner accepted the medical evidence provided by the complainant, but did not consider the report from the social worker to add evidence beyond the complainant’s statement because it merely describes the complainant’s version of events. Also, the statements from family were not considered to add any weight to the complainant’s claims given the other medical evidence.

An incident at the Mid Western Rugby Squash Club, in Mr Deeming’s view, raised issues about the adherence of the club to the provisions of the then Sale of Liquor Act 1989 administered by the Whangarei District Council (Council). Mr Deeming alleges he sought an investigation by Council into the incident and in so doing relied on a policy by which Council protected the identity of complainants.

Mr Deeming’s case is that his complaint was disclosed to Councillor Shelley Deeming (the wife of a cousin of Mr Deeming). She, in turn, disclosed the complaint to the President of the Mid Western Rugby Club.  As a result Mr Deeming was harassed at his home and other places and received a life-time ban from the club. Media reports led to hurt and humiliation not only to Mr Deeming but also to his family.

Mr Crampton was a member of the Executive Committee of the Massey University Extramural Students’ Society (EXMASS) and also a journalist by occupation. Some of the members of the Executive Committee (including Mr Crampton) sent to the then President of EXMASS (who had held office for only 10 weeks) a “written warning” alleging she was not meeting certain performance standards. The letter included information about the President of a personal and sensitive nature.

A short time later, Mr Crampton provided a copy of the warning letter to a reporter for Massey University’s student magazine. The President had not given consent to the disclosure.  The student magazine published an article in print and online in which reference was made to the warning letter and an excerpt from it was quoted.

The complaint stated that after the letter was published she suffered from stress and anxiety, had trouble sleeping and sought medical advice.

Orcon Limited (Orcon) is a telecommunications company which provides broadband and telephone services.  Claiming Mr Taylor owed money, Orcon instructed the debt collection agency, Baycorp, to recover the alleged debt.  This had an immediate effect on Mr Taylor’s credit rating.  Specifically, it became almost impossible to find rental accommodation for his family.

The complaint claims Orcon had earlier advised that all amounts owed by him had been waived and as no debt existed, that Orcon provided Baycorp with inaccurate personal information.

Mr Feather was a recipient of an indexed ‘pension’ as a result of a work accident. By an administrative error a friend of the Feather family was provided with details of Mr Feather’s pension including his annual income. The friend provided the information to Mrs Feather who was distressed at the disparity between Mr Feather’s earnings and the money he had allocated to their household during their marriage. This information ‘cast a long shadow over the marriage’ almost bringing it to a close despite its then nearly 50-year length.

The case is notable because the agency that mistakenly released Mr Feather’s information to the family’s friend, acknowledged its error and took active steps to minimise further distress to the Feathers, including issuing a genuine and sincere apology.

The agency’s contrition was favourably noted by the Tribunal and was a significant factor in Mr Feather being awarded a significantly lesser sum than he had sought. The Tribunal stated:

“We wish to make it clear that our award would have been higher but for the way in which the ACC has dealt with the matter and conducted its case in the Tribunal. Had the ACC adopted an uncompromising stance the case would have occupied very much more time, and it would inevitably have been a very great deal more stressful for Mr Feather. The ACC is entitled to appropriate recognition for the responsible way in which it has responded to the situation created by the disclosure of information about Mr Feather’s income.”