Privacy Case Note 01-2017 (Section 28)
Case note number: 01-17
Privacy principles: Information Privacy Principle 11
The complaint
The complainant made a (non-privacy) complaint via e-mail to a Queensland Government agency raising concerns about a private sector organisation’s delivery of a training course to the general public.
The e-mail was sent to a number of recipients, both in and out of government, including:
- the private sector organisation that was the subject of the complaint
- a political party
- a media organisation.
Approximately two weeks later, the complainant sent a further e-mail to the same recipients withdrawing his complaint and the agency closed its investigation of the matter.
However, under its duty of care as a regulator, the agency subsequently contacted the employer of the complainant to discuss the appropriate process for future complaints of this nature and the agency provided the employer with a copy of the complainant’s e-mails to it.
The alleged breach of the privacy principles
The complainant alleged that the agency breached the Information Privacy Act 2009 (Qld) (IP Act) by disclosing his e-mails to his employer – a complaint involving at least, Information Privacy Principle (IPP) 11 – Limits on disclosure.
Self-publishing exception
Section 28 of the IP Act provides the capacity for an agency to disregard some of the IPPs in situations where an individual has themselves published their personal information.
Section 28 states:
28 Noncompliance with particular IPPs
(1) An agency is not required to comply with a prescribed IPP in relation to an individual’s personal information if the information is related to or connected with personal information of the individual that has previously been published, or given for the purpose of publication, by the individual.
(2) In this section—
prescribed IPP means IPP 8, 9, 10 or 11.
Editor’s note—
IPP 8 (Checking of accuracy etc. of personal information before use by agency), 9 (Use of personal information only for relevant purpose),10 (Limits on use of personal information) or 11 (Limits on disclosure)
publish, for personal information, means to publish it to the public by way of television, newspaper, radio, the internet or other form of communication.
Notable features of section 28 include:
- the individual must have themselves published their personal information or have provided for the purposes of publication
- it applies not only to the personal information as was published by the individual but also to any personal information ‘related to or connected to’ the published personal information
- it applies to only the privacy principles governing use, secondary use and disclosure
- it applies to material provided for the purposes of publication, whether it is published or not; and
- the definition of publishing is very broad - it includes ‘other form of communication’.
The rationale behind section 28 is that if an individual themselves waives their privacy by ‘self-publishing’ they cannot then ‘re-assert’ privacy rights at a consequent time. If section 28 applies, an individual making a privacy complaint would be claiming that the agency failed to meet an obligation where no such obligation exists.
Our decision
We considered that the complainant’s emailing of their complaint to entities external to Queensland government - including most notably, a media outlet – constituted their publishing of their personal information to the public ‘by other form of communication’.
This meant that the agency would not have been required to comply with IPPs 8 – 11 in respect of personal information ‘connected to or related to’ the personal information contained in the complaint about the private sector organisation.
As such, we decided to not accept the privacy complaint on the basis that section 28 of the IP Act applies to the subject of the complaint. For this reason, we did not have to consider in any detail, the issue as to whether the agency would have otherwise breached IPP 11.
For further advice on which privacy principles are affected, and not affected, by section 28, please refer to our Information published by the individual guideline.
