This information is general in nature. It does not constitute legal advice and should not be relied upon as such.
When a privacy complaint is accepted by the Office of the Information Commissioner (OIC) for mediation, we will ask the parties to provide written settlement offers. This information is designed to assist a complainant to write a settlement offer for the privacy complaint.
Queensland privacy complaint jurisdiction
It is helpful to understand the limits of Queensland’s privacy complaint jurisdiction under the Information Privacy Act 2009 (Qld) (IP Act) when preparing your settlement proposal.
OIC’s sole focus when dealing with a privacy complaint is to help the parties to come to an agreed resolution. The main way that we do this is by exchanging written settlement offers between each party. OIC asks each party to consider resolving the privacy complaint based on the other party’s proposal or to put forward an alternative offer for the other party to consider. This may occur several times over the course of the mediation process.
If the privacy complaint cannot be resolved through this process, OIC will close the mediation and then the complainant can ask OIC to refer the privacy complaint to the Queensland Civil and Administrative Tribunal (QCAT). QCAT can hear and decide privacy complaints. QCAT listens to the parties’ arguments and evidence. QCAT decides whether the complainant has proven that the respondent has not followed the IP Act, resulting in damages. If QCAT decides that the privacy complaint (or part) has been proven by the complainant, and as appropriate, QCAT may make orders to remedy the breach. QCAT orders could include, for example:
- that the respondent must not repeat or continue the relevant act or practice,
- that the respondent must apologise to the complainant, and/or
- that the respondent pay compensation to the complainant—to a maximum of $100,000—to compensate for loss or damage suffered because of a substantiated privacy breach, including injury to the complainant’s feelings or for humiliation suffered by the complainant.
The advantages of mediation
Mediation is a cooperative process designed to allow both parties to have input into and agree to an outcome. Mediation is often quicker, less formal and may assist in restoring or maintaining a relationship that could otherwise be damaged or worsened through a litigation process.
While QCAT is a less formal environment than traditional courts, it is still an adversarial legal process. This means the parties make arguments (in person and/or in writing) for QCAT to weigh and consider. Then, QCAT makes a decision that one party is successful or ‘wins’ the case. A QCAT hearing is generally open to the public and the tribunal’s decision is published.
On the other hand, OIC does not publish identifying information about privacy complaints, and OIC cannot be compelled to produce a privacy document or disclose privacy complaint information in third-party legal proceedings (IP Act, section 153). These limitations support privacy complaint parties to be frank and candid in the mediation.
Coming up with a resolution for the privacy complaint
Settlement of the privacy complaint is designed to repair the damage the complainant has suffered from the alleged privacy breach—to put the complainant back in the position they were in before the alleged breach occurred. It may involve financial and non-financial terms, focused on restoring the relationship between the complainant and the respondent.
While QCAT is limited under the IP Act in the orders it can make, mediation allows the parties to propose and consider a wider range of settlement options. However, it is important to remember that a privacy complaint is not a pathway to review other administrative decisions, nor is it intended to be used to penalise an agency or an individual officer for their conduct or actions.
Every privacy complaint is different, and appropriate settlement terms will be negotiated on a case-by-case basis, taking into account the individual factors of the privacy complaint.
Examples of non-financial settlement options:
- Having the opportunity to communicate to the respondent how the disclosure of personal information has affected the complainant.
- Asking the respondent for an apology for the act or practice.
- Asking the respondent to recognise the impact that it has had on the complainant.
- Asking the respondent to agree that it will stop the particular practice that is the subject of the privacy complaint.
- Asking the respondent to agree to take certain steps to prevent a similar incident occurring in the future (for example, through a change in agency processes or the provision of privacy training to staff).
- Asking the respondent to amend inaccurate, incomplete, or out of date personal information it holds about the complainant.
Examples of financial settlement options
Some damages have a defined ‘dollar amount’ and can be proven from records such as receipts (for example, medical or counselling expenses).
An amount of compensation can also be claimed for injuries to feelings or humiliation, but assigning a ‘dollar amount’ may be more difficult in these cases.
Since the commencement of the IP Act in Queensland in 2009, there have only been four cases where QCAT has awarded financial compensation (set out in the table below).
QCAT has also explained that the following principles apply when assessing compensation:
- where a privacy complaint is substantiated and a loss or damage is suffered (as a result of the substantiated privacy complaint), the legislation contemplates some form of redress in the ordinary course;
- awards should be restrained but not minimal;
- in measuring compensation, the principles applied in tort law will assist, although the ultimate guide is the words of the statute
- in an appropriate case, aggravated damages may be awarded; and
- compensation should be assessed having regard to the complainant’s reaction and not to the perceived reaction of the majority of the community or of a reasonable person in similar circumstances.
These principles are found in JL v Queensland Police Service [2014] QCAT 623 at [213] to [214].
Determinations on privacy complaints in QCAT
These cases are for general guidance only and should not be relied upon as necessarily being directly applicable in every case.
| Case name | Summary of case | QCAT orders |
|---|---|---|
| AA v State of Queensland (Office of Industrial Relations) [2021] QCAT 258 | The complainant (AA) was on leave from their employment with the Office of Industrial Relations (OIR). During this time, they were receiving income protection benefit payments from their superannuation fund, QSuper Limited (QSuper). AA had not authorised either OIR or QSuper to exchange their personal information. QCAT was satisfied that there had been four separate incidents which breached Information Privacy Principle (IPP) 11—when OIR staff made several telephone calls to QSuper and disclosed work-associated information about AA to QSuper. QCAT accepted AA had suffered hurt and humiliation because of the breaches but did not accept that OIR had acted with malice, or that there was sufficient evidence to attribute AA’s ill-health to the breaches. QCAT awarded $5,000 per breach for the four separate breaches—a total award of $20,000. |
|
CH v Queensland Police Service [2019] QCAT 297
| The complainant (CH) was arrested by the Queensland Police Service (QPS). He was an Australian Defence Force (ADF) Reservist, however, he was not on active duty or in uniform at the time of the arrest. The officer in charge of the watch-house notified the ADF of the arrest which resulted in further contact the next day. QCAT found that part of the privacy complaint was substantiated—that QPS breached IPP 11 on one occasion. QCAT ordered QPS to apologise to the complainant, and pay the complainant $17,806.75 in compensation. On appeal, QPS was also ordered to pay costs of the original proceedings and the appeal filing fee. |
|
The complainant (PB) made a workers’ compensation claim to WorkCover Queensland (WorkCover). WorkCover requested information from two doctors (Dr W and Dr B), and full medical histories were provided by each of the doctors (rather than information only about the relevant injury). This information was then provided to Q-Comp for external review of WorkCover’s decisions on the compensation claim. Following a privacy complaint from PB, WorkCover undertook to destroy this information, but did not go on to do so. QCAT substantiated part of the privacy complaint—that WorkCover breached IPPs 1, 2, 3, 4 and 11. QCAT accepted that PB had suffered injury to his feelings and experienced humiliation as a result of irrelevant personal information having been obtained by WorkCover, noting that some of the irrelevant information was particularly sensitive. However, QCAT found the breaches were careless rather than malicious. $5000 compensation was awarded by QCAT, and WorkCover was ordered to return any original records to the respective doctor. On appeal, the compensation amount was increased to $15,000. |
| |
| RM v Queensland Police Service [2017] QCAT 071 | While the complainant (RM) was an employee of QPS, they made a compensation claim to WorkCover. WorkCover notified QPS of the claim and requested an employer’s response, including statements ‘from those involved as you see fit’. QPS emailed ten QPS employees about the claim, setting out RM’s personal information—RM’s name, WorkCover claim number, the name of the claimed injury and the causes or factors of the claimed injury. The email advised recipients, ‘You do not need to do anything at this stage.’ QCAT substantiated part of the privacy complaint—that QPS breached IPP 10 by sending the email, and ordered that QPS must not repeat this act. QCAT also ordered that QPS provide a written apology to the complainant and pay $5,000 compensation for the injury to RM’s feelings and humiliation, noting the secondary use was careless rather than malicious. QCAT also ordered QPS pay $4,400 for RM’s legal costs. |
|
| JL v Queensland Police Service [2014] QCAT 623 | The complainant (JL) was a serving police officer. She was in a car accident while off duty and charged with driving under the influence. JL’s medical records were seized by QPS under warrants for use in the criminal proceedings. The criminal proceedings were dismissed. QPS commenced disciplinary action against JL and an internal process to determine whether she was a fit and proper person to be a police officer. The medical records seized in the criminal proceedings were used in both the disciplinary action and the determination of her fitness to perform duties as a police officer. QCAT found that the collection of the medical records was lawful and fair, but the secondary use for the internal disciplinary and fitness process was an unauthorised secondary use—contravening IPP 10. QCAT ordered that original medical records of JL in QPS’s possession must be returned to the place from which they were seized under the warrant. QCAT ordered the use of JL’s medical records in disciplinary proceedings and fitness assessment should not be repeated unless the use is otherwise authorised by law. QCAT also found that any distress experienced by JL was as a result of the lawful and fair collection by QPS, rather than the unauthorised secondary use. As a result, no financial compensation was awarded. QCAT set out the principles applicable to compensation awards under s 178(a)(v) of the IP Act at [213]:
|
|