In‘D’ and Wentworthville Leagues Club the Privacy Commissioner made a determination that there was a breach of the complainant’s privacy under section 52 of the Privacy Act 1988 (the “Act”).

FACTS

In October 2008, the complainant lodged a complaint with the Office of the Privacy Commissioner against the Club under s 36 of the Act alleging that:

• having been a member of the Club since 1997, on 28 September 2007, the Club disclosed the complainant’s full membership details, and player activity statements about their use of the Club’s gaming machines, for the periods July–August 2002 and January–June 2003. This information was provided to the complainant’s ex-partner
• the complainant learned of the disclosure in late July 2008
• the Club gave the personal information to the complainant’s ex-partner in breach of the Act.

The complainant sought, [4], a declaration in the sum of $19,483.90 in compensation for economic loss and an unspecified amount for non-economic loss, as well as punitive damages.  The Club admitted, at [5], it disclosed the complainant’s personal information in breach of the Act but submitted that any damages awarded for non-economic loss should be minimal, that  the complainant provided insufficient evidence of economic loss and there was no scope for awarding punitive damages under the Act.

The process taken in investigating the complaint is set out at [12] providing:

• On 28 October 2008, the Assistant Privacy Commissioner opened an investigation into the allegations pursuant to s 40(1) of the Privacy Act.
• Written information and evidence supplied by both the Club and the complainant was considered.
• The Club and the complainant were provided with the opportunity to respond to the OAIC’s preliminary view on the complaint dated 15 January 2009, which found that the Club had complied with NPP 2.1(g).
• In response to the OAIC’s preliminary view, additional written information and evidence was supplied by both parties.
• Based on this additional information and evidence the OAIC reviewed the preliminary view and moved to conciliation.
• The parties were unable to achieve a mutually agreeable outcome through conciliation and I decided to move to a determination.
• Both parties were provided with the opportunity to provide written and oral submissions pursuant to s 43(5) of the Privacy Act.
• A hearing was held on 20 October 2011 for both parties to make oral submissions.

THE DECISION

The Commissioner undertook an analysis of the operation of the NPP under the Act. The NPPs contained in schedule 3 of the Privacy Act outline standards for ‘organisations’ handling personal information. The relevant NPP was 2.1, see [9].

THe Commissioner made the following findings:

1. The Club is an ‘organisation’ for the purposes of the Privacy Act  and therefore obliged to comply with the NPPs [14];
2. The Club received a letter from the complainant’s ex-partner dated 17 August 2007, which attached a copy of a subpoena issued by the Federal Magistrates Court in family law proceedings involving the complainant and their ex-partner. The subpoena directed to ‘The Proper Officer – Gaming Section, Wentworthville Leagues Club’ was dated 10 November 2005 and required the Club to provide to the Court by 28 November 2005  “All gambling records, or records of transactions linked to any gambling cards related to or held in the name of [complainant’s name, address and date of birth] or the [complainant’s company].” [15];
3. In September 2007 a manager at the Club provided computer printouts of information about the complainant. Those documents were a printout of the complainant’s full membership details,  bonus point activity statements for the periods July–August 2002 and January–June 2003, the complainant’s total turnover and winnings and the complainant’s then balance with the Club [17];
4. The Club did not present the documents to the Court but rather directly to the complainant’s ex-partner and the subpoena required the Club to provide these documents to the Court by 28 November 2005 [18]. Notwithstanding acknowledging that the disclosure was an interference with the complainant’s privacy the Club initially argued it made the disclosure in ‘good faith’ in seeking to comply with a Court subpoena;

At [20] the Commissioner was satisfied that the disclosure was not authorised under law as the disclosure was not in accordance with the requirements of the subpoena. As such the disclosure was an interference with the complainant’s privacy.

In exercising his  discretion under s 52(1)(b)(iii) and 52(1A) of the  Act to award compensation for ‘any loss or damage suffered by reason of’ the interference with privacy the Commissioner had regard, at [21] – [22], to the principles set out by the Administrative Appeals Tribunal  in Rummery and Federal Privacy Commissioner:

(a) where a complaint is substantiated and loss or damage is suffered, the legislation contemplates some form of redress in the ordinary course

(b) awards should be restrained but not minimal

(c) in measuring compensation the principles of damages applied in tort law will assist, although the ultimate guide is the words of the statute

(d) in an appropriate case, aggravated damages may be awarded

(e) compensation should be assessed having regard to the complainant’s reaction and not to the perceived reaction of the majority of the community or of a reasonable person in similar circumstances.

and at [23]

… not go so far as deciding that we must award compensation once a loss is established. However, we are of the view that once loss is proved, there would need to be good reason shown to the Tribunal as to why compensation for that loss should not be awarded

Non Economic Loss

The complainant claims, at [25] – [27] that the disclosure of personal information caused psychological and physical harm because the complainant’s ex-partner showed the complainant’s personal information to a range of people including their friends, family, previous neighbours, parents of children’s friends and work colleagues. The complainant provided medical certificates, a report from a social worker,  a psychologist’s report and statutory declarations from family members in support of the claim for non-economic loss, [27].

At [29], the Commissioner found the medical certificate showed the complainant suffered from anxiety, panic attacks and physical symptoms after they became aware of the disclosure of their personal information. After considering the medical evidence the Commissioner, at [34], accepted the medical evidence but not the social worker’s report and found that the statements from family did not add any weight. As a consequence he reached the conclusion that the disclosure of the complainant’s gambling records caused non-economic loss to the complainant but that a proportion of the medical symptoms were not caused by the disclosure because of the complainant’s dispute with the ex-partner over property settlement, child support and child custody and pre existing issues [35] – [37] .

The Commissioner found the complainant was entitled to $7500 in non-economic loss [41].

Economic loss

In the claim for economic loss an element claimed, at [45], was that the complainant’s employer completed an annual review of the complainant’s contract in January 2009, around six months after the complainant became aware of the disclosure and the employer reduced the complainant’s share of company profits in the review. The complainant claimed this was due to the Club’s breach of privacy. The Commissioner did not give strong weight to the employer’s letter stating that the ‘privacy dispute had a detrimental effect’ on the complainant’s performance given it was written more than two and half years after the review and the author admits he was ‘unaware of the nature of the dispute’ [46]. The Commissioner was not satisfied that the complainant suffered economic loss by reason of the interference with their privacy, [49] .

The Commissioner found that under Section 52(1)(iii) a declaration that a person is entitled to ‘compensation’ for any loss or damages suffered as a result of the breach of the complainant’s privacy but punitive damages are not compensatory in nature, [50].   Aggravated damages are awardable under s 52 where the respondent behaved ‘high-handedly, maliciously, insultingly or oppressively in committing the act of discrimination, [51].  The Commissioner accepted the respondent’s evidence that its employee disclosed the gambling records to the ex-partner after obtaining a letter and an attached subpoena from the complainant.  He did not found that conduct is high-handed, malicious, insulting or oppressive [54].  At [56] the Commissioner did not  consider that it is appropriate to award the complainant aggravated damages.

Issues

The award of  $7500 awarded for non-economic loss is quite modest.  The Commissioner’s approach in rejecting an  award of aggravated damages may not be the approach taken by courts considering a similar fact situation.  Providing documents to a third party rather than complying with the terms of a subpoena is a matter that courts take very seriously and action which often attracts censure.  It may have been an administrative mistake but it is a very significant one and one that borders on recklessnes and high handed behaviour, particularly of a body which has resources to obtain legal advice.

What should be noted is that the  the ex-partner was not subject to any action. That person was, according to the determination, a prime mover in spreading the material obtained improperly.  As the law currently stands the Privacy Act does not apply to that person and there is no statutory cause of action available to the complainant.  Based on the disclosed facts it is difficult to see how the complainant could commence a breach of confidence action, relying upon the principles set out in Giller v Procopets, against the ex partner.

This appears to be the 9th determination ever made by the Commonwealth Privacy Commissioner.  The most recent previous determination was made on 19 April 2004.

The Sydney Morning Herald reported on the determination here, almost a month after the fact.

Many thanks to Warwick Rothnie for notification.