Peter A Clarke

It is hard to be more disappointed with the Privacy Commissioner given the consistently inadequate determinations and tepid regulation.  But the Acting Commissioner has managed to show that with time and effort even more dreadful decisions are possible in privacy regulation in Australia.  That is amply displayed in the Commissioner’s response to the Centrelink release of personal information about a Ms Fox who wrote an article critical of Centrelink’s automated debt recovery system as it was used upon her.

The Commissioner’s “concluding statement” states:

On 28 February 2017, the former Australian Information Commissioner and Privacy Commissioner announced he had commenced inquiries with the Department of Human Services in response to media reports that Centrelink had released personal information into the public domain.

The Department submitted the disclosure was authorised by Australian Privacy Principle (APP) 6.2(a)(ii), which provides that if an APP entity holds personal information for a primary purpose, it may use or disclose it for a secondary purpose if the individual would reasonably expect it to do so, and the secondary purpose is related to the primary purpose.

Having carefully considered the specific public statements made by the Centrelink customer, and the specific information disclosed in response, the acting Australian Information Commissioner and acting Privacy Commissioner reached the conclusion that, in this instance, the disclosure was permitted by APP 6.2(a)(ii). The acting Commissioner had regard to the matters outlined in the case note L v Commonwealth Agency [2010] PrivCmrA 14 (24 December 2010) and in the Australian Privacy Principles Guidelines.

The ABC  sets out the concerns aptly in Privacy decision sets worrying precedent for what the Government can reveal about us which provides:

Legal experts are warning a recent decision by the Privacy Commissioner sets a worrying precedent allowing the Government to reveal people’s private information without their consent.

This week the acting Privacy and Information Commissioner, Angelene Falk, determined that the Department of Human Services was justified in releasing the personal information of blogger Andie Fox to the media last year.

In February 2017, Ms Fox wrote an opinion piece for Fairfax critical of Centrelink’s automated debt-recovery system, commonly known as “robo-debt”.

Fairfax journalist Paul Malone subsequently wrote a follow-up article about Ms Fox which included details about her financial and personal affairs based on information provided by the Department of Human Services.

The disclosures resulted in a complaint to the office of the Australian Information Commissioner, which ruled on Tuesday that the Government’s actions were justified.

‘It raises really massive alarm bells’

But Anna Johnston, director of privacy consultancy Salinger Privacy and a former NSW deputy privacy commissioner, believes the commissioner’s decision sets a terrible precedent.

“I think we should be extremely worried.

“The Attorney-General should look urgently into reforming the Privacy Act and tightening up that disclosure rule,” Ms Johnston said.

“If this is the way it’s being interpreted, then I think that is a massive problem.”

The commissioner’s decision rests on section 6.2 of the Australian Privacy Principles which allows a government department to reveal personal information if the disclosure is directly related to the purpose for which it was collected, and within the reasonable expectations of the individual.

Anna Johnston says it is hard to see how releasing Ms Fox’s information fits this principle.

“It raises really massive alarm bells,” she said.

“I find it extremely surprising that that is considered a related purpose to the administration of the welfare scheme.”

Ms Johnston says it is especially hard to see how the requirements for disclosure could apply to Andie Fox’s former partner, whose details were also revealed to Fairfax.

“A third party got dragged through the mud here as well, and the Privacy Commissioner’s press release made no reference to the privacy of the third party,” she said.

Calls to change Privacy Act

The case involving Ms Fox is not the first time the Government has released personal information about an individual to a journalist.

A 2011 decision by the Commissioner regarding a similar case also concluded the department had acted appropriately because the information was released to correct the public record.

Last year Human Services Minister Alan Tudge claimed the department was entitled to release Ms Fox’s information for the same reason, but Anna Johnston argues the information released by Centrelink did not achieve that objective.

“In Andie Fox’s case, most of the things she said in her blog were subjective opinions — how she felt [she was] treated, the disadvantage she felt … none of which was disproved by the information released about her,” Ms Johnston said.

Ms Johnston said the suggestion the Government can reveal information about a person simply because they have said something negative about a government agency points to a broader need to reform the Privacy Act.

She said the possibility that information could be revealed in this way would stifle free speech and public debate.

“People might think twice before they talk even about their subjective experiences at the hands of a government department.

“The Federal Government is pushing ahead with a lot of very ambitious data-related projects, including shared electronic health records, which will be allocated to every Australian in November this year unless they opt out.

“This is a massive shift in the way in which our most sensitive information is handled by the Government.”

Dr Darren O’Donovan from La Trobe University’s law school agrees the decision sets a worrying precedent and the law needs to be changed to clarify how and when the Government can release personal information to third parties.

“Absolutely the law needs to be changed,” Dr O’Donovan said.

“Even if politicians do nothing, the senior leaders of the Australian Public Service need to talk about what they’re going to do to address this.”

Dr O’Donovan believes the decision reveals the Privacy Commissioner is out of touch with public expectations around how their information can be disclosed.

“There’s a huge amount of public concern about this — in the Privacy Commissioner’s own survey, 86 per cent of Australians oppose secondary uses of their data,” he said.

“It’s remarkable that the law here is meant to voice community expectations and yet it doesn’t.”

Dr O’Donovan says both the Privacy Commissioner and the department secretary need to “rebuild public confidence” and introduce a code of conduct regarding disclosures.

Limited recourse for appeal

Legal experts say Ms Fox may find it difficult to appeal the decision because of the way the determination was made by the Privacy and Information Commissioner.

The commissioner could have chosen to assess the complaint under section 52 of the Privacy Act, which would have allowed Ms Fox to appeal the decision through the Administrative Appeals Tribunal.

But because a formal determination was not made, Ms Fox can only challenge the decision through the Federal Court or Federal Circuit court and would have to do so on the basis that the commissioner made an error of law, a case Anna Johnston says would be difficult to make.

“That is a very expensive and a very difficult argument to make,” she said.

“Andie Fox is basically not left with anywhere to turn…

“We need to be looking to the Attorney-General to fix this mess and tighten up the legislation, rather than expect an unrepresented single mother to try and fix this situation on behalf of all Australians who are affected by this decision.”

The ABC did reach out to Ms Fox but she did not return our request for comment