Hundreds of email addresses shared by Victorian Victims of Crime Assistance Tribunal email error
October 1, 2024 |
The ABC reports in Hundreds of email addresses shared in Victims of Crime Assistance Tribunal administrative error that there was an accidental share of email addresses of victims of crime in an email advising of changes to the compensation application process. It appears that the email was a sent to multiple addressees, 480 the ABC has seen, however the addressees were not blind copied so the recipient could read the email address of other recipients. The addresses included first and last names. VOCAT sent 2 recall emails, which means very little.
The damage is done. Given the addressees are victims of crime, some of which may involve stalking, the presumed damage would be greater than might otherwise be the case. Damages in privacy cases have not been significant in Australian cases. That is primarily because there have been relatively few reported cases where damages have been considered. In the United Kingdom the courts also took a restrained approach to damages however with increased litigation and the bench’s greater understanding of how privacy breaches can impact a person the awards have risen. And egregious privacy breaches have increased the ceiling over time. In Victoria a complaint can be made under the Privacy and Data Protection Act 2014 with VCAT hearing a complaint. Under Section 77(1)(a)(iv) it has jurisdiction to award damages of up to $100,000. There has been only one instance where an award of damages has been made, Zeqaj v Victoria Police (Human Rights) [2018] VCAT 1733. In that case the breach was proved and an award in the sum of $1,000 was made. That is derisory. The analysis was also very disappointing. The jurisprudence in VCAT should not make a complainant optimistic. It is very difficult to succeed, hence the award provision in the Act is virtually dead letter. The analysis by VCAT is very disappointing and not consistent with privacy litigation in the UK or the USA, let alone Europe. The Office of the Victorian Information Commissioner has a page titled Assessing compensation claims for loss in privacy complaints where it provides an overview of the law. It is fairly basic and not particularly sophisticated given the development of privacy in common law jurisdictions. It is useful given all complaints must proceed through the Victorian Information Commissioner. Many complaints are mediated and resolved there. Better that than taking one’s chances in VCAT.
This type of error is all too common and especially prevalent in the public service. It is entirely preventable. Proper training and refresher training would minimise this occurring.
The article provides:
In short:
The Victims of Crime Assistance Tribunal has accidentally shared hundreds of email addresses, some believed to belong to victims of crime, within an administrative email chain.
Lawyers have condemned the “serious” privacy breach, saying the incident would add to the trauma experienced by vulnerable people, including victims of attempted murder and family violence.
What’s next?
A Court Services Victoria spokesperson apologised for the error and said offers of support were being made to all involved.
Hundreds of email addresses, some understood to belong to victims of crime, have been “unintentionally” shared in a Victorian courts administrative blunder, leaving at least one victim “very frightened” about the fallout.
The Victims of Crime Assistance Tribunal (VOCAT) sent an email on Thursday afternoon detailing administrative changes to the compensation application process for Victorian victims of crime — but hundreds of email addresses were able to be seen by all recipients.
The ABC counted at least 480 email addresses, many which included first and last names.
VOCAT sent two “recall” emails in the hours afterwards, which were also sighted by the ABC.
“This email was sent in error, and we apologise,” one email said.
“We are working to recall and contain the message. Please disregard and delete the previous email.”
A Court Services Victoria spokesperson confirmed the email addresses belonged to people who had previously contacted the tribunal, and were unintentionally shared.
Privacy breach would add to trauma, lawyer says
Rachel Storey, a solicitor based in Melbourne’s east, said a handful of her clients were sent the email and had their addresses shared, with one client informing her of the privacy breach last week.
She said this client was a young and “vulnerable” person, who had since received unsolicited legal advice and graphic footage from another person on the email chain.
“He’s very frightened, he doesn’t know what to do,” she said.
“I’ve been telling my clients to change their email addresses very quickly.
Ms Storey said applicants for victims of crime compensation were some of the most vulnerable people in contact with the legal system, and the group included victims of attempted murder and family violence.
While she said the privacy breach appeared to be an administrative error, she said it would cause additional trauma to applicants.
“They don’t need this — they should know that when you apply to a court, your details are going to be safe,” she said.
“We don’t know all of the situations that these people have been in or have experienced, so to add to that trauma is just horrific.”
Tribunal intended to support victims of crime
Jeremy King, principal lawyer for Robinson Gill, said it was a serious privacy breach.
“There are a variety of different victims who have made applications to the tribunal, some who have very, very sensitive applications,” he said.
Mr King said the tribunal was set up to make the lives of victims of crime easier, often providing financial compensation or mental health support such as counselling to affected people.
“You’ve got a tribunal that’s supposed to help people, and unfortunately, in this situation, they’ve potentially done something that’s probably distressed a number of people.”
Ms Storey has called on VOCAT to introduce additional financial compensation for those who have had their details disclosed.
VOCAT ‘unreservedly apologises’ for the error
A Court Services Victoria spokesperson said the email was “a general update about changes to procedure and did not contain any sensitive information”.
“The email was recalled, but some emails were opened,” they said.
The spokesperson said VOCAT has contacted everyone impacted, “unreservedly” apologised for the error and was looking at measures to ensure it did not happen again.
“VOCAT is mindful of the distress the unauthorised sharing of email addresses can cause and offers of support are being made to all involved.”
