The complainant made two complaints to the Privacy Commissioner regarding her allegations that her privacy had been breached.

Jurecek v Director Transport Safety Victoria [2015] VCAT 253 | Case summary | Zoe

VICVCAT

Jurecek v Director Transport Safety Victoria

[2015] VCAT 253

Victorian Civil and Administrative Tribunal|2015-02-20

View original source

General information, not legal advice.

At a glance

Source facts

Court

Victorian Civil and Administrative Tribunal

Decision date

2015-02-20

Source

Original judgment source is linked above.

Judgment (145 paragraphs)

[1]

These proceedings are brought by the complainant's pursuant to the Information Privacy Act 2000 Vic_._ (the Act). It was submitted by both parties at the outset that this legislation applied. I have accepted this submission notwithstanding the repeal of the Act subsequent to the issue of these proceedings and the consequent enactment of the Privacy and Data Protection Act 2014.
The complainant alleges that her privacy has been breached in contravention of the Act. She alleges that this occurred in the context of her employment by the respondent. She alleges that the breaches occurred in respect of information on her Facebook account and information on the Facebook 'wall' of a work colleague which was posted by the complainant.[1]
The respondent is the Director of Transport Safety Victoria (TSV). At the relevant time the complainant was an employee of the Secretary of the Department of Transport, but was seconded to assist the Office of the Director of Transport Safety.
The background events leading to the claims occurred at the complainant's place of employment. She had been experiencing ongoing difficulties. In summary, these involved allegations by the complainant and others in the workplace, of bullying, undue workplace stress and complaints against various staff members. These problems were alleged to have been occurring over a period of time well before the events the subject of this complaint occurred and involved various employees as well as the complainant in the workplace.
The claims arise from a number of Facebook 'chats' that the complainant engaged in with a work colleague Paula Ferronato. She alleges that there were four breaches of her privacy, in which the respondent collected and used her personal information in contravention of the Act. I will consider the detail of these claims shortly.

[38]

This post (which will be identified as 'the abusive post'), and the two emails which followed are important in order to understand the chain of events which then unfolded, and which resulted in the investigation being carried out at the behest of the respondent. The complainant does not submit that the respondent should not have collected this post, or acted upon it. Rather, she says that in the course of the investigation of this post, and the circumstances in which it was made, further personal information was accessed by the respondent contrary to his obligations under the Act.
As stated, the conclusion of the investigation was a finding of misconduct against the complainant for which she has received a final warning.
The other matter of significance with regard to the abusive post was that the complainant subsequently denied that it was she who had written it, and that in fact, it was her partner, Tavis Lamprell who wrote it. The complainant also claimed that the two emails were sent by him. Therefore a significant focus of the investigation was the attempt by the respondent to determine whether this was the case. The respondent employed an independent investigator, Leanne Faraday-Brash, to undertake the investigation into the alleged misconduct, and also obtained the services of a linguistic expert, Kristine Illingsworth, to attempt to clarify the authorship of the abusive post. The complainant again claims that these steps taken by the respondent were taken in such a manner as to breach provisions of the Act.
The authorship of the abusive post is significant for the present proceedings in that it raises questions about the credit of the complainant. The Tribunal is not required to make findings regarding the content of the post, that being a matter properly to be considered by the respondent as he did in the investigation. What is relevant is that if the complainant was the author of the post but claimed otherwise, other parts of her evidence before the Tribunal, must be treated with caution when unsupported independently.
The partner of the complainant, Tavis Lamprell, gave evidence about the circumstances in which he says he wrote the post. He said that he had observed the complainant's health worsening in the period leading up to these events, and that he wanted to help her. He said that on the evening in question, that the complainant had said she was upset about the comments Paula Ferronato had posted in relation to the alleged murderer. He said she had taken some medication and then gone to bed. He said that later that night, having had 4-6 beers, he then went to her laptop and found the posts from PF. He said that he had promised the complainant in the past not to delete friends from her Facebook, so he then decided to try to make Paula Ferronato delete the complainant as a Facebook friend. His evidence was that he took some 2 hours to write the post, using some of the complainant's notes which he said were spread about the table at their home. He said that he used a Word document to compose the post. He said it took him this long because it was "difficult to pretend to write like someone else".
When, the next day, Paula Ferronato responded to the abusive post, and then 'blocked' the complainant, he said he was glad that the post had had the desired effect, but was angry as the complainant did not have the chance to respond to her. So according to his evidence he then sent Paula Ferronato an email ('the first email') using the complainant's email address, He said that he sent a further email ('the second email') a day or so later which was intended, according to his evidence, to get her to leave 'Lara and Alicia Parker alone'.
Tavis Lamprell was unimpressive as a witness. His account of his efforts to copy the writing style of the complainant was unconvincing. He changed his evidence continually about how he did this when confronted in cross-examination with inconsistencies between the writing in the abusive emails and the writing in his own blogs. Having said that he used Microsoft Word to pre-write everything - 'I pre-write stuff, yes I plan things. I do it on emails, on my blogs, on Facebook' - he then changed this to saying he did not always use Microsoft Word, and then to saying that sometimes he used the web spellchecker or perhaps sometimes he had ignored the suggested changes in spelling. The alleged Word document of the abusive post was never produced, nor were the 'notes' of the complainant from which he was allegedly able to copy her writing style.
The respondent employed a linguistics expert to look at the abusive posts and the emails and report to him as to the likely authorship of the material. In order for her to write the report the respondent provided her with materials including the posts of the complainant. She was also provided with some of the blogs of Tavis Lamprell in order to compare the writing styles.
The conclusion of the linguistics expert was that the posts were more than likely written by the complainant and not by her partner. Her conclusion was accepted by the respondent, and was taken into account for the finding of misconduct.
In some respects her evidence was unsatisfactory. The manner in which she was briefed was questionable, in that she was given writing of the complainant and her partner which was clearly identified as to which of them had written each post. The provision of unidentified written material would have produced a more demonstratively objective finding. Her handwritten notes which she had taken upon being briefed contained comments to the effect that the complainant was "manipulative", "devious" and "monsters people" and "Lara manipulating poisoning [AP's] relationship with [PF]". Clearly this information had been given to her by those briefing her, although this was denied by Catherine Daly and by Leanne Faraday-Brash who did the telephone briefing.
She stated that her techniques of linguistic analysis were independent of any personal information she may have been given about the subjects of the analysis. In her own notes, she had made notations such as "interview husband", "motivations", "why breach wife's Facebook page/access" and "why act to exacerbate situation". She also made a finding that the tone of Tavis Lamprell in his posts with which she was provided was "calm, mature, polite and reasonable". All these questions clearly relate to matters extraneous to a strict analysis of language and seemed to indicate that she would at least consider these matters as being relevant. She adamantly denied however that this material had any effect upon her ability to analyse the writing in an objective manner and that she always applied a strict technique of linguistic analysis.
She was specific in her evidence about conclusions she was able to reach about the gender of the writer, using the degree of personal animus in the posts and the use of "I" in the posts, which she said did not occur as a rule in attempts to copy writing style. I do not accept the submission of complainant's counsel that this was the only basis for her findings. When pressed in cross-examination as to whether it was possible that Tavis Lamprell had written the material in question given his close knowledge of the state of mind of the complainant, she conceded that, if one ignored other evidence, it was possible, but not probable.
She was otherwise firm in her opinion that he did not write the abusive post, and in re-examination set out in detail her reasons for holding this view - that she considered that the post was written by a female because it was concerned with feelings and relationships, that profanity was not used except in parentheses, that work colleagues such as Iresha Herath and Alicia Parker were identified by their initials, and numerous personal references were made to the complainant's workplace. I found this part of her evidence convincing and I accept her finding that Tavis Lamprell was not the author of the abusive post, by her use of these analytical techniques.
It is not possible to accept the evidence of the complainant and her partner on this issue on other grounds. Firstly, when rung by Alicia Parker on the morning following the post being made, the complainant reportedly expressed no immediate surprise at being told of the post, and did not immediately deny the fact that 'she' had written the post as would be expected, nor did she try to correct Alicia Parker when she was told about the post. She said in her witness statement that she did not want her husband to get in trouble with the police and that was why she said nothing to Alicia Parker at the time. (It was not explained why the complainant did not believe that she herself might be in trouble with the police if it was thought that she wrote the post.) However, at the very least, an immediate reaction of surprise or denial would be expected.
Secondly, Alicia Parker's text to Paula Ferronato on 1 October says as follows:

[43]

The complainant denied writing this email and in his evidence Tavis Lamprell claimed that he had written it, and had sent it to Alicia Parker along with a copy of the abusive post, which allegedly had been deleted because of a problem with Yahoo. If this was the case, there seemed to be no reason why he would write this email to Alicia Parker. He gave no convincing explanation and, as stated, he was not a convincing witness generally.
I consider that it is more likely than not that the complainant was the author of the email. It is from her own email account and is responded to by Alicia Parker who acknowledged that she did probably respond although she had no recollection of doing so (nor of receiving the preceding email). The email is written in the same style as the abusive post, with the same angry and aggrieved animus with which the abusive post is written.
Fourthly, the abusive post has a high degree of personalized, detailed grievance about various matters associated with the workplace of the complainant. This degree of detail would simply not be necessary for Tavis Lamprell to achieve his stated aim of getting Paula Ferronato to block the complainant on Facebook. This accords with the conclusions reached by Kristine Illingsworth, the linguistics analyst, regarding the likely author of the post.
Fifthly, there is no logic in the fact that Tavis Lamprell needed to write the subsequent abusive emails to Paula Ferronato, since he had already achieved his stated objective of getting her to block the complainant as her friend on Facebook. Instead, on his account, he was again initiating contact by sending the further emails, which was not a course of action calculated to achieve his aim of ceasing contact between them. He said that a Word document was used to assist him in writing those emails, but his evidence in this matter was implausible as stated above. I do not accept his evidence that he wrote the first and second emails.
Sixthly, his account of composing the abusive post over 2 hours in the early hours of the morning after having had 4-6 beers, supposedly using the complainant's notes (which were not produced) and a Word document (also not produced) to assist him, is simply not credible. It has all the hallmarks of a narrative devised by himself and the complainant as an attempt to assist her to avoid any adverse consequences arising from sending the abusive post. It is a contrived and unbelievable account and cannot be accepted.
The implication of this finding is that, where the complainant's evidence, and that of her partner, differs from that of other witnesses, and there is no independent evidence to support it, it needs to be treated with great caution.
Before considering the breaches alleged by the complainant in detail, I will consider some of the general submissions made by counsel for the parties regarding the operation of the Act. Relevant provisions of the Act are set out as follows.
Section 16 of the Act, which is headed 'Organisations to comply with IPPs (Information Privacy Principles)' states as follows:

[69]

The Act does not purport to confer any right of privacy on an individual, but sets out the means by which the private information of individuals may be responsibly handled by public sector organisations.
In setting out a means by which this process can take place it gives recognition to the fact that individuals are entitled to a process which allows appropriate handling of private information which is required by public sector agencies in carrying out their statutory responsibilities. The Act applies only to public sector agencies, and is not of more general application. To expand this into a more general right of privacy would not be consistent with the specific objects of the Act.
In the absence of any indication to create a more general right of privacy, the effect of consideration of the Charter provisions above, and the effect of beneficial legislation in general is that an interpretation of the provisions of the Act should be compatible with promoting human rights and given a 'fair large and liberal interpretation' rather than one which is 'literal or technical'.[5]
Section 7 states that nothing in the Act gives rise to any civil cause of action, or operates to create in any person any legal right enforceable in a court or tribunal. There is no right to privacy at common law in Australia, although undoubtedly such a right does exist in other jurisdictions - notably New Zealand, and the USA. This jurisprudence was analysed in some depth by the High Court in ABC v Lenah Game Meats Pty Ltd[6], which fell short of holding that a right of privacy existed in this jurisdiction (albeit that it was concerned with a corporation and not an individual). However, without a specific reference to such a right in the legislation, it should not be interpreted as creating one.
As stated above, s 39 of the Charter states that international law and foreign judgments may be considered in interpreting a statutory provision.[7] 'Personal information' is defined and the Act sets out the circumstances in which an organisation may collect personal information, and the steps it must take if it does so. These specific matters should be interpreted in accordance with the Charter, and with the requirements of beneficial legislation generally.

[73]

Under s 29(5) the complainant may, within 60 days after receiving the Privacy Commissioner's notice declining to entertain a complaint '...require [the Privacy Commissioner] to refer the complaint to the Tribunal'.
Therefore, it is clear that the Tribunal may only hear complaints which are referred to it in this manner, and also that the Tribunal may only hear 'a Complaint' which has already been considered by the Privacy Commissioner, and dealt with by any of the means set out in s 39 as set out above. Thus, the substance of the complaint to be considered by the Tribunal must be identical to that considered by the Privacy Commissioner.
The complainant made two complaints to the Privacy Commissioner. Both were duly considered but declined to be accepted by the Commissioner. The complainant then brought the present proceedings pursuant to s 29(5).
The parties differed as to how they characterised the substance of the complaint and the extent to which the Tribunal has jurisdiction to hear some of the matters put before it.
Junior counsel for the complainant, Mr Denton, submitted that these 'jurisdictional' issues had been ventilated before the Tribunal at an earlier directions hearing in this matter, which took place on 30 June 2014. At the directions hearing, there was protracted discussion about the Points of Claim, and discussion about whether all the matters claimed were within the jurisdiction of the Tribunal. SM Coghlan took the view that it was appropriate to take a broad approach in light of the fact that the original complaints to the Privacy Commissioner were made by a person who was not legally trained.
I was taken by both parties to several cases which consider a similar issue, although in respect of different legislation. MT v CGU Workers Compensation (Health Records Act)[8] and Burrows v State of Victoria (Department of Education) [2002] (Equal Opportunity Act)[9]. These cases are concerned in part with the Tribunal's powers of amendment (under different enactments however), and its ability to hear matters which are purported to not be part of the original complaint. It was submitted by the respondent that the power to amend a complaint may not be used to introduce 'what is in effect a new complaint, which has not undergone the processes established by the Act'.[10]
In the case of Youd-Holmes v Milford Hall Pty Ltd,[11] McKenzie DP stated, in the context of the then Equal Opportunity Act 1995, the following comments about the Tribunal's powers of amendment:

[75]

The parts of the complainant's claim complained about by the respondent as being outside the original complaints made by the complainant to the Privacy Commissioner fall into four groups:
- (a). the claims regarding the respondent's collection and use of the information that the complainant Laura Jurecek operated a Facebook account under the pseudonym or 'avatar' Lora Otto.
- (b). the fact that the original complaints did not specify an allegation that some of the information collected was also used by the respondent.
- (c). some of the information collected by the respondent in the course of the investigation.
- (d). claims regarding the collection and use of information by the respondent as part of his response to the 2 complaints made by the complainant to the Privacy Commissioner.
The claim regarding the respondent's linking of her pseudonym with her own name was not particularised until the Reply was filed which was some months following the directions hearing referred to. The claim regarding the use of her personal information in the misconduct investigation was made only after she became aware of its use when it was set out in the defence of the respondent.
The question to be determined is whether these matters can be said to have been part of the complainant's original complaints to the Privacy Commissioner, even though she was unaware at the time of the details of the alleged breaches. It is not sufficient to say that these matters were merely mentioned in the complaint, but they must form part of the complaint.[13] In deciding this however, it is important to keep in mind, as was submitted that the complaints were not drafted by a person with legal training, and indeed the legislation would not envisage that this would normally be the case. It is therefore appropriate to give as broad an interpretation as is possible and there is not the need to 'dissect every word' as one might in other circumstances. As stated, this was the approach adopted by the Senior Member in the directions hearing and is respectfully adopted.
The gravamen of the complainant's two complaints to the Commissioner was that her personal and private information had been accessed by the respondents in an ongoing manner. The complaints took the form of a narrative, giving an extensive background history of what she considered to be the relevant events at her workplace. The narrative explained how she had set up her Facebook page, referring to the measures taken to protect her privacy, outlining the privacy settings which had been put in place by her husband, and the fact that she used an 'avatar' or pseudonym, which itself was not searchable or publicly available. At the stage of making the complaints she did state that she did not have any specific information as to what information was collected, or how it was used and engaged in considerable speculation regarding this.
The first complaint outlined her concerns that her personal and private[14] messages were being used in a document written by Iresha Herath. It had come to her attention that her Facebook avatar's private and personal messages to Paula Ferronato were being used in a document written by Iresha Herath. Having alleged that her private information had been collected she also believed 'this document was actually used going forward...'. She did not specify in any detail what was the 'private and personal information' other than to mention her finding it referred to in a confidential document which she had inadvertently come across. This complaint forms the subject matter of the claim regarding the 'first breach' of her privacy in the amended Points of Claim.
The second complaint was against the respondent, the Director of TSV, Alan Osbourne, and Leanne Faraday-Brash, regarding the collection of personal information to investigate allegations of misconduct. Again, the complainant outlined the measures she had taken with the assistance of her husband to set up her Facebook account with the highest privacy settings, and including using the avatar or pseudonym, which was not accessible by searching or otherwise publicly available. Again, she referred to her private and personal messages being accessed by Iresha Herath, Alan Osbourne, Leanne Faraday-Brash and others of whose identity she was not aware, and that her personal Facebook avatar was accessed by a person or persons unknown. She did not specifically allege that the information had been used by the respondent, but the fact that she believed it had been used can be implied from the manner in which the complaints are worded - eg that the investigator made findings based upon the information collected.[15]
As is stated above, in the case of MT Workers Compensation,[16] the simple mention of a matter in the original complaint is not sufficient for it to enliven the Tribunal's jurisdiction. It must also be a part of the matters complained about even if it is simply 're-characterising facts, or adding to a continuing pattern of contravention, already alleged in the complaint'[17] In this case, using a broad approach to interpretation, the references italicised above clearly refer not only to the private information which she had put in her Facebook pages, but also the fact that she used a pseudonym in making those Facebook posts. It also indicates awareness on the complainant's part that the information had been used, and that her private 'avatar' had been identified, which enabled access to her personal information and that she was aggrieved by this having occurred. Therefore, this information does form part of the original complaint even though it is not articulated in the detail which is particularised in the Amended Points of Claim, and further particularised in the Reply.
This same reasoning applies to part of the investigation information which was obtained by the respondent in the course of the misconduct investigation. This information consisted of screenshots of the complainant's homepage collected by Catherine Daly and Leanne Faraday-Brash. To the extent described above, this was referred to by the complainant in her complaints, and therefore is able to be considered by the Tribunal in these proceedings.
Included in the 'investigation information' are the Records of Interview with relevant employees obtained by the investigator, Leanne Faraday-Brash, in carrying out the misconduct investigation. I do not consider that these can be characterised as being part of either of the complaints of the complainant to the Privacy Commissioner. As set out above, those complaints were concerned with the complainant's belief that her personal and private information was being accessed by the respondent, most particularly the information on her Facebook pages and her personal avatar. As such they cannot be characterised as part of her original complaints. They relate to information collected by the respondent from other employees as part of the investigation. This information was obtained from the complainant's colleagues, not her Facebook pages. Therefore the Tribunal does not have jurisdiction to deal with complaints about the collection of this material, and a fresh complaint would need to be made to the Privacy Commissioner.
There was a further allegation where it is submitted by the respondent that the Tribunal has no jurisdiction. This is regarding information collected by the respondent when his response to the complainant's complaints was sought from the Privacy Commissioner. (This allegation did not appear to be in the complainant's Points of Claim.) I do not consider that the Tribunal has the jurisdiction to deal with this part of the claim.
Firstly, the events alleged occurred after the complaints had been made to the Privacy Commissioner. This fact in itself is not always necessarily fatal to such a claim.[18] However, whilst the claim is similar to the previous ones, in that it alleges that the respondent collected the complainant's information in a manner contrary to the Act, these circumstances differ, in that the previous allegations concern the collection of the information in the context of the misconduct investigation. In this instance, the information was collected allegedly to respond to her complaints to the Privacy Commissioner. Secondly, this aspect of the complainant's claim has not been pleaded, or at least insufficiently particularized, nor has an amendment to the claim been sought in order for this to occur.

[80]

The clause appears to envisage that the collection of the personal information will be carried out by an organisation of whom the individual may not be aware. It is certainly the case that the wording of the IPPs seems directed in many instances to an agency collecting information from individuals who are not familiar with its operation. For example in IPP 1.3 the agency collecting the information is enjoined to ensure the individual is aware of its identity, that he or she is able to gain access to the information, the purposes for which the information is collected and to whom the organization normally discloses the information. In the case of an employer/employee relationship most of these steps would not be necessary as most of the information would already be known by the individual.
Nonetheless the presence of these provisions does not exclude the possibility that the information may be collected by an organisation of which the individual is aware, a situation which must occur frequently, not only in the employment context. The legislation must surely also apply in those situations.
The respondent also submits that the need to comply with the provisions of the Act would place an unduly onerous burden on an employer, in that they would need to notify employees every time information about them had been collected. The extent to which compliance with the legislation is onerous however, depends upon what is required for compliance by the organisation. Much of the collection of personal information from employees would be routine and predictable and it would not be onerous to put appropriate systems in place to manage this. Also, as stated, many of the required steps set out in IPP 1.3 would simply not be necessary in the context of an employment relationship.
There is no specified exclusion in the Act regarding the employment context. As submitted by Mr Rivette, this is in contrast to the comparable Commonwealth legislation, the Privacy Act 1988 (Cwth), which, in s 7B(3) specifically exempts the operation of the legislation in respect of 'any act done by an organisation that is or was an employer of an individual, if the act is related to the employment relationship, or regarding a record held by the organisation relating to the individual'.[19] Given that there are otherwise many similarities in the drafting of the two Acts, the omission in the Victorian Act of any reference to its application to an employer must be seen to be significant.
The application of the Act in the context of an employment relationship has been considered in the case of Ng v Department of Education.[20] The fact that the Act applied in that situation did not appear to have been in issue.
Section 9 of the Act is headed 'Application of Act'. The Act is stated to apply, inter alia, to a public sector agency. It was common ground in the present case that it therefore does apply to the respondent. There is nothing in s 9 to exclude the operation of the Act to the public sector agency as an employer, as opposed to its primary function.
The Tribunal is bound by the statute in its operation as was submitted during the hearing, and unless there was a specific exclusion in the wording, there is no reason why the organisation as an employer should not have the same obligations as any other. An employer is in a position to collect personal information from an employee, as it is from any other individual and obviously needs to do so in order to properly manage its workforce. The obligations imposed upon an employer are consistent with the objects of the Act with regard to promoting awareness of responsible personal information handling practices in the public sector and other objects as set out above. To give an interpretation of the Act that it applies to the employment relationship is also to give a beneficial interpretation of the Act, which is consistent with the nature of legislation concerned with human rights.

[85]

'Generally available publication' as defined in the Act means 'a publication (whether in paper or electronic form) that is generally available to members of the public and includes information held on a public register'. [25]
The complainant, Paula Ferronato and Alicia Parker all believed that the security settings on their Facebook accounts were such that the information behind their Facebook walls could not be accessed by anyone other than their Facebook 'friends'. The witness Paula Ferronato at a much later stage, realized that her security settings were not as secure she had believed at the time.
The complainant and her partner, Tavis Lamprell described at some length the steps taken to ensure that the privacy settings on her Facebook account were the highest possible. She believed her partner had more expertise than she did, although he acknowledged under cross-examination, that he did not consider himself to be an expert. On her profile page there was minimal personal information about herself. This information was to the effect that 'Lora Otto' studied at RMIT University, lived in Melbourne, Victoria, Australia, was from New York, New York and knew Australian English, British English and American English. It stated that her place of employment was 'Weasel World', a name which she said in her witness statement, was derived from an amusement park in the US. She said that no photographs of herself were included and she used an image from the film 'Thelma and Louise' on her profile page.
The account was set up with the use of a pseudonym, 'Lora Otto'. It was not connected to her usual email address but to another address which had been allegedly specially set up for this purpose. Further, an internet search did not come up with any Facebook results indicating that either 'Lora Otto' or Lara Jurecek had a Facebook account. The complainant's evidence was that she went to these lengths to avoid being located by a former partner who had been abusive.
The complainant also said in evidence that she had not included any of her work colleagues as 'friends' on her Facebook account with the exception of two people whom, at the time, she regarded as friends - they were Paula Ferronato and Alicia Parker. She said that she took this step to enable her to communicate with them regarding some of the bullying and workplace harassment issues which she said all of them had experienced either at that time or previously.
The witnesses Catherine Daly and Leanne Faraday-Brash both gave evidence that they accessed the Facebook homepage page of the complainant through their knowledge of the pseudonym of the complainant, and of her friendship with Alicia Parker. Catherine Daly said that she searched the complainant's name on Google, and came up with a guest book entry with the complainant's name as well as her 'avatar' name, Lora Otto. Catherine Daly had been told of the pseudonym being used by the complainant by Paula Ferronato. (The complainant's pseudonym could also be identified by the linking of the 'Lora Otto' Facebook author of the abusive post, with subsequent emails from the 'Lara Jurecek' email account.) Catherine Daly was unable to access the Facebook page of Lora Otto however, except by accessing the Facebook page of Alicia Parker, who she had been told, was a Facebook 'friend' of 'Lora Otto'. Using this method, she was able to access the Facebook homepage of Lora Otto, but not the pages that sat behind it.
Leanne Faraday-Brash conducted a similar series of searches, and achieved the same result.
In contrast it appeared that Cameron Toy, upon receiving the complaint from Paula Ferronato about the abusive post, had done a Facebook search for 'Lora Otto' but without the linking information, he was unable to obtain any results. Therefore, the evidence suggested that the information regarding the pseudonym and the link with Alicia Parker was necessary to access the personal information on the Facebook page. That is, the information on her Facebook homepage of itself was publicly available, but did not disclose her true identity.
There are several provisos to this finding however. One is that according to the evidence of Catherine Daly and Leanne Faraday-Brash, when they did a Google search using the name of the complainant, an item came up which linked the complainant's name to her pseudonym Lora Otto. As this came through a simple Google search, it could in a sense be described as publicly available information. But without more, the searcher would still be unable to access the Facebook page of Lora Otto. There was also evidence that, at the relevant time, there was a photo of the complainant with her cat, on her homepage, which would therefore allow anyone viewing the page to link the complainant with the name 'Lora Otto'.[26] However, it was still not possible to locate this information via a Facebook search.
The respondent says that the pieces of information alleged to be personal information by the complainant, being her Facebook page, her pseudonym Lora Otto, and her Facebook friendship with Alicia Parker, were all pieces of information which were publicly available and therefore not subject to the provisions of the Act.
Mr Pizer submitted that 'generally available publication' does not mean that all members of the public have ready and easy access to the document. Rather, it means that most members of the general public can access it. The focus is on the number of people who might be able to access the document, not the ease with which they can do so. It was submitted that this way of interpreting the provision better promotes the public interest in ensuring the free flow of information.
Mr Rivette submitted that a much narrower view should be taken of what information/documents were generally or publicly available publications. He cited the case of Australian Football League v The Age Company Ltd [27] in support of a more limited interpretation of what should be considered as being 'publicly available'. The case concerned confidential information about the alleged drug taking offences of AFL players, which had been the subject of speculation in newspapers and online blogs. Kellam J held that this widespread publication did not amount to the information in question becoming public information, one of the reasons being that much of the disseminated information was speculation. The case was decided in the context of confidential information upon its particular facts which are not comparable to this particular situation, or this legislative regime.
It was also submitted, on behalf of the complainant, that because of the manner in which she had set up her Facebook page, she had a reasonable expectation of privacy, a concept that has been raised in privacy jurisprudence in the UK and referred to in several Australian cases. The case of ABC v Lenah Game Meats[28] was also cited by counsel for the complainant in support of this concept. Reference was made in submissions by counsel for the complainant in the case to a House of Lords decision,[29] where the notion of a reasonable expectation of privacy was discussed. This concept appeared to arise from the Press Complaints Commission Code of Practice in the UK, to which the Court had regard in considering a matter concerning media reports about a celebrity model.
The principle seems to be to the effect that the intention of the party claiming privacy should be taken into account in assessing whether the information so claimed should be regarded as subject to the privacy legislation.
However, the extent to which the witnesses believed their security settings prevented access to their personal information could not form the basis upon which information is caught by the Act. This would mean that someone who was incompetent in setting up such privacy settings could benefit from the provisions more than someone who was more skilled. The definition of 'personal information' does not have any reference to the belief of the person making a claim under the Act. I do not accept the submission of counsel for the complainant that, in these circumstances, the notion of a reasonable expectation of privacy can apply to this situation.
A case which considered the meaning of s 11 was CT v Medical Practitioners Board of Victoria.[30] The application was for summary dismissal of a proceeding which had been brought under the Act. In the course of deciding the application, President Morris considered the meaning of s 11. He expressed the view that the section was concerned with documents[31] rather than information, based upon its wording. He said that it would be difficult to see how the section could operate in a practical sense if it turned on whether information was publicly available, as this would involve an exercise that would always be controversial and difficult.[32]
Mr Pizer submitted that the Tribunal was not bound by this decision as it was obiter, and that the preferred interpretation of s 11 was that offered by Nekvapil[33] which suggests a different interpretation, and that s 11 would apply to personal information in a publicly available document. As to whether this difference in interpretation will be relevant in the present case depends upon whether the 'documents', the subject of the claim, are generally publicly available. I therefore put this question to one side.
Mr Rivette referred to the position taken by the Privacy Commissioner as to whether a post to a social networking service is a 'generally available publication'. This is that, in general, the fact that something is posted online does not mean that it becomes a generally available publication, 'even if it is (for instance) duplicated or archived by a search engine and made searchable...'.[34] Similarly, organisations 'should not assume that a post on a social networking service is a generally available publication and should comply with the IPPs when collecting, using or disclosing personal information'.[35]
The information with which this case is concerned is that which was posted on social media. On one view, depending upon the skill of the user, almost anything posted online, either on the internet or on social media, is information which is potentially publicly available, and, as such, would not be protected under the provisions of the Act. However the word 'generally' would appear to qualify the term 'publicly available'. I take it to mean that it applies to a document or information in a document that would be able to be accessed by most members of the public, who are not particularly skilled in carrying out such searches.
Whilst I am not bound by the views of the Privacy Commissioner, again, the commentary on these issues is informed by his or her experience in managing the operation of the IPPs on a regular basis. The position taken is a narrow one, and favours a conservative approach to be taken by organisations in assessing whether information is a generally available publication. His position is that organisations should not assume that individuals using social media are always aware of the fact that some of their material may be unintentionally disclosed and recommends that the privacy policy of an organisation make reference to this possibility.
I accept this approach. As discussed above, this legislation is beneficial in nature. It is necessary to give an effect to its provisions which promotes the human rights of the complainant particularly in this case where there is considerable ambiguity in the meaning of the section. In considering the submissions made on behalf of the parties regarding what is meant by generally available publication, I prefer the interpretation which is a narrow one.
This interpretation will still give effect to the intended objects of the Act which is to balance the public interest in the free flow of information with the public interest in protecting the privacy of personal information, to promote awareness of responsible personal information handling practices and responsible and transparent handling of personal information in the public sector. I therefore find that the personal information on the complainant's Facebook page was not generally publicly available and as such was not subject to the exemption in s 11.
I will now consider in detail the specific allegations made by the complainant.

[89]

The complainant's evidence was that this came as a complete shock to her as she had allegedly always kept the fact of her Facebook account secret from all but Paula Ferronato and Alicia Parker. She was of the view that this indicated that her private Facebook chats had been disclosed by Paula Ferronato to the respondent.
She came to the conclusion that Paula Ferronato must have disclosed this information because of Ms Ferrronato's response to her 5 April post. The response indicated that Ms Ferronato had discussed CW's situation with Iresha Herath.[36] The mention of her Facebook account in the file note in her view meant that her Facebook chats with Paula Ferronato had been disclosed.
At that stage she decided not to confront either Ms Herath or Ms Ferronato as she said in evidence that she had fears about losing her job.
Both Paula Ferronato and Iresha Herath denied in their evidence that they had alluded to the fact that the complainant had a Facebook account in their meeting on 11 April, that they discussed the Facebook post or had taken or received copies of the post. Both recalled that on 11 April they had discussed the fact that some other staff were aware of CW's work situation and that some were saying that he had been suspended from work. Paula Ferronato's evidence was that on 11 April, she had 'bumped into' Iresha Herath and spoke to her about the situation as she was concerned that the whole situation would be stressful for Ms Herath, with whom she had a friendship. She had told Ms Herath that CW's situation was discussed between herself and the complainant, but not how this information had been communicated between herself and the complainant (i.e. via Facebook). Her Facebook post to the complainant on 11 April states 'she asked me how I heard and I said both you and (AP) told me directly'.
She was cross-examined on this at some length, and it was submitted by counsel for the complainant that she had conceded that it was 'possible' that she had disclosed the fact of the Facebook communication. However, a close reading of her evidence indicates that she did not make this concession. She said that she had only disclosed the fact, as stated in the post, that she and complainant had directly discussed the matter. She said that although she could not recall the conversation that she had with IH, she felt that it would not have been helpful for her to mention Facebook to Iresha Herath, because she was concerned with Iresha Herath and the possible stress she was under because of the situation with CW.
She was of the view that it would not have been helpful to Iresha Herath to hear that people were 'gossiping' about the situation on Facebook. Her recollection was that the conversation arose as a result of her concern for Ms Herath, and how she was having to deal with a difficult situation, rather than concerning the complainant. Although she did not recall the conversation, she believed she would have remembered if Facebook had been discussed. She said she had been uncomfortable with the Facebook messages from the complainant about CW's situation and uncomfortable with responding to them.
Paula Ferronato was a witness who impressed as being measured and honest in her evidence. When pressed upon this issue by counsel for the complainant she did not waver from her evidence as stated above. I accept her evidence.
Iresha Herath was also cross-examined on her recollection of how she had become aware of the Facebook communication from the complainant to Paula Ferronato. Her recollection was that they discussed the matter in her office. She acknowledged that it was possible that she asked how the complainant passed the information to Paula Ferronato, but thought it not probable. She considered that how the complainant had told Paula Ferronato or whether it was via Facebook was not really relevant. She was of the view that what had been relevant at the time was what was being discussed not how the information had been communicated. She did not keep any file notes of the meeting, as she said she did not keep verbatim notes in deeply personal matters. However, she was of the opinion that if she had been given copies of Facebook pages at the meeting she would have kept a record.
Iresha Herath's evidence was that the complainant herself disclosed the fact of the Facebook post on or about 12 April. She believed, upon looking at her diary entries at the time, that it was on 12 April at around 11am, although the meeting was not noted in her diary. She was asked about the complainant's post on the evening of 12 April which did not refer to any meeting with Ms Herath, even though it was made later on the same day. She didn't agree that the wording of the post was inconsistent with there having been a meeting on that day. On the contrary she said that she had in fact, cautioned the complainant, telling her that she needed to be careful about discussing this sensitive matter with other work colleagues. The complainant's post referred to how 'they' were going to 'deal' with people who were saying CW had been suspended.
Significantly, there was a copy of an email attached to her witness statement, from herself to the respondent, Alan Osbourne, dated 11 April 2012, in which she expresses concern about the fact that 'there were a number of reports that Lara and Alicia are the major people spreading (CW's) version of events, with Comms (sic) people talking about a suspension. I agreed with (Catherine Daley) that Ingrid and I would speak to Lara tmw..' - (presumably meaning 'tomorrow' - ie 12 April). This appears to support her recollection of meeting the complainant on 12 April.
The complainant's evidence was that apart from having a brief conversation on that day with Iresha Herath, in the street on route to a social event, she did not have any meeting that day with Iresha Herath, and that she did not discuss the Facebook post or its contents at that time with Iresha Herath. She said that she had been with CW all that afternoon. CW's evidence however, was that he had met with the complainant on the afternoon of the following day, on 13 April.
It did appear that the complainant had been cautioned on 12 April about talking about the matter however, hence her comments in, as mentioned the chat of that evening - 'they are going to deal' with people [who were saying CW had been suspended]. It is possible to infer that this may have arisen as a result of a discussion with Iresha Herath. The comment is consistent with the evidence of Ms Herath that she had cautioned the complainant regarding discussing CW's situation earlier that day.
The complainant did not point to any specific evidence that either the fact of her having a Facebook account, or the contents of the April posts were communicated by Paula Ferronato to Iresha Herath at that time, and her only basis for making the allegation was the brief reference in the file note of 23 May.
In the situation where a version of events given by the complainant differs from that of the two other witnesses, for the reasons given above, I prefer the latter. Where there is no supporting evidence, the complainant's evidence must be treated with caution.
She has the onus of persuading the Tribunal that her version of events occurred as she alleged, on the balance of probabilities. There is no evidence upon which to base the allegation that the details of the chats of 5, 11 and 12 April were disclosed, or the relevant Facebook pages on or before 23 May 2012. I find that it is more likely than not that any information which was disclosed was by the complainant herself. Therefore the complainant's allegation that this personal information was disclosed to the respondent is not proven.

[93]

Much of what is set out above in relation to the 5 April chat is relevant for those of 11-12 April.
The complainant alleges that Paula Ferronato disclosed information including personal information (further personal Information) contained in Facebook chats on 11 and 12 April 2012.
As with the 5 April chat, there was no evidence that this information was collected. This is in light of the evidence of Paula Ferronato and Iresha Herath about what occurred prior to 23 May when the confidential memo was written, as discussed above. Similarly, there was no evidence that the information was used at that time by the respondent.
It was the evidence of Paula Ferronato, however, that along with the information she had provided as part of the investigation process, she inadvertently included an extract[38] from the 12 April Facebook chat[39] when she had an interview with Leanne Faraday-Brash as part of the investigation process.
For reasons set out above, I consider that this part of the 12 April chat is 'personal information' for the purposes of the Act. It was also not in contention that this information was 'collected' by the respondent albeit inadvertently, in the context of gathering information for the purposes of the misconduct investigation.
The question to be determined regarding this 'extract' of information was whether it was 'necessary' for the respondent to collect the information as required pursuant to IPP 1.1. Although it was collected as part of the information for the misconduct investigation, the fact that it was collected unintentionally would seem to indicate clearly that when seen in isolation, it was not necessary for the purposes of the misconduct investigation. As such, it was therefore a breach by the respondent of IPP 1.1. Therefore this part of the complainant's claim is proven.
In the general context of the surrounding events, the consequences which flowed from the breach were not significant in light of what the complainant seeks as remedy in this proceeding. However, counsel for the complainant may wish to make submissions on this issue.

[94]

There being a finding that the respondent collected this extract information in breach of the Act, was it then able to use that information? It was submitted by Mr Rivette that it should follow that the organisation should not then be permitted to use such information.
In the case of Robert v Anglicare,[40] the Tribunal discussed the relationship between IPPs 1 and 2. The Member referred to the second reading speech of the Act - 'The second reading speech and the introductory words of IPP 2.1 make it plain that the "primary purpose" is that which is referred to in IPP 1, that is personal information necessary for one or more of the organisation's functions or activities. Accordingly, the secondary purposes which are allowed under IPP 2.1 are distinct from the primary purpose. I agree with this approach.
As stated, the information was collected inadvertently, and therefore, cannot be said to have been 'necessary' for one or more of the functions or activities of the respondent. There was therefore no 'primary purpose' of collection. It follows therefore, that the use of the information did not comply with IPP 2.1 as the organisation is only permitted to use the information for the primary purpose for which it was collected.
The extract was part of the chain of posts on Paula Ferronato's wall which were collected as part of the investigation. Although it was not intentionally collected, it was included in the materials provided to the linguistic analyst, Kristine Illingsworth, and was used by her, along with other examples of the writing of the complainant as part of the analysis which she was requested to carry out. I find therefore, that this part of the complainant's claim is proven.
The extract was part of a considerable amount of other material which was provided to the linguistic analyst. As this was the case, no consequences flowed from the breach by the respondent. There is no evidence that it played any part in the opinion expressed by the linguistic analyst. Had it not been disclosed, the outcome would be the same.

[96]

Following the receipt of the abusive post, Paula Ferronato blocked the complainant from her Facebook account and thereafter, it is alleged by the complainant, she would have had no way of accessing the Facebook account of the complainant. She alleges, therefore, that this information was collected by the respondent in breach of the Act, and as such was personal information under the Act_._ The relevant Facebook page shows the exchange of posts on Paula Ferronato's Facebook wall at the time leading up to the abusive post and the abusive post itself.
The facts giving rise to these allegations are referred to above, having arisen in the context of the murder case which was widely discussed in the media at the particular time. As set out above, on 29 September 2012, Paula Ferronato had posted a comment on her Facebook page, urging some of her Facebook friends to desist from commenting on the murder in a manner that she considered inappropriate. This resulted in the complainant posting a number of comments in response, and in the abusive post being made that evening.
On the following morning, Paula Ferronato took the screenshot containing the abusive post to her immediate superior at the workplace, Cameron Toy. The posting of the abusive material on Ms Ferronato's Facebook wall became the subject of an investigation of the complainant by the respondent and the allegations made by the complainant in relation to the second breach arise in the context of information obtained by the respondent and used in the course of that investigation, which she says, was in contravention of the Act. The alleged personal information does not include the abusive post, but includes the posts leading up to this post.
Having received the complaint from Paula Ferronato about the abusive post, the respondent decided that the matter needed to be investigated, and that an independent investigator should be employed to carry out the investigation. The role of Catherine Daly in her capacity as carrying out human resources functions was to carry out an initial assessment as to whether an investigation should proceed. The services of Leanne Faraday-Brash as an independent investigator were engaged. The witnesses for the respondent, Alan Osbourne, Catherine Daly and Leanne Faraday-Brash all gave evidence regarding the circumstances surrounding the investigation of the complainant in relation to the abusive post.
Catherine Daly and Leanne Faraday-Brash were able to access the Facebook homepage of the complainant by taking the series of steps as described above. The information collected was that on the Facebook wall of Paula Ferronato, and the homepage of the complainant, in which she listed her place of employment as 'Weasel World'.
At this time, the complainant was on sick leave, which she had commenced in August of that year, as a result, she says, of the extreme stress she was suffering in her workplace. She was invited to participate in the investigation, either in person, or via her union representative, Geraldine Hughes. The investigation was halted to enable this to occur on or about 19 October. The complainant responded to the investigation with a letter dated 29 October 2012, which was when she claimed that her husband Tavis Lamprell had written the abusive post and the emails, and apologized on his behalf. Leanne Faraday-Brash made several further attempts to involve her and/or Ms Hughes but these were not responded to by either. Eventually the investigation was resumed.
It was submitted by counsel for the complainant that, in view of the fact that the complainant was on sick leave, the investigation should not have proceeded at that point. The Tribunal does not propose to consider the manner generally in which the investigation was conducted. The matter solely before the Tribunal is in relation to the issues arising from the Information Privacy Act 2000.

[101]

Pursuant to IPP 1.2, the respondent was required to collect the personal information only by 'fair and lawful means and not in an unreasonably intrusive way'. In the context of a complaint made, and allegations that there were possibly other matters to be investigated, Paula Ferronato disclosed the complainant's personal information on her wall to the respondent. There was no evidence that the respondent obtained this information improperly by unauthorised entry to the complainant's Facebook account. Although the complainant alleged in her complaints to the Privacy Commissioner that her Facebook account had been 'hacked' into, and despite not resiling from this in her evidence, her Amended Points of Claim did not allege this, nor was there any evidence that this had occurred.
Relevant parts of IPP 1.3 are set out above.
The issue of how the respondent should have complied with these provisions is a complex one in this case. The difficulty is that they appear to have been drafted to encompass the situation where a public sector agency, otherwise unknown to the individual, collects information for a statutory purpose in a manner that is predictable. An organization can easily comply with these provisions by means of a pro forma provided to individuals whose information is collected, and this is commonly done. The respondent itself had such a privacy policy in place, with respect to its statutory functions. Where the organisation is also an employer the means of compliance is less clear.
The respondent did not appear to have a specific privacy policy with regard to how it proposed to deal with personal information collected from employees. Such a policy may have alerted employees to the fact that such collection of information was potentially likely in circumstances such as those in this case. This could have included the possibility of information being collected from social media.[44] The respondent, however, believed that the various policies concerning managing workplace matters sufficiently covered its activities in investigating the complainant.
Therefore, in carrying out the investigation, the respondent and his witnesses did not turn their minds to any obligations they might have under the Act. They were of the view that having complied with their own departmental policy - the Victorian Public Service Workplace Determination (the Determination) - they were dealing with the investigation appropriately. This policy sets out the steps to be taken in conducting an investigation into misconduct. Privacy of the person being investigated is not mentioned although reference is made to 'procedural fairness'. Pursuant to that policy, a 'Notice of Investigation' was sent to the complainant on 8 October 2012, setting out the allegations against her, advising her of the investigation, the employment of the independent investigator, and the process of the investigation which was to be followed. The complainant was advised that she would be given an opportunity to participate.
The Notice of Investigation set out the allegations against the complainant in paragraph 1 as follows:

[105]

Sent inappropriate emails to Paula Ferronato's personal email account; 2. Published inappropriate comments on your own Facebook 'status' and/or 'wall' that [sic] about TSV and TSV senior management, including listing your place of work as 'Weasel World'.
To the extent that the letter sets out the details of the allegations against the complainant, the respondent says that it complied with its obligations under the Act. These details, while not specifying the documents in which the personal information was contained, did make it apparent that the respondent was in possession of material obtained from Paula Ferronato's Facebook wall, the Facebook wall of the complainant, and also by implication, that it was aware of the pseudonym used by the complainant to access her Facebook account.
Alan Osbourne also said in evidence that he discussed the details of the investigation with Geraldine Hughes, the union representative, and that this would inform the complainant further, and it is clear from the correspondence of Geraldine Hughes of 19 October 2012 to Alan Osbourne,[45] and also from correspondence containing a purported apology from the complainant, dated 26 October 2012,[46] that the complainant was well aware of the subject matter of the investigation, and therefore, of the fact that information from the her Facebook homepage and Paula Ferronato's Facebook 'wall' had been accessed.
The complainant also gave evidence that she had deleted the reference to 'Weasel World' as her place of employment on her profile page prior to the Notice of Investigation being sent. She said this was done on the advice of Geraldine Hughes. This clearly indicated an awareness of the possibility that the respondent would be likely to access material on that Facebook page.
Mr Rivette submitted in his closing submissions, that the respondent had not complied with the Determination, or the Act because he had not advised the complainant 'as soon as practicable' after determining an investigation is to take place, and that 'relevant information' had been withheld from the complainant contrary to the Determination. He submitted that the respondent was 'required to contact the complainant, explain the complaint and the personal information the subject of the complaint which was in his possession, and then seek any further information from her that was required to conduct the investigation.'[47]
I do not accept this submission. Firstly, the Tribunal does not have jurisdiction to consider whether the respondent complied with its own Determination. Secondly, the respondent was required, under IPP 1.1 'at or before the time (or if that is not practicable, as soon as practicable after)' the personal information was collected, to take reasonable steps to ensure that the complainant was aware of the various matters enumerated in IPP 1.3.
Clearly, in this situation, a number of the provisions in IPP 1.3 do not apply - for example, the identity of the organisation was known to the complainant. She would also have been aware, expressly or impliedly, of most of the other matters listed in IPP 1.3 it being the case that the organization was her employer. She did not need to be told that she was able to gain access to the information. She would be presumed to have been aware of the purpose for which the information had been collected. Other parts of 1.3 - 1.3(d), regarding to whom the organization usually discloses the information; 1.3(e), any law requiring the particular information to be collected and 1.3(f), the main consequences for not providing all or part of the information - are simply not relevant in this context.
It was submitted by Mr Pizer that the individual may be made aware of one or more of the matters listed in IPP 1.3 expressly or impliedly. That this is the case was made clear in the case of Zeqaj v Victoria Police[48] where the Tribunal held that any reasonable person would have had awareness of the relevant information in IPP 1.3(e) in the circumstances of that case.
The complainant's counsel submitted that the obligation on the respondent was to provide the complainant with the actual information which had been collected, and that this should have occurred immediately upon the information first being collected, and put this proposition to Alan Osbourne and Catherine Daly.
Alan Osbourne said that he did not consider that there was any obligation to provide the information until the misconduct allegations were investigated further. He was concerned that because there had been ongoing 'culture' problems at the workplace he needed to 'get to the bottom' of what had occurred. He was concerned that the complainant, if given more information, would take steps to delete or change material from her Facebook page before the matter could be properly investigated. (Indeed, the complainant had deleted the words 'Weasel World' from her homepage before the Notice of Investigation was received).
Catherine Daly considered that they needed to uncover what had actually occurred, especially in that she considered the posts very 'vitreolic'. She had had concerns that the complainant would seek to alter her Facebook account, or alter information in some other way.
There is no requirement set out in the Act that the individual must be provided with the actual personal information collected by the organization. The individual is to be made aware 'at or before the time (or, if that is not practicable, as soon as practicable after) an organization collects personal information' of the various matters set out in IPP 1.3. Insofar as these applied to this situation, the complainant was aware to the extent stated, of the personal information collected. I consider that, in the circumstances, the time in which she was made aware was 'as soon as practicable'.
IPP 1.4 states that 'if it is reasonable and practicable to do so, an organization must collect personal information about an individual only from that individual'. I consider that in this particular case, such a course of action was not 'reasonable or practicable', given that neither the complainant nor her union representative was participating in the investigation. In the circumstances, the respondent may well have been of the opinion that the complainant would not be forthcoming in providing information to assist the investigation.
IPP 1.5 says that 'if an organization collects personal information about an individual from someone else, it must take reasonable steps to ensure that the individual is or has been made aware of the matters listed in IPP 1.3 except to the extent that making the individual aware of the matters would pose a serious threat to the life or health of any individual'.
Mr Pizer submitted that the requirement in IPP 1.5 is cast in different terms from that in IPP 1.3, in that there is no time requirement (ie 'at the time of (or as soon as practicable after'), and this appears to be the case. IPP 1.5 would apply to the collection of personal information by Leanne Faraday-Brash and Kristine Illingsworth in the course of the investigation. The respondent was required to take reasonable steps to ensure that the complainant was aware of the various matters set out in 1.3 however, but was not required to do so within a particular time frame. As discussed above, I consider that the complainant was sufficiently aware of these matters, particularly as she was an employee of the respondent organisation. Mr Pizer submitted that if the individual is already aware of one or more of these provisions the organisation need not take any steps under IPP 1.5.[49]
I consider that the respondent complied with IPP 1 in collecting the personal information. It cannot be correct to interpret the Act as requiring the immediate provision to the individual of all materials relating to a misconduct investigation in the manner submitted by counsel for the complainant. The respondent believed that to do so could jeopardize the investigation, and common sense would indicate that may have been the case. The effect would otherwise be completely impractical.

[111]

However, the collection of the screenshots was part of the investigation into misconduct, and as such I consider it was necessary for the respondent to collect the information as discussed above.
The screenshots were collected using the sequence of information of which Leanne Faraday-Brash and Catherine Daly were aware, as described above. This did not involve illegally 'hacking' into the complainant's Facebook pages. Therefore, IPP 1.2 was complied with.
Regarding the screenshot collected by Catherine Daly, the respondent was required to comply with the matters set out in IPP 1.3, to the extent that these matters were relevant. As stated he was not required to provide the actual information to the complainant. As was the case with the information the subject of the third alleged breach, I consider that the complainant was made aware to a sufficient degree of the fact that her Facebook page had been accessed, that her pseudonym was known and that Alicia Parker was a Facebook friend. It would also have been apparent that Paula Ferronato's Facebook wall had been accessed in order to investigate the allegations. In providing the Notice of Investigation, the respondent complied with these requirements to the extent necessary.
Regarding the screenshot collected by Leanne Faraday-Brash, as this information was not collected by the respondent, IPP 1.5 applied. The respondent complied with this requirement in the Notice of Investigation in which the complainant was informed that an independent investigator was to be engaged.
The complainant did not need to be made aware of the other matters listed in IPP 1.3, in that she was already aware of the identity of the organisation, and it is reasonable to assume that she would not need to be told how to gain access to the information. As stated, she was aware of the purpose for which the information was collected. Other parts of IPP 1.3 - awareness of to whom the organisation usually discloses the information, any law that requires the particular information to be collected and the main consequences of not providing the information - were simply not relevant. Therefore, I consider that in collecting this information, the respondent complied with the provisions of the Act.

Jurecek v Director Transport Safety Victoria

At a glance

Court

Decision date

Source

Judgment (145 paragraphs)

Parties

Legislation Cited (3)

Cases Cited (2)

Jurecek v Director Transport Safety Victoria (Human Rights) [2015] VCAT 253 (20 February 2015)