The Respondent negligently or with wilful disregard for the provisions of the Act and in breach of the Act disclosed the Applicants' personal information to [the half-brother].

(a) protect the Applicants' personal information which it had obtained wrongfully and without authority

(b) prevent the misuse and unauthorised disclosure it obtained or otherwise collected from DHS; and

(c) prevent the unauthorised disclosure of the [personal information] to a third party, in this case, [the half-brother].

1. The closing written submissions say that, even if Anglicare was authorised to collect the personal information and use it to take an action or provide services under the CYF Act, that authorisation does not extend to the disclosure of Anglicare's records to a child and client. It is noted that the half-brother was not an employee or officer of Anglicare. Undisputed evidence of a lack of privacy related training to staff, including NFB, is relied on to contend that the duty to take reasonable steps was not met. That is said to be a breach of 4.1 which is separate entirely from any breach of IPP 2.1.[16]
2. Mr Clarke referred me to a number of paragraphs of the Guidelines.[17] The Guidelines discuss record management, staff training and the need to identify who in an organisation needs to have access to personal information in order to do their jobs. The Guidelines distinguish between those in the organisation who are able to access the information held, as compared to those who need to access the information. The Guidelines say that 'More usually, access will be restricted to a narrower group of persons within the organisation, particularly where the information is sensitive or delicate.'
3. Paragraph 4.17 says that a breach of IPP 2 may also involve a breach of IPP 4 and vice versa. A case study is used to illustrate. In the case study, a woman fleeing an abusive relationship changed her name by deed poll. Despite assurances to the contrary, a statutory authority to whom she supplied her new name and contact details disclosed those to her former partner. Paragraph 4.18 of the Guidelines has the effect that, even where data security arrangements are adequate to meet IPP 4, there may be an unauthorised disclosure contrary to IPP 2. The example given is of a person who ignored a computer warning not to disclose confidential information to unauthorised persons or access it for personal reasons. Paragraph 4.18 notes that careless and accidental disclosures may invoke both IPPs where the organisation could have better secured the information through record management procedures or staff training. Paragraph 4.27 notes that the reasonable steps called for by IPP 4 may be determined having regard to a range of matters including the nature of the information and the gravity of harm if a security breach occurs.
4. The Guidelines discuss disclosure, raising questions about whether there is a need to specify which persons or bodies are authorised recipients or, conversely, whether there are persons or bodies to whom the information should not be disclosed, because, for example there are safety concerns. Criteria, protocols or policies for determining who should have access and who is authorised to receive information are recommended. Guideline 4.37 says that organisations should ensure that their staff are aware of their access rights and responsibilities under the legislation. It is suggested that information be made available electronically, in handbooks, policies and procedural manuals.
5. Anglicare's Storage, Protection and Backup of Client Date Policy was in evidence.[18] In the written closing submissions, that Policy was described 'at best, a rudimentary framework' and as a document which 'does not even come close to meeting Anglicare's obligations under IPP 4.' The contention is that, based on the evidence, Anglicare's policy regarding the use and control over data was 'ad hoc, incomplete and ineffective'. The identified failures were said to constitute a failure to take reasonable steps to protect the personal information as required by IPP 4.1.[19]

1. Anglicare says that it is clear that IPP 4.1 is:

. . . designed to operate after the personal information is collected for a purpose, while it is being held, before it is used or disclosed for the relevant purpose. The intention is obvious: to ensure that while the information is held in anticipation of being used for the purpose of collection, it is not by mistake or theft obtained by a third party.[20]

1. Anglicare drew my attention to a diagram in the Guidelines which refers to the 'Life cycle of IPPs'.[21] The entry which mentions IPP 4.1 says:

• Ensure the organisation has security measures in place (IPP 4.1).
• Provide mechanisms to enable individuals to access and correct their information (IPP 6/Freedom of Information Act 1982 (Vic)).
• Update, amend and supplement the information, as necessary (IPP 3).

1. Reference was made to the Tribunal's decision in Kudleck v Victoria University.[22] That case, in part, concerned a university lecturer sending two emails about Ms Kudleck's academic performance and conduct to three other members of staff. The Tribunal found that the sending of the particular emails was for the primary purpose of collection or for a related secondary purpose and so there was no breach of IPP 2.1. The Tribunal said at paragraphs 78 to 79:

It follows from my findings in paragraphs 46 to 50 and 59 to 67 above that the sending of the initial emails containing Ms Kudleck's personal information did not contravene IPP 4.1 because the sending of the initial emails did not amount to "misuse", "loss" or "unauthorised access, modification or disclosure" of Ms Kudleck's personal information for the purposes of IPP 4.1.

The sending of the initial emails to the acting heads of school and the student progress coordinator were for the primary purpose of collection, that is, to enable VU to deliver the course of study. Accordingly, there was no "misuse" or "unauthorised disclosure" of Ms Kudleck's personal information. In addition, it is clear that Ms Kudleck's personal information was not lost, accessed or modified in an unauthorised manner when the initial emails were sent to the acting heads of school and the student progress coordinator.

1. Anglicare say that, if no breach of IPP 2.1 is established, there can be no breach of IPP 4.1.

1. I was not referred to any decisions of the Supreme Court (or any other court) or the Tribunal on the interpretation of IPP 4.1, other than Kudleck. As discussed earlier, while the Guidelines are not binding on me, they reflect the opinions and experience of the former Privacy Commissioner in respect of the old Act IPPs, which are the same as those which are contained in the PDP Act.
2. While the Guidelines and IPP 4 refer to 'unauthorised' , the word is not defined in the PDP Act or in the glossary of the Guidelines.
3. In addition to the paragraphs relied on by Mr & Mrs Roberts, I have considered paragraph 4.73. It says:

Access, modification or disclosure of personal information may be regarded as "unauthorised" where the person:

1. has no authority to access, modify or disclose the information - for example:
   1. where there is a legal restriction on access, modification or disclosure (eg, a statute may prohibit certain disclosures, or may restrict access to prescribed persons only);
   2. where the person is not employed by the organisation and has no entitlement to deal with the information;

iii. where the person obtains authority through fraud or deception;

1. where a purported demand for release of information has no basis in law or is otherwise invalid (eg, the demand power referred to by the requester does not exist); or

1. exceeds their authority - for example, where the person goes beyond their limited authority:
   1. to view certain information only (eg, by using their key to the file room to view confidential files unrelated to their duties);
   2. to make certain types of modifications only (eg, to update individuals' contact details but not otherwise alter the contents on their file);

iii. to disclose only to authorised persons or bodies; or

1. misuses their authority - for example, by accessing information they are entitled to access, but for an ulterior purpose or motive (such disclosing information for personal financial gain).

1. To the extent that Mr & Mrs Roberts' contentions depend on an assumption that the personal information was 'obtained wrongfully and without authority', they cannot succeed as no breach of IPP 1 has been alleged or proven. For the same reason, any internal assumptions about what was or was not authorised at the point of collection by Anglicare cannot be taken into account.
2. Having considered the structure of the IPPs and how IPP 4.1 is discussed in the Guidelines, in the circumstances of this case I am not persuaded that there may be a proven breach of IPP 4.1 where the alleged breach of IPP 2.1 has not been proven.
3. Like IPP 2, the foundation for the proper use and disclosure of personal information under IPP 4 is IPP 1. It is through IPP 1 that an organisation establishes why it collects personal information having regard to what is necessary for one or more of its functions or activities. Consistent with those functions and activities, disclosure is authorised where it is for the primary purpose of collection or within the terms of the secondary purposes discussed in IPP 2.1. This approach is consistent with the Tribunal's decision in Kudleck and with the way IPP 4.1 is discussed in the Guidelines, including its requirements forming part of the life cycle of responsible information management.
4. Where I have concluded that the personal information in issue was disclosed for the primary purpose of collection, I am not satisfied that I can also conclude that there has been an 'unauthorised disclosure' under IPP 4.1.

1. For the reasons given, I am not satisfied that Mr & Mrs Roberts have proven a breach of IPP 4.1.

1. Given that I have concluded that the alleged breaches of the IPPs have not been proven, it is not necessary for me to consider the application for compensation under section 77(1)(a)(iii) of the PDP Act. However, as that matter was the subject of a substantial amount of evidence and argument, I wish to make a brief comment about how I would have approached the issue had these allegations or any alternate or additional claim been proven.
2. On the evidence, it seems to me that the cause of the very significant upset and distress suffered by Mr & Mrs Roberts was the young men making contact in November 2011 and spending time together. Had Anglicare disclosed only the son's name and the suburb in which he lived or carefully managed contact between them in the manner discussed at the hearing, it seems most likely the same dreadful consequences would have resulted once they made direct contact. Arguably, any compensation would have been limited to the distress they experienced connected with the half-brother making telephone contact with them in June 2011.
3. Mr & Mrs Roberts also sought an order reimbursing them for expenses under section 77(1)(d) of the PDP Act. That section allows the Tribunal to make an order 'in any case' in favour of a complainant for reimbursement for 'expenses reasonably incurred by the complainant in connection with the making of the complaint and the proceedings held in respect of it under this Act.'
4. At the end of the hearing, I indicated that, if the complaints were proven, a further hearing would be held on the question of compensation, and in particular, the question of double recovery. While those matters do not need to be considered further, the matter of the expenses claim was not fully argued. I consider it appropriate to allow Mr & Mrs Roberts to indicate to the Tribunal and the respondent whether that claim is maintained and, if so, for what expenses. If the claim is maintained, the parties may wish to discuss whether a further hearing is required or whether they would consent to the matter being determined on the basis of written submissions.
5. As mentioned, this matter was not fully argued but I made some preliminary comments about it at the hearing. I noted that a number of the expenses claimed seemed not to have been incurred in connection with the proceeding here or before the Privacy Commissioner - for example taxi and other costs associated with Mr & Mrs Roberts' attempts to locate their son from time to time, the cost of installing an alarm system at their home and costs for counselling. I queried whether such expenses would have to be the subject of an award under the compensation provision (section 77(1)(a)(iii)). It is of course open to Mr & Mrs Roberts to put a contrary position for my further consideration.
6. Mr Nekvapil for Anglicare put Mr & Mrs Roberts on notice that it was Anglicare's view that legal costs did not fall within section 77(1)(d). As I understood it, that was put on the basis that section 109 of the Victorian Civil and Administrative Tribunal Act 1998 (Vic) has as its starting point an expectation that all parties bear their own costs and the PDP Act does not state that section 109 does not apply to the expenses referred to in section 77(1)(d).
7. I will make directions in respect of this question.

1. At the conclusion of the hearing, I also raised a question about the publication of my reasons beyond the parties given the suppression order made under section 17 of the Open Courts Act 2013 (Vic) and given section 534 of the CYF Act which prohibits the publication of identifying information arising from certain proceedings. Another matter of concern was confidential terms of settlement which were tendered to the Tribunal.
2. Out of an abundance of caution and to allow the parties to consider whether the publication of these reasons would raise concerns about the above matters, subject to any further order, I will direct the principal registrar not to publish my reasons for decision to any person other than the parties. I will, however, allow a copy of my orders to be made available on request. If the Tribunal does not receive submissions from the parties as to publication of these reasons by 9 December 2014, they shall be published in the usual way after that day.

1. It is apparent to me that all who have been involved in this case have been struck by its tragic consequences for the Roberts family. These events have also caused distress to Anglicare staff.
2. Having heard evidence from Mr & Mrs Roberts, I was impressed by the enormous contribution they made to the life of their son and to the Victorian community by first becoming foster parents and then permanent carers. I admire their commitment to their son and daughter and how they conducted themselves in the face of adversity. I regard them as reliable and honest witnesses. However, as I explained at the conclusion of the hearing, holding those views is not enough for them to succeed. My task has been to apply the proven facts to complex and technical law. As explained above, the complaints have not been proven and so the complaints must be dismissed. I will make that order but also wish the family all of the best in the future.

[2] Given that the IPPs under the new PDP Act are the same as those which were contained in the old Act and the Guidelines remain on the website of the Commissioner for Privacy and Data Protection, I have proceeded on the basis that they continue to be regarded as applicable to the re-enacted IPPs.

[3] Written submissions also dated 24 October 2014, for example paragraphs 7, 28 and 33.

[4] I note that the original complaint made to the Privacy Commissioner included allegations of breaches of IPP 1 .2 and 1.5.

[5] Respondent's Tribunal Book, page 46.

[6] Respondent's Tribunal Book, page 24.

[7] Witness statement dated 19 September 2014, paragraph 8

[8] Witness statement dated 10 October 2014, paragraph 3.

[9] See Outline of Complaints prepared with assistance of the Office of the Privacy Commissioner - Complainants' Tribunal Book, pages 1-7.

[11] [2005] VCAT 1054.

[12] Respondent's Tribunal Book, page 4-5.

[13] The concept of best interests comes from the Best Interest Principles contained in section 10 of the Children, Youth and Families Act 1995 (Vic).

[14] Complainants' Tribunal Book, page 77-78.

[15] Respondent's Tribunal Book, page 24.

[17] Respondent's closing written submissions, paragraph 30.

[19] Complainants' closing written submissions, paragraph 39.

[20] Respondent's closing written submissions, paragraph 31.

[21] Respondent's closing written submissions, page 34.

[22] [2013] VCAT 1971.