1. Under section 77(1)(a) of the Privacy and Data Protection Act 2014 (Vic) (Privacy Act), I find the complainant's complaint of a breach of Information Privacy Principle 3.1 proven in respect of a November 2016 disclosure made in the context of another person's Firearms Act 1996 (Vic) licence (Firearms Act disclosure).
2. Under section 77(1)(a)(ii) of the Privacy Act, I order that the respondent:

(a) Attach a copy of these orders and reasons for decision to its physical and electronic records of the Firearms Act disclosure; and

(b) Provide a copy of these orders and reasons for decision to the person to whom the Firearms Act disclosure was made.

1. Under section 77(1)(a)(iii) of the Privacy Act, I order that the respondent pay the complainant the sum of $1,000 as compensation for the breach referred to in order 1.
2. Under section 77(1)(c) of the Privacy Act, I find the complainant's other complaints are not proven and so they are dismissed.
3. Liberty to apply only in respect of any practical issues arising the respondent's capacity to comply with order 2(b) above.

1. Mr Visho Zeqaj complained that Victoria Police interfered with his privacy by disclosing certain information about him to third parties. Mr Zeqaj says that the information was inaccurate and untrue and so should not have been disclosed.
2. The disclosures related to communications between Victoria Police and the Australian Taxation Office (ATO) and one of Mr Zeqaj's relatives who is the holder of a firearms licence.
3. In essence, Mr Zeqaj said Victoria Police has told others he is a 'known criminal identity' and that he has been involved with others in the cultivation, distribution and sale of commercial quantities of cannabis. He regards that as slander. Mr Zeqaj said he does not particularly care what information Victoria Police holds about him, but it should not disclose information to others which is not accurate, complete and up to date.
4. Mr Zeqaj said, and Victoria Police records confirm, he has not been convicted or found guilty of any criminal offence. Mr Zeqaj made a statutory declaration stating that he had never been involved in the activities described above.[1] He challenged Victoria Police to charge him with perjury if it believed that declaration was incorrect. Mr Zeqaj believes he has been denied his right to be presumed innocent.
5. Mr Zeqaj's claim falls under the Privacy and Data Protection Act 2014 (Vic) (Privacy Act)[2] which contains Information Privacy Principles (IPPs). As discussed later, the IPPs contain a regime for the collection and handling of personal information.
6. Mr Zeqaj complains that Victoria Police breached two IPPs and has asked the Tribunal to order it to:
   • Apologise to him;
   • Pay him $100,000, being the maximum amount of monetary compensation available under the Privacy Act, for the upset and distress the disclosures caused him, including aggravated damages; and
   • 'Be held accountable and to rectify and communicate the details of the inaccurate allegations to all parties that Victoria Police have disclosed the information to.'
7. Victoria Police denied breaching the Privacy Act. It says, when it disclosed information about Mr Zeqaj, it was doing so as part of its law enforcement and community policing functions and so was not required to comply with relevant IPPs. In any event, it says its actions were either within the terms of the relevant IPPs or within express exceptions and so no breach could be proven, even if the IPPs applied.
8. Victoria Police also said the information in issue was based on information or intelligence that was accurate at the time it was recorded and disclosed.
9. I record here that, in the course of the hearing, I ruled that evidence was not to be given by the police officer witnesses as to the sources of intelligence about Mr Zeqaj, including the material Victoria Police relied on when it sought information from and responded to the ATO. I made that ruling on the basis that it was not in the public interest for material of that kind to be disclosed as it might prejudice the prevention, investigation or prosecution of an offence.[3]
10. The primary hearing day for the proceeding was on 10 July 2018. A further directions hearing was held on 2 August 2018 in order for me to determine Victoria Police's application to file further affidavit material. I decided to allow further material to be filed and made orders allowing Mr Zeqaj to seek a hearing if he wished and to file further material in reply. The orders also provided for written submissions from both parties.

1. Mr Zeqaj became aware of the following disclosures as a consequence of obtaining documents from the ATO under Freedom of Information laws.
2. In May 2011, Victoria Police sent a notice to the ATO requesting taxation information about Mr Zeqaj (and others) for the period 30 June 2004 to 30 June 2010. The notice was issued under section 355-70(1) of Schedule 1 of the Taxation Administration Act 1953 (Cth).
3. The relevant section of the ATO proforma notice[4] required the entity seeking information to describe the serious indictable offence the information sought related to and an explanation as to how the information would assist. Victoria Police completed that part of the form by inserting the words 'Trafficking Drug of Dependence' with reference to the Drugs Poisons & Controlled Substances Act 1981 (Vic). The form was completed by Victoria Police to show the relevance of the information was as follows:

The investigation seeks to determine what legitimate income is declared by the subjects to compare against known assets in order to determine the extent of income derived from criminal activity.

1. On 23 May 2012, the ATO issued a notice to Victoria Police requesting specified information about Mr Zeqaj (and others) for the period 1 July 2003 to the date of the notice. The information sought was that 'concerning the income or assessment of' the named persons. The notice was issued under section 264 of the Income Tax Assessment Act 1936 (Cth), which says relevantly, that the Tax Commissioner may by notice in writing require any person to furnish him with such information as he may require, subject to exceptions which did not apply in this case. The notice stated that it was an offence to fail to comply with such a notice.
2. Mr Zeqaj produced a copy of an undated ATO document which carried a number of redactions.[5] On its face, the document appeared to have been created by the ATO but it referred to information apparently provided by Victoria Police. I understand the content of that document summarises information Victoria Police supplied to the ATO in response to its 23 May 2012 request. Relevantly, the document referred to Mr Zeqaj as someone identified as being involved in the cultivation, distribution and sale of cannabis. Under a heading which said 'Is the taxpayer linked to organised crime?', an entry was made which referred to Mr Zeqaj as someone Victoria Police alleged was part of a group involved in the cultivation, distribution and sale of cannabis.

Firearms Act disclosure

1. In November 2016, a person I will call A, received notice from Victoria Police's Licensing and Regulation Division that his longarm licence had been suspended and that the Chief Commissioner of Police intended to cancel that licence.[6]
2. The letter was issued under the then applicable version of section 49(1)(f) of the Firearms Act 1996 (Vic). Senior Sergeant Andrew Armstrong wrote the letter as the delegate of the Chief Commissioner and stated the reason the licence had been suspended was because:

I am of the belief that you are currently not a fit and proper person to be in possession of firearms or a firearms licence namely Police are in possession of intelligence whereby it is alleged you associate with known criminal identities (my emphasis).

1. The letter invited A to make a written submission concerning the suspension and proposal to cancel the licence.
2. There was no dispute A telephoned Senior Sergeant Armstrong and asked for more time to respond and asked for information about how to do so. Following that telephone call, Senior Sergeant Armstrong sent A an email that allowed additional time for a response and said:

Submission should address your relationship with the following:

1. A provided a written response to Victoria Police through his solicitors and, in due course, his licence was reinstated.
2. A is a close family member of Mr Zeqaj.
3. A told Mr Zeqaj about what had occurred and gave him a copy of Senior Sergeant Armstrong's letter and email.
4. I will now turn to the Privacy Act and the provisions relied on by both parties.

1. The Privacy Act contains a regime for the responsible collection and handling of personal information in the Victorian public sector and provides remedies for interferences with the information privacy of individuals. There was no dispute that Victoria Police is bound by the Privacy Act and was bound by the predecessor legislation, the Information Privacy Act 2000 (Vic).
2. The term 'personal information' is defined in section 3 of the Privacy Act to mean information or an opinion that is recorded in any form and whether true or not, about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.
3. The regime for the collection and handling of personal information is set out in Schedule 1 of the Privacy Act in the form of Information Privacy Principles (IPPs). By section 20 of the Privacy Act, organisations such as Victoria Police must not do an act or engage in a practice that contravenes an IPP.
4. The IPPs deal with personal information and also 'sensitive information' which is defined to mean, amongst other things, information or an opinion about 'an individual's criminal record'. That term is not defined in the Privacy Act, but Victoria Police noted the Privacy and Data Protection Commissioner's Guidelines to the IPPs (3rd Edition) (Guidelines) said this:

"Criminal record" should be broadly interpreted to mean "any information associating an identifiable individual with criminal behaviour, whether or not charged, convicted, or found guilty".[8]

1. As is required by the Privacy Act, Mr Zeqaj first made a complaint about the ATO disclosures and the Firearms Act disclosure to the Privacy and Data Protection Commissioner (Commissioner). The Commissioner referred the complaint to this Tribunal after it concluded that it was not reasonably possible for the complaint to be successfully conciliated and after Mr Zeqaj exercised his right to have the matter referred.[9]
2. It is convenient to note here that, in his submissions, Mr Zeqaj made assertions about what he believed to be the Commissioner's views of his complaints. Given the circumstances of the referral, I have put those assertions to one side. I have also put to one side Mr Zeqaj's request that the Tribunal seek the Commissioner's views before making findings in this matter, as it is for the Tribunal to make its own assessment of the complaints. Finally, as the Tribunal may only consider the complaints made to the Commissioner, I have disregarded Mr Zeqaj's queries about whether Victoria Police disclosed information of the kind in issue to third parties other than the ATO and A.
3. Mr Zeqaj complained that the ATO and Firearms Act disclosures breached IPP 2.1 and IPP 3.1.
4. IPP 2 deals with the use and disclosure of personal information. It is well understood that organisations bound by the Privacy Act are required to only use and disclose personal information for the purpose for which it was collected, unless an express exception applies.
5. Relevantly, IPP 2.1 says:

An organisation must not use or disclose personal information about an individual for a purpose (the secondary purpose) other than the primary purpose of collection unless -

(i) the secondary purpose is related to the primary purpose of collection and, if the personal information is sensitive information, directly related to the primary purpose of collection;

(ii) the individual would reasonably expect the organisation to use or disclose the information for the secondary purpose; or

(e) the organisation has reason to suspect that unlawful activity has been, is being or may be engaged in, and uses or discloses the personal information as a necessary part of its investigation of the matter or in reporting its concerns to relevant persons or authorities; or

(f) the use or disclosure is required or authorised by or under law;

An organisation must take reasonable steps to make sure that the personal information it collects, uses or discloses is accurate, complete and up to date.

1. Victoria Police relied on section 15 of the Privacy Act to say that IPP 2.1 did not apply to it and so no breach can be proven.
2. I will first summarise Victoria Police's evidence[10] about the disclosures and then discuss how section 15 and the relevant IPPs apply.

1. Detective Sergeant Coghlan made a witness statement on 21 June 2018,[11] and attended the hearing to give oral evidence. He has been a member of Victoria Police since 1980 and has been a Detective Sergeant since 2003. He is currently a supervisor at the Crime Stoppers Unit but in 2011 worked in the Security and Organised Crime Intelligence Unit.
2. Detective Sergeant Coghlan stated that in late 2011, he was working on an operation regarding an extensive financial intelligence probe into the assets held by Mr Zeqaj's family. Victoria Police was said to have held intelligence which indicated that Mr Zeqaj's father and members of his family were involved in the cultivation, distribution and sale of large quantities of cannabis. Investigators believed the families' 'significant asset portfolio' was tainted and had been derived or realised (or substantially derived or realised) directly or indirectly from the commission of offences involving cannabis.
3. Detective Sergeant Coghlan explained that it is standard practice for Victoria Police to, when conducting investigations of this kind, gather all financial records of the relevant 'persons of interest', including their tax records. Tax records are obtained by making an Information Disclosure Request under the Taxation Administration Act 1953 (Cth). That was the basis on which the Victoria Police made its request to the ATO in 2011.
4. On being cross-examined by Mr Zeqaj, Detective Coghlan agreed that, as at the hearing date, no charges had been laid against Mr Zeqaj in relation to the cannabis related offences mentioned and he had not been brought before a court or found guilty of any offence.
5. Mr Zeqaj asked Detective Sergeant Coghlan whether he considered an allegation or opinion to be accurate. The response was 'until proven otherwise'.
6. Detective Sergeant Coghlan gave evidence that, at the time the ATO was given information by Victoria Police in 2012, that information was accurate and up to date. He said he could not comment on whether the ATO's records were accurate and up to date.

1. As mentioned earlier, Senior Sergeant Armstrong is an officer with Victoria Police's Licensing and Regulation Division. He was the author of the Firearms Act disclosures. Senior Sergeant Armstrong made a witness statement on 22 June 2018,[12] and was available to give evidence by telephone.
2. Senior Sergeant Armstrong explained his role includes assessing the suitability of individuals to be granted a firearms licence and making decisions about whether those licences should be suspended or cancelled.
3. He gave evidence that, in around 2016, A's firearms licence was reviewed on the basis of intelligence received which indicated he may have been involved in an organised criminal association or network. I understood from his oral evidence that Mr Zeqaj's name was connected with A's in police records due to their family relationship.
4. In his oral evidence, Senior Sergeant Armstrong stated that he did not know the source of the intelligence referred to in his letter to A or whether it was accurate. Senior Sergeant Armstrong explained that rather than diving into the intelligence, he thought it prudent to check with A. As a result, he did not know at the time the letter was written whether it was correct for Mr Zeqaj to be described as a 'known criminal identity'. He had 'no idea' who had called Mr Zeqaj a ' known criminal identity'.
5. Senior Sergeant Armstrong's evidence was that, having received the intelligence, he simply assessed whether the licence ought to be suspended ahead of an assessment about whether it ought to be cancelled because A was not a fit and proper person. That process led to him writing to A and the steps outlined above. He confirmed the purpose of the process was to give A a chance to comment or explain before a final decision was made.
6. Senior Sergeant Armstrong gave evidence that, after sending the letter to A, they spoke and he provided the additional information in the email to assist in the preparation of a submission. A response was received from A's solicitors and, having assessed it, he decided to reinstate the licence.
7. In particular, Senior Sergeant Armstrong gave evidence that the explanation satisfied him that there were no concerns about A's fitness to hold the licence arising from his association with Mr Zeqaj. In cross-examination, he confirmed that Mr Zeqaj was 'not a person of concern' but indicated other family members were. When asked why Mr Zeqaj's name was included, he stated that was because of the familial connection and that all members of the family were listed as associates of A.
8. Based on Senior Sergeant Armstrong's evidence, I find that the letter and email may be read together so that the email is understood as listing the names of the 'known criminal identities' mentioned in the letter.
9. Senior Sergeant Armstrong made a further statement in the form of an affidavit on 3 August 2018. The affidavit attached extracts from the Victoria Police Manual (Manual) which contains policies and procedures issued under the authority of the Chief Commissioner. I note that the Manual is publicly available and Victoria Police send a complete copy to Mr Zeqaj before his final submissions were due.
10. Senior Sergeant Armstrong's witness statement said non-compliance with the Manual can constitute a breach of discipline and may lead to the relevant officer being subject to management or disciplinary action.
11. Senior Sergeant Armstrong attached extracts from the Manual which included the following:

Victoria Police information must be recorded in a Victorian Police endorsed system that maintains its confidentiality, integrity and availability in accordance with the following data quality principles:

- Accurate - Information should be recorded accurately first time. Care must be taken when recording information and where appropriate, the source of the information must also be recorded. If there is any doubt over the authenticity of the information, clarification should be sought from the source. Inaccurate information must be corrected as soon as possible. In ensuring accuracy and currency of information, it is important to retain historic information that may be significant or relevant

- Relevant - Information recorded must be relevant to policing purpose. The nature of the event will determine what information is relevant. Opinions need to be clearly distinguished from fact

- Complete - Recorded information must include all the available information. All recorded information must be easily understood by others including content, context and structure

- Timely - Information must be promptly recorded into the relevant repository (my emphasis)

1. In its written submissions, Victoria Police drew my attention to a section of the Manual which deals with monitoring 'priority persons of interest'. The Manual says such individuals require deliberate consideration of 'management options' to prevent significant impact on community safety or on divisional, regional, command or state priorities. Clause 4.1 explains:

A standardised intelligence and [tasking and coordination] process for prioritising and targeting Persons of Interest (POI) achieves the following objectives:

• ensures a coordinated approach across the State for addressing priority POI that minimises duplication of effort and increases efficiencies
• provides a standardised framework for addressing priority POI by reviewing key inputs and deciding the most appropriate response
• enhances the accountability, transparency and consistency of POI identification, threat assessment, prioritisation and intelligence management processes
• improves the effectiveness of proactive target selection to impact local and State priorities and focus intelligence collection activity to the highest priority POI.

1. Clause 4.6 states that frontline members and investigators must nominate all potential POIs who, amongst other things, are 'assessed as having significant current impact on Divisional/Command priorities', organised crime authorities and 'other high risk offenders'. POI National Security flags in Victoria Police's Law Enforcement Assistance Program (LEAP) system must be reviewed six monthly to ensure the relevant risk rating is accurate and current.
2. Clause 8 of the Manual says that, where a criminal charge was withdrawn or no offence was disclosed or detected, the report is to be marked accordingly with records updated to reflect that outcome.
3. I will comment on those parts of the Manual later.

Section 15 exemption - law enforcement

1. Victoria Police contended that it could not have acted in breach of IPP 2.1 in relation to any of the three disclosures because, as a result of section 15 of the Privacy Act, that IPP did not apply.[13]
2. Section 15 says:

It is not necessary for a law enforcement agency to comply with IPP 1.3 to 1.5, 2.1, 6.1 to 6.8, 7.1 to 7.4, 9.1 or 10.1 if it believes on reasonable grounds that the noncompliance is necessary -

(a) for the purposes of one or more of its, or any other law enforcement agency's, law enforcement functions or activities; or

(b) for the enforcement of laws relating to the confiscation of the proceeds of crime; or

(c) in connection with the conduct of proceedings commenced, or about to be commenced, in any court or tribunal; or

(d) in the case of Victoria Police, for the purposes of its community policing functions.

1. Victoria Police is expressly included in the definition of the term 'law enforcement agency'.[14]
2. Victoria Police contended that the ATO disclosures both fell within section 15(a) above on the basis that Victoria Police's law enforcement functions and activities include preventing the commission of offences and detecting and apprehending offenders. Victoria Police relied on section 9 of the Victoria Police Act 2013 (Vic) (VP Act) for that proposition.
3. Section 8 of the VP Act says that the role of police is to 'serve the Victorian community and uphold the law so as to promote a safe, secure and orderly society'. Section 9(1) of the VP Act says that the functions of police include:

1. Those provisions were not in force in 2011 and 2012 when the ATO disclosures were made. In Djime v Kearnes,[15] I discussed the legislation which preceded the VP Act, the Police Regulation Act 1958 (Vic). The 1958 Act did not expressly set out the role or functions of police but did include an oath which all police officers were required to take. That oath provided, amongst other things, that the officer swore to 'see and cause Her Majesty's peace to be kept and preserved', to 'prevent to the best of my power all offences against the same' and 'to the best of my skill and knowledge discharge all the duties legally imposed upon me faithfully and according to law'.[16]
2. Despite the change in legislation, I took the view in Djime that the VP Act described Parliament's view of the role of police over the relevant period. I considered that the matters set out in sections 8 and 9 were consistent with the general community's expectation and understanding of the broad role and function of police. I take the same approach here.
3. Noting the role and functions of Victoria Police as described in sections 8 and 9 of the VP Act and the content of the Manual, I am satisfied that, when Victoria Police collects personal information about possible breaches of the law, past and current investigations of possible breaches of the law and of court outcomes, it does so for the primary purpose of undertaking that role and those functions (VP Act duties). I am satisfied that section 15(a) to (d) contain another comparable description of the VP Act duties.
4. Accordingly, I find that seeking information from the ATO in 2011 and responding to its 2012 request for information fell within the meaning of section 15(a) of the Privacy Act as it was sought for the purposes of one or more of Victoria Police's law enforcement functions or activities.
5. Victoria Police contended that the Firearms Act disclosure occurred in the context of its community policing activities and so was within section 15(d). It relied on the purposes of the Firearms Act which include the principle that the possession, carriage, use, acquisition and disposal of firearms are conditional on the need to ensure public safety and peace. That purpose is to be achieved in part by the establishment of a system of licensing and regulating the possession, carriage and use of firearms and related items and the establishment of a system of licensing and regulating the carrying on of the business of dealing in firearms. By section 9 of the Firearms Act, the Chief Commissioner has the power to issue licences.
6. Victoria Police also referred me to the Explanatory Memorandum to the Privacy Act which said that 'community policing function' is intended to refer to, amongst other things, licensing.
7. I accept those submissions and find the assessment of licence applications or assessments as to whether to suspend licences under the Firearms Act is a community policing function within section 15(d) of the Privacy Act. Given the Firearms Act contains a fit and proper person test and that may raise a licensee's past conduct and past and present associations, it also overlaps with the VP Act duties.
8. The issue raised by section 15 in this case is how to identify when a law enforcement agency, such as Victoria Police, 'believes on reasonable grounds that the noncompliance [with the identified IPPs] is necessary'.
9. I considered the equivalent of section 15 in the then applicable Information Privacy Act 2000 (Vic) in Zeqaj v Victoria Police.[17] The relevant part of the decision concerned whether Victoria Police had breached IPP 1.3 during the course of the execution of a search warrant.
10. At paragraph 129 of the reasons for decision I said this:

No evidence was given by any of the police officers present, including the officer in charge of the execution of the warrant, Detective Sergeant Coghlan, to the effect that a belief was formed that non-compliance with IPP 1.3 was necessary. No evidence was given that the officers present or Victoria Police more generally had formed a belief that, when search warrants are being executed, that non-compliance with IPP 1.3 is necessary. I leave section 13 of the Privacy Act to one side.

1. In this case, Victoria Police contended that:
   • The term 'noncompliance' in section 15 refers to the action to be taken by the relevant law enforcement agency that, but for the operation of that section, would otherwise constitute a noncompliance;
   • For the section to apply, it cannot require an officer to turn their mind to section 15 specifically, identify a breach of an IPP, form a belief that such a breach is necessary and record that belief in such a way that there is contemporaneous evidence of the need for it;
   • The above proposition was said to be clear from the Explanatory Memorandum references to community policing functions such as the location of missing persons, public emergency situations and locating next of kin - all of which may require immediate and rapid use of personal information;
   • 'In such situations, a separate legislative requirement to consider noncompliance with IPP 2.1 would potentially create a life-threatening impediment to the necessary performance of [Victoria Police's] functions. At the least, it would impose a significant administrative burden and practical impediment to routine community policing functions such as door-knocking to locate missing persons or next of kin.'; and
   • Rather, the section requires that the action to be taken by Victoria Police is to be based on a belief on reasonable grounds that such an action is necessary for one of the purposes listed in the section.
2. As I understood Victoria Police's submission, what was required to be shown was that there was a reasonable belief that the policing activity in issue (within 15(1)(a) to (d)) was necessary without any need to consider the IPPs.
3. Victoria Police contended that section 15 could be contrasted with IPP2.1(g) and IPP 2.2 which require that an organisation that reasonably believes that a use or disclosure is reasonably necessary for a listed purpose on behalf of a law enforcement agency must make a written note of the use or disclosure.

1. Mr Zeqaj did not agree that section 15 applied in this case. In his Evidence Supporting Complaint document he said that section 15 of the Privacy Act 'does not exempt Victoria Police from using damaging, hurtful, false, misleading, inaccurate and malicious allegations for an unauthorised secondary purpose.'

1. I noted Victoria Police's submission about comparable provisions. In my view, it is of greater assistance to compare section 15 of the Privacy Act with one of the other sections exempting organisations from compliance, rather than with IPP 2.1(g) or IPP 2.2. For example:

Nothing in this Act or in any Information Privacy Principle or any data security standard applies in respect of the collection, holding, management, use, disclosure or transfer of information -

(a) in relation to its or the holder's judicial or quasi-judicial functions, by -

(ii) the holder of a judicial or quasi-judicial office or other office pertaining to a court or tribunal in their capacity as the holder of that office; or

(b) in relation to those matters which relate to the judicial or quasi-judicial functions of the court or tribunal, by -

(i) a registry or other office of a court or tribunal; or

(ii) the staff of such a registry or other office in their capacity as members of that staff

(1) Nothing in this Act or in any Information Privacy Principle or any data security standard applies to any information contained in a document that is -

(b) kept in a library, art gallery or museum for the purposes of reference, study or exhibition; or

(c) a public record under the control of the Keeper of Public Records that is available for public inspection in accordance with the Public Records Act 1973; or

(d) archives within the meaning of the Copyright Act 1968 of the Commonwealth.

(2) Subsection (1) does not take away from section 20(2) which imposes duties on a public sector agency or a Council in administering a public register.[18]

1. What is notable about these other exemptions is that, not only do they have blanket effect, there is no mention of the otherwise bound organisation being required to hold a belief before the exemption applies.
2. The operative phrase in section 15 is in the present tense and says Victoria Police is not required to comply with the specified IPPs 'if it believes on reasonable grounds that the noncompliance is necessary' to undertake the categories of duties or tasks described.
3. In my view, if Victoria Police's submissions were correct, section 15 could simply have stated the relevant IPPs did not apply to the identified law enforcement activities without any reference to it holding a belief on reasonable grounds that the noncompliance is necessary.
4. I accept that the formation of the relevant belief arises from Victoria Police undertaking its duties or tasks. I accept that, if it were not for the required belief being formed, Victoria Police would be required to comply with the relevant IPPs.
5. However, in my view the belief must not only be that the duty or task must be undertaken but that, in order to perform that duty or task, it is necessary not to first comply with the IPPs which would otherwise apply. The belief the noncompliance is necessary is linked not to the action Victoria Police intends to take, but to the IPPs which would otherwise apply.
6. I accept Victoria Police's contentions that this reading may cause difficulties in urgent or emergency situations but that is not relevant to the interpretive task before me.
7. Accordingly, I find that, in order for section 15 of the Privacy Act to apply, there must be evidence of a belief of the kind referred to having been formed. As no evidence to that effect was given in relation to either the ATO disclosures or the Firearms Act disclosure, I cannot find section 15 applies.
8. I will now turn to the alleged breaches of the IPPs.

1. As set out above, IPP 2.1 is concerned with how organisations use information they collect.

1. Mr Zeqaj contended that, when Victoria Police made the ATO disclosures, it used and disclosed the personal information it had collected for an unrelated secondary purpose, namely to maliciously disclose allegations to third parties. He made that submission based on the fact that Victoria Police had not presented any evidence to show the allegations regarding his involvement with cannabis related offences were true and he had never been charged with, not to mention found guilty of, any such offences.
2. Mr Zeqaj produced an April 2018 printout which showed there were no disclosable outcomes for him on LEAP. Printouts of Magistrates' orders show that in 2009 charges of assault, resist and hinder police laid against him were struck out/withdrawn.
3. Victoria Police contended that, when it collected and held personal information in relation to Mr Zeqaj's possible involvement in the cultivation, distribution and sale of cannabis, that was done as part of its law enforcement activities and functions. It contended the use of that information was consistent with the primary purpose of collection.
4. Relying on Detective Sergeant Coghlan's evidence, Victoria Police's position was that, when it made the 2011 ATO disclosure, it did so in the context of its then current investigation into Mr Zeqaj's family and the financial information it sought was a relevant and important part of the investigation. Accordingly, it contended that, explaining to the ATO why the information was sought, was a necessary part of the primary purpose of collection and so within IPP 2.1.
5. Similarly, it contended that, when it disclosed information to the ATO in 2012, Victoria Police did so as part of its law enforcement functions or activities and so that use fell within IPP 2.1. I understood that submission was made on the basis that it is part of Victoria Police's role to work and cooperate with other law enforcement agencies, such as the ATO.[19]
6. I accept those submissions. I find that the personal information about Mr Zeqaj which had been collected by Victoria Police in the context of its VP Act duties - that is preserving the peace, protecting life and property, preventing the commission of offences and detecting and apprehending offenders - was used for those purposes rather than for a secondary purpose.
7. I have noted Mr Zeqaj's view that there was no basis for his name to be mentioned in the context of that investigation and he believes Victoria Police had no basis to treat him as part of the group it was investigating. However, I am satisfied, taking into account Detective Sergeant Coghlan's evidence, that Victoria Police was acting to undertake its VP Act duties when it made the disclosures to the ATO.
8. I record that it is apparent from the material that the content related to allegations only and it was not asserted that charges had been laid or that any convictions or findings of guilt had been made. As is clear from the Privacy Act definition of 'personal information', that can include information which contains opinion and material which may not be true. Accordingly, a breach of IPP 2.1 is not proven because the relevant information is opinion only or is not true.

1. Even if Victoria Police was found to have used Mr Zeqaj's personal information for a purpose other than the primary purpose of collection, I am satisfied that it could rely on an exception to IPP 2.1 for each of the ATO disclosures.
2. The first relevant exception is that contained in IPP 2.1(e) - Victoria Police had reason to suspect that unlawful activity had been, was being or may have been engaged in, and used or disclosed the personal information as a necessary part of its investigation of the matter.
3. I accept Detective Sergeant Coghlan's evidence that, at the time the 2011 ATO disclosure was made, Mr Zeqaj was one of a number of people being investigated and that investigation concerned, in part, the source of funds which had been used to purchase family assets. The fact that no criminal action resulted is not material, provided the request was made in the circumstances described in IPP 2.1(e).
4. Accordingly, as the exception in IPP 2.1(e) applied, even if Victoria Police was not protected by section 15 of the Privacy Act or it had appeared to have breached IPP 2.1, no finding could be made that Victoria Police had interfered with Mr Zeqaj's privacy as a result of the 2011 ATO disclosure.
5. The second relevant exception is contained in IPP 2.1(f) - Victoria Police's use and disclosure of the personal information was required or authorised by or under law. The word 'requires' includes demands or necessitates and extends to warrants, court orders and statutory provisions. The phrase 'authorised by law' refers to a law which permits the act but does not make it compulsory.[20]
6. I am satisfied IPP 2.1(f) clearly applies given Victoria Police was legally obliged and so 'required' to comply with the ATO notice as a result of section 355-70(1) of Schedule 1 of the Taxation Administration Act 1953 (Cth).
7. Where an exception applies, there can be no proven interference with a complainant's privacy contrary to section 20 of the Privacy Act.
8. The complaints that Victoria Police breached IPP 2.1 in respect of the ATO disclosures must be dismissed.

Firearms Act disclosure - IPP 2.1

1. I have described above Senior Sergeant Armstrong's evidence about his role and functions when assessing whether to suspend or cancel a firearms licence.
2. Section 47 of the Firearms Act sets out how the Chief Commissioner (or his or her delegate) makes decisions about suspensions and cancellations. It says:
   • If the Chief Commissioner is satisfied that there may be grounds for cancelling a licence under section 49 the Chief Commissioner may suspend the licence
   • If a licence is suspended, the Chief Commissioner must serve notice of the suspension of the licence on the holder of the licence either personally or by post;
   • The notice must include the grounds relied on for the suspension decision; and
   • State that the holder of the licence may make written submissions within 28 days of the giving of the notice.
3. Under section 49(1), the Chief Commissioner is required to consider any written submissions received in the stated time frame before deciding whether to cancel a suspended licence.
4. In other words, the Firearms Act requires that, where a licence is suspended pending an assessment of whether it will be cancelled, the licence holder must be told why that has been done and be given a chance to make submissions which must then be considered. It was in this context the Firearms Act disclosure was made.
5. Mr Zeqaj contended the disclosure was made for the primary purpose of deceiving A.
6. I am satisfied that the assessment of whether a person is fit and proper to hold a firearms licence may be made taking into account information held by Victoria Police which is relevant to the person under consideration, including information which may link the person to others. I am satisfied that information about Mr Zeqaj was used for the purpose of Victoria Police's VP Act duties to preserve the peace, protect life and property and prevent the commission of offences - that is, making an assessment of whether A ought to hold a firearms licence taking into account his character and associates. I am satisfied it was necessary for Mr Zeqaj's name to be disclosed in order to allow A a fair opportunity to respond to the material Victoria Police was considering. I will come to the descriptor attached to Mr Zeqaj's name later in these reasons.
7. In those circumstances, I am satisfied the Firearms Act disclosure was made within the primary purpose of collection and so there was no breach of IPP 2.1.

1. Even if Victoria Police was found to have used Mr Zeqaj's personal information for a purpose other than the primary purpose of collection, I am satisfied that it could rely on an exception to IPP 2.1 for the Firearms Act disclosure.
2. Victoria Police relied on the exception in IPP 2.1(f) - Victoria Police's use and disclosure of the personal information was required or authorised by or under law.
3. Noting sections 47 and 49 of the Firearms Act summarised above, I am satisfied on Senior Sergeant Armstrong's evidence that he made the suspension decision after considering Victoria Police intelligence. He was required to inform A why his licence had been suspended and, on his evidence, one of those reasons was because of A's relationship with Mr Zeqaj as contained in Victoria Police records.
4. I am satisfied IPP 2.1(f) applies given Victoria Police was legally obliged to give the reasons why it had suspended the person's firearms licence and so that disclosure was required or authorised by law.
5. As discussed above, where an exception applies, there can be no proven interference with a complainant's privacy contrary to section 20 of the Privacy Act.
6. The complaints that Victoria Police breached IPP 2.1 in respect of the Firearms Act disclosures must be dismissed.

1. Section 15 of the Privacy Act does not exclude IPP 3.1 and so it applies to Victoria Police.
2. As set out earlier, the obligation on Victoria Police under IPP 3.1 is to take reasonable steps to make sure that the personal information it collects, uses or discloses is accurate, complete and up to date.

1. Mr Zeqaj contended that the information about him disclosed to the ATO by the two requests and through the Firearms Act disclosure was not accurate, complete or up to date because none of it was true at the time and nor is it true now. As set out earlier, he seeks correction of the records, including notice of correction to relevant persons, and compensation.
2. Mr Zeqaj contended that the content of the Firearms Act disclosure - him being described as a 'known criminal identity' was a lie - he contended that descriptor was inaccurate and, had it been true, A's firearms licence would not have been reinstated.
3. He regards the material included in the ATO disclosures as out of date and inaccurate.
4. Mr Zeqaj contended that, although there may have been allegations about him (the foundation for which he disputes), no charges have been laid against him and so it cannot be said the allegations are accurate, complete or up to date. He contended that, given the resources available to Victoria Police, it ought to be in a position to describe a matter not as an allegation but as either true or false.
5. Mr Zeqaj made particular reference to the fact that the assault police and related charges were not only withdrawn but, in settlement of a civil claim brought in the County Court of Victoria, Victoria Police agreed to pay his costs.[21]
6. Mr Zeqaj also alleged that Victoria Police had breached section 13(b) of the Charter of Human Rights and Responsibilities Act 2006 (Vic) (Charter) which says:

(b) not to have his or her reputation unlawfully attacked.

1. As to his claim for compensation, Mr Zeqaj said this:

To say that what Victoria Police have provided to third parties including government departments and agencies won't affect future job prospects and denied holiday travel to countries with strict entry rules is ignorantly blind and deeply hurtful. We all know when applying for a good job or entering another country, background checks are done, what do you think will show up and happen when my name pops up again . . . These lies are permanently on the system, for ever, what I done to deserve that.

1. Mr Zeqaj described his 'deeply hurt feelings' which have led to 'anger and a deep and lasting hatred for the lies that Victoria Police have spread which directly attacks [his] reputation'.

1. In its written submissions, Victoria Police said it understood from the hearing and Mr Zeqaj's submissions that his general complaint was that Victoria Police holds personal information that 'implies or suggests that he is a criminal identity, has a criminal history or criminal associations, and that any such information is false or untrue'.
2. Victoria Police submitted that the content of its Manual,[22] demonstrated that it takes reasonable steps of the kind described in IPP 3.1 due in part to the obligations the Manual places on officers to make appropriate and accurate records of events and to retain those for future reference. Further, it contended the deliberate creation and promulgation of instructions to all members in a manner that is empowered to attract legislatively established disciplinary penalties demonstrates Victoria Police's reasonable steps in compliance with IPP 3.1.
3. Victoria Police contended that the information held about Mr Zeqaj was accurate, complete and up to date at the time it was collected and used. It contended that, as its records showed Mr Zeqaj had been interviewed for allegedly assaulting police and associated with known convicted criminals or with persons with a criminal history, he had a 'criminal record' in the wider sense discussed in the Guidelines - that is, its records contained information associating an identifiable individual with criminal behaviour, whether or not charged, convicted or found guilty.
4. Victoria Police submitted that there had been no breach of IPP 3.1 and further, that it had not engaged in any conduct which amounted to an unlawful attack on Mr Zeqaj's reputation contrary to section 13(b) of the Charter.
5. Accordingly, it contended that no award of compensation ought to be made. Victoria Police noted that, in any event, Mr Zeqaj had not produced any evidence, including any medical evidence, to support his claim he had suffered compensable loss or damage.

1. I accept that Victoria Police's Manual and its past and current privacy policies demonstrate that it takes reasonable steps to meet the obligation under IPP 3.1 on an organisation wide basis. However, that is not the end of the matter, because the obligation applies to whether the required reasonable steps are taken in relation to individual pieces of personal information.
2. The personal information in issue in respect of IPP 3.1 may be summarised as follows:

(a) In 2011, Mr Zeqaj (and members of his family) was the subject of a Victoria Police investigation. The serious indictable offence in issue was 'Trafficking Drug of Dependence'. Victoria Police told the ATO it was seeking to determine what legitimate income was declared by the subjects of investigation to compare against known assets in order to determine the extent of income derived from criminal activity;

(b) In 2012, Victoria Police disclosed to the ATO that Mr Zeqaj (and others) was identified as being involved in the cultivation, distribution and sale of cannabis and that he was part of a group involved in those activities; and

(c) In 2016, Mr Zeqaj was considered by Victoria Police to be a 'known criminal identity'.

1. It is apparent from the content of the personal information that it was in the nature of opinion and that there were only allegations about Mr Zeqaj and the others named at the time. On Detective Sergeant Coghlan's evidence, I accept the personal information regarding investigations and suspicions in 2011 and 2012 might fairly be regarded as accurate at that time. I reject any suggestion from Detective Sergeant Coghlan's evidence that is equivalent to an acceptance that the content of the allegations was proven at that time.
2. I accept the contention that Victoria Police records are points in time and it would not be appropriate to remove or delete information which records historical events, including when allegations come to nothing and no action is taken. I accept that historical material might be relevant to POI risk assessments and the like and so it must be retained, subject of course to the review and updating mentioned in the Manual.
3. As noted earlier, Mr Zeqaj produced a document which showed there were no disclosable outcomes for him on LEAP. The printouts of Magistrates' orders show the 2009 charges mentioned were struck out/withdrawn.
4. I am satisfied that, those documents show, as at the hearing before me, Mr Zeqaj has no criminal convictions or findings of guilt and, in particular, that no charges, convictions or findings of guilt have been made arising from the allegations referred to in the ATO disclosures.
5. Those records are clearly available to Victoria Police, are part of its records and are accurate, complete and up to date.
6. Accordingly, I am not satisfied a breach of IPP 3.1 has been proven in respect of the personal information set out in items (a) and (b) above and as contained in the ATO disclosures.
7. As set out earlier, I find that, when read together, the letter and email sent by Senior Sergeant Armstrong to A, amounted to stating that Mr Zeqaj was regarded as a 'known criminal identity'.
8. In order to make an assessment of the personal information contained in item (c), it is necessary to consider what the words 'known criminal identity' mean. Taking into account the parties' submissions and characterisations, I proceed on the basis that the phrase refers to a person who is known (as opposed to suspected or alleged) to have directly or indirectly engaged in criminal acts which may or may not have led to convictions.
9. For the purposes of this discussion, I have set to one side the Commissioner's wider meaning of 'police record'. That is because I do not see a correlation between the phrase in issue in the context in which it was used and any person where there was simply some information associating him or her with criminal behaviour, whether or not charged, convicted or found guilty.
10. Given Senior Sergeant Armstrong's evidence that he did not look at the basis for the link between Mr Zeqaj and A and did not consider whether the information relied on was accurate, it is fair to characterise Senior Sergeant Armstrong as having expressed an opinion.
11. The question posed by IPP 3.1 is whether, at the time it was used or disclosed, Victoria Police had taken reasonable steps to make sure that the specific personal information in item (c) above was accurate, complete and up to date. The relevant use and disclosure here was Senior Sergeant Armstrong sending A the email in December 2016 which included Mr Zeqaj's name as one of the people A appeared to have a relationship with and who was regarded by Senior Sergeant Armstrong as a known criminal identity.
12. Given:
    • Senior Sergeant Armstrong's evidence about his lack of enquiries into the basis for linking Mr Zeqaj to A; and
    • The absence of evidence before me that Mr Zeqaj is known (as opposed to suspected) to have directly or indirectly engaged in criminal acts whether they led to convictions or not,

I am not satisfied that Victoria Police took reasonable steps to ensure the personal information was accurate, complete or up to date when Mr Zeqaj was described to A as a known criminal identity and so I find the Firearms Act disclosure breached IPP 3.1.

1. I make that finding, also taking into account the following:
   • Had the email stated that Mr Zeqaj had been the subject of past investigation or charges which had been struck out/withdrawn, it would have been accurate, complete and up to date;[23]
   • Information will be inaccurate if it includes personal information that is factually erroneous or is an opinion based on, or conclusions drawn from, erroneous facts;[24]
   • An inadequacy of underlying factual information may lead to an incomplete or inaccurate opinion. While an opinion will not be inaccurate because the subject does not agree with it, an opinion which is uninformed due to a failure to take account of relevant material may be inaccurate.[25] It seems to me that is what clause 6.1 of the Manual is concerned with when it says 'Opinions need to be clearly distinguished from fact'; and
   • Ensuring records are up to date 'is largely about ensuring they are not likely to convey a misleading impression to others who view the information.'[26] Senior Sergeant Armstrong's failure to check the basis for or reliability of the intelligence, did not meet the obligation to take reasonable steps to ensure that personal information to be used and disclosed was accurate and up to date. It is difficult to see how the content of his communications could be regarded as accurate and complete as discussed in clause 6.1 of the Manual.

1. Given I have found Victoria Police breached IPP 3.1 in respect of the Firearms Act disclosure, it is arguable that the unlawfulness element in section 13(b) of the Charter has been met.
2. However, I had no evidence before me as to Mr Zeqaj's reputation generally or in A's eyes before or after the Firearms Act disclosure. Even if the use of the descriptor 'known criminal identity' might amount to an attack under section 13(b) of the Charter, the absence of other evidence means I am unable to find the IPP 3.1 breach also amounted to a breach of that provision.

Orders under section 77(1)(a) of the Privacy Act

1. Relevantly, section 77(1)(a) of the Privacy Act gives the Tribunal power to make orders of the following kind when a complaint is proven:

(i) An order restraining the respondent from repeating or continuing any act or practice the subject of the complaint which the Tribunal has found to constitute an interference with the privacy of an individual;

(ii) An order that the respondent perform or carry out any reasonable act or course of conduct to redress any loss or damage suffered by the complainant, including injury to the complainant's feelings or humiliation suffered by the complainant, by reason of the act or practice the subject of the complaint; or

(iii) An order that the complainant is entitled to a specified amount, not exceeding $100,000, by way of compensation for any loss or damage suffered by the complainant, including injury to the complainant's feelings or humiliation suffered by the complainant, by reason of the act or practice the subject of the complaint.

1. Under section 77(1)(b), the Tribunal may find a complaint proven but decline to take any further action.
2. As noted earlier, Mr Zeqaj asks that records which breach IPP 3.1 be updated and that recipients of the relevant disclosures be notified of any correction. That remedial action is consistent with the Guidelines.[27]
3. As the letter and email were sent some time ago and it is appropriate for Victoria Police to retain a record of what was done at the time, I do not consider those documents ought to now be amended. However, I am satisfied it would be appropriate for a copy of these reasons to be physically and electronically attached to the Firearms Act disclosure records as a means of correction. In case there should be a practical problem with complying with that order, I have granted liberty to apply for a further order on that matter only. I am satisfied that Victoria Police ought to notify A of my finding that the email was incorrect, incomplete and not up to date by providing him with a copy of these reasons.
4. Mr Zeqaj also sought an apology. While I could make an order under section 77(1)(a)(ii) requiring such an action to be taken, I see no utility in making such an order where a respondent has denied all liability.
5. Mr Zeqaj sought $100,000 as compensation for the three disclosures. As I have only found one proven, I must consider whether it alone warrants compensation and, if so, what amount.

1. As set out above, compensation of up to $100,000 may be ordered under section 77(1)(a)(iii) of the Privacy Act so as to compensate for any loss or damage suffered, including injury to the complainant's feelings or humiliation suffered by them.
2. There are only a few Tribunal decisions dealing with the application of section 77 of the Privacy Act. I have noted those and also been assisted by the discussion of comparable cases in Nekvapil's Victorian Administrative Law, some of which arise from discrimination law.[28]
3. The principles which are relevant to determining whether to award compensation are as follows:

(a) Where a complaint is substantiated and loss or damage is suffered, the legislation contemplates some form of redress in the ordinary course;

(c) In measuring compensation, the principles of damages applied in tort law will assist, although the ultimate guide is the words of the statute;

(d) In an appropriate case, aggravated damages may be awarded; and

(e) Compensation should be assessed having regard to the complainant's reaction and not to the perceived reaction of the majority of the community or of a reasonable person in similar circumstances.[29]

1. When assessing whether to make an award, one must look not at the conduct but to the effect of the conduct.[30]
2. It is understood that, where a complaint is substantiated and loss or damage is suffered, some form of redress is contemplated in the ordinary course. While that does not mean an award must be made, there ought to be a good reason why not.[31]
3. As to the quantum of awards for injury to feelings, it is impossible to say what will amount to sufficient restitution - that will depend on the experience and good sense of the judicial officer. Awards should not be minimal, because this would tend to trivialise or diminish respect for the public policy to which the relevant act gives effect. On the other hand, because it is impossible to assess the monetary value of injured feelings, awards should be restrained. To award sums which are excessive does almost as much harm to the policy and the results which it seeks to achieve as do nominal awards.[32]

1. Given I have found only the complaint of breach of IPP 3.1 in the context of the Firearms Act disclosure has been proven, that is the sole focus of my assessment of whether an award of compensation ought to be made under section 77(1)(a)(iii) of the Privacy Act.
2. Mr Zeqaj's submissions on compensation understandably focussed on the disclosures he considered breached the Privacy Act. As I have not found the disclosures were in breach of IPP 2.1, that element is arguably irrelevant.
3. Having said that, it is difficult to distinguish between the failure to take reasonable steps to ensure data quality in breach of IPP 3.1 in the context of the Firearms Act disclosure and the fact the record containing that inaccurate and not up to date personal information was used and disclosed. While I have found Victoria Police was entitled to use personal information about Mr Zeqaj when dealing with A's Firearms Act licence, it breached IPP 3.1 because the personal information in the form of an opinion it included in that particular record was inaccurate and not up to date.
4. Accordingly, I have considered Mr Zeqaj's general submissions about the effects on him, including arising from the disclosures.
5. Although Mr Zeqaj referred to the disclosures leading to possible job losses or an inability to travel, there was no evidence before me that either possibility had in fact eventuated. No other form of monetary loss or damage was claimed or established by way of evidence.
6. There was no evidence Mr Zeqaj was subjected to humiliation by any other person. Noting that the Firearms Act disclosure was to Mr Zeqaj's close relative, there was no evidence the inaccurate and not up to date disclosure affected their relationship or had any other consequence.
7. My task then is to only assess whether Mr Zeqaj's hurt feelings arise from the inaccurate and not up to date personal information contained in the Firearms Act disclosure - I must be satisfied the specific inaccurate and not up to date personal information in breach of IPP 3.1 had the effect of causing that form of damage.
8. There was no medical evidence before me identifying and describing the nature and extent of Mr Zeqaj's distress or upset. I accept that it is not always necessary for medical evidence to be produced to establish an entitlement to compensation. However, I note and adopt SM Davis' approach in Whitfield v Greater Bendigo CC, that, where a large amount of compensation is claimed, one would expect to see some medical evidence in support.[33]
9. It was apparent at the hearing that Mr Zeqaj has a long-standing antipathy towards Victoria Police and that, due to his family connections, its officers have for many years treated him as being involved in criminal acts despite there being no convictions or findings of guilt against him. Reported decisions of this Tribunal confirm that long-standing antipathy and record Mr Zeqaj believes police officers have acted improperly and corruptly in the past.[34]
10. In my view, that context is relevant to the task - I must be satisfied the claim for compensation for injury to feelings before me arose from the breach of IPP 3.1 in the context of the Firearms Act disclosure rather than from Mr Zeqaj's other historic and ongoing disputes with Victoria Police. Having said that, the history has clearly informed Mr Zeqaj's reaction.
11. I have given weight to Mr Zeqaj's evident upset and frustration at discovering he had been described as a known criminal identity to a third party. I accept his submission that the fact the disclosure was to a close family member does not entirely negate his response and his entitlement to compensation. Noting the presumption that an award will be made for breaches of legislation of this kind in the absence of a good reason, I am satisfied some award ought to be made.
12. I am not, however, satisfied a substantial award of compensation is called for. While I have accepted Mr Zeqaj was upset and frustrated when his family member alerted him to the content of the Firearms Act disclosure, he was also upset and frustrated by the ATO disclosures which I have found were lawful and is clearly upset and frustrated by historic disputes with Victoria Police. It is extremely difficult to disentangle the content of the personal information and the manner in which it was used from the injury to feelings arising from the ATO disclosures and the other historical matters.
13. Doing the best I can, I will award the sum of $1,000 for hurt feelings caused by the breach of IPP 3.1. I make that award noting that Mr Zeqaj also has the benefit of the findings I have made as to the breach and the orders as to correction and notice.

[2] Some of the complaints in this proceeding occurred at the time when the Information Privacy Act 2000 (Vic) applied. The Privacy Act provisions discussed in these reasons and the relevant IPPs are the same under both Acts and so I have referred only the Privacy Act provisions in these reasons.

[3] See section 130(4)(c) of the Evidence Act 2008 (Vic).

[4] Attachment 1 to the witness statement made by Detective Sergeant J Coghlan on 21 June 2018.

[5] Annexures B3 and B4 to Mr Zeqaj's statutory declaration made on 6 July 2018 - Exhibit A1.

[6] Annexures B1 and B2 to Mr Zeqaj's statutory declaration made on 6 July 2018 - Exhibit A1.

[7] Annexure B2 to Mr Zeqaj's statutory declaration made on 6 July 2018 - Exhibit A1.

[9] Commissioner's letter dated 6 December 2017 referring to section 66(4) of the Privacy Act.

[10] That evidence included Victoria Police's Information Privacy Statement which was said to have been revised in October 2017 (Exhibit R3). As it was not clear whether the document had been in the same form under the earlier Act and/or in 2011, 2012 and 2016, I have set it to one side.

[13] Section 13 of the Information Privacy Act 2000 (Vic), which applied prior to September 2014, was in identical terms.

[15] [2015] VCAT 941.

[17] [2013] VCAT 2105.

[18] These provisions were largely the same in the Information Privacy Act 2000 (Vic).

[19] See paragraph (q) of the section 3 Privacy Act definition of 'law enforcement agency'.

[20] See the discussion in Nekvapil, paragraph [PAS1-700].

[21] Annexures F4 and F5 to Mr Zeqaj's statutory declaration made on 6 July 2018 - Exhibit A1.

[23] On updating information, see the Guidelines, paragraph 3.9.

[25] Guidelines, paragraph 3.10 to 3.12.

[29] These principles come from Hall v A & A Sheiban Pty Ltd [1989] FCA 92 (which dealt with a claim under the Sex Discrimination Act 1984 (Cth)) and were adopted by the Administrative Appeals Tribunal of Australia in Rummery and Federal Privacy Commissioner and Anor [2004] AATA 1221.

[30] Phillis v Mandic [2005] FMCA 330 at paragraph 24.

[31] See French J in Hall at paragraph 282 and Rummary at paragraph 34.

[32] Wilcox J approved this approach in Hall at paragraph 41 - it comes from the judgment of Lord Justice May of the English Court of Appeal in a racial discrimination case, Alexander v Home Office (1988) 1 WLR 968 at page 975.

[33] [2005] VCAT 1756 at paragraph 18.

[34] See Zeqaj v Office of Police Integrity [2010] VCAT 479; Zeqaj v Victoria Police [2010] VCAT 1132; Zeqaj v Victoria Police FOI Privacy Division [2013] VCAT 1546; and Zeqaj v Victoria Police [2013] VCAT 2105.