BAW v Department of Justice and Attorney-General, Office of Fair Trading [2015] QCAT 285

CITATION: BAW v Department of Justice and Attorney- General, Office of Fair Trading [2015] QCAT 285 PARTIES: BAW (Applicant) v Department of Justice and Attorney-General, Office of Fair Trading (Respondent) APPLICATION NUMBER: OCL003-14 MATTER TYPE: Other civil dispute matters HEARING DATE: 19 and 20 March 2015 HEARD AT: Townsville DECISION OF: Member Howard DELIVERED ON: 17 July 2015 DELIVERED AT: Brisbane ORDERS MADE: 1. The complaints have not been substantiated; 2. The complaint is dismissed; 3. Other than to the parties of this proceeding, these reasons for decision may be published in a de-identified format only; 4. Publication of any information which may identify BAW, ALS or SDD is prohibited. CATCHWORDS: INFORMATION PRIVACY – where workers compensation claim – where workers compensation requested a response to the claim from the employing agency – where agency disclosed the claim to a person named in it and requested comments from that person to include in the agency response – whether breach of information privacy principles Information Privacy Act 2009 (Qld), s 4, s 5, s 7, s 12, s 23, s 27, Schedule 3 Queensland Civil and Administrative Tribunal Act 2009 (Qld), s 3, s 28 -- 1 of 21 -- 2 Workers Compensation and Rehabilitation Act 2003 (Qld), s 133 ALS & Anor v Department of Justice and Attorney-General Office of Fair Trading [2014] QCAT 423 Re Stewart and Department of Transport (1993) 1 QAR 227 APPEARANCES: APPLICANT: BAW represented by Mr J Greggery of Counsel instructed by Connolly Suthers, Lawyers RESPONDENT: Department of Justice and Attorney-General represented by Mr G Sammon, Solicitor, Crown Law REASONS FOR DECISION [1] BAW was at all relevant times employed in the Office of Fair Trading (‘OFT’). OFT is within the Department of Justice and Attorney-General (‘DJAG’ or ‘the department’). OFT was previously administered through the Department of Employment, Economic Development and Innovation (‘DEEDI’). BAW makes a privacy complaint. [2] He alleges that DJAG breached the Information Privacy Act 2009 (Qld) (‘IP Act’), in the manner it used his personal information set out in his 2013 WorkCover claim, which involved disclosing it to SDD and collecting personal information about him from her. SDD was at the relevant time an employee in the Office of Liquor and Gaming (‘OLGR’), also within DJAG. [3] BAW suspected SDD of making a complaint in 2010 against him (and also against another person in a more senior position at OFT who was a friend and former lover of BAW). BAW considered the complaint contained ‘homophobic and vexatious’ allegations. The 2010 complaint resulted in a misconduct investigation and the misconduct investigation was the subject of an earlier privacy complaint by the other OFT staff member concerned and BAW.1 The other staff member is referred to as ALS in the Tribunal’s reasons for decision in that earlier proceeding. He is also referred to as ALS in these reasons for decision. [4] The 2010 complaint was made anonymously and the identity of the complainant was not investigated. In 2012, a representative of the department advised BAW that the complaint had been assessed as a public interest disclosure under the (now repealed) Whistleblower Protection Act 1 See Exhibit 18 ALS & Anor v Department of Justice and Attorney-General Office of Fair Trading [2014] QCAT 423. BAW confirmed in the hearing that he was the person de- identified as DJM in that decision. -- 2 of 21 -- 3 1994 (Qld) (‘Whistleblowers Act’).2 The department advised him that accordingly it was obligated to protect the identity of the discloser and it was not appropriate for the department to investigate the source of the complaint. [5] On 20 February 2013, BAW heard from a staff member employed in OLGR that OFT and OLGR may merge office space. He immediately raised concerns with OFT management about the possibility of being in the same office as the person he suspected of making the 2010 allegations. He later nominated SDD as the suspected complainant to OFT management representatives. [6] Subsequently, BAW made the 2013 WorkCover claim. He disclosed to WorkCover that he believed SDD was the anonymous complainant and details about his concerns were set out in information provided by WorkCover to DJAG when requesting an employer response. DJAG representatives contacted SDD, gave her a copy of the documentation and requested a submission from her as to her position in the matter for inclusion in its response to WorkCover. [7] In April 2013, BAW initiated a privacy complaint.3 The privacy complaint was later referred to QCAT to determine whether the complaints are substantiated. BAW complains that several Information Privacy Principles (‘IPPs’) were breached by DJAG’s actions. In particular, he claims that DJAG breached its obligations under IPP-1, IPP-3, IPP-9, and IPP-10. He seeks orders that his complaints are substantiated and seeks orders for payment of compensation to him. [8] DJAG denies that any breach of the IPPs has been established by BAW. In the alternative, it submits that if there has been a breach of IPP-9, IPP-1 and/or IPP-3, it was lawfully justified. Two lawful justifications are put forward. Firstly, DJAG submits that, pursuant to s 4, s 5 and s 7(2) of the IP Act, the IP Act requirements are subject to s 133 of the Workers Compensation and Rehabilitation Act 2003 (Qld) (‘Workers Compensation Act’) which authorised or required DJAG to make enquiries of employees to provide a response to WorkCover. Secondly, DJAG submits that a common law natural justice requirement of protecting a person’s reputation required that SDD be informed of the allegations made against her, and informing her was permitted by s 4 of the IP Act (which refers to the IP Act not preventing the giving of access to, and amendment of, documents other than under the IP Act if permitted or required ‘by law’). [9] Relevantly, s 133 of the Workers Compensation Act requires that an employer whose worker sustains an injury for which compensation may be payable must provide a report to WorkCover within eight days of the happening of specified events, including receiving a written request from 2 Exhibit 4. 3 It is uncontroversial that a document which combines BAW’s claim and DJAG’s response is set out in the Record Book produced by the parties, entitled Composite Document dated 2 March 2015, pages 34-49. -- 3 of 21 -- 4 WorkCover for a report.4 There is no dispute that DJAG was required to provide a report to WorkCover in response to the claim. [10] For reasons to be explained, I have reached the conclusion that on the evidence, breach of the IPPs has not been established and that the complaints are unsubstantiated. Background [11] On 20 February 2013, BAW emailed two OFT managers, SS (Director, Statewide Operations, OFT, who was then on leave) and BB (Executive Director, OFT) expressing his concerns about the merger proposal. He said that he could not work near the person he believed had made the 2010 complaint and that he continued to suffer psychologically as a result of the events from 2010 to 2012. He advised that he was on sick leave, effective immediately, as he could not continue to function.5 [12] On 21 February 2013, a teleconference was organised by OFT management. It was attended by BAW, MR (then Acting Manager Regional Offices) and RP, (then Acting Director, Statewide Operations, OFT). BAW outlined his concerns. BAW, was asked to disclose the name of the person he suspected of being behind the complaint. RP assured him that the conversation was confidential and no action would result without his consent. BAW then named SDD as the person he believed was responsible for the anonymous complaint which he believed had dramatically impacted on his reputation and career prospects at OFT. [13] He explained that he had earlier asked for the vexatious complaint to be investigated. However, he explained that the department had advised him that it was prohibited from investigating the identity of the person who made the complaint on the basis of the (now repealed) Whistleblowers Act. He said that he was concerned that if SDD was approached by OFT management, she would simply deny all allegations and then intensify her vendetta against him. Notes were kept during the meeting and detailed notes were produced by RP and MR following the meeting.6 It was anticipated that following the meeting, BAW would formalise his concerns into a statement and that options would be considered. (That did not happen, because shortly afterwards, BAW made the 2013 WorkCover claim and then advised RP that he intended to allow Work Cover to assess his claim before he went further with the options discussed on 21 February). [14] On 26 February 2013, BAW lodged the claim for workers compensation. He claimed psychological or psychiatric injury. A WorkCover representative contacted him by telephone to obtain further details and during that conversation he named SDD as the person he suspected was the anonymous complainant.7 During or after that conversation, the WorkCover representative produced a document detailing nominated factors (the 4 Workers Compensation Act s 133. 5 Exhibit 5. 6 Exhibit 6, 7 and 8. 7 Exhibit 21, p 81-82. -- 4 of 21 -- 5 Factors Document) which she forwarded by email dated 19 March 2013 to ‘DJAG Rehab’ requesting an employer response by 26 March.8 A staff member in DJAG Rehab then on-forwarded it to SS at OFT for response. [15] The Factors Document set out three brief factors: namely, the announcement of the merger which meant BAW would be sitting in close proximity to the person he suspected of making the 2010 allegations; a lack of support during the 10 months since his return to work following his previous WorkCover claim; and management’s failure to have a contingency plan in case of the merger. A more detailed explanation appears underneath the three nominated factors and is described as a ‘summary of the factors nominated’. It records that the WorkCover representative asked BAW to name the person he believed to be the complainant, and he named SDD, describing her as a ‘vile piece of garbage’.9 He also said that his suspicions had not been confirmed by OFT and outlined why he believed she was the complainant (based essentially on her writing style). [16] On 20 March 2013, SS forwarded the email attaching the Factors Document to MR and RP stating: Please note that it is possible that some of the detail within one of the documents could in some circumstances be considered defamatory. Whether they are or not in these circumstances is not an issue, what is is (sic) that we need to take care to secure these documents to ensure they are not distributed - I have forwarded you these documents with this detail still in it only because I am aware that you have already been made aware of BAW’s allegations by BAW himself. Can you please consider the factors noted in the claim and provide any information you may have regarding it.10 [17] She also noted that ‘DJAG HR’ suggested obtaining a statement from the OLGR staff member named. She asked RP to attend to this. [18] On 22 March 2013, RP telephoned SDD, who held the position of Manager Indigenous Compliance, OLGR. The telephone call was also attended by TB, Acting Director Regional Service, OLGR. In the course of that telephone call, RP disclosed the application and the Factors to TB and SDD. [19] On that same day, RP sent an email to SDD attaching the Factors Document. His email advised her of the due date for the response to WorkCover. It further stated that allegations had been raised by BAW which involved her and requested her written submission so WorkCover could assess the merits of application.11 The request made was in the following terms: In short, certain allegations have been raised by BAW which involve yourself and accordingly, so that WorkCover can fully assess the merits of the application, DJAG HR … has authorised me to contact you, to provide you 8 Exhibit 9. 9 Exhibit 9. 10 Exhibit 10. 11 Exhibit 23, PJR 7, p 218. -- 5 of 21 -- 6 with the opportunity to lodge a written submission, outlining your position in the matter.12 [20] On the same day that she was approached by RP, SDD sent an email to RP in response.13 Her email included statements to the following effect. She said she had been told about an investigation involving ALS, but was not aware of ‘any issue’14 concerning BAW. She says she tried to support ALS. She spoke about her knowledge of BAW’s living arrangements and having met his partner. She said that she ‘challenged’ the assertion she had made the allegations. She said she had little to do with BAW. She said she has always been friendly, professional and supportive, and was saddened by the comments about homophobia. [21] The facts as set out so far in these reasons are uncontroversial. I find that the events occurred as described. The scheme of the IP Act [22] The IP Act has been amended since the claimed breaches occurred. These reasons set out the IPPs and other sections relevant to the alleged breaches as they were at the date of the alleged breaches. [23] Personal information is defined as information or opinion, whether or not it is true, and whether recorded in a material form, about an identified individual or an individual whose identity is reasonably ascertainable from the information or opinion.15 There is no issue between the parties that the information contained in the Factors Document and in SDD’s response is personal information under the IP Act. [24] A privacy complaint may be made by an individual about an act or practice of a ‘relevant entity’ in relation to the individual’s personal information which breaches the obligation of the relevant entity to comply with the privacy principles.16 ‘Relevant entity’ is defined for the Chapter which provides for complaints, to include an agency, in relation to the documents of the agency.’17 An ‘agency,’ (except for chapter 3, which is not relevant) includes a department.18 For the IP Act, a reference to an agency includes reference to a body established by government to perform functions connected with the agency (that is, the body is not a separate agency, but is taken to be comprised within the agency).19 In this case, it is uncontroversial that OFT and OLGR are comprised within DJAG. [25] The IP Act is not intended to prevent ‘access to,’ or ‘amendment of’, documents permitted or required at law: s 4. Nor does it affect the operation of another Act or administrative scheme that requires information about 12 Exhibit 23, PJR 7, p 218. 13 Exhibit 23, PJR8, p 219-221. 14 Exhibit 12. 15 IP Act s 12. 16 IP Act s 164(1). 17 IP Act s 164(2). 18 IP Act s 18(1). Cf: for Chapter 3, see s 17. 19 IP Act s 18(3). -- 6 of 21 -- 7 personal information in the possession or control of government to be made available to members of the community, or enables individuals to ‘access,’ or to ‘amend,’ the individual’s personal information: s 5. These sections do not apply in the circumstances of this proceeding, as they are directed to accessing and amending information in documents held by government.20 The breaches alleged in this proceeding relate to use and collection of personal information, (although reference is also made to disclosure). The relationship between the IP Act and other Acts in relation to these concepts is provided for in s 7. [26] Section 7(1) is not relevant in this proceeding. It concerns the relationship for Chapter 3 of the IP Act (concerning applications from individuals for access to documents held by government containing the individual’s personal information and to amend inaccurate or incomplete information in those documents), with other Acts which prohibit disclosure of personal information. [27] However, s 7(2) provides that, other than as provided in s 7(1), the IP Act operates subject to the provisions of other Acts relating to (among other things) collection and use of personal information; 21 and disclosure within the meaning of s 23, of personal information.22 For the application of the IPPs, what it means to ‘disclose’ and ‘use’ personal information is provided for in s 23 as follows. 23 What it means to disclose personal information and to use personal information (1) This section applies for the application of the privacy principles. (2) An entity (the first entity) discloses personal information to another entity (the second entity) if— (a) the second entity does not know the personal information, and is not in a position to be able to find it out; and (b) the first entity gives the second entity the personal information, or places it in a position to be able to find it out; and (c) the first entity ceases to have control over the second entity in relation to who will know the personal information in the future. (3) An entity uses personal information if it— (a) manipulates, searches or otherwise deals with the information; or (b) takes the information into account in the making of a decision; or (c) transfers the information from a part of the entity having particular functions to a part of the entity having different functions. (4) Subsection (3) does not limit what actions may be use of the personal information. 20 In adopting this construction, I agree with the comments of Senior Member O’Callaghan in ALS v Department of Justice and Attorney-General [2014] QCAT 423, especially at [59]-[71]. 21 IP Act, s 7(2)(a). 22 IP Act s 7(2)(b) -- 7 of 21 -- 8 (5) However, use of the personal information does not include the action of disclosing the personal information to another entity. [28] For this purpose, entity is defined under the Acts Interpretation Act 1954 (AI Act) to include a person or an unincorporated body.23 [29] Section 27 of the IP Act requires agencies to comply with the IPPs. In particular, agencies must not do acts or engage in practices that contravene or are inconsistent with the requirement of an IPP. The IPPs are set out in Schedule 3. The particular IPPs alleged by BAW to have been breached are set out and discussed in detail later in these reasons. [30] After hearing a privacy complaint, the Tribunal may make orders that a complaint has been substantiated (and if so, may for example, order an amount of compensation); or may order that a complaint has not been substantiated, together with an order that a complaint is dismissed.24 Were the IPPs breached? [31] There are several issues raised on the material that are determinative of whether breaches of individual IPPs are established. They are considered below. What was the purpose for which DJAG had BAW’s personal information? [32] It is uncontroversial, and I find that DJAG had the Factors Document containing BAW’s personal information for the purpose of reporting to WorkCover in response to the WorkCover claim. Did DJAG use it for another purpose? Was personal information disclosed to or collected from SDD relevant for responding to WorkCover? BAW’s arguments [33] As discussed, BAW’s WorkCover claim nominated three factors. The first related to the co-location of OFT and OLGR and the likelihood he may have to be sitting in close proximity to the person he suspected was the anonymous complainant. The second related to an alleged lack of support during the 10 month period since his return to work after his previous claim. The third related to management’s failure to have a contingency plan in case of the merger. The information in the ‘summary’ section expands on the three factors. It is in the summary that SDD is named. [34] BAW argues that there was a lack of critical analysis by OFT about what was required to respond to the WorkCover claim; what information was relevant to the employer response; and whether SDD could provide any relevant comment. Further, if she could provide relevant input, consideration was not given to whether it was necessary to disclose BAW’s personal information to her, or whether she could be asked questions 23 AI Act, Schedule 1, ‘entity.’ 24 IP Act s 178. -- 8 of 21 -- 9 directed to the issues. Further, BAW submits that his personal information was used for a purpose other than responding to the WorkCover claim. [35] He submits that this must be objectively assessed. He submits that it is reasonable to infer that in disclosing information to and collecting information from SDD, RP was conducting an investigation into the identity of the anonymous complainant. He submits this inference can reasonably be drawn because the WorkCover claim was about the actions of OFT management, not about SDD. Despite his belief that she was the anonymous complainant and his earlier agitation for an investigation into the identity of the complainant, BAW understood that because of the Whistleblowers Act, the Department could not and would not investigate the identity of the complainant. He suggests that SDD had nothing to do with the lack of support (as referred to in his claim) having regard to the merger announcement and was not in a position to comment upon it. [36] He submits that the Factors Document did not go to the identity of the anonymous complainant. If properly characterised, he says his claim is a claim about a lack of proper management action. He says that the proper response would have been for DJAG to report to WorkCover that because of the Whistleblowers Act, it was unable to investigate the identity of the alleged anonymous complainant. Therefore, he argues, DJAG could have said there was no obligation to have a contingency plan. However, it could further have responded that once the issue was raised, DJAG met with BAW to discuss arrangements to accommodate his concerns. That is, other details of the response, BAW says, should have been framed around the inability to investigate. He says it should have focussed on the distress BAW felt as a result of the merger of OFT and OLGR into co-located office space. [37] He argues that if characterised in this way, SDD’s identity is irrelevant. He further submits that her response does not justify disclosing the information to her and collecting her response. What is at issue, he says is the legitimacy of contacting her for comments at all. [38] Accordingly, in summary, the contention is that despite the naming of SDD, she was not relevant to the claim which was about lack of proper managerial action and it was not necessary to disclose any personal information to her or collect any from her. Therefore, as I understand it, BAW suggests that part of the document which named her should not have been used by DJAG, because none of the information disclosed to her or collected from her was relevant to the purpose of responding to the WorkCover claim. [39] BAW submits the DJAG’s response to his privacy complaint contains inconsistencies and is an attempt to reclassify conduct taken during an ill- considered, hurried response to the request for a report by WorkCover without regard to the IPPs. [40] DJAG submits that the information from SDD was ultimately a substantial reason for the refusal of the WorkCover claim and that this gives legitimacy to making enquiries of her and obtaining her comments. It points out that in -- 9 of 21 -- 10 cross-examination, BAW himself conceded that if SDD was not the anonymous complainant, his concerns would fall away. DJAG’s evidence [41] RP says he believed DJAG had a duty to respond comprehensively to the WorkCover claim. He says that when he received SS request for a response to BAW’s WorkCover claim, he read the attachments including the document entitled ‘Psychological or Psychiatric Injury Claims’ to find out what steps he needed to take in order to respond.25 He says he noted that WorkCover documents made it clear that BAW was aware that the information in his claim would be provided to the employer who would be given the opportunity to respond. [42] RP says in essence that he considered it necessary to involve SDD in order to fully respond to the WorkCover request. He admits he had not previously responded to a WorkCover claim about psychiatric injury. He admits that he did not consider the requirements of the IP Act in determining how to proceed, although he marked all of the documents ‘in confidence’ and stressed the importance of keeping the documents securely stored.26 In essence, he says he formed the view that it was necessary and appropriate to speak with SDD and obtain her version of events, because she was named in the claim. [43] He says he obtained ‘clearance’ from an employee at DJAG HR to contact SDD, although it is clear from his evidence that the clearance was directed to the protocol about contacting a person who was not employed within OFT, but worked for DJAG in OLGR. He did not consider whether the Factors Document should be provided to her in its entirety, or in part. [44] RP asserts that he was not investigating the identity of the anonymous complainant, only responding to the WorkCover claim. In cross- examination, he said that he treated it as a WorkCover claim and not as a complaint against SDD. He denied that he sought to ascertain whether SDD authored the 2010 complaint, saying that it was done to ask her to make general commentary on whatever she thought appropriate. He said he thought she was the most appropriate person to respond. [45] RP appeared to concede at hearing that the claim was about (alleged lack of) proper managerial action. While denying that he was investigating the identity of the anonymous complainant, RP acknowledged that he thought that without the identity of the complainant, that the internal processes could not be put in place. In his statement provided to WorkCover as part of the employer report, he asserts that the central issue to factor 1 was the identification of SDD as the ‘subject person’.27 He proceeded in that report to make his own assessment of the lack of evidence supporting BAW’s suspicions about her, concluding that ‘I and presumably any fair-minded 25 Exhibit 23, at [42]-[43]. 26 Exhibit 23, PJR-7, p 218. 27 Exhibit 23, p 229 at [12]. -- 10 of 21 -- 11 independent observer would have great difficulty in assigning much weight to such tenuous evidence’.28 [46] RP considered that SDD’s response ‘appears to categorically deny the allegations against her’.29 Discussion and conclusions [47] In my view RP’s view of SDD’s response is an overstatement, although she certainly makes comments which suggest she denies them, and she certainly does not admit them. DJAG seeks to argue that the end justifies the means in relying upon the outcome of the WorkCover claim to justify the actions of RP. I accept, as BAW says, that the content of her response and outcome of the WorkCover claim is irrelevant to my consideration of the privacy complaints. [48] RP admits, and I accept, that he was inexperienced in responding to WorkCover claims of this nature. Also, he did not consider DJAG’s obligations under the IP Act. It may have been possible to respond to the claim in other ways which did not involve contacting SDD. That said, BAW’s concession that his concerns would fall away if SDD was not the anonymous complainant acknowledges the centrality of the issue to his reaction to the merger which he alleged resulted in the harm that led to the claim. [49] I accept that, as BAW says, RP’s evidence contains some apparent inconsistencies. I make the observation that approaching the person nominated by BAW as the suspected anonymous complainant does not appear to sit well with any provision for anonymity arising out the Whistleblowers legislation. That said, I acknowledge the practical difficulties in responding to a claim about an alleged failure of management take action and to have contingency plans in place to protect a staff member from psychological harm (based on unsubstantiated suspicion that a named person made an anonymous complaint against that person) without considering whether there was a basis for the suspicion. [50] In any event, this proceeding concerns a complaint about whether DJAG breached BAW’s privacy contrary to the IPPs. It is not about the Whistleblowers legislation and the constraints it may or may not impose. Indeed, BAW refers to it, only in so far as, he had been advised that it imposed constraints and he had advised RP and MR in the 21 February teleconference of the advice he had previously received from the department to this effect. [51] RP says that he was not seeking to ascertain whether SDD authored the anonymous complaint. It is plain from RP’s assertions at the time of preparing the statement as part of the DJAG response for WorkCover that he considered the central issue in Factor 1 was BAW’s identification of SDD. 28 Ibid, at [13]. 29 Ibid, p 197. -- 11 of 21 -- 12 Despite his denial that he sought to ascertain whether SDD whether SDD was the author of the 2010 complaint, I conclude that it is reasonable to infer, and I draw the inference, that RP sent the Factors Document to SDD to test whether SDD admitted to (or denied) being the anonymous complainant because she was named in the WorkCover claim with the intention of including that information in the employer response. This is consistent with the events which occurred. I accept that he believed that a comprehensive response was necessary. His email asked for her comments for inclusion in the WorkCover response. He did include SDD’s response in DJAG response. He did so because he considered her identification in the Factors Document as the central issue to factor 1. [52] I am not satisfied that RP’s purpose was to conduct an investigation into the identity of the anonymous complainant. An investigation of that nature would have, as BAW appeared to submit, required a broader approach and enquiry process. RP took no steps, other than asking for SDD’s comments for the WorkCover response. [53] The WorkCover claim made allegations of harm, which revolved around BAW’s suspicions concerning SDD, describing her as a ‘vile piece of garbage’. Although RP considered BAW’s suspicions should be given no weight, the claim was to be assessed by WorkCover, not him. As I have accepted, he considered a comprehensive response was appropriate. The Factors Document included allegations against SDD. DJAG was required to report in response to the WorkCover claim. [54] DJAG could have responded in the manner BAW submits was appropriate. That is, by treating the WorkCover claim as a claim about managerial action only, and not seeking information from SDD. It is admittedly the case that RP was not experienced in responding to claims for psychological harm such as BAW’s and did not consider the IPPs. However, given that the claim named SDD, I am not satisfied that RP as DJAG’s representative acted unreasonably in disclosing the information to SDD and obtaining information from her for inclusion in the report to WorkCover. [55] I am not satisfied that DJAG used BAW’s personal information to investigate the identity of the anonymous complainant. Further, I am not satisfied that the information DJAG disclosed to or received from SDD was not relevant to the WorkCover claim. Did DJAG breach IPP-9? [56] IPP-9 provides: 9 IPP 9—Use of personal information only for relevant purpose (1) This section applies if an agency having control of a document containing personal information proposes to use the information for a particular purpose.30 30 Emphasis added. -- 12 of 21 -- 13 (2) The agency must use only the parts of the personal information that are directly relevant to fulfilling the particular purpose.31 [57] BAW alleges that in breach of IPP-9, DJAG failed to use only the parts of the information in the Factors Document which were directly relevant to fulfilling its purpose of responding to WorkCover. In particular, BAW says that none of the information disclosed to SDD or collected from her was relevant to the purpose of responding to WorkCover.32 [58] Further, submissions were made by BAW at the hearing, apparently in the alternative. These were to the effect that if the Tribunal considers it was it was reasonable to involve SDD, DJAG should have used some discrete parts of the Factors Document in seeking her input or asking questions of her directed to the issues raised, rather than giving the Factors Document to her. [59] DJAG’s primary submission is that IPP-9 was not breached. It submits that the submissions made in the alternative at the hearing extend impermissibly beyond the matters pleaded by BAW as set out in the Composite Document.33 It relies in the alternative on the lawful justification arguments summarised earlier. [60] DJAG further submits that the three nominated Factors are related and interconnected. It submits that none of them was independent of the others and cannot be isolated from one another: they all relate back to the anonymous complaint. It says that SDD responded that she had been supportive and this is relevant to factor 2. [61] I have found that OFT had control of the Factors Document containing BAW’s personal information for the particular purpose of reporting to WorkCover in response to BAW’s WorkCover claim. Other than information identifying BAW, the personal information in the Factors Document is the three nominated factors and the details supplied by BAW during his telephone call with the WorkCover representative which nominated SDD as the suspected anonymous complainant. The first factor was about the announcement of the merger and BAW’s concerns about it. The second and third factors concerned a lack of support from OFT management and lack of a contingency plan by OFT management. There is little detail in the factors document about the second and third factors. I accept DJAG’s submission that the factors were all inter-related. [62] The command in IPP-9 required that in using the Factors Document, DJAG was entitled to use only the parts of the personal information that were directly relevant to fulfilling the particular purpose for which it had control of the information. In this case, the particular purpose was for reporting in response to the WorkCover claim. The Factors Document sets out the WorkCover claim and the basis for it. I am satisfied that all of the personal information in the Factors Document was about the WorkCover claim. 31 Emphasis added. 32 Record Book, Composite Document dated 2 March 2015, p 34-49 at [13], [14] and [19]. 33 Ibid. -- 13 of 21 -- 14 BAW’s argument seems to be that the information about the suspected anonymous complainant was irrelevant. I do not accept that argument. Even if that information was considered no more than background to the claim, all of the personal information contained in the Factors Document is about the WorkCover claim. I have not accepted BAW’s argument that the information disclosed and collected was not relevant to responding. Accordingly, I find that in fulfilling the particular purpose of responding to the WorkCover claim, DJAG was entitled to use all of the personal information in the Document because it was all directly relevant to fulfilling the particular purpose of responding to the WorkCover claim. [63] With respect to BAW’s argument in the alternative, the Queensland Civil and Administrative Tribunal Act 2009 (Qld) does not provide for pleadings and requires the Tribunal to act in a way which is fair and informal, and having regard to the substantial merits of the matter. DJAG cannot be said to be disadvantaged by the alternative arguments and had the opportunity to respond to them. Accordingly, I do not accept that it is impermissible for BAW to make the submission. [64] However, the argument does not assist BAW. Although DJAG used the entire Factors Document in requesting SDD’s comments, when arguably she could have been given only those parts which related to Factor 1 or could have been asked questions directed to the issues, on a plain reading of IPP-9 there has been no breach by DJAG’s actions. DJAG used the information only for the particular purpose for which it had control of the document, that is, to respond to the WorkCover claim. Further, DJAG disclosed the information and collected SDD’s comments specifically about the WorkCover claim for the purpose of inclusion in its response. [65] For completeness, I make the observation that BAW made some submissions to the effect that he reasonably expected SDD would not be contacted, and was confident she would not be contacted, because of the assurances given by RP in the teleconference on 21 February 2013. The assurances were given in a context unrelated to the WorkCover claim, which created obligations on DJAG to report to WorkCover. In any event, that assurance is irrelevant to whether the IPP-9 was breached because IPP-9 contains no requirement relating to consent. [66] BAW has not established that DJAG breached IPP-9. Did DJAG breach IPP-10? [67] IPP-10 provides: 10 IPP 10—Limits on use of personal information (1) An agency having control of a document containing personal information that was obtained for a particular purpose must not use the information for another purpose 34 unless— 34 Emphasis added. -- 14 of 21 -- 15 (a) the individual the subject of the personal information has expressly or impliedly agreed to the use of the information for the other purpose; or (b) the agency is satisfied on reasonable grounds that use of the information for the other purpose is necessary to lessen or prevent a serious threat to the life, health, safety or welfare of an individual, or to public health, safety or welfare; or (c) use of the information for the other purpose is authorised or required under a law; or (d) the agency is satisfied on reasonable grounds that use of the information for the other purpose is necessary for 1 or more of the following by or for a law enforcement agency— (i) the prevention, detection, investigation, prosecution or punishment of criminal offences or breaches of laws imposing penalties or sanctions; (ii) the enforcement of laws relating to the confiscation of the proceeds of crime; (iii) the protection of the public revenue; (iv) the prevention, detection, investigation or remedying of seriously improper conduct; (v) the preparation for, or conduct of, proceedings before any court or tribunal, or implementation of the orders of a court or tribunal; or (e) the other purpose is directly related to the purpose for which the information was obtained; or Examples for paragraph (e)— 1 An agency collects personal information for staff administration purposes. A new system of staff administration is introduced into the agency, with much greater functionality. Under this paragraph, it would be appropriate to transfer the personal information into the new system. 2 An agency uses personal information, obtained for the purposes of operating core services, for the purposes of planning and delivering improvements to the core services. (f) all of the following apply— (i) the use is necessary for research, or the compilation or analysis of statistics, in the public interest; (ii) the use does not involve the publication of all or any of the personal information in a form that identifies any particular individual the subject of the personal information; (iii) it is not practicable to obtain the express or implied agreement of each individual the subject of the personal information before the use. (2) If the agency uses the personal information under subsection (1)(d), the agency must include with the document a note of the use. [68] BAW says that in breach of IPP-10, DJAG had control of the Factors Document for the purposes of providing an employer response to -- 15 of 21 -- 16 WorkCover, but used the information for the purposes of conducting an investigation into the identity of the anonymous complainant. He says it did so in breach of IPP-10, as follows: (a) Without the express or implied agreement of BAW; (b) Without being satisfied of the matters in IPP10(1)(b); (c) Without being authorised or required under a law to do so; (d) Without being satisfied on reasonable grounds that the use of the information was necessary under IPP10(1)(d); (e) The purpose was not directly related to the purpose for which the information was obtained; and (f) When none of the circumstances in IPP10(1)(f) applied.35 [69] DJAG says it did not breach IPP-10 because it used the information for the purposes of providing an employer response to the WorkCover claim and that it did not conduct an investigation into the identity of the anonymous complainant. [70] To comply with IPP-10, if an agency has control of a document containing personal information obtained for a particular purpose, it must not use the information for another purpose unless it falls within the stated exceptions. I have found that DJAG did not use the Factors Document to investigate the identity of the anonymous complainant. I am satisfied that the personal information was used only for the particular purpose of responding to the WorkCover claim. [71] It follows that I am satisfied that DJAG, which had control the Factors Document for the particular purpose of responding to the WorkCover claim, used it for that particular purpose and did not use it for any other purpose. The exceptions are therefore irrelevant. [72] It follows that I am not satisfied that DJAG breached IPP-10. Did DJAG breach IPP-1? [73] IPP-1 provides: 1 IPP 1—Collection of personal information (lawful and fair) (1) An agency must not collect personal information for inclusion in a document or generally available publication unless— (a) the information is collected for a lawful purpose directly related to a function or activity of the agency; and (b) the collection of the information is necessary to fulfil the purpose or is directly related to fulfilling the purpose. (2) An agency must not collect personal information in a way that is unfair or unlawful. 35 Composite Document dated 2 March 2015, [13], [14], [15], and [20]. -- 16 of 21 -- 17 [74] BAW alleges that DJAG breached IPP-1 by collecting personal information from SDD by email dated 22 March 2013, in response to RP’s request for her comments in response to the Factors Document. He says that the information was not collected for a lawful purpose directly related to a function or activity of DJAG; was not necessary to fulfil any lawful purpose; and was not collected in a manner which was fair and lawful.36 [75] DJAG’s primary submission is that it did not breach IPP-1 because the information was collected for a lawful purpose directly related to a function or activity of DJAG, in particular functions or activities as an employer in responding to the WorkCover claim, or alternatively, functions or activities described in its lawful justification contention (as set out earlier). Further, it says the collection was either necessary or directly related to fulfilling the purpose. [76] DJAG employs BAW. DJAG was required by the Workers Compensation Act to respond to the WorkCover claim. RP on behalf of DJAG collected personal information from SDD for inclusion in a document, namely, the WorkCover response to BAW’s claim. SDD’s comments were included in the employer response. I find that DJAG collected the personal information (for a lawful purpose of) inclusion in its report to WorkCover which is directly related to the function of DJAG as an employer. IPP-1(1)(a) is satisfied. [77] In respect of IPP-1(1)(b), the issue is whether the collection of the personal information from SDD for inclusion in the response was either necessary to fulfil the purpose or directly related to fulfilling the purpose of responding to the WorkCover claim? [78] BAW submits that collecting the information was not necessary and that responding to the WorkCover claim about management actions did not require comments to be included from SDD. He says that DJAG could have proceeded from the premise that it could not seek input from her because of the protections in the Whistleblowers Act. [79] As I have acknowledged, this was an approach that could have been taken. Also, RP considered BAW’s suspicions that SDD was the anonymous complainant could be given no weight because of the tenuous grounds for his suspicions. This was another basis upon which DJAG could have decided not to seek her input. In light of these matters, I accept that it was not necessary to invite her comments in order to provide the employer response. A response could have been provided without her comments. Having regard to these matters, I am not satisfied on the evidence that the collection of personal information from SDD was necessary, in that, it was not an essential requirement in fulfilling the purpose of responding to the WorkCover claim. [80] That said, I am satisfied that the personal information was collected by DJAG for the purpose of responding to the WorkCover claim because SDD was named by BAW in the making the claim. Although I am not satisfied 36 Record Book, Composite Document dated 2 March 2015, [15] and [21]. -- 17 of 21 -- 18 that it was essential that she be contacted and asked to comment, she was asked to do so in the course of DJAG providing its employer response. I have found that this was not unreasonable in the circumstances that she was named in the Factors Document. Further, the comments she provided were included, as RP indicated they were to be, in the response to WorkCover. On this basis, I am satisfied that its collection was directly related to fulfilling the purpose of providing the employer response to WorkCover. [81] Turning to the matters in IPP-1(2), were SDD’s comments collected in a way that was unfair or unlawful? It is not in issue that DJAG was required to provide its response to the WorkCover claim. The personal information was collected from her for this purpose. BAW does not raise any issues as to the lawfulness of collecting the information from SDD other than his contention that it was an investigation of the identity of the anonymous complainant (which he argues is impermissible under the IPPs). I have rejected that argument. I am not satisfied that the collection was unlawful. [82] The assurance given in the teleconference on 21 February by RP not to contact SDD was given in the context of a particular discussion. It was not given with knowledge of, or even in contemplation of, the WorkCover claim. In the course of preparing its response for WorkCover, DJAG collected information to include from SDD. I am not satisfied that this was unfair in circumstances that BAW made the WorkCover claim in which he nominated SDD as the suspected anonymous complainant. [83] BAW has not established a breach of IPP-1. Did DJAG breach IPP-3? [84] IPP-3 provides: 3 IPP 3—Collection of personal information (relevance etc.) (1) This section applies to the collection by an agency of personal information for inclusion in a document or generally available publication. (2) However, this section applies to personal information only if the agency asks for the personal information from any person. (3) The agency must take all reasonable steps to ensure that— (a) the personal information collected is— (i) relevant to the purpose for which it is collected; and (ii) complete and up to date; and (b) the extent to which personal information is collected from the individual the subject of it, and the way personal information is collected, are not an unreasonable intrusion into the personal affairs of the individual.37 37 Emphasis added. -- 18 of 21 -- 19 [85] BAW alleges that DJAG breached IPP-3 by failing to take all reasonable steps to ensure that the personal information collected from SDD was relevant to the purpose for which it was collected and was not an unreasonable intrusion into BAW’s personal affairs.38 BAW argues that as DJAG concedes that the information collected from SDD was personal information, it follows that collecting it was an intrusion into his personal affairs if it was not relevant for the purpose for which it was collected. He submits that just because the injury arose out of work, does not make it a work complaint or grievance. He says that the WorkCover claim was made for injury to his person arising out of work. [86] DJAG says it did not breach IPP-3 because it took all reasonable steps to ensure that any collection of personal information was relevant for the purposes for which it was collected. DJAG submits there was no an unreasonable intrusion into personal affairs, because BAW initiated the WorkCover claim and raised the allegations and the Department then collected information in response from those named by him. It also submits that RP sought confidentiality. [87] DJAG submits that as a matter of construction, ‘personal affairs’ is a separate concept from ‘personal information.’ Unlike personal information, it is not defined in the IP Act. It submits that the meaning of ‘personal affairs’ was considered by the then Information Commissioner in the context of the now repealed Freedom of Information Act 1992 (Qld) (FOI Act) 39 to mean of or relating to the private affairs of a person’s life.40 DJAG says that information in the WorkCover claim concerns his employment affairs, related to the proposed co-location of workspaces. It says that it does not relate to his personal affairs. [88] The decision upon which DJAG relies draws a distinction between personal affairs and business or professional affairs.41 However, it was considering the former FOI Act, in which the term ‘personal affairs’ was widely used. The current legislation was introduced as part of a significant overhaul of the former FOI regime. The words must be interpreted in the context of the IP Act. I have not been referred to, nor am I aware of, any recent consideration of the meaning of the phrase in the IP Act. The term in context is broad enough to cover, at least, matters relevant to an individual’s personal life circumstances and private or domestic arrangements. [89] That said, I have concluded that IPP-3 does not apply in the circumstances of this proceeding. For reasons to be explained, read as a whole and on a plain reading, IPP-3 applies only to collection by an agency of an individual’s own personal information from that person. In case I am wrong and if IPP- 3 applies, I consider its application in explaining my conclusions. 38 Composite Document dated 2 March 2015, [15] and [22]. 39 Re Stewart and Department of Transport (1993) 1 QAR 227 (F N Albietz). 40 Ibid at 228. 41 Ibid at 239. -- 19 of 21 -- 20 [90] I have made findings to the effect that SDD’s comments containing personal information were collected by DJAG for inclusion in a document, namely the employer report in response to the WorkCover claim. Accordingly, IPP-3(1) would appear to be met. DJAG collected the personal information from a person, namely SDD. Accordingly, IPP-3(2) appears to be met. However, when IPP-3 is read as a whole, it becomes clear because of IPP-3(3)(b), it applies only to information collected from a person who is the subject of it. [91] Under IPP-3(3)(3), if IPP-3 applies, DJAG was obliged to take all reasonable steps to comply with all of the matters set out in IPP-3(3)(a) and (b). [92] Although (applying similar reasoning to the reasoning used in discussing what was ‘directly relevant’ in relation to IPP-1) collecting the information from SDD may not have been essential in preparing the response to WorkCover, I would be satisfied that it was relevant to providing a response to WorkCover. This is because BAW had named SDD in the claim, describing her as the ‘vile piece of garbage’42 whom BAW considered was responsible for the ‘homophobic and vexatious’43 anonymous allegations underlying his concern about OFT being co-located in the same office space as OLGR. Therefore, I would also find that IPP-3(3)(a)(i), if it applies, is satisfied. [93] There is no issue raised that the information collected from SDD was not complete and up to date as IPP-3(3)(a)(ii) requires. [94] However, IPP-3(3)(b) on a plain reading applies only when an agency is collecting an individual’s own personal information from that individual. This is because it requires that all reasonable steps be taken in collecting personal information from the individual the subject of it, to ensure that the extent and the manner of collection are not an unreasonable intrusion into the affairs of the individual. The concluding reference to the individual relates back to collecting personal information from the individual the subject of it. On a plain reading in context, the ‘person’ referred to in IPP- 3(2) is the subject individual. Here, DJAG did not collect information from BAW and his complaint does not allege that he did. His complaint relates to collection of personal information from SDD. [95] Therefore, I have concluded that IPP-3 does not apply to these circumstances. [96] If I am wrong about that, I would not in any event be satisfied that the IPP- 3(3)(b) had been breached. As discussed earlier, SDD was invited to provide her comments in the following terms: In short, certain allegations have been raised by BAW which involve yourself and accordingly, so that WorkCover can fully assess the merits of the application, DJAG HR … has authorised me to contact you, to provide you 42 Exhibit 9, p 97. 43 Ibid. -- 20 of 21 -- 21 with the opportunity to lodge a written submission, outlining your position in the matter.44 [97] She was not requested by DJAG to address any matters other than her response to the matters raised in the WorkCover claim. In providing her comments, SDD included information about BAW and his private life. She spoke of having met his partner on a number of occasions. She speaks about knowledge of his living arrangements. She states that she challenges the assertions that she made homophobic and vexatious allegations. [98] In responding as she has, SDD has made comments about her knowledge or understanding of BAW’s personal life which are not directly relevant to the allegations made in the WorkCover claim. However, DJAG did not ask for that information, it sought only her submission in respect of the allegations in the WorkCover claim. [99] It appears, and I would draw the reasonable inference, that SDD made these additional comments in seeking to demonstrate that she was not vexatiously and homophobically motivated towards BAW. As the allegation in the WorkCover claim arose out of BAW’s suspicion that she made the ‘homophobic and vexatious allegations’ against him (and ALS), I would not be satisfied that the extent to which the personal information collected from SDD, nor the way in which it was collected, was an unreasonable intrusion into BAW’s personal affairs. [100] BAW has not established a breach of IPP-3. Conclusions and orders [101] In summary, I find that the claimed breaches of the IPPs are not substantiated. [102] The privacy complaint is dismissed. Non-publication order [103] I do not consider it is in the interests of justice for information which may identify BAW or SDD to be published. Publication would tend to unnecessarily aggravate the potential for workplace issues. I am satisfied that the interests of justice can be served by publication of de-identified reasons for decision. Some of the documents also identify ALS by name as ALS. I do not consider it is in the interests of justice to identify him. I make orders prohibiting publication of any information which may identify BAW, SDD or ALS45. These reasons for decision must, other than to the parties, be published in a de-identified format. 44 Exhibit 23, PJR 7, p 218. 45 Reasons amended to correct references to de-identified persons. -- 21 of 21 --