AXP v Queensland Police Service [2013] QCAT 680

CITATION: AXP v Queensland Police Service [2013] QCAT 680 PARTIES: AXP (Applicant) v Queensland Police Service (Respondent) APPLICATION NUMBER: OCL137-12 MATTER TYPE: General administrative review matters HEARING DATE: 29 and 31 May 2013 HEARD AT: Brisbane DECISION OF: Senior Member O’Callaghan DELIVERED ON: 21 November 2013 DELIVERED AT: Brisbane ORDERS MADE: 1. The complaint has not been substantiated. CATCHWORDS: Information Privacy Act – where complaint referred to Tribunal for determination – where application of privacy principles considered – where documents exempt from privacy principles considered – where question of whether information in document arose out of a complaint under Police Service Administration Act or Crime and Misconduct Act considered; Where liability of agency for disclosure by employee considered; whether strict or vicarious liability; where meaning of PP4 and PP11 in privacy legislation considered. Information Privacy Act 2009 (Qld) ss 3, 164, 176, 178 Schedule 3 Police Service Administration Act (Qld) 1990 s 10.5 Queensland Civil and Administrative Tribunal Act 2009 (Qld) ss 3, 98 Briginshaw v Briginshaw (1938) 60 CLR 336 Charltons CJC Pty Ltd v Fitzgerald [2013] NSW -- 1 of 24 -- 2 SC 350 Director General, Department of Education and Training v MT (2006) 67 NSW LR 237 APPEARANCES and REPRESENTATION (if any): APPLICANT: represented by Mr Gnech, Queensland Police Union Solicitor RESPONDENT: represented by Mr McLeod of counsel, instructed by the Police Service Solicitor REASONS FOR DECISION [1] AXP is a member of the Queensland Police Service (QPS). He claims that an officer or officers of the QPS leaked personal information about him to a journalist who subsequently published an article about him using the information. He complains that in doing so the QPS has breached certain information privacy principles set out in the information privacy legislation (IPA)1 and that he is entitled to be compensated for the breach. [2] Upon publication of the article AXP lodged a complaint with the Information Commissioner pursuant to section 165 of the IPA. The parties engaged in an unsuccessful mediation and in accordance with the IPA the Information Commissioner referred the matter to QCAT at the request of AXP.2 [3] QCAT has original jurisdiction to decide a privacy complaint3 after hearing the privacy complaint the Tribunal can make one or more of the following orders set out in IPA:4 a) An order that the complaint or part of the complaint has been substantiated together with certain consequential orders if appropriate for example an apology, monetary compensation, amendment to a document.5 b) An order that the complaint has been substantiated with an order that no further action be taken. c) An order that the complaint, or part of the complaint, has not been substantiated, together with an order that the complaint or part is dismissed. d) An order that the complainant be reimbursed for expenses reasonably incurred in connection with making the complaint. 1 Information Privacy Act 2009 (Qld). 2 Ibid s 176(1). 3 Ibid s 176(2). 4 Ibid s 178. 5 Ibid s 178(a)(i) to (v). -- 2 of 24 -- 3 [4] It was decided that the issue of whether the complaint was substantiated would be the subject of an initial hearing and the claim for compensation deferred depending on the outcome of that hearing. [5] The hearing in relation to substantiation was an oral hearing with both parties being legally represented. Background to the complaint [6] The train of events which lead to the documenting of the information alleged to have been disclosed began in January 2012. [7] A male person was arrested and taken to the basement of a Police Station. The interaction between the police officers and the male person was captured on the police CCTV footage. On 6 February 2012 the male person complained about the use of force by the arresting officers. [8] On 15 February the media published extracts from the CCTV footage. An investigation was commenced concerning the responsibility for the release of the footage. [9] It was revealed that on 10 February 2012 media outlets had received emails from an anonymous person offering to release the footage. An investigation commenced into the possible involvement of AXP in the release of the footage. [10] The police executed a search warrant at AXP‟s house on 16 March 2012. [11] On the evening of 16 March 2012 an executive briefing note (EBN) in relation to the matter was drawn up and distributed to certain people within the QPS. [12] On 19 March 2013 a journalist from a local newspaper – WR sent an email to police media seeking confirmation of information relating to the execution of the warrant. AXP says that information was contained within the EBN. [13] QPS issued a media release in response indicating that an internal investigation was underway concerning the allegation of excessive force and the release of the video footage and that they did not intend to provide a progressive commentary whilst the investigation was ongoing. [14] WR published an article on 20 March in the newspaper containing details which AXP says came from the information set out in the EBN. He says that the information was disclosed to WR by a person or persons unknown in QPS. [15] The complaint regarding the release of the information was made initially to the QPS and the Crime and Misconduct Commission. AXP subsequently lodged the complaint with the Information Commissioner. -- 3 of 24 -- 4 The complaint [16] The substance of AXP‟s complaint is set out in his written submissions to the Tribunal:6 that between 16 March 2012 and 20 March 2012 the QPS was in control of the personal information of the applicant. The applicants personal information was contained within the EBN dated 16 March 2012. The information was released to WR. The consequence of this release of personal information was that an article was published by WR within the newspaper and online on 20 March 2012. The release of the said personal information by the Queensland Police (an agency under the Information Privacy Act) has breached information privacy principle 11 (IPP 11). Also, the Queensland Police Service have breached information privacy principle 4 (PP 4) by failing to ensure the document was protected against unauthorised access, use, modification or disclosure. [17] The QPS says that the Tribunal does not have jurisdiction to deal with that part of the complaint relating to an alleged breach of IPP 4. [18] They say:  QCAT has jurisdiction to hear and decide a “privacy complaint” referred to it under section 176 IPA.  The privacy complaint made to the Commissioner and referred to the Tribunal was disclosure of AXP‟s personal information in breach of PP 11. No mention was made of breach of IPP 4 until after the referral to the Tribunal. [19] The IPA defines a “privacy complaint”7 as a complaint by an individual about an act or practice of a relevant entity in relation to the individual‟s personal information that is a breach of the relevant entities obligations under the IPA to comply with the privacy principles. [20] AXP says that definition focuses on the conduct complained about and there is no need for restriction or a requirement to detail exactly what IPP was breached. [21] He says at the time of making the initial complaint he was not aware of the possible breach of IPP 4. [22] He says he only became aware of this when it became apparent that a number of persons from the QPS had had access to the EBN. [23] I note that this allegation was raised by AXP in his submissions filed with the Tribunal in November 2012 – well before the hearing in May 2013. [24] I do not agree with QPS‟ narrow interpretation of “privacy complaint.” In circumstances where both alleged breaches involve allegations of conduct which is based on the disclosure of the same information in the same document I accept that the complaint is one that has been referred to the Tribunal and that I have jurisdiction to determine whether the 6 Applicants submissions dated 28 June 2013. 7 IPA s 164. -- 4 of 24 -- 5 complaint regarding the conduct concerning the information in the document, is substantiated. [25] I also note that an examination of whether QPS have breached IPP 11 involves a consideration of whether they have breached PP 4 (this is discussed later in these reasons). [26] In those circumstances it would be inconsistent with QCAT‟s objectives to deal with matters in a way that is accessible, fair, just, economical, informal and quick8 not to deal with the complaint concerning IPP 4. The onus of proof [27] It is accepted that AXP bears the onus of proving a breach of the privacy principles to the requisite standard and that standard is the balance of probability. [28] It is also accepted by both parties that the test outlined in the Briginshaw case9 applies. The seriousness of an allegation made, the inherent likelihood of an occurrence of a given description, or the gravity of the consequences flowing from a particular finding are considerations which must affect the answer to the question whether the issue has been proved to the reasonable satisfaction of the Tribunal. [29] I agree with the submissions of AXP that the imposition of this test does not change the standard of proof – namely on the balance of probabilities, however I also accept that the nature of the allegation is serious and as such “reasonable satisfaction” that the breach occurred should not be lightly reached or on flimsy evidence. [30] The issue the Tribunal must determine is whether AXP‟s complaint that PP 4 and 11 have been breached by the QPS is substantiated. Privacy principle 11 [31] AXP must establish that in accordance with the principle:  the QPS is an agency;  it had control of a document containing the individual‟s personal information;  QPS disclosed that personal information to an entity other than himself. Is QPS an agency? [32] Both parties accept, and the Tribunal agrees, that the QPS is “an agency” and therefore obligated to comply with the privacy principles. 8 Queensland Civil and Administrative Tribunal Act 2009 (Qld) s 3(b). 9 Briginshaw v Briginshaw (1938) 60 CLR 336 at 332. -- 5 of 24 -- 6 Did the QPS have control of a document containing personal information about AXP? [33] The relevant document is the EBN which was completed and distributed on 16 March 2012. [34] QPS did have control of the document. I accept that this document contained personal information about AXP as particularised by AXP10 as follows:  On Friday 16 March ESC officers attended the identified home of AXP where they executed a search warrant.  AXP gave investigators an “SD” card containing the CCTV footage subject to the inquiry and other QPS CCTV footage.  AXP claimed he was compiling the footage for training purposes.  There were ongoing criminal investigations.  AXP will be directed to commence duty at a Police Community Communications Centre. Do the privacy principles apply to the EBN? [35] QPS say that the complaint cannot be substantiated because the privacy principles do not apply to the EBN. [36] Section 15 of the IPA provides that „a document does not include a document to which the privacy principles do not apply‟. Schedule 1 of the IPA sets out those documents to which the privacy principles do not apply. [37] The list includes:11 A document to the extent it contains personal information arising out of – (a) a complaint under the Police Service Administration Act 1990 part 7: or (b) a complaint, or an investigation of misconduct under the Crime and Misconduct Act 2001. [38] QPS submit the privacy principles do not apply to the information contained within the EBN because it is information arising out of a complaint under the Police Service Administration Act part 7 or a complaint or investigation of misconduct under the Crime and Misconduct Act. [39] QPS rely on the evidence of CX in support of this submission. His oral evidence at the hearing given under cross examination concerned the nature and purpose of an EBN. [40] He said that an EBN was a document used to communicate important information to the Executive.12 10 Applicant‟s submissions 28 June 2013 paragraph 18 page 5. 11 IPA s 3 Schedule 1. -- 6 of 24 -- 7 [41] He confirmed that the creation of an EBN was not necessarily part of the disciplinary process but may be provided in serious cases of misconduct. [42] I accept the QPS submission that this evidence simply establishes that the EBN did not “arise” out of a complaint. The question however is whether the information in the EBN arose out of the complaint. [43] CX also provided an affidavit after the hearing detailing the progress in the misconduct investigation. [44] Annexure A to his affidavit is “a compass summary report”. Compass summary is the police discipline computer database that records complaints in respect to QPS officers and any actions that are taken in relation to the complaint. [45] CX says that the compass report shows that:  On 15 February 2012 a complaint was made against a member of the police service by ZP pursuant to section 7.2 of the Police Service Administration Act.  On 16 February 2012, CX assessed the complaint as a misconduct matter being “control of information” and assigned it to WD to investigate.  The complaint was referred to the CMC pursuant to the Crime and Misconduct Act.  The CMC assessed the complaint as official misconduct being conduct which could amount to a criminal offence or a disciplinary breach upon which a person‟s employment may be terminated.  On 23 February 2012 the CMC referred the complaint back to the QPS for investigation and a direction to report to the CMC on the findings of the disciplinary investigation and all resolution recommendations prior to any action being taken.  Upon the referral by the CMC the Commissioner of the QPS was charged under section 41(2) of the CMC Act with the responsibility for dealing with the complaint.  The complaint was investigated by the officers of the ESC.  On 16 March 2012 an executive briefing note was prepared and distributed as part of the investigation.  The final investigation report and recommendations were referred to the CMC on 25 September 2012 in accordance with the “review before” direction issued on 23 February 2012. [46] QPS point out that “arising out of” is not defined in the Act. They say the phrase in its ordinary meaning includes “to come into being”, “originate” and “to result, issue, proceed”. They provide no reference for this 12 Transcript page 15 at 40. -- 7 of 24 -- 8 submission however these suggested meanings for the phrase can be found when the words are searched on online resources.13 [47] QPS submit that the personal information within the EBN did “arise out of” the complaint by ZP under section 7.2 of the Police Service Administration Act in that the information concerning the raid on AXP‟s house and the discovery of items came into being or originated with the complaint. [48] QPS say the evidence of CX clearly indicates that a complaint of misconduct under the Crime and Misconduct Act had been made and assessed by the Commissioner. The personal information in the EBN arose out of this complaint in that its genesis lay in the complaint. [49] AXP submits that the exception in schedule 1 section 3 does not apply to the information contained within the EBN because such an application would be contrary to the objectives of the IPA. [50] The primary objective of the IPA is to provide for the fair collection and handling in the public sector environment of personal information.14 He says if a broad interpretation was given to the category of documents to which the principles don‟t apply this would not further the primary objective of the Act. He says it is not the case that the QPS should have a license to be reckless with personal information because of the exceptions listed in schedule 1. [51] The QPS accept that because the IPA is purposive legislation its provisions are to be interpreted in such a way as to further that primary object. They agree that provisions (such as schedule 1) that aggregate from the primary object are to be interpreted narrowly. They say however it is not the case that the provisions are to be interpreted in a manner which is unreasonable or unnatural. [52] QPS say that it has never been submitted that the exemption provides a license for reckless disclosure of information. They say it is simply the case that IPP 11 will not apply to that personal information of AXP within the EBN which has arisen out of complaint or investigation and that in this case the information did arise from the original complaint of misconduct. [53] AXP also says that in any event the document contains information about a criminal investigation not a complaint of misconduct. He says there was in fact no discipline interview until April 2012. The EBN itself states „no disciplinary interview has been commenced at this stage due to ongoing criminal investigation‟. He says the actions of the officers on 16 March 2012 in executing the warrant was solely related to a criminal investigation and as such the EBN contains information solely in regards to a criminal investigation not a complaint. 13 Legal dictionary – free dictionary.com. 14 IPA s 3. -- 8 of 24 -- 9 [54] In response QPS say that is accepted that a criminal investigation was undertaken however what AXP‟s submission does not recognise is that such an investigation may also constitute a misconduct investigation. The allegation against AXP in respect of the leaking of the CCTV footage is one of official misconduct which is defined as including conduct which if proved could be “a criminal offence”. It follows they say that the complaint and investigation of alleged criminal conduct on the part of a police officer could also constitute a complaint and investigation of official misconduct under section 15 of the Crime and Misconduct Act. [55] To some extent the submissions of AXP on this issue focus on the “unfair consequences” if the EBN is not protected by the Privacy Principles. [56] It is no doubt the case that if the information has been wrongly disclosed AXP‟s privacy has been eroded. It is another question however whether in accordance with the express provisions of the Act the information disclosed which is in the document arose from a complaint and therefore is not protected by the Privacy Principles. On balance I prefer the argument of the QPS. On a literal reading of the provisions of schedule 1 the personal information that was contained within the EBN was information arising from a complaint which resulted in a misconduct investigation which investigation included the execution of a search warrant. [57] I find that the document is not a document to which the privacy principles apply and as such the complaint that the QPS have breached PP 4 and 11 is not substantiated. [58] However if I am incorrect in this finding I propose to consider the other elements of the referral. Did the QPS disclose the information in the EBN in breach of PP 11? [59] AXP says that when regard is had to the similarities between the contents of the EBN and the published article together with the evidence given at the hearing by officers of the QPS and by the journalist WR the Tribunal can be confident that the information in the article had its origins in the EBN and was provided to the journalist by a member or members of the QPS. [60] The QPS say there is no direct evidence that the EBN and the QPS were the source of the information in the article. They say AXP‟s case is merely circumstantial and the evidence fails the test required for facts to be established on circumstantial evidence. -- 9 of 24 -- 10 [61] They refer the Tribunal to the decision of Charltons CJC Pty Ltd v Fitzgerald15 in which the principles and the approach to circumstantial evidence in civil matters was addressed with the following points made: a) Proof of any fact on the balance of probabilities may be established by circumstantial evidence. b) A fact may be proved by inference if according to common experience the fact is the more probable inference from the unexplained primary facts. Certainty is never possible, and is not required. c) For the purpose of considering whether the probabilities are satisfied in a case based on circumstantial evidence, the Court must consider „the accumulation of the evidence‟. It is appropriate „not only to evaluate each of the factual contentions separately but also to form an appreciation of the overall affect of the whole of the evidence by considering the weight which is to be given to the united force of all the circumstances put together‟. [62] AXP says that there is in fact direct evidence from the journalist to prove that she obtained the information from a member of the QPS. They say if the Tribunal does not accept that then in any event the evidence in totality proves the action to the relevant standard. The evidence?  The similarities between the contents of the EBN and the article. [63] AXP points to the following similarities: EBN  … the home address of AXP.  On Friday 16 March the ESC attended the home address of AXP where they executed a search warrant. Article  On Friday, officers from ethical standard command raided the home of AXP. WR in evidence confirmed that information about the raid came from a source but that she didn‟t think she got the address from a source but rather a RP Data Search. EBN  WR handed investigators an „SD‟ card containing the CCTV footage subject to the inquiry. 15 [2013] NSW SC 350. -- 10 of 24 -- 11 Article  … and found a copy of the damning CCTV vision that shows officers struggling with 21 year old BN. In oral evidence WR conceded that that was information that she was told.16 EBN  … and other QPS CCTV footage Article  Other potentially damaging material was found. WR conceded in oral evidence that that information came from her source and informant.17 EBN  He was compiling the footage for training purposes. Article  AXP allegedly claimed it was for „training purposes‟. WR conceded in evidence that the information came from her source or informant.18 EBN  Ongoing criminal investigation Article  Whilst an investigation is ongoing EBN  He will also be directed to commence duty at a police Communications Centre. Article  He has been transferred to a Communications Centre EBN  Enquiries reveal that three of these emails were sent from computer using a modem situated at the home address of AXP 16 Transcript page 53. 17 Transcript page 54. 18 Transcript page 53. -- 11 of 24 -- 12 Article  Emails traced to AXP‟s home show he was angry at the treatment of his brother. [64] I find that similarities between the information and how it expressed in the EBN and in the article are such that it is highly likely that the information in the EBN was disclosed to WR and formed the basis of her article. [65] I accept that there is also information in the article which did not come from the EBN, for example „police sources allege AXP timed the leak to be published as he left the country on leave‟. I have no doubt, as disclosed by WR in evidence that she was in contact with a number of sources to gather the information in the article. [66] The information referred to above in paragraph 63 is so similar however that I find it difficult to conclude that she gleaned that particular information came from anywhere else but the EBN. As discussed further in these reasons WR had information about the leakage of the CCTV footage and the allegations about AXP in this regard prior to drafting and distribution of the EBN. As AXP submits however the specific information in the article goes further than simply joining the dots.  Evidence of WR [67] WR has been employed by the newspaper for approximately 15 years. [68] In February 2012 she received emails from a person using the email address [email protected] offering to provide the newspaper a copy of CCTV footage of the arrest of a male person. [69] She says she took no action in relation to the email at that stage (although another employee at the newspaper did send contact ZP advising of the contents of the email). [70] At her mother‟s funeral on 2 March 2012 she had a conversation with HI wherein she told him about the emails. She was subsequently asked by HI to supply the emails to QPS. She did that through her editor. She had a subsequent conversation with HI on 16 March when she asked how the AXP investigation was going. [71] On 19 March she sent an email to QPS Media seeking clarification in relation to the execution of the warrant. [72] On 20 March her article containing AXP‟s private information was published. [73] In the article she refers to information coming from “police sources” and “insiders”. [74] WR knows where the information in the article came from. It would have been easier to make findings in this matter if she had shared this information with the Tribunal. -- 12 of 24 -- 13 [75] At the hearing she was asked in cross examination whether the sources of her information were members of the QPS.19 She refused to answer this question on the basis that in doing so would breach her code of ethics which required her to respect confidential sources. [76] She was legally represented at the hearing and her counsel argued that although the question did not ask her to identify a particular person, it had the potential to identify the sources of the information and therefore breach the code. [77] He also submitted that if she answered the question it may identify that the information came from a police source which may tend to incriminate her. It is an offence for a police officer to disclose confidential personal information to a journalist and in receiving that information she could potentially be a party to the offence.20 [78] The QCAT Act provides that the Tribunal cannot compel a witness to answer a question if the witness has a reasonable excuse for refusing to answer. It is a reasonable excuse for a witness to refuse to answer a question if answering the question might tend to incriminate the person.21 [79] At the hearing I made a finding that WR could not be compelled to answer the question on the basis that she had a reasonable excuse. I did not consider her concern about breaching the code of ethics to be a reasonable excuse in this case because the answer would not identify the source of the information, merely that the person/s were a member/s of the QPS. The risk however that the answer may incriminate her was a reasonable excuse. [80] WR‟s evidence was in any event informative as to the source of the information in her article. [81] AXP in his submissions refers the Tribunal to the following aspects of WR‟s evidence.22 a) She confirmed that she had compiled the article in accordance with ethical principles including to report and interpret honestly, striving for accuracy.23 b) She agreed that police sources or insiders informed her:  that AXP was the police officer involved;24  that ethical standards raided AXP‟s house;25 19 Transcript page 58. 20 Transcript page 60. 21 QCAT Act s 98(2)(3). 22 Applicants submissions 21 June 2013 at page 22. 23 Transcript page 52 at 35. 24 Transcript page 53 at 15. 25 Transcript page 53 at 35. -- 13 of 24 -- 14  that the raid was in relation to an allegation that he leaked CCTV footage;26  that AXP claimed that it was for “training purposes” and other damaging material was found;27  that AXP had been transferred to Communications;28  that AXP was overseas and returned last Thursday;29  that AXP was angry and upset when his brother was accused by co-workers of having an inappropriate involvement;30  that emails were traced to AXP‟s home.31 [82] WR gave evidence that she was in contact with a number of people from QPS, that she considered them friends and that they were giving her information about AXP which was included in her article.32 [83] QPS submit that her evidence does no more than indicate that QPS Members “could” have been the source of the information. [84] I think it goes further than that. This evidence satisfies me to the requisite standard that QPS employee/s disclosed to her the information about AXP that was included in her published article. [85] Because of the similarities between the EBN and the article I am also satisfied that to the extent of those similarities the information disclosed was information contained in the EBN. [86] The original findings in investigations by the QPS into AXP‟s complaint conducted by WS and JD were inconclusive. They found it couldn‟t be discounted that a QPS member was involved in the disclosure but it couldn‟t be concluded that was the case. Both officers noted that AXP‟s family and a neighbour were present during the execution of the warrant intimating that they could have been the source of the disclosure. The relevant people have provided affidavits deposing to the fact that they had not disclosed any information to WR. These witnesses were not required for cross examination. I reject the unlikely scenario that they were the source of the information. Can the pool of employees who possibly disclosed the information be narrowed? [87] QPS filed affidavits from 39 employees who had cause to have seen the EBN or had knowledge of its contents all disposing to the fact that they did not disclose any information regarding AXP to WR. 26 Transcript page 53 at 40. 27 Transcript page 54 at 0. 28 Transcript page 54 at 32. 29 Transcript 55 at 5-25. 30 Transcript 55 at 34. 31 Transcript 56 at 0. 32 Transcript 57 at 15. -- 14 of 24 -- 15 [88] One of those persons was HI. AXP has submitted that on the basis of evidence before the Tribunal it is more probable than not that it was HI who provided at least part of the information to WR. [89] The evidence reveals:  HI knew WR‟s family and attended her mother‟s funeral on 2 March 2013;33  at some point prior to 5 March 2013 (it may have been at the funeral) WR told HI that she had received emails from an anonymous source offering to provide CCTV footage of the arrest;34  HI overheard a conversation between SX and others at Ethical Standards about an investigation into the disclosure of the footage and advised them of the information given by WR;  he was asked to obtain the emails from WR;  he called her and followed up with a letter from CX asking for copies of the emails;  HI received a phone call on 16 March from WR asking him what was happening with the AXP investigation;35  he directed her to WI;  he did not see the EBN. [90] AXP submits and I accept that at some point between 2 March 2013 and 16 March WR received information which ties AXP to the emails. [91] AXP goes further and submits that information is likely to have come from HI as he was the person that had principle contact with WR. [92] HI denied in cross examination that he told WR he required the emails because of an investigation of AXP.36 [93] WR in her evidence said she could not recall asking HI about AXP before 19 March.37 [94] Her evidence was unclear about how she had found out about the investigation into AXP. [95] When asked whether she made a phone call to HI on 16 March to ask about the AXP matter she said: Probably, I was trying to keep tabs on where the inquiry was at.38 33 Transcript page 40 at 25. 34 Transcript page 44. 35 Transcript page 45. 36 Transcript page 45 at 35. 37 Transcript page 45 at 56. 38 Transcript page 56. -- 15 of 24 -- 16 [96] Then it was put to her that as at 16 March she had connected AXP to the emails and she said she „couldn’t recall‟.39 [97] Her evidence only went as far as to say she did receive information about the investigation into the emails, she did ask HI for an update on the AXP matter and that the information which made its way into the article was obtained by virtue of her being „in contact with a number of police‟.40 [98] AXP says that the Tribunal should have concerns about the validity of WR and HI‟s evidence. He says the evidence was unconvincing and evasive. I agree that neither witness was particularly helpful and in HI‟s case he was vague in his recollection of events. WR was at times inconsistent and evasive. [99] AXP submits that combining this unconvincing evidence with the fact that HI was in contact with WR prior to the information being disclosed it is open to the Tribunal to find it was more probable than not that it was HI who provided at least part of the information. [100] I am not satisfied to the requisite standard that this is so. I accept it is a possibility however without further persuasive evidence I find no more than that. I am satisfied to the requisite standard on the evidence both circumstantial and direct that a member or members of the police force disclosed personal information about AXP to WR and that information had been recorded in the EBN. The issue of liability – did the QPS breach PP 11 [101] The next question is whether the QPS as an agency should be held responsible for such disclosure. [102] AXP submits that once an employee is found to have breached the privacy principle there is strict liability against the agency. Alternatively if there is not strict liability then the QPS is vicariously liable pursuant to section 10.5 of the Police Service Administration Act. [103] QPS say that the legislation does not impose strict liability and further they are not vicariously liable pursuant to section 10.5. [104] It is accepted that the IPP does not expressly provide for strict liability nor does it identify when the conduct of an employee of an agency is to be attributed to the agency. [105] Both parties have referred the Tribunal to the NSW Court of Appeal decision in Director General, Department of Education and Training v MT41 in support of their positions. The judgment in this decision is of assistance in interpreting the legislation. 39 Transcript page 56. 40 Transcript page 57 . 41 (2006) 67 NSW LR 237 -- 16 of 24 -- 17 [106] In that case a teacher employed by the Department of Education was also a coach of a local soccer team which was unconnected to the school. A student at the school was a member of a soccer team. This student had a medical condition which affected her ability to play sport. [107] The teacher accessed the student‟s school file, which was available to all teachers, to obtain information about the student‟s medical condition. [108] He subsequently disclosed that information to the soccer club president and the student was not selected to play in the soccer final. The case concerned whether the Department had breached privacy principles in the NSW legislation. [109] The NSW legislation is similar but in some aspects different to the Queensland Act. Relevantly it contains the following protection principles:  S 129(c) (the equivalent of PP 4) A public sector agency that holds personal information must ensure… That the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse.  S 18(1) (the equivalent of PP 11) A public sector agency that has personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such person or body is a public sector agency. [110] The Department admitted a breach of section 12(c). [111] The question for the Court was whether the Department “disclosed” the information in breach of section 18(1). [112] As with the Queensland legislation, the Act did not specify when conduct of an employee of an organisation should be attributed to the organisation. [113] It was found by Spigelman CJ that:  There was no specific statutory provision that identifies, by way of clarification and often by way of extension, when conduct of an employee or agent of an organisation is to be attributed to the organisation. Absent any provision, the issue in any specific case is one of interpretation of the legislative scheme, giving weight to its scope and purpose.42  The legislative scheme is concerned with the conduct of public sector agencies acting for their public purposes.  The most relevant obligation with respect to unauthorised use of information is that imposed by section 12(1) requiring the agency to 42 At paragraph 35 of the decision. -- 17 of 24 -- 18 take steps to „ensure … that the information is protected … against … unauthorised access, use … or disclosure‟.43  Section 62(1) specifically prohibits the disclosure of personal information by an employee outside the scope of their official function.44 (It is noted there is no similar provision in the Queensland legislation, a point which is relied upon by AXP and will be dealt with below.)  The interaction of section 12(c) and section 62(1) leaves no scope for the extension of each reference to conduct of the public sector agency to encompass any conduct by an employee or agent, irrespective of whether it is within the scope of his or her functions as such. Where the “disclosure” of information was for a purpose extraneous to any purpose of the Department, it should not be characterised as “disclosure” by the Department.45 [114] AXP says because the Queensland legislation does not have an equivalent to s 62(1) where there is no provision for an offence by an individual employee for disclosing information for purposes outside the scope of their employment MT‟s case is clearly distinguishable. The agency should be held liable for all acts of employees irrespective of the circumstances of the disclosure. [115] I accept the logic of this submission, however even without a specific provision imposing liability on an employee, the comments of Spigelman CJ on the impact of 12(c) in considering when an agency should be liable for disclosure are applicable when interpreting the Qld legislation. He says at [44]: The express regulation of “unauthorised use or disclosure” is qualified by the condition that the “safeguards” must only be reasonable. The Court should be slow to interpret a statutory obligation expressed in general terms with the effect that it overlaps with another obligation which is expressed in conditional terms. Where the agency has satisfied its obligation under section 12 it was not parliament‟s intention to expose every such agency to a form of absolute liability for the unauthorised private conduct of its employees. Nothing in the text or the scope and purpose of the legislative scheme suggest that Parliament intended to impose absolute regulatory liability. Section 12(1) itself imposes an obligation only to adopt such “safeguards as are reasonable in the circumstances. [116] This analysis is equally applicable to the Queensland legislation. Privacy principle 11 protects information in the document which the agency has control of. PP4 deals with the obligations on the agency to ensure the security of the information in the document that they have control of. [117] The NSW provision (section 12) clearly states that the agency „must ensure that the information is protected by taking such security safeguards as are reasonable‟. The Queensland equivalent, PP4 is not drafted as clearly. 43 At paragraph 41 of the decision. 44 At paragraph 41 of the decision. 45 At paragraph 43 of the decision. -- 18 of 24 -- 19 [118] On its initial reading PP4 seems to provide for a stricter liability apparently requiring the agency to ensure the information is protected without any element of reasonableness. (1) An agency having control of a document containing personal information must ensure that: (a) the document is protected against: … (ii) unauthorised access, use, modification or disclosure; and (iii) any other misuse; and (b) If it is necessary for the document to be given to a person … the agency takes all reasonable steps to prevent unauthorised use or disclosure…” [119] Subsection 2 of PP 4 however goes on to provide for a requirement of reasonable safeguards. It provides: (2) Protection under subsection 1 must include the security safeguards adequate to provide the level of protection that can reasonably be expected to be provided. [120] Although, the drafting could be clearer, I accept the submissions of QPS46 that the use of the word “includes” in PP 4(2) is not used for the purpose of adding to the natural significance of PP 4(1) but in the context of the Act is designed to provide an exhaustive explanation of the obligation of agencies under PP 4(1). As such, the proper construction of PP 4 is that an agency having control of a document containing personal information must ensure that the document is protected by security safeguards adequate to provide the level of protection that can reasonably be expected to be provided. [121] That being the case I find that the scope and purpose of the legislative scheme does not lend itself to the conclusion that there is strict liability imposed on the agency. In circumstances where the agency is only expected to provide safeguards that are reasonable to prevent disclosure, liability when there is disclosure must be something less than strict liability. If it is not strict liability, when is the agency liable? [122] In MT‟s case the Court commented that where the agency has satisfied its obligation under 12 (our 4) that it was not Parliament‟s intention to expose the agency to a form of absolute liability. That approach can be applied to our legislation. If then, the agency has taken such steps that are reasonable to safeguard the information then an unauthorised disclosure should not be bought home to the agency. [123] The issue of whether QPS has complied with PP 4 in this case is discussed below. 46 QPS submissions dated 29 July 2013 at paragraph 69. -- 19 of 24 -- 20 [124] Spigelman CJ, said that the converse although may not necessarily be the case, that is a breach of PP 4 does not of itself make the agency liable for the disclosure. [125] I accept the submissions of the QPS as being an appropriate interpretation. The liability of agencies should be limited to those situations where the disclosure was within the ability of the agency to control either through its possession or control of the documents, or the adoption of protective safeguards. This involves a consideration of whether the disclosure was authorised by the QPS or done when an employee was acting for the purpose of the agency or alternatively for personal reasons. Vicarious liability [126] AXP says that if there is not strict liability imposed on the QPS then it is vicariously liable pursuant to section 10.5 of the Police Service Administration Act which provides: The crown is liable for a tort committed by any officer, staff member, recruit or volunteer, acting or purporting to act, in the execution of duty as an officer, a staff member, recruit or volunteer, in like manner as an employer is liable for tort committed by the employer‟s servant in the course of employment.47 [127] There is some debate in the submissions about whether a breach of the privacy principle is a tort. In the absence of any authority from AXP to support this argument I would be unlikely to find that it was. It is not however necessary to do that. Without any evidence that the disclosing of the information was in the actual or purported execution of duty by the QPS employee I am unable to find that section 10.5 applies. [128] The question of whether QPS can be liable for the breach of PP 11 involves initially a question of whether in the circumstances PP 4 has been breached (see paragraphs 124 and 125 above). [129] If there is no breach it would be difficult to find that the QPS are liable for the disclosure. [130] I have already found that QCAT has jurisdiction to hear the complaint concerning a breach of PP 4 so it is convenient to consider that issue at this juncture. Privacy principle 4 [131] I have already determined that the QPS is an agency having control of a document containing personal information (see paragraph 32 and 34 above). The next question is whether the QPS failed to ensure the EBN was protected and to take all reasonable steps to prevent the unauthorised disclosure of the information in the EBN to WR. 47 Police Service Administration Act (Qld) 1990 s 10.5. -- 20 of 24 -- 21 [132] I agree with the submission of the QPS that the question whether security precautions are “reasonable” requires a consideration of the nature of the information, which would include its sensitivity, and the consequences of loss, unauthorised access, use or disclosure. [133] AXP says that on the QPS‟ own evidence at least 43 persons had access to the EBN and this is sufficient to establish a breach. He says there was no need for that information to be shared on mass as it was. [134] QPS say that although at least 43 people had access to the EBN, the question is whether the process by which this information came to the knowledge of that number of staff represented an unreasonable failure to protect the information. [135] As set out in QPS submissions48 the EBN was distributed as follows: 77. The following persons were present during the drafting of the EBN:  WD (ESC)  RM (ESC)  JK (ESC)  LT (ESC) 78. The following persons were involved in the approval of the EBN:  SD (ESC)  CK (ESC)  CX (ESC) 79. At approximately 7pm, an EBN was distributed to the following persons:  The then Deputy Commissioner (DCRO), now Commissioner of Police  NM (DCRO Staff Officer)  DX (ESC)  DB (ESC Staff Officer)  WJ (ESC)  RG (SER)  HS (SER)  CM (SCOC)  HB (SCOC)  HG (Chief of Staff)  TM (SCOC – FCEU) [136] The EBN was subsequently (before the disclosure) distributed to the email groups for the Commissioner of Police, the Deputy Commissioners and the Staff Officer SER. [137] AXP says this was excessive distribution and indicates the QPS had no regard for its responsibilities under the IPA. 48 QPS Submissions dated 29 July 2013 at paragraphs 76 – 79. -- 21 of 24 -- 22 [138] AXP also points to the fact that the EBN was not marked “not for media” despite a requirement in the QPS media guidelines that this notation be applied. [139] QPS concede that they did not comply with the guidelines in this regard but say that in this instance a failure to do so did not amount to a failure to take reasonable precautions. [140] QPS rely on the evidence of CX. [141] CX said in relation to the distribution to 43 people that this process was a necessary part of „the practicability of running a large organisation and keeping those senior officers appropriately informed‟.49 [142] He maintained that senior officers have trusted staff to manage such confidential information. It is an appropriate balance between the need to secure personal information and the operational requirements of the QPS. [143] As to the failure to note the EBN “not for media”, CX said that policy was simply a guide to officers in dealing with a multitude of media related issues. [144] He said in a case such as this where the contents of the document relate to a disciplinary issue there is a legislative and policy practice and process in place that officers are aware of through training which provides for the strict management of confidential information. The QPS submitted that employers know that disclosure of confidential information is an offence under the Police Service Administration Act. [145] I accept the sense of this submission in a practical sense. QPS staff are no doubt in possession and control of extensive confidential information and the agency should be able to rely on staff acting in accordance with the appropriate ethical standards. As such, the distribution of the EBN to group email addresses and the failure to note this EBN as not for media release do not in themselves equate to a breach of privacy principle 4. [146] I must however have regard to particular circumstances of this case. It was known to some officers in control of the EBN that the newspaper already had an interest in the matter the subject of the EBN. It was known that WR had received emails which were the subject of the investigation. Having regard to the likely consequences of disclosure of the information namely there was a likelihood it would reach the media and be published, it would have been appropriate to maintain a tighter control of the information in the EBN. [147] It is noted that JD (the officer who investigated the disclosure at the request of the CMC, commented in evidence that he thought distribution of the EBN to 43 persons „was on the high side‟).50 49 Transcript page 20, 15 – 31. 50 Transcript page 35 at 10 – 20. -- 22 of 24 -- 23 [148] In those circumstances I find that if the privacy principle had applied to the EBN (which I have already concluded did not) then in distributing the EBN to a large number of people in circumstances where the media was clearly interested and this fact was known to officers involved in the drafting and distribution of the EBN, there was a failure by the QPS to take reasonable steps to safeguard the information. Does a breach of PP4 mean that the QPS have breached PP 11 [149] As discussed above51 a breach of PP 4 does not automatically bring about liability to the QPS for a breach of PP 11. It is still necessary to conclude that the disclosure was related to the breach. [150] On the evidence and findings set out above I am not satisfied to the requisite standard that there was such a connection. [151] I am satisfied that a member or members of the QPS disclosed information in the EBN to WR but I am not satisfied that the perpetrators were in a position to disclose the information because reasonable safeguards were not put in place to secure the information. [152] I have no evidence as to the precise circumstances in which and by whom the information was released. It may or may not have been authorised or connected to the members‟ employment. The information may have been known to the employee and disclosed regardless of the dissemination of it to a large number of staff. [153] In those circumstances I find that QPS has not breached privacy principle 11. Summary [154] I find that the PP 11 and 4 do not apply to the EBN and as such the complaint has not been substantiated. [155] If this finding is incorrect my views with respect to the other elements of the referral are:  A member or members of the QPS disclosed information in the EBN to WR.  QPS as an agency is not liable for the disclosure.  QPS did breach PP 4 in that it failed to provide security safeguards adequate to provide the level of protecting that could reasonable have been expected to be provided to protect the document against unauthorised disclosure and did not take all reasonable steps to prevent unauthorised disclosure of the information. 51 Paragraph 124 above. -- 23 of 24 -- 24 Non publication order [156] The Tribunal notes that an order has previously been made on 31 May 2013 prohibiting the publication of any information that may enable AXP or any of his family members (including their addresses) or the other persons named in the order to be identified. -- 24 of 24 --