Privacy Law
The Privacy Act 1988 lays down the Information Privacy Principles 1-11 (IPPs) under section 14, which apply generally to APS agencies (and generally to its contractors) in relation to handling 'personal information'. Any act that is inconsistent with an IPP is considered an 'interference with privacy'.
The Privacy Act 1988 is often relevant when: a perpetrator discloses targets' personal information contrary to the IPPs (which forms part of their bullying, harassment, victimisation or discrimination conduct); APS officers (usually investigators) collect, record, keep, use or disclose personal information contrary to the IPPs; or APS officers and APS agencies refuse to give individuals any records containing their personal information, or to correct their personal information, in connection with a complaint of bullying, harassment, victimisation or discrimination. The Privacy Act 1988 can also be relevant to applications for access to personal information under the Freedom of Information Act 1982.
The IPPs do not place personal liability upon officers of APS agencies. Further, APS agencies are only liable for the acts of their officers done in the performance of their duties as APS employees. However, reprimands/sanctions should be taken against non-complying APS officers under the APS Code of Conduct (see the Public Service Act sub-page).
You should familiarise yourself with the Office of the Australian Information Commissioner's Legally Binding Privacy Guidelines and Rules and Information Privacy Principle Guidelines.
Complaints about breaches of the Privacy Act 1988 should be made to the Office of the Australian Information Commissioner and they should be made no later than 12 months after becoming aware of the breach. The Commissioner will usually begin a preliminary inquiry of a complaint (see section 42 of the Privacy Act 1988) and then, where appropriate, move on to conducting an investigation (see section 43 of the Privacy Act 1988). (As discussed at The Reality page, you should be very wary of official channels, as utilising them can lead to protracted, frustrating, dead-end or harmful outcomes. Thus, you are better off knowing your privacy rights and asserting them at the time of your rights being breached rather than waiting to make a complaint with the Commissioner afterwards.)
Be aware that the Commissioner may decide not to investigate a complaint or defer an investigation of a complaint where the Commissioner is satisfied that:
The Commissioner may resolve complaints of breaches of the Privacy Act 1988 by making one of the following determinations:
Formal complaint determinations by the Commissioner only occur in rare cases, as most complaints will be resolved by conciliation or other means. Generally, where an APS agency refuses to comply with a determination, the complainant can apply to the Federal Court or Federal Magistrates Court for an order that the determination be enforced.
Applications for review of the Commissioner's determinations regarding compensation and expenses are to be made to the Administrative Appeals Tribunal.
Given that most complaints are settled by conciliation, there are few court case precedents to refer to in assessing the amount payable for personal suffering that results from a breach of the Privacy Act 1988. The Administrative Appeals Tribunal, in the case of Re Rummery and Federal Privacy Commissioner and Department of Justice and Community Safety (2004) AATA 1121 (22 November 2004), set out the following principles in the assessment of compensation:
Some of the aspects of personal suffering that can be relevant to determining the amount of compensation payable are:
The Privacy Act 1988 is often relevant when: a perpetrator discloses targets' personal information contrary to the IPPs (which forms part of their bullying, harassment, victimisation or discrimination conduct); APS officers (usually investigators) collect, record, keep, use or disclose personal information contrary to the IPPs; or APS officers and APS agencies refuse to give individuals any records containing their personal information, or to correct their personal information, in connection with a complaint of bullying, harassment, victimisation or discrimination. The Privacy Act 1988 can also be relevant to applications for access to personal information under the Freedom of Information Act 1982.
The IPPs do not place personal liability upon officers of APS agencies. Further, APS agencies are only liable for the acts of their officers done in the performance of their duties as APS employees. However, reprimands/sanctions should be taken against non-complying APS officers under the APS Code of Conduct (see the Public Service Act sub-page).
You should familiarise yourself with the Office of the Australian Information Commissioner's Legally Binding Privacy Guidelines and Rules and Information Privacy Principle Guidelines.
Complaints about breaches of the Privacy Act 1988 should be made to the Office of the Australian Information Commissioner and they should be made no later than 12 months after becoming aware of the breach. The Commissioner will usually begin a preliminary inquiry of a complaint (see section 42 of the Privacy Act 1988) and then, where appropriate, move on to conducting an investigation (see section 43 of the Privacy Act 1988). (As discussed at The Reality page, you should be very wary of official channels, as utilising them can lead to protracted, frustrating, dead-end or harmful outcomes. Thus, you are better off knowing your privacy rights and asserting them at the time of your rights being breached rather than waiting to make a complaint with the Commissioner afterwards.)
Be aware that the Commissioner may decide not to investigate a complaint or defer an investigation of a complaint where the Commissioner is satisfied that:
- the complaint was made more than 12 months after the complainant became aware of the act/practice;
- the complaint if frivolous, vexatious, misconceived or lacking in substance;
- the act/practice is the subject of an application under another Commonwealth, state or territory law, and the subject-matter of the complaint has been, or is being, dealt with adequately under that law;
- another Commonwealth, state or territory law provides a more appropriate remedy for the act/practice that is the subject of the complaint;
- the respondent has dealt, or is dealing, adequately with the complaint;
- the respondent has not yet had an adequate opportunity to deal with the complaint; or
- it would be more appropriate for the Australian Human Rights Commission, the Ombudsman or the Public Service Commissioner to deal with the complaint.
The Commissioner may resolve complaints of breaches of the Privacy Act 1988 by making one of the following determinations:
- dismiss the complaint; or
- where the complaint is substantiated, declare that the conduct giving rise to the complaint should not be repeated, or that the APS agency should perform a course of conduct to redress the complainant's loss, declare that the complainant is entitled to a specified amount of compensation for loss or damage (including any reasonable costs associated with making the complaint and investigation of the complaint), or that it would be inappropriate to take any further action.
Formal complaint determinations by the Commissioner only occur in rare cases, as most complaints will be resolved by conciliation or other means. Generally, where an APS agency refuses to comply with a determination, the complainant can apply to the Federal Court or Federal Magistrates Court for an order that the determination be enforced.
Applications for review of the Commissioner's determinations regarding compensation and expenses are to be made to the Administrative Appeals Tribunal.
Given that most complaints are settled by conciliation, there are few court case precedents to refer to in assessing the amount payable for personal suffering that results from a breach of the Privacy Act 1988. The Administrative Appeals Tribunal, in the case of Re Rummery and Federal Privacy Commissioner and Department of Justice and Community Safety (2004) AATA 1121 (22 November 2004), set out the following principles in the assessment of compensation:
- where a complaint is substantiated and loss or damage is suffered, the legislation contemplates some form of redress in the ordinary course;
- awards should be restrained, but not minimal;
- in measuring compensation, the principles of damages applied in tort law will assist, although the ultimate guide is the words of the legislation;
- in an appropriate case, aggravated damages may be awarded; and
- compensation should be assessed by having regard to the complainant's reaction and not to the perceived reaction of the majority of the community or of a reasonable person in similar circumstances.
Some of the aspects of personal suffering that can be relevant to determining the amount of compensation payable are:
- foreseeable economic loss;
- physical and emotional distress and anxiety;
- disruption of personal life;
- humiliation;
- being excluded by one's community;
- being the subject of malicious or hurtful rumours;
- threats or assaults.