Determination and reasons for determination of
Australian Privacy Commissioner, Timothy Pilgrim

Contents

Summary
Allegations and remedy sought
The law
Investigation process
Findings
Finding on damages
Non-economic loss
Economic loss
Punitive damages
Aggravated damages
Determination

 Summary

1. Wentworthville Leagues Club (the Club) interfered with the complainant's privacy by disclosing the complainant's membership details and gaming information to the complainant's ex-partner, in breach of National Privacy Principle (NPP) 2.1 of the Privacy Act 1988 (Cth) (the Privacy Act).

2. To redress this matter the Club shall:

• apologise in writing to the complainant within three weeks
• review its training of staff in the handling of personal information and legal requests for personal information including court subpoenas
• no later than six months from the date of this determination confirm that this review of training has been completed and advise me of the results of review
• pay the complainant $7500 for non-economic loss caused by the interference with the complainant's privacy.

 Allegations and remedy sought

3. In October 2008, the complainant lodged a complaint with the Office of the Privacy Commissioner against the Club, under s 36 of the Privacy Act. The complainant alleged that:

• having been a member of the Club since 1997, on 28 September 2007, the Club disclosed the complainant's full membership details, and player activity statements about their use of the Club's gaming machines, for the periods July–August 2002 and January–June2003. This information was provided to the complainant's ex-partner
• the complainant learned of the disclosure in late July 2008
• the Club gave the personal information to the complainant's ex-partner in breach of the Privacy Act.

4. The complainant seeks a declaration by me that they are entitled to $19,483.90 in compensation for economic loss and an unspecified amount for non-economic loss, as well as punitive damages.

5. The Club admits it is within the jurisdiction of the Privacy Act and to disclosing the complainant's personal information in breach of the Privacy Act. The Club considers that any damages awarded for non-economic loss should be minimal and that the complainant has not provided sufficient evidence to support a claim for economic loss. The Club submits that I am not entitled to award punitive damages under the Privacy Act.

 The law

6. The NPPs contained in schedule 3 of the Privacy Act outline standards for 'organisations' handling personal information. The definition of 'organisation' is set out in s 6C of the Privacy Act.

7. Organisation means:

(a) an individual; or

(b) a body corporate; or

(c) a partnership; or

(d) any other unincorporated association; or

(e) a trust;

that is not a small business operator, a registered political party, an agency, State or Territory authority or a prescribed instrumentality of a State or Territory.

8. Personal information is defined in s 6(1) of the Privacy Act as:

... information or opinion (including information or an opinion forming part of a database), whether true or not, and whether recorded in material form or not, about an individual whose identity is apparent, or can be reasonably ascertained, from the information or opinion.

9. NPP 2.1 deals with the disclosure of personal information. It states that an organisation must not use or disclose personal information about an individual for a purpose (the secondary purpose) other than the primary purpose of collection unless an exception in NPP 2.1(a)–(h) applies.

10. NPP 2.1(g) allows an organisation to use or disclose personal information if the use or disclosure is required or authorised by or under law.

11. Section 52 of the Privacy Act provides that, after investigating a complaint, I may make a determination:

• dismissing the complaint (s 52(1(a)); or
• finding the complaint substantiated and declaring:
  • that the respondent has engaged in conduct constituting an interference with the privacy of an individual and should not repeat or continue such conduct (s 52(1)(b)(A)); and/or
  • the respondent should perform any reasonable act or course of conduct to redress any loss or damage suffered by the complainant (s 52(1)(b)(ii)); and/or
  • the complainant is entitled to compensation for any loss or damage suffered by reason of the act or practice the subject of the complaint (s 52(1)(b)(iii)); and/or
  • it would be inappropriate for any further action to be taken in the matter (s 52(1)(b)(iv)).

 Investigation process

12. The Office of the Australian Information Commissioner's (OAIC's) investigation of this complaint involved the following:

• On 28 October 2008, the Assistant Privacy Commissioner opened an investigation into the allegations pursuant to s 40(1) of the Privacy Act.
• Written information and evidence supplied by both the Club and the complainant was considered.
• The Club and the complainant were provided with the opportunity to respond to the OAIC's preliminary view on the complaint dated 15 January 2009, which found that the Club had complied with NPP 2.1(g).
• In response to the OAIC's preliminary view, additional written information and evidence was supplied by both parties.
• Based on this additional information and evidence the OAIC reviewed the preliminary view and moved to conciliation.
• The parties were unable to achieve a mutually agreeable outcome through conciliation and I decided to move to a determination.
• Both parties were provided with the opportunity to provide written and oral submissions pursuant to s 43(5) of the Privacy Act.
• A hearing was held on 20 October 2011 for both parties to make oral submissions.

 Findings

13. After considering the information before me, I make the following findings.

14. The Club is an 'organisation' for the purposes of the Privacy Act because it is a body corporate that is not a small business operator, a registered political party, an agency, State or Territory authority or a prescribed instrumentality of a State or Territory. The Club is therefore obliged to comply with the NPPs.

15. The Club received a letter from the complainant's ex-partner dated 17 August 2007, which attached a copy of a subpoena issued by the Federal Magistrates Court in family law proceedings involving the complainant and their ex-partner. The subpoena directed to 'The Proper Officer – Gaming Section, Wentworthville Leagues Club' was dated 10 November 2005 and required the Club to provide to the Court by 28 November 2005:

All gambling records, or records of transactions linked to any gambling cards related to or held in the name of [complainant's name, address and date of birth] or the [complainant's company].

16. The letter requested that the Club give the documents detailed in the subpoena to the ex-partner.

17. In September 2007 a manager who was performing duties at the Club as an employee provided computer printouts of information about the complainant to the ex-partner at the Club. The documents were a printout of the complainant's full membership details and their bonus point activity statements for the periods July–August 2002 and January–June 2003. The statements showed the complainant's total turnover and winnings and the complainant's then balance on their account with the Club.

18. The Club originally submitted to the OAIC that it had disclosed the personal information in accordance with NPP 2.1(g) as it was attempting to comply with the terms of a subpoena. However, the Club did not present the documents to the Court but rather directly to the complainant's ex-partner and the subpoena required the Club to provide these documents to the Court by 28 November 2005.

19. The Club has since acknowledged that this disclosure by the manager of personal information about the complainant to the ex-partner was an interference with the privacy of the complainant. However, the Club initially argued it made the disclosure in 'good faith' in seeking to comply with a Court subpoena.

20. I am satisfied that the disclosure was not authorised under law as the disclosure was not in accordance with the requirements of the subpoena. I am therefore also satisfied that the disclosure was an interference with the complainant's privacy.

 Finding on damages

21. I am afforded the discretion under s 52(1)(b)(iii) of the Privacy Act to award compensation for 'any loss or damage suffered by reason of' the interference with privacy. Section 52(1A) states that loss or damage can include 'injury to the complainant's feelings or humiliation suffered by the complainant'.

22. I am guided by the following principles on awarding compensation, summarised by the Administrative Appeals Tribunal (Full Tribunal) in Rummery and Federal Privacy Commissioner:[1]

(a) where a complaint is substantiated and loss or damage is suffered, the legislation contemplates some form of redress in the ordinary course

(b) awards should be restrained but not minimal

(c) in measuring compensation the principles of damages applied in tort law will assist, although the ultimate guide is the words of the statute

(d) in an appropriate case, aggravated damages may be awarded

(e) compensation should be assessed having regard to the complainant's reaction and not to the perceived reaction of the majority of the community or of a reasonable person in similar circumstances.

23. The Tribunal in Rummery went on to express its own view, that it would:

... not go so far as deciding that we must award compensation once a loss is established. However, we are of the view that once loss is proved, there would need to be good reason shown to the Tribunal as to why compensation for that loss should not be awarded.[2]

 Non-economic loss

24. I accept the complainant's written evidence that they formed a gambling addiction between 1997 and 2003 and that, at the time of the disclosure in 2007, the complainant had stopped gambling.

25. The complainant claims that the disclosure of personal information caused psychological and physical harm because the complainant's ex-partner showed the complainant's personal information to a range of people including their friends, family, previous neighbours, parents of children's friends and work colleagues.

26. The complainant alleges that they were humiliated as a result of the disclosure and experienced symptoms of stress and emotional disturbance. The complainant cited effects such as poor concentration, low energy and wakefulness, memory disorders and depression.

27. The complainant provided medical certificates dated 5 August 2008 and 19 August 2011; a report from a social worker dated 12 August 2011; a psychologist's report dated 2 June 2008; the complainant's own statement and statutory declarations from family members in support of the claim for non-economic loss.

28. The Club did not dispute medical certificates or the psychologist's report. The Club disputed aspects of the social worker's report as being 'untested and too simplistic'. The Club considered that little weight should be given to the statutory declarations of family members.

29. In my view the medical certificate dated 5 August 2008 shows that the complainant suffered from anxiety, panic attacks and physical symptoms after they became aware of the disclosure of their personal information.

30. I need to consider to what extent, if any, these symptoms were caused by the disclosure.

31. A psychologist's report dated 2 June 2008, written before the complainant became aware of the disclosure says the complainant's 'profile does not display any elevated T scores that would suggest clinically significant emotional problems'.

32. However, the report says the complainant reported 'mild symptoms associated with anxiety, stress, depression and difficulty thinking at times'. Other symptoms included issues with concentrating and low energy. The complainant states in their submission that they suffered 'mild stress' before the disclosure but 'coped with it'.

33. The medical certificate completed by a general practitioner on 5 August 2008 states:

[The complainant] is receiving treatment for acute anxiety with panic attacks.

The precipitant to the anxiety has been the unauthorised release of personal information from the Wentworthville Leagues Club to [the complainant's] [ex-partner].

The certainty that these records have subsequently been shown without [the complainant's] consent to family and friends in order to undermine and destroy any regard they have for [the complainant] is serving to increase [the complainant's] anxiety.

[The complainant] is suffering daily from multiple panic attacks causing great distress. [The complainant's] normal coping abilities have been undermined. I have recommended medication to ease the symptoms.

The release of the records without [the complainant's] consent has caused [the complainant] great personal harm.

34. I have accepted the medical evidence provided by the complainant. However, I do not consider the report from the social worker dated 12 August 2011 adds evidence beyond the complainant's statement because it merely describes the complainant's version of events. Also, the statements from family do not add any weight to the complainant's claims given the other medical evidence.

35. Having accepted the medical evidence, I have reached the conclusion that the disclosure of the complainant's gambling records caused non-economic loss to the complainant including injury to the complainant's feelings and humiliation. In my view the disclosure contributed to serious anxiety, panic attacks and physical symptoms.

36. However, from the information provided by the complainant, it is also my view that a proportion of the medical symptoms were not caused by the disclosure by the Club. At the time of the disclosure, the complainant was in a dispute with the ex-partner over property settlement, child support and child custody.

37. The complainant was also experiencing additional family pressures and according to the psychologist's report, had exhibited some 'mild' symptoms of anxiety and depression before the disclosure of the complainant's personal information.

38. Given the combined pressures on the complainant it is a difficult task to determine to what extent the anxiety, panic attacks and physical symptoms were caused by the Club's disclosure. However, I am of the view that the disclosure caused injury to the complainant's feelings and humiliation even if a proportion of their anxiety and physical symptoms had other causes.

39. In deciding appropriate damages for non-economic loss I have considered previous Privacy Commissioner determinations and an appeal of such a privacy determination to the Administrative Appeal Tribunal.[3]

40. Given the limited number of cases decided under the Privacy Act I have also considered discrimination cases that consider compensation for non-economic loss as outlined in Federal Discrimination Law Online.[4]

41. Having considered the facts of various discrimination cases and all the evidence – including the medical evidence and humiliation suffered due to the disclosure of their former gambling habits – in my view the complainant is entitled to $7500 in non-economic loss.

 Economic loss

42. The complainant claims that the psychological and physical harm experienced as a result of the disclosure had a detrimental effect on the complainant's performance at work as a contractor sales person, as a result of which they incurred economic loss.

43. The complainant provided profit and loss tables and a letter from their employer in support of the claim for economic loss.

44. The Club argues there is an 'absence of evidence to support [the complainant's] proposition that the reduction in the commission rate can be attributed to [the complainant's] personal circumstances as a result of [the complainant] becoming aware of the breach of [the complainant's] privacy'.

45. The complainant's employer completed an annual review of the complainant's contract in January 2009, around six months after the complainant became aware of the disclosure. The employer reduced the complainant's share of company profits in the review. The complainant claims they had reduced work performance due to the Club's breach of privacy and that this was the cause of the reduction in profit share.

46. I do not give strong weight to the employer's letter stating that the 'privacy dispute had a detrimental effect' on the complainant's performance given it was written more than two and half years after the review and the author admits he was 'unaware of the nature of the dispute'.

47. The sales figures do not show a clear downward trend after the complainant became aware of the disclosure. The complainant continued to make significant sales every month with a slight fall from the same quarter from the previous year.

48. I accept that the complainant's profit share dropped and that reduced performance in their business may have contributed to the drop in profit share. However there are many factors that can affect the performance of a business including the natural business or economic cycle. Many factors in the complainant's life, including the finalisation of a divorce and caring responsibilities may have contributed to the alleged diminished work performance and reduction in percentage commission.

49. Having considered all the evidence provided by the complainant about their alleged economic loss, I am not satisfied that the complainant suffered economic loss by reason of the interference with their privacy.

 Punitive damages

50. Section 52(1)(iii) of the Privacy Act provides for the making of a declaration that a person is entitled to 'compensation' for any loss or damages suffered as a result of the breach of the complainant's privacy. It does not provide for the making of a declaration as to punitive damages, which are punitive rather than compensatory in nature.[5]

 Aggravated damages

51. Aggravated damages may be awarded under s 52 of the Privacy Act.[6] Aggravated damages may be awarded where the respondent behaved 'high-handedly, maliciously, insultingly or oppressively in committing the act of discrimination.'[7]

52. The 'manner in which a defendant conducts his or her case may exacerbate the hurt and injury suffered by the plaintiff so as to warrant the award of additional compensation in the form of aggravated damages.'[8]

53. Although the complainant has not specifically sought aggravated damages, I will consider it.

54. I accept the respondent's evidence that its employee disclosed the gambling records to the ex-partner after obtaining a letter and an attached subpoena from the complainant. Although not authorised by law, I do not consider this conduct is high-handed, malicious, insulting or oppressive.

55. The Club initially attempted to rely on the subpoena to justify its disclosure of the complainant's personal information. I recognise that the Club said it disclosed the personal information in good faith and it has unconditionally apologised to the complainant during the complaint process. Again, I do not consider the Club's conduct to be high-handed, malicious, insulting or oppressive.

56. Having regard to the evidence, I do not consider that it is appropriate to award the complainant aggravated damages.

Determination

57. I declare in accordance with s 52(1)(b)(i)(B) of the Privacy Act that the Complainant's complaint is substantiated. I declare that the Club has breached NPP 2.1 in disclosing the personal information about the complainant to their ex-partner and that the Club should not repeat such conduct.

58. The Club has verbally apologised. However, I declare, in accordance with s 52(1)(b)(ii) of the Privacy Act that the Club must issue a written apology to the complainant within three weeks of this decision. I also declare under s 52(1)(b)(ii) that the Club must review its training regarding the handling of personal information with particular focus on responding to court subpoenas. The Club must also confirm to me that this review of training has been completed and advise me of the results of review no later than six months from the date of this determination.

59. I declare in accordance with s 52(1)(b)(iii) that the complainant is entitled to $7500 for the non-economic loss suffered as a result of the Club's interference with their privacy.

Timothy Pilgrim
Australian Privacy Commissioner

9 December 2011

[1]Rummery and Federal Privacy Commissioner and Anor [2004] AATA 1221, [32].

[2]Rummery and Federal Privacy Commissioner and Anor [2004] AATA 1221, [34].

[3]Rummery and Federal Privacy Commissioner and Anor [2004] AATA 1221.

[4]Australian Human Rights CommissionFederal Discrimination Law (2011) www.hreoc.gov.au/legal/FDL/index.html, ch 7 at 10 October 2011.

[5] Hall v A & A Sheiban Pty Ltd [1989] FCA 72; [74] per Lockhart J; [66] per French J, Ardeshirian v Robe River Iron Associates (1993) 43 FCR 475, [14].

[6]Rummery and Federal Privacy Commissioner and Anor [2004] AATA 1221, [32].

[7]Hall v Sheiban [1989] FCA 72, [75].

[8] Elliott v Nanda & Commonwealth [2001] FCA 418, [180].