In the recent decision of the Queensland Civil and Administrative Tribunal (Tribunal) in AA v State of Queensland (Office of Industrial Relations) [2021]^[1] an employee was awarded $20,000 in compensation due to the unlawful disclosure of his personal information.

Relevant background

The matter concerned an employee who had been absent from work for an extended period, due to a psychological condition. At the time of the unlawful disclosure(s), the employee was not in receipt of workers’ compensation benefits in respect of the condition. However, he was receiving income support payments through QSuper (QSuper Payments).

Evidence was provided by the OIR that it had a responsibility to facilitate the employee’s safe return to work. Separate from the OIR’s obligations, QSuper also provided evidence that it had warranted to the employee that it would assist him to recover and return to work.

Despite the efforts of an OIR Rehabilitation Officer, the employee did not engage in the return to work process. In accordance with the relevant Public Service Directive, the Rehabilitation Officer requested the employee to participate in an Independent Medical Examination (IME). The employee’s solicitors objected to the request. The OIR did not take any further steps to direct the employee to participate in an IME, pursuant to section 175 of the Public Service Act 2008 (Qld) (PS Act).

Without notifying the employee or seeking his consent, the Rehabilitation Officer contacted QSuper to discuss the barriers to the employee’s return to work and to request QSuper to arrange its own IME in respect of the employee (Communications).

The employee became aware of the Communications and was able to obtain relevant records. This including three audio-recordings of telephone discussions between the Rehabilitation Officer and QSuper.

The employee alleged that:

• four breaches of the Information Privacy Protection Act 2009 (Qld) (IPP Act) arose from the Communications. The OIR conceded that the breaches occurred; and
• the Rehabilitation Officer had, with malicious intent, sought to collude with QSuper by obtaining an IME by “illicit means” because he was trying to undertake a process that the OIR could not properly achieve (that is, to have the employee independently examined).

The Tribunal agreed that there had been four breaches of the IPP Act. The Tribunal’s focus, therefore, was on determining whether the Rehabilitation Officer’s conduct had been malicious, and the appropriate orders.[2]

Breach of Information Privacy Principles under the IPP Act

The IPP Act recognises the importance of protecting the personal information of individuals. It contains a set of rules or ‘privacy principles’ that govern how Queensland Government agencies collect, store, use and disclose personal information.[3]

The Tribunal agreed that on four occasions the OIR breached Information Privacy Principle 11 (IPP 11) as set out in Schedule 3 of the IPP Act. IPP 11 requires that “[a]n agency having control of a document containing an individual’s personal information must not disclose the personal information to an entity…unless…the disclosure is authorised or required under a law” (our emphasis).

Because the OIR had already conceded that the Communications amounted to breaches of the IPP Act, the Tribunal was not required to consider the issues of what is ‘authorised’ or ‘required under a law’.

Whilst the Communications were ‘ill advised and ‘inappropriate’, no malice was intended

In relation to the employee’s allegations that the Rehabilitation Officer was motivated by malice in his Communications with QSuper, the Tribunal observed that:

• whilst the audio-recordings demonstrated that the Rehabilitation Officer (and perhaps the QSuper employee) appeared awkward and at times inappropriate, this was not enough to conclude that they were laughing at the employee or acting with malice;
• malice requires a step further, beyond the poor handling of a matter, or inappropriate conduct;
• there was no available evidence that would support an allegation of collusion between the Rehabilitation Officer and QSuper;
• the Rehabilitation Officer had failed to contact the employee’s treating doctors at any point during the return to work process. The Rehabilitation Officer gave evidence that he did not speak with the employee’s treating practitioners because he felt there was no point doing so because he had extracted all information he could from the general practitioner’s report and the rehabilitation and return to work process was at a standstill.

In light of the above, the Tribunal held that the OIR’s breaches were readily characterised as actions that were “careless, inept or ill-conceived rather than malicious”.

Calculating the quantum

Whilst the Tribunal accepted that the employee suffered hurt and humiliation because of the breaches, due to a lack of evidence, the Tribunal did not find that the employee had been forced to move interstate, to accept a lower paid job with inferior superannuation benefits, or that the breaches resulted in further damage to his mental health.

Having had regard to the principles applicable to compensation under the IPP Act, the submissions of the parties, and various authorities, the Tribunal awarded the employee $5,000 per breach of the IPP Act. The OIR conceded that the employee was entitled to claim his legal costs.

Jurisdictional issues

Regarding the original submission that the Tribunal should make an order under the Public Interest Disclosure Act 2010 (Qld) (PID Act) it was noted that when sitting in its original jurisdiction the Tribunal is not a public entity for the purposes of the PID Act or the Human Rights Act 2019 (Qld) (HR Act). Neither the PID Act nor the HR Act was considered further by the Tribunal.

Take-aways

Public service employers should be aware that:

1. Particularly when discussing an employee’s personal information, it is essential to maintain professionalism. It is important to remember that, unless an exception applies, an employee will have the right to request access to a document that contains their personal information.
2. Employers should maintain open communication and maintain transparency when requesting an employee to participate in an IME. The relevant directive and s.175 of the PS Act should be relied upon, as applicable.
3. Subject to receiving the employee’s written consent, it is essential for employers to consult with the employee’s treating practitioner(s) prior to making decisions regarding fitness for work. This applies even where it is perceived that consultation is unnecessary, or likely to delay the process.
4. It is advisable to obtain written consent from an employee prior to requesting or disclosing their personal information. The written consent should be specific and current.
5. Serious penalties apply where there has been a proven breach of the IPP Act. If in doubt about the collection, storage, use or disclosure of employee information, employers should seek legal advice.

[1] QCAT 258 (the Case).

[2] The available orders are set out in s.178(a) of the IPP Act.

[3] See the website of the Office of the Information Commissioner Queensland https://www.oic.qld.gov.au/about/privacy