Veterans' Affairs forced to apologise over privacy breach

Privacy Commissioner Timothy Pilgrim has ordered the Department of Veterans' Affairs to apologise to one of its clients after it handed details of an ongoing dispute over to his employer.

In a case that tests nearly every exemption to the Privacy Act’s non-disclosure provisions, Pilgrim knocked back repeated attempts by the DVA to defend its exchange of details about the man’s behaviour.

The dispute began in October 2011 when the Defence Force employee started contacting DVA staff about what he perceived to be the gross mishandling of his compensation claim.

As the frequency and tone of the emails, texts and phone calls escalated, the DVA decided to pass details of the matter – including concerns about the man’s psychological state – onto medical authorities within the Department of Defence.

But Pilgrim today ruled that the DVA should have followed normal protocol and called the police if staff were worried about their safety in the face of perceived threats.

He said the man’s behaviour did not qualify as a “serious and imminent” threat to the life or wellbeing of either the man or DVA staff, as demanded by the Privacy Act to excuse a disclosure of personal information.

He also raised questions over whether the DVA staff in question were truly motivated by the perceived threat.

“It is particularly unclear how the department could have considered it was necessary to disclose the complainant’s personal information to his employer in order to prevent or lessen the serious and imminent threat to the life or health of a DVA staff member,” Pilgrim said in his judgement.

The Privacy Commissioner also knocked back DVA’s subsequent attempts to evade guilt.

He passed off the agency's defence that it was merely meeting its obligations to protect staff under the Work Health and Safety Act 2011 - Privacy Principle 11 exempts disclosures carried out to meet the demands of other Australian laws.

But the WHS Act didn’t come into effect until months after the disclosure was made, Pilgrim pointed out.

He also rejected the DVA’s attempts to frame the disclosure as being for the purposes of law enforcement, under the Defence Force Disciplinary Act 1982, because the information was shared with health officials in no way connected to defence misconduct investigations.

Pilgrim made it clear that casting doubt over any person’s mental wellbeing with their employer would always be a sensitive matter in the eyes of privacy legislation, because of the potential for serious workplace consequences.

“This, in my view, places a greater need on ensuring disclosure is necessary and where such a need for disclosure is identified, the full context of the situation is disclosed,” he warned.

He also expressed disappointment the case had carried on for three years – despite the fact that in his emails, the complainant has only ever asked for an apology as compensation.

He ordered the department to apologise to the man within two weeks.