text: OCL036-15
  26 February 2016 and 13 May 2016
  Written submissions filed 24 May 2016, 14 June 2016 and 20 June 2016
  The complaint that Queensland Police Service breached Privacy Principles 4, 9 and 11 is not substantiated and is dismissed.
  The complaint that Queensland Police Service breached Privacy Principle 10 is substantiated.
  The act of sending an email on 13 September 2012 at 4.52pm was an interference with RM's privacy and Queensland Police Service must not repeat the act.
  Queensland Police Service must provide to RM a written apology for the interference with RM's privacy by 4:00pm on 10 April 2017.
  Queensland Police Service must reimburse RM the sum of $4,400 for expenses reasonably incurred by 4:00pm on 10 April 2017.
  Queensland Police Service must pay RM compensation in the sum of $5,000 by 4:00pm on 10 April 2017.
  HUMAN RIGHTS – PRIVACY – Information Privacy – whether information released was personal information – whether information was used for the purpose for which it was obtained – whether an employee sending the offending email constitutes use or disclosure – whether QPS took all reasonable steps to prevent unauthorised use or disclosure – whether consequential orders ought be made including an apology, re-imbursement of expenses incurred and payment of compensation
  Information Privacy Act 2009 (Qld), s 3, s 6, s 12, s 23, s 24, s 27, s 164, s 176, s 178
  Workers Compensation and Rehabilitation Act 2003 (Qld), s 133
  Acts Interpretations Act 1954 (Qld), Schedule
  BAW v Department of Justice and Attorney–General, Office of Fair Trading [2015] QCAT 285
  Harmony Shipping Co SA v Saudi Europe Line Ltd [1979] 1 WLR 1380
  Commonwealth Bank of Australia v Cooke [2000] 1 Qd R 7
  RM in person
  Queensland Police Service represented by Ms SD Anderson of Counsel instructed by Public Safety Business Agency
  RM is a former member of the Queensland Police Service (QPS). RM claims that while employed by the QPS another member of the QPS, CF, sent an email containing RM's personal information, including information about RM's health and in doing so the QPS breached information privacy principles (IPP) 4, 9, 10 and 11 as provided for in the Information Privacy Act 2009 (Qld) (the Act). RM seeks a variety of orders, including a written apology, compensation in the amount of $100,000 and reimbursement for expenses reasonably incurred under section 178 of the Act.
  On the first day of the final hearing, I made an order prohibiting the publication of any information, which may identify RM and an order that other than to the parties of this proceeding the reasons for decision may be published in a de-identified format only. I have only prepared reasons in a de-identified format.
  On the second day of hearing, after the close of evidence, I made directions for the filing of written submissions. Both parties have sought to raise some new matters, not previously raised at the oral hearing in the written submissions. RM has set out extracts of what appear to be various QPS policies and attached additional documents, not previously in evidence, some of which RM asserts are produced for the fact of their existence rather than their content to refute certain submissions made by the QPS. The policies were not previously in evidence before me. They were not the subject of any statement of evidence or oral evidence. There has been no application to adduce new evidence. I therefore do not consider them further.
  RM's written submissions state:
  My privacy complaint does not involve CF being provided a copy of my WorkCover claim. My privacy complaint solely relates to the email CF sent to witnesses.[1]
  Was the information personal information?
  This Act applies to the collection of personal information, regardless of when it came into existence, and to the storage, handling, accessing, amendment, management, transfer, use and disclosure of personal information regardless of when it was collected.
  Information or an opinion, including information or an opinion forming part of a database, whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion.[19]
  Was the personal information obtained by the QPS for a particular purpose but used for another purpose?
  Was IPP 10 breached?
  Did the QPS breach IPP4 as a result of CF sending the Email? Did the QPS take all reasonable steps to prevent unauthorised use or disclosure of personal information?
  An agency having control of a document containing personal information must ensure that the document is protected by security safeguards adequate to provide the level of protection that can reasonably be expected to be provided .....I find that the scope and purpose of the legislative scheme does not lend itself to the conclusion that there is strict liability imposed on the agency........The liability of agencies should be limited to those situations where the disclosure was within the ability of the agency to control either through its possession or control of the documents, or the adoption of protective safeguards. This involves a consideration of whether the disclosure was authorised by the QPS or done when an employee was acting for the purpose of the agency or alternatively for personal reasons.[44]
  Was CF's access to and use of the personal information in sending the Email authorised?
  what support was offered and what action was taken by management in relation to these allegations.[46]
  Did the QPS take all reasonable steps to protect the personal information?
  Was IPP9 breached?
  Was IPP 11 breached?
  Was sending the Email 'disclosure'?
  use of the personal information does not include the action of disclosing the personal information to another entity.
  less than two weeks prior to the hearing that a potential employer was disclosed this information based on CF's email and was told not to employ me and referred to as a 'dog for dobbing'.[59]
  Is RM entitled to the consequential orders sought?
  Apology[65]
  Re-imbursement of expenses reasonably incurred[67]
  Compensation[70]
  belittled, intimidated, humiliated and embarrassed that he had made this known to so many people.[72]
  However, a significant part of the written submissions and the points made during the oral hearing related to CF's lack of authority to have the information including due to his claimed conflict of interest by being named as a bully by RM.
  RM's submissions also contain matters, which are irrelevant to the determination of whether the IPPs were breached. They relate to a number of other serious allegations including a breach of the QPS Standard of Practice in relation to CF's action in sending the offending email, in respect of the QPS handling of Right to Information applications and records keeping issues. These allegations are not for determination in this proceeding and I do not consider them further.
  The QPS submissions contained a number of inconsistencies including as to the purpose for which the offending email was sent and the role which CF undertook in relation to the WorkCover claim response.
  The onus is on RM, as applicant, to prove a breach of the Act.
  The Tribunal has previously accepted that the relevant test is the balance of probabilities[2] and that depending upon the circumstances the test outlined in the Briginshaw case might apply.[3]
  The Act was amended since the claimed breaches occurred. In these reasons, I refer to the Act as it was at the date of the alleged breach.[4]
  A privacy complaint is a complaint by an individual about an act or practice of an agency in relation to their personal information, which is a breach of the agency's obligations to comply with the privacy principles.[5] An agency, such as the QPS, is required to comply with the IPPs and must not do an act that contravenes or is inconsistent with a requirement of an IPP.[6]
  The breaches claimed relate to storage and security of personal information[7], use of personal information[8] and disclosure of personal information.[9]
  whether the QPS have breached the privacy principles as claimed?
  if so, whether RM is entitled to the consequential orders sought under section 178 of the Act?
  Whilst employed by the QPS, RM made a WorkCover claim. On 20 August 2012, WorkCover notified the QPS of the claim.
  A copy of RM's WorkCover application was not in evidence before me during the hearing. RM attached an extract of RM's WorkCover claim to RM's submission filed 24 May 2016. The QPS submissions filed 14 June 2016 did not object to the inclusion of the attachment. During this proceeding, the QPS raised many objections to evidence, upon which RM sought to rely. As the QPS did not object on this occasion, I have read and taken into account the attachment.
  WorkCover requested an employer's response, including statements 'from those involved as you see fit' by 31 August 2012.[10] On or about 24 August 2012, in response to a request by WorkCover for additional information about the allegation that RM was previously bullied, RM provided names of other QPS employees who RM claimed were also bullied. On 31 August 2012, the QPS submitted its employer report to the claim.
  It is not in dispute that the WorkCover claim identified the following factors:
  Anxiety over a named colleague's death;
  Being moved into a previous role where RM was bullied;
  No 'rehab' offered by the QPS.
  Sometime after RM's colleague's death in the line of duty, RM requested to be moved into a non-operational role because RM was struggling with performing operational duties. In 2012, RM was moved into a non-operational role, in which RM claimed RM had previously been bullied. The evidence is, and I accept, that RM's anxiety increased after being moved into this role and RM sought medical assistance.
  The employer's report to WorkCover detailed responses to the previous bullying incidents, to which RM referred to found RM's fear, that RM might again be subjected to bullying.
  On 13 September 2012 at 4.52pm, CF sent an email to 10 QPS employees, which contained:
  RM's name;
  RM's WorkCover claim number;
  the nature of the claimed injury i.e. 'psychological and psychiatric';
  the three causes or factors of the claimed injury identified including naming the colleague, ('the Email').
  There is evidence that CF forwarded the Email at 5.19pm to two other QPS employees, both of whom had been requested to provide statements by PT, the relevant QPS Health, Safety and Injury Management Co-ordinator.[11]
  A short time later, at 5.29pm, CF forwarded the Email to a supervisor and PT, informing them of his actions in sending the Email.[12]
  CF's evidence was that he sent these emails so that others, who were also assisting with the preparation of the QPS response knew the step had been taken to avoid duplicate actions.
  Subsequently, RM's WorkCover claim was declined and a few months later RM was medically retired from the QPS.
  There is evidence before me that upon a review of the WorkCover decision Q-Comp, whilst confirming the decision, accepted that three instances of alleged bullying by CF and the other QPS member named by RM, to which RM referred, showed 'blemishes in management action'.[13]
  In 2014, RM lodged a privacy complaint with the Office of the Information Commissioner (OIC). The part of the complaint, which related to the Email was accepted by the OIC. The OIC unsuccessfully attempted to mediate the complaint. In accordance with the Act, the matter has been referred to QCAT.[14]
  RM claims that:
  the Email was sent to persons RM identified in RM's WorkCover claim, who RM contends were witnesses relevant only to the factor relating to RM's previous bullying, who had themselves been subjected to bullying by those identified by RM;
  all but one of the recipients of the Email had no knowledge of RM's trouble dealing with the death of RM's colleague and no knowledge of RM's WorkCover claim that no rehabilitation had been offered. There is little evidence on this point. RM's evidence is, and I accept, that RM 'barely spoke to anyone' in the QPS about the anxiety RM experienced on the death of RM's colleague out of a concern that it would be viewed as a sign of weakness;
  CF was identified in the WorkCover claim as one of the QPS staff, who RM claimed bullied RM and therefore had a conflict of interest in participating in the investigation of RM's WorkCover claim and ought not to have sent the Email or undertaken other roles in relation to RM's WorkCover claim;
  CF's actions in sending the Email:
  interfered with RM's claim by intimidating and bullying the witnesses named, adversely affecting the outcome of RM's claim;
  caused RM significant embarrassment and stress due to the stigma attached to an officer in the QPS who may have mental health issues; and
  adversely affected and continues to adversely affect RM's promotion and employment prospects within the public sector.
  The QPS contends that:
  the Email did not contain personal information;
  the evidence does not support a breach of IPP 4, 9, 10 or 11;
  if there was a breach, it was lawfully justified as the Workers Compensation and Rehabilitation Act 2003 (Qld) authorises the employer to make enquiries of employees to provide a response to WorkCover and an employer who fails to provide such a report commits an offence.[15]
  The QPS contend that the information in the Email is not personal information. In support of this contention, the QPS refer to sections 3, 6 and 12 of the Act and state that RM agreed to the release of information in RM's Workers' Compensation application to RM's employer.
  I am satisfied that the information was personal information.
  Section 3 of the Act sets out the primary objects of the Act. The first object is to provide for the fair collection and handling in the public sector environment of personal information.
  The Tribunal in JL v Queensland Police Service[16] has previously observed that this object is achieved, by requiring public service agencies to comply with privacy principles set out in Schedule 1 to the IPA when dealing with an individual's personal information.[17]
  The second object, which is not relevant to these proceedings, is to provide a right of access to and amendment of personal information in the government's possession or control in certain circumstances.
  The Act is to be applied and interpreted to further the primary objects.[18]
  The QPS submit that various individual elements of the Email would not satisfy the definition of 'personal information' and in particular, that the WorkCover claim number was not 'personal information'. The QPS submits that the fact of a WorkCover claim cannot satisfy the definition. It is not imparting the fact of a WorkCover claim of which RM complains but rather the imparting of details of RM's claim and in particular the nature of the claimed injury.
  I accept that some of the elements of the Email in isolation and in particular, the WorkCover claim number are unlikely to satisfy the definition of 'personal information' because there is no evidence before me that RM's identity would be apparent or reasonably ascertained from that information alone. However, the individual elements were not isolated. RM's identity is apparent from the Email and the Email contains information about RM's claimed injury and its claimed causes.
  During the hearing, the QPS contended that it did not 'collect' the information rather it was provided to them. I am not satisfied that such a narrow interpretation of 'collect' is consistent with the objects of the Act.
  The final written submissions did not expressly advance this proposition but it did submit a similar proposition i.e. that the information was not 'obtained' for a particular purpose in relation to IPP 10 because it was provided by WorkCover to the QPS on behalf of RM. The QPS did not point to any authority to support such a narrow construction.
  The primary concepts in the Act are 'collection' and 'handling'. 'Handling' consists of a number of subsidiary concepts i.e. 'storage', 'use' and 'disclosure'. There is no definition of 'collection' or 'obtain' within the Act. Having regard to the ordinary meaning of the terms 'collection' and 'obtain', I find that, although the QPS did not actively seek out the information, once the information was in its possession it can be regarded as having collected it or as having obtained it. If I am wrong about that, I find that having received the WorkCover claim information the QPS was under obligations in relation to its 'handling' i.e. storage, use and disclosure.
  I note that IPP4, IPP9, IPP10 and IPP 11 are all in terms of an agency having control of a document containing personal information. An agency has control of a document if it has the document in its possession.[20] The QPS had in its possession documents containing personal information relating to RM's WorkCover claim. The Email contained some of that personal information.
  In support of the contention that RM agreed to the release of information in RM's WorkCover application to RM's employer, the QPS referred me to the application form found on the WorkCover website. I note that the form on the website is dated 26 November 2014, which is of little assistance in establishing a fact as at 2012.
  In any event, RM's evidence was such that RM acknowledged that RM's employer, but not every employee within the employer, was entitled to receive the information in RM's WorkCover claim and to use it for the purpose for which it was provided i.e. for the purpose of responding to the WorkCover claim.
  I accept that in order to provide a report as required an employer is required to make enquiries and that in doing so information about the claimed injury and causes will need to be communicated to some employees. In making a claim there is at least an implied (if not an express) agreement that the employer is authorised to use the information in the claim to make enquiries as to the circumstances of the claim.
  Somewhat inconsistently, RM asserts that RM only authorised WorkCover to investigate RM's claim. RM points to the relevant QPS policy (the Policy).[21] RM's claim in this regard is not supported by the terms of the Policy.
  'generally' WorkCover is to investigate such claims by taking statements from named witnesses.[22] WorkCover did not do so. Even if WorkCover had conducted an 'investigation' as contemplated by the Policy, that would not detract from the employer's authority to make enquiries.
  upon receipt of the work stressors (otherwise referred to as the factors) and the list of witnesses nominated by the injured member, the Health & Safety Co-ordinator in consultation with management are to identify additional witnesses and review and verify or refute the employee's claims.[23] Making enquiries and conducting some 'investigation' is a necessary step and one contemplated by the Policy in order to identify witnesses so that they could be named and in order to review and refute the claims.[24]
  the employer will undertake an investigation to assist the QPS to 'enable control measures to be implemented to prevent similar injuries'[25] and to 'collect information and documentation which may later be required for reviews, appeals and common law claims'.[26]
  witnesses are to 'cooperate with any investigation and provide factual information that may assist WorkCover to determine liability.'[27]
  The Policy contemplates that information obtained about claimed work related injuries will be used by the QPS not only to assist WorkCover to determine liability but for other related purposes as set out in the Policy.[28]
  RM's complaint relates to the manner in which the information was handled. In particular, RM complains that CF was not authorised to have the information and in particular complains that CF was not authorised to send the Email.
  RM accepted that an officer in charge may delegate responsibility for co-ordinating a response to a WorkCover claim to a sub-ordinate[29] but takes issue that CF was actually delegated this responsibility or if he was delegated, that he was not authorised by RM to do so because he was conflicted, having been identified as a person, who had bullied RM.
  The QPS claims that CF undertook roles consistent with the Policy.[30] The Policy sets out that the roles and responsibilities of Officers in Charge/Supervisors/Managers are to actively support the claims management process[31] and to forward all documents to the regional Health and Safety Co-ordinator within required timeframes.[32]
  It is not disputed that CF was a supervisor of RM at the time of the alleged bullying. The obligations in the Policy[33] are more consistent with an injured member's supervisor at the time of the claim. However, there is no reason why previous supervisors could not also be captured by the terms of the Policy, where the factors relied upon relate to events, which are alleged to have occurred during their time as a supervisor.
  On any view, CF was a witness. The Policy required that he cooperate with any investigation and provide information.
  I find that the information was not used for the particular purpose for which it was obtained i.e. for the purpose of preparing the employer's report/response to WorkCover. I find that on the balance of probabilities the Email was sent to address rumours relating to the WorkCover claim due to CF's responsibility for staff welfare rather than for the purpose of assisting the QPS provide its employer response, initial or otherwise.
  I address later in these reasons whether the secondary use fell within the exceptions in IPP 10.
  The QPS contend it had the information in its possession for the purpose of preparing the employer's report to WorkCover, as it was obliged to do. RM accepts that the QPS had the information for the purpose of preparing the employer's report/response to WorkCover. RM contends that CF and therefore the QPS used and disclosed it for a different purpose. RM claims CF sent the Email for a personal purpose i.e. to intimidate witnesses, benefit himself (because he was named as a bully) and belittle RM.
  I am not satisfied to the requisite standard that CF sent the Email for the personal purpose as contended for by RM.
  Nor am I satisfied that the Email was sent for the purpose of preparing the employer's report/response to WorkCover as contended by the QPS. The Email did not ask the recipients to do anything, in fact it states 'You do not need to do anything at this stage'.
  Given the sensitive nature of information in a WorkCover claim I do not accept, that in circumstances that a statement was not actually being sought, as distinct from being foreshadowed as possibly being required at some future time, that it was reasonably necessary to inform a nominated witness of all of the details provided. This use of the information is not consistent with the Policy to treat information obtained 'with sensitivity and confidentiality.' [34]
  The QPS contend that CF sent the Email to foreshadow to the recipients that a statement may be required as they were identified as a witness and that it was within CF's responsibility as a supervisor/manager and reasonably necessary to enable the QPS to prepare its response to WorkCover.
  The QPS also submit that it was reasonable management action that a person identified in a WorkCover claim be notified. The QPS contends sending the Email was within CF's authority as a manager/supervisor. There is little evidence about whether CF was the recipients' manager or supervisor.
  CF gave a number of different explanations for why he sent the Email to the recipients. These included:
  to let the witnesses know they may be required to provide a statement (express in the Email);
  so they could turn their mind to whether they had pertinent information to the claims being made (said to be implied in the Email);
  so they would not destroy emails or other documents, which may be relevant (said to be implied in the Email);
  to address rumours circulating variously surrounding the WorkCover claim (express in the Email) and about the Property Crime Investigation Unit. CF's oral evidence regarding the rumours about the latter was unclear and not convincing.
  CF's evidence of why the Email was sent to the particular recipients and not all witnesses nominated was not clear. He stated that they were employed or previously employed in the same QPS Command as he was employed.
  Whilst the WorkCover claim is not in evidence before me, it was not disputed that RM had nominated as witnesses not only the 10 recipients but also some witnesses, to whom the Email was not sent, including FI, who was also previously employed in the same QPS Command and gave evidence in these proceedings.
  The QPS submit that CF sent the Email to address workplace speculation and rumours, confirm the recipients had been named in the WorkCover claim, to foreshadow they may be required to provide a statement and to identify the contact person.[35]
  RM contends that CF sent the Email for the purpose of intimidating the witnesses to ensure they did not provide a statement in support of RM's claim. There is no evidence before me by a recipient, that they felt intimidated by receiving the Email nor that they would have otherwise provided a statement in support of the claim.
  RM claims that CF obtaining statements from 20 witnesses but none from her nominated witnesses demonstrates that his investigation was self-serving.[36] For reasons outlined later in these reasons, there is insufficient evidence to make a finding that CF 'investigated' himself. It is clear that CF and numerous other QPS employees were involved to some extent in responding to the WorkCover claim.
  Given the various explanations, I place more weight on the contemporaneous explanation and find that on the balance of probabilities the Email was sent to address rumours relating to the WorkCover claim due to his responsibility for staff welfare rather than for the purpose of assisting the QPS provide its employer response, initial or otherwise.
  I am, therefore, not satisfied that the information was used for the purpose for which it was obtained.
  CF's actions and his unclear explanation as to why the Email was sent to a subset of nominated witnesses raise a suspicion that other motives were at play especially as the QPS had provided its response to WorkCover on 31 August 2012 and additional information including statements were provided to WorkCover on 10 September 2012. CF's evidence is that he later became aware of when the QPS response was provided to WorkCover and that he had continued to collate information in relation to the claim after he provided his statement. There is no evidence before me that CF was aware that the response had already been provided at the time he sent the Email.
  The QPS submit that the information was released in accordance with existing policies and procedures but do not specifically identify those policies and procedures. To the extent that the QPS contends that the information was released in accordance with the Policy, I am not satisfied that the release in these circumstances was in accordance with it.
  Relevantly I note that the Policy provides that the Health & Safety Co-ordinator is to identify witnesses for interview and advise them of the interview process.[37] There is no evidence before me that PT requested CF to notify the witnesses. In any event, I am not satisfied that the Email advised them of the interview process.
  The QPS contends that CF was 'complying with the statutory requirement to obtain and then provide information to WorkCover'.[38] The evidence does not support the submission. CF did not ask the nominated witnesses to reflect on the factors, collate or preserve any documentary evidence, which might be in their possession or come forward with any information they may have had.
  If CF had made such a request, then I could accept that the Email may have been sent for the particular purpose (on the basis that he may not have been aware that the response had been submitted by that time) or for a purpose consistent with the Policy i.e. for the 'collection of information and documentation which may later be required for reviews, appeals and common law claims'.[39]
  In the circumstances, it is more likely than not the Email was sent to address rumours relating to the WorkCover claim, being the contemporaneous explanation, due to his responsibility for staff welfare rather than for the purpose of assisting the QPS provide its employer response, initial or otherwise.
  I am satisfied that a breach of IPP 10 is substantiated.
  IPP 10 prohibits an agency with control of a document containing personal information obtained for a particular purpose from using the information for another purpose unless one of the listed exceptions apply.
  I am not satisfied that one of the exceptions apply.
  IPP 10 provides
  An agency having control of a document containing personal information that was obtained for a particular purpose must not use the information for another purpose unless—
  the individual the subject of the personal information has expressly or impliedly agreed to the use of the information for the other purpose; or
  the agency is satisfied on reasonable grounds that use of the information for the other purpose is necessary to lessen or prevent a serious threat to the life, health, safety or welfare of an individual, or to public health, safety or welfare; or
  use of the information for the other purpose is authorised or required under a law; or
  the agency is satisfied on reasonable grounds that use of the information for the other purpose is necessary for 1 or more of the following by or for a law enforcement agency—
  the other purpose is directly related to the purpose for which the information was obtained; or
  An agency collects personal information for staff administration purposes. A new system of staff administration is introduced into the agency, with much greater functionality. Under this paragraph, it would be appropriate to transfer the personal information into the new system.
  An agency uses personal information, obtained for the purposes of operating core services, for the purposes of planning and delivering improvements to the core services.
  the use is necessary for research, or the compilation or analysis of statistics, in the public interest;
  the use does not involve the publication of all or any of the personal information in a form that identifies any particular individual the subject of the personal information;
  it is not practicable to obtain the express or implied agreement of each individual the subject of the personal information before the use.
  If the agency uses the personal information under subsection (1)(d), the agency must include with the document a note of the use.
  RM claims the QPS breached IPP 10 as:
  The particular purpose was not to respond to the WorkCover claim as the QPS had 14 days earlier on 31 August 2012 provided the response to WorkCover;
  CF's only purpose was self-serving to protect himself against witnesses who had reported being bullied by him and preserve promotion opportunities;
  The purpose was self-serving, not authorised by RM, not justified having regard to the Policy or excused by law as there was no lawful direction given to him to investigate himself.
  For the reasons set out earlier, I am not satisfied that RM has proven that CF's use of the information was for the personal purpose contended.
  The QPS contend that the conduct does not fall within IPP10 because the QPS did not obtain the information rather it was provided to it by virtue of RM making a WorkCover claim. For the reasons set out earlier, I am not satisfied that such a narrow construction is warranted.
  The QPS contend that contacting RM's nominated witnesses was for the purpose of complying with the statutory requirement to obtain and the provide information to WorkCover and so was authorised or required under law.[40]
  It is difficult to reconcile this contention with the Email's express words that the recipients were not required to 'do anything at this stage' and did not expressly ask the recipients to turn their mind to the matters that CF contends were implied by the Email.
  The QPS submissions did not address whether the use fell within any of the other exceptions because it claimed that the use was for the purpose of responding to the WorkCover claim. I address each of the exceptions.
  On the evidence before me I am not satisfied that RM had expressly or impliedly agreed to the use of the information for the purpose for which I have found it was used. I am not satisfied that the use was for a purpose consistent with the Policy, which I accept would be for a purpose for which RM had at least impliedly agreed.[41]
  Whilst I accept that the purpose related to staff welfare, there is insufficient evidence for me to be satisfied that any threat to staff welfare was 'serious'.[42]
  The QPS is a law enforcement agency, however, I am not satisfied on the evidence before me, that it was satisfied that the use was necessary for any of the matters in exception (d).
  I accept that the use was 'related' to the WorkCover claim because the rumours sought to be addressed arose from the WorkCover claim. However, I am not satisfied that it was 'directly related' to the particular purpose of responding to the claim having regard to the close connection demonstrated by the examples set out in IPP 10.[43]
  There is no evidence before me upon which I can form a view that exception (f) is applicable.
  I am not satisfied that a breach of IPP4 by the QPS is substantiated.
  IPP 4 provides
  RM points to unauthorised access, use and disclosure and claims that:
  CF did not have authority to access or use RM's WorkCover claim or republish information from it;
  CF did not take reasonable steps to prevent unauthorised use and disclosure of RM's personal information as he had no control over the actions of the recipients of the email.
  The Tribunal has previously accepted that the proper construction of IPP 4 is that:
  I find that CF sending the Email was not actually authorised by the QPS. It was done in the course of his employment as distinct from being done for the personal purpose for which RM contended.
  There is no evidence that CF was requested to send the Email by PT or by a supervisor or to notify these QPS employees that they had been named in RM's WorkCover claim. CF did not give evidence that he was specifically tasked with this step. The purpose for which the Email was sent, as found earlier in these reasons, was not one contemplated by the Policy. If the Email had been sent for a purpose consistent with the Policy I accept it would have been authorised.
  I am satisfied that CF had authority to access or use information in the WorkCover claim in the context of providing a statement to assist the QPS respond to the WorkCover claim and to locate and forward documents to the regional Health and Safety Co-ordinator within required timeframes in accordance with the Policy.
  RM contends that CF was not authorised by RM to access or release RM's personal information. RM accepted under cross-examination that an employer is entitled to make enquiries in respect of a WorkCover claim and to delegate tasks relating to those enquiries.
  RM contrasts the Email with the email of 20 August 2012 sent by PT.[45] The latter does not refer to the WorkCover number or refer to 'psychological and psychiatric injury' but it does set out the three factors including naming the colleague. PT's email was sent to two QPS employees seeking statements by 22 August. One of these recipients identified other officers, who were RM's supervisors during the period of claimed bullying and suggested statements be obtained from these officers. CF was one of those identified. I note that the copies of emails sent by PT, which are in evidence before me, do not have the confidentiality footer, which formed part of the Email.
  CF was made aware of RM's WorkCover claim so that he could provide a statement to assist with the QPS response to the WorkCover claim and in particular in respect of the alleged complaints of bullying. He was requested to provide details including
  In these circumstances, there is nothing unreasonable in CF being provided with information in respect of the claims made so that he could provide a statement as requested. As no WorkCover claim had been made regarding the bullying claims previously, it was reasonable for an employer to investigate those incidences and it was appropriate for CF to be requested to provide a statement and to be provided with information about the claims made so that he could be afforded the opportunity to reply to the allegations.
  There is evidence that the deadline for CF's statement was extended from 22 August to 30 August[47] and that some additional information was provided by PT to CF by email on 28 August.[48] CF's statement in the WorkCover claim indicates that he reviewed a copy of the claim in the course of preparing his statement.[49]
  CF's evidence is that:
  on 28 August 2012 PT requested his assistance in collating a response on behalf of the QPS and thereafter he commenced a response;
  on 31 August 2012 he delivered material to PT;
  on 4 September 2012 he supplied further material;
  he did not take witness statements from the recipients of the Email;
  he did not advise people on the content of their statements;
  it was part of his role to assist PT so that she could carry out her roles in relation to the WorkCover claim;
  at the time he sent the Email he was not RM's supervisor.
  RM contends that CF was conflicted because he was named as a bully and ought not to have undertaken investigations effectively of himself. The further contention is that the conflict impacts upon his authority to perform tasks and use the information.
  The evidence of the specific tasks CF was requested to undertake and in fact undertook apart from providing a statement and 'supplying material' is limited. It is apparent, because the QPS response[50] refers to 20 statements, that others also undertook various tasks in assisting to prepare the QPS response. CF's evidence was that he played a part in assisting the QPS to provide a response to the WorkCover claim and that other QPS staff performed other tasks in providing a response.
  I accept that an employer should be cautious about the tasks requested of an employee in CF's circumstances, having been named as a bully in the claim, but I do not accept that such a conflict necessarily equates to a lack of authority to access and use the information for the particular purpose.
  As set out earlier, the Policy requires a witness such as CF to cooperate with any investigation and to provide factual information. There is written evidence that CF was requested to assist by providing a statement.
  RM also contends that if CF was not requested in writing to assist or given a written lawful direction, 'it did not happen'. CF's evidence was that the request was oral. I accept that it is not necessary for an employer to make a written request for assistance to an employee for it to be valid or to have occurred.
  Further RM contends that as no written direction or request has been produced and PT's statement, which was prepared and filed by the QPS but not sought to be relied upon by the QPS, did not expressly confirm a request for assistance I should draw the inference that there was no request.
  During the oral hearing, RM sought to rely upon PT's statement. In the subsequent final written submissions, RM asks that little or no weight be placed upon it. PT's statement gives evidence of some matters, which are supported by email correspondence but otherwise says she could not recall a number of matters. PT did not attend the hearing. There is little to place weight upon. The QPS contend it was open to RM to apply to the Tribunal for a Notice to Attend addressed to PT, which would have enabled RM to ask PT questions about this issue. Whilst this is true, I do not make any adverse inference from RM's failure to take this step as RM was self-represented during most of these proceedings and in particular at the hearing.
  As the applicant, RM bears the onus of proof. CF's evidence is that he was requested to assist. There is no evidence to corroborate CF's evidence that he was requested to assist with the WorkCover response beyond providing a statement. There is no evidence that he was not asked to assist. However, the Policy makes it clear that persons in CF's position are required to cooperate and assist. I am not satisfied that I should prefer an inference over direct and un-contradicted evidence.
  RM contends that reasonable steps were not taken because:
  CF had no control over the actions of the recipients;
  the recipients did not have a need to know all the information released to them as they were only nominated by RM in respect of the previous bullying; and
  at the time of the release the employer's report had already been provided to WorkCover.
  I am not satisfied that a breach of IPP 4 has been substantiated because I am satisfied that the QPS took all reasonable steps to protect the personal information even though there was unauthorised use of the information in breach of IPP 10.
  The QPS contends that the information was effectively controlled by CF because the evidence shows that 20 witnesses provided information or statements in respect of the WorkCover employer response.[51] It is not clear to me how such evidence could logically support such a conclusion. In any event, there is no evidence to support the contention that CF was responsible for obtaining statements other than his own. CF's evidence was that he played a part in assisting the QPS to provide a response to the WorkCover claim and that other QPS staff performed other tasks in providing a response.
  There is undisputed evidence that:
  the 10 people to whom CF sent the Email were all employees of the QPS on the day the Email was sent and had been nominated as potential witnesses to one of the factors identified in the WorkCover claim;
  the Email was sent to QPS email addresses;
  the identity of the recipients were protected by blind copying the recipients. Taking this step protected the recipients from identification to other recipients;
  the Email contained a footer containing a confidentiality warning;
  at least 9 of the 10 initial recipients were employed in the same QPS Command as CF and the other had previously been employed in that Command;
  the QPS had in place the Policy;
  the QPS provided privacy training to staff.[52]
  I accept CF's evidence that QPS employees, by virtue of the nature of their employment have a heighted awareness of the need for confidentiality of information received in the course of their employment.
  The Tribunal has previously recognised that QPS staff are no doubt in possession and control of extensive confidential information and the agency should be able to rely on staff acting in accordance with the appropriate ethical standards.[53]
  I am not satisfied that a breach of IPP 9 has been substantiated.
  IPP 9 provides
  The agency must use only the parts of the personal information that are directly relevant to fulfilling the particular purpose.
  RM claims that the QPS breached IPP 9 as:
  CF did not disclose the information for a particular purpose other than for his own benefit. For the reasons set out earlier, I am not satisfied that CF released the information for a personal purpose.
  CF could not explain why he selected the recipients to the Email. Whilst CF's oral evidence on this point was unclear, given the effluxion of time this is perhaps understandable.
  the particular purpose was not to respond to the WorkCover claim as the QPS had 14 days earlier on 31 August 2012 provided the response to WorkCover. I accept that CF was not in charge of submitting the response and there is no evidence that he was aware that the response had been submitted at the time he sent the Email. In any event, I accept that the Email was not sent for the particular purpose for the reasons set out earlier.
  the recipients of the Email were not aware of all the nominated factors and that disclosure of the factors other than that related to the bullying was not directly related to fulfilling the purpose for which the information had been provided.
  I accept that the QPS had control of the WorkCover claim documents, which contained personal information, which was obtained by the QPS for a particular purpose i.e. for the purpose of responding to the WorkCover claim.
  The QPS submit that the factors compose a chain of events, which contributed to RM's injury and that they are related and interconnected. The QPS contends that in sourcing information to respond to a WorkCover claim it would not be appropriate for an employer to predetermine which factors are relevant and to withhold information from a witness as this may affect the employer's ability to comprehensively respond to a WorkCover claim. The QPS submits that informing the witnesses of the factors is a matter directly relevant to fulfilling the particular purpose of enabling an employer response to be prepared.
  The factors are not as interconnected as they were in BAW v Department of Justice and Attorney–General, Office of Fair Trading.[54] I accept that from a timeline perspective the nominated witnesses may have had relevant information about RM's claims both from when the incidences of alleged bullying occurred and after the death of RM's colleague when RM was returned to the unit.
  If the QPS had been asking them to provide statements or provide any relevant documents to advance the employer's enquiries, it would be open to find, if there was appropriate evidence as to the QPS's state of knowledge, that it was not unreasonable or unnecessary to provide all of the factors. However, they were provided the information but not asked to do anything. As I have said earlier in these reasons, this is relevant to a breach of IPP10.
  I am not satisfied that the facts support a breach of IPP 9 where the information was not used for the particular purpose.
  IPP 11 prohibits disclosure of personal information to an entity other than the individual unless one of the listed exceptions apply.
  I find that the complaint that the QPS breached IPP 11 is not substantiated.
  RM's personal information contained in the Email was sent to employees of the QPS. In the current circumstances, am not satisfied that the information was 'disclosed' as opposed to 'used' and therefore a breach of IPP 11 is not substantiated.
  The concepts of 'use' and 'disclosure' are defined in the Act and are mutually exclusive.[55] The QPS contend that 'use' refers to internal dealings whilst 'disclosure' relates to release of information to an entity external to the agency. RM disputes that disclosure is necessarily to an external entity.
  Section 23(3) of the Act sets out in a non-exhaustive way the actions, which may constitute 'use'. The examples are all internal dealings and include a transfer of the information between parts of an agency. Section 23(5) provides:
  In light of these definitions and having regard to the terms of IPP10 and IPP11, I find that the concept of 'use' is more consistent with dealings internal to an agency and 'disclosure' is more consistent with dealings with entities including persons external to an agency.
  I accept CF's evidence that employees of the QPS receive training about maintaining the confidentiality of information received by them in the course of their employment and information privacy training.[56]
  I find that if information is communicated to employees of the QPS, the QPS retains some degree of control over its employees as to the future release of the information through its training and policies, including the Policy. The Policy expressly recognises a member's right to privacy protection, provides that the information is to be treated with confidentiality and sensitivity and states 'the Service respects and upholds a member's right to privacy protection'.[57]
  For these reasons, I am not satisfied that sending the Email constituted 'disclosure' as distinct from 'use' because there is no evidence before me that the Email was sent to persons other than QPS employees.
  IPP 11 provides
  An agency having control of a document containing an individual's personal information must not disclose the personal information to an entity (the relevant entity), other than the individual the subject of the personal information, unless—
  the individual is reasonably likely to have been aware, or to have been made aware, under IPP 2 or under a policy or other arrangement in operation before the commencement of this schedule, that it is the agency's usual practice to disclose that type of personal information to the relevant entity; or
  the agency is satisfied on reasonable grounds that the disclosure is necessary to lessen or prevent a serious threat to the life, health, safety or welfare of an individual, or to public health, safety or welfare; or
  the disclosure is authorised or required under a law; or
  the agency is satisfied on reasonable grounds that the disclosure of the information is necessary for 1 or more of the following by or for a law enforcement agency—
  the disclosure is necessary for research, or the compilation or analysis of statistics, in the public interest;
  the disclosure does not involve the publication of all or any of the personal information in a form that identifies the individual;
  it is not practicable to obtain the express or implied agreement of the individual before the disclosure;
  the agency is satisfied on reasonable grounds that the relevant entity will not disclose the personal information to another entity.
  If the agency discloses the personal information under subsection (1)(e), the agency must include with the document a note of the disclosure.
  If the agency discloses personal information under subsection(1), it must take all reasonable steps to ensure that the relevant entity will not use or disclose the information for a purpose other than the purpose for which the information was disclosed to the agency.
  RM contends and I accept that a person is an entity according to the definitions[58] and claims that QPS breached IPP11 as the Email was sent to 10 people and an additional 6 people later received it.
  In the submissions of 24 May 2016, RM further contends that another 4 people received the information in the Email verbally and RM learnt
  The circumstances surrounding this contention were not the subject of any written statement of evidence. RM acknowledges that RM did not provide a statement by that potential employer. RM contends that RM is entitled to rely upon hearsay evidence because the QPS relied upon hearsay evidence in respect of 'lawful directions, tasks, request for assistance'.
  RM did not give written or oral evidence of such matters so in fact there is no evidence of these matters as distinct from hearsay evidence.
  RM gave evidence on the first day of the hearing and I permitted RM to rely upon a further short statement on the second day of the hearing clarifying the evidence RM gave on the first day on a particular point with no relevance to this issue. A copy of the Transcript of the first day was available to the Tribunal and was made available to RM to inspect. A review of the first day's evidence reveals that no evidence to this affect was given.
  I recall that RM made some statements from the 'bar table' to this affect on the second day. Whilst the Tribunal is not bound by the strict rules of evidence, it is to conduct proceedings having regard to natural justice.[60] In addition to the statements being hearsay, they were made in a way, which prevented the QPS from being able to cross-examine RM or anyone else about them. In those circumstances, I place no weight upon them.
  Even if RM had actually given evidence about this potential employer and the circumstances surrounding how RM became aware of such matters, I observe that the QPS did not seek to rely upon hearsay evidence in respect of 'lawful directions, tasks, request for assistance'. The QPS sought to rely upon CF's evidence that he had been requested to assist. Such evidence is direct evidence, because CF was a party to the request. I accept that there was very limited written evidence corroborating such direct evidence and no other witness was called by the QPS to give evidence of the request to CF.
  The QPS contends, having regard to section 23(2) of the Act, that disclosure means more than the mere release of information and that it requires an absence of knowledge of the information by the recipient, which includes the recipient not being in a position to find out the information.
  There was little evidence as to the state of knowledge of the recipients. RM's evidence was, and I accept, that RM 'barely spoke' to other QPS employees about the impact on RM of the death of RM's colleague out of fear that RM would be viewed as weak and that RM had not discussed the lack of rehabilitation offered or the WorkCover claim with the recipients as RM had not worked with them since 2010.[61] There was no other evidence lead.
  The QPS contend that because RM nominated the witnesses it was reasonable for the QPS to assume that RM's witnesses were aware of all the factors and that it expected the recipients were already aware of the information. Given that the evidence shows that the witnesses were nominated after the QPS requested additional information about the alleged bullying, I do not accept that this assumption necessarily follows. The QPS did not draw to my attention any evidence that such an assumption was in fact made or the expectation was actually held at the time of the release of the information. The submission is not supported by the evidence.
  The QPS also submits that the recipients were in a position to find out the information because of their being nominated as witnesses. I accept that if they had been asked to provide a statement or information that they would have been entitled to find out the information so that they could provide a response. However, they were not asked to do anything, giving rise to a breach of IPP 10.
  Having regard to section 23(5) of the Act the same act cannot constitute both 'use' and 'disclosure' therefore the same act cannot substantiate both a breach of IPP 10 and IPP 11.
  The QPS also submits that if the sending of the Email constituted 'disclosure' it was authorised by law.[62] For the reasons stated earlier I am not satisfied that the information was released for the particular purpose of responding to the WorkCover claim and therefore this exception would not be applicable.
  Further, for the reasons stated earlier in relation IPP 10, I am not satisfied that the equivalent exceptions in IPP 11 would apply.
  RM takes issue with CF's contention that the persons to whom the Email were sent were not 'RM's witnesses' when they were nominated by RM in relation to RM's WorkCover claim. I accept RM's evidence that RM nominated these persons as witnesses relevant to the bullying RM claimed had occurred when RM previously worked in the section to which RM was returned in 2012 after requesting to be transferred to a non-operational role.
  In our judicial system, there is a well-known principle that there is no property in a witness of fact.[63] A party to a proceeding may seek evidence from any person and it is for that person to decide whether they will give information prior to a hearing.[64] In this sense, the witnesses named by RM were not RM's witnesses.
  Having found that the breach of IPP 10 is substantiated I am to consider whether any consequential orders should be made.
  I am satisfied that the QPS should provide a written apology as the act of sending the Email was an interference with RM's privacy and the QPS must not repeat the act.[66]
  I am satisfied that QPS should re-imburse RM's legal costs in the sum of $4,400.
  There is evidence that RM paid RM's lawyers $1,100 on 2 February 2016[68] and $3,300 on 25 January 2016[69] in connection with this claim. The initiating document on the Tribunal's file indicates no filing fee was paid. I am satisfied the costs were reasonably incurred.
  I find that the QPS ought to pay RM compensation for injury to RM's feelings and humiliation suffered in the sum of $5,000.
  RM claims the maximum allowable compensation for loss or damage suffered because of the act of which RM complains in the amount of $100,000 because of the seriousness of the breach, the loss of employment and loss of opportunity with respect to RM's WorkCover claim as well as the fear and anxiety it caused RM.
  There is insufficient evidence to draw the conclusion that on the balance of probabilities the sending of the Email caused or significantly contributed to RM:
  being medically retired;
  being unsuccessful in RM's WorkCover claim;
  not being able to secure employment earlier. The evidence at the time of the hearing was that RM had secured a temporary role after approximately 3 years.
  RM's doctor's evidence, which I accept:
  was that in July 2012, a couple of months prior to the Email being sent, RM was suffering from an adjustment disorder, was anxious and depressed. RM sought medical assistance after being placed in the QPS unit where RM claims RM was previously bullied.
  was that in August 2012 he doubted whether RM was able to continue to perform non-operational roles within the QPS.
  was that RM's condition was exacerbated by the sending of the Email. There is no evidence of how much more quickly RM may have progressed but for the sending of the Email.
  There is evidence that a number of employees within the QPS were sent emails in particular by PT, which listed the three factors but did not use the words used by CF i.e. 'psychological and psychiatric injury' or RM's WorkCover number. Upon a reading of the factors, it would be clear that the nature of the injury was of a psychological or psychiatric nature rather than a physical injury.
  RM claims that RM's employment prospects have been diminished because RM is unable to use the persons to whom the Email was sent as job referees due to the damage the Email has caused to RM's reputation.
  There is little evidence before me on this point other than that these people worked with RM for a period of time up to early 2010. There is little evidence of their roles, standing or likely influence in assisting RM to secure employment but for the receipt of the Email.
  RM sought to rely upon the evidence of EF, another former QPS employee, to show how information from the QPS can adversely affect job or promotion prospects. EF's circumstances are substantially different to RM's circumstances. The information about EF's employment history with the QPS was released to a prospective employer with EF's consent. However, EF disputes the appropriateness or accuracy of the information released. The release of the information, with his consent, caused him to withdraw from a promotional opportunity.
  I also note that in relation to the unsuccessful WorkCover claim WorkCover have subsequently acknowledged that they did not handle the claim appropriately in that they did not seek statements in relation to the claim other than those provided by the QPS. This may have contributed to the unsuccessful outcome of the claim.
  There is insufficient evidence available to me to form a view that any particular financial loss is attributable to the sending of the Email, as distinct from any other authorised or lawfully justified access or use of the personal information for the purposes of responding to the WorkCover claim.
  In these circumstances, any compensation to be awarded would be limited to compensation for the humiliation and embarrassment caused by CF sending the Email.[71] I accept RM's evidence that RM felt
  This evidence is consistent with the evidence provided by RM's doctor.
  The Tribunal has previously set out the following principles as applicable:[73]
  Where a complaint is substantiated and a loss or damage is suffered, the legislation contemplates some form of redress in the ordinary course;
  In measuring compensation the principles applied in tort law will assist, although the ultimately (sic) guide is the words of the statute;
  In an appropriate case, aggravated damages may be awarded;
  Compensation should be assessed having regard to the complainants reaction and not to the perceived reaction of the majority of the community or of a reasonable person in similar circumstances.
  A relatively small number of QPS employees received the Email in breach of IPP 10 but nonetheless RM felt humiliated. Whilst other QPS employees received substantially the same information for the particular purpose, the recipients of the Email ought not to have received the information in this way.
  As previously stated in these reasons, I accept the secondary use of the information was made in the course of CF's employment. The secondary use appears to have been careless rather than malicious. Having regard to the principles outlined above and in particular that the award should be restrained, I find that the QPS ought to pay compensation in the sum of $5,000.
  Both parties sought their costs in the event they were successful. In view of the order re-imbursing RM's costs, I do not consider this further other than to make some observations.
  RM submits that the QPS unnecessarily delayed the hearing by arguing against RM's application for a hearing in private and non-publication orders and that the QPS otherwise caused the hearing to be protracted and be extended from one to two days.
  Evidence as to the impact on RM of not having a closed hearing and of a decision identifying RM being published was not squarely before the Tribunal until RM's doctor gave oral evidence at the hearing. Once that evidence was before the Tribunal the QPS conceded there were grounds for making such orders.
  RM sought to rely upon witness statements that were filed and delivered to the QPS the day prior to the hearing. RM's late delivery of the statements required the QPS to make enquiries to be able to respond to the late evidence. It is not surprising that the QPS were unable to fully investigate and provide a statement in response at such short notice thereby requiring a further hearing day.