Case brief: BMN vs Stonewood Group Limited

Summary

The Human Rights Review Tribunal awarded $60,000 in damages for a privacy breach, in which an employer took an employee’s work laptop, personal cell phone and a personal USB drive, without consent.

Background

BMN, a former employee of Stonewood Group Limited, was invited to a coffee meeting outside the office. While he was gone, Stonewood's Executive Director removed his work laptop, personal cell phone, and personal USB flash drive from his desk. One week later, BMN's employment was terminated.

Despite repeated requests, Stonewood failed to return BMN's devices which contained personal information including tax returns and medical information.

BMN filed a claim with the Human Rights Review Tribunal alleging Stonewood interfered with his privacy. Stonewood disputed taking the cell phone and USB and argued there was no breach of privacy.

The Case

The Tribunal considered whether there was an "interference with privacy" under the Privacy Act, which requires both a breach of an Information Privacy Principle (“IPP”) and demonstrable harm to the individual.

Prior to considering the IPPs, the tribunal analysed the definition of collection, finding it is to be interpreted widely and can mean “acquire”. The active and intentional steps of Stonewood to take BMN’s devices, while knowing that they contained his personal information was “collection”, not the receipt of unsolicited information.  

IPPs

1. ‍Purpose of collection of personal information (IPP 1) – The Tribunal found Stonewood failed to demonstrate any lawful purpose for collecting BMN's personal information or that collection was necessary. Stonewood had stated it “had no reason to collect BMN’s personal information”.
   ‍
2. Source of personal information (IPP 2) – Information must be collected from the individual concerned unless an agency believes on reasonable grounds that a listed exception applies. The onus is on the agency to prove this, and Stonewood failed to present any reasonable grounds, merely stating it held “genuine and serious concerns”.
   ‍
3. ‍Unfair or Intrusive Collection(IPP 4) – Information cannot be collected unfairly or in a manner that is an unreasonable intrusion on the personal affairs of the individual. Even though it was a work laptop owned by Stonewood, the Tribunal found a breach of IPP 4 due to the method of collection; the planned removal of devices while BMN was away.
   
4. ‍IPP 6 & 11– The Tribunal lacked jurisdiction to consider these claims because the Privacy Commissioner did not investigate them. The Commissioner’s investigation focused solely on the wrongful collection of information.

Harm to the Individual

The Tribunal found that Stonewood’s breach of IPPs 1, 2, and 4 caused significant humiliation, loss of dignity, and injury to feelings. This was evidenced by BMN's subsequent diagnosis of acute anxiety and depression. The Tribunal acknowledged the impact on BMN’s tax filing and career prospects.

Result

The Tribunal ruled in favour of BMN, finding that Stonewood interfered with his privacy.  Stonewood was ordered to return BMN's personal information and USB drive, delete all copies of his information, and pay $60,000 in damages for humiliation, loss of dignity, and injury to feelings, in addition to $394.87 in pecuniary losses. Non-publication orders were granted to protect BMN's identity.

The case highlights that “collection” is to be interpreted widely and that a right to privacy exists in the context of taking property that is known to contain personal information, without consent, and without a lawful purpose or where the person did not reasonably believe an exception to requiring consent, under the Act, applied. An interference with privacy under the Act will only be made out where there is evidence of correlating harm to the individual.  

For further information on this case or similar issues, please contact Director, Brigitte Morten.