OAIC Notice – immigration data breach privacy complaint

Background

On 10 February 2014, the Department of Immigration and Border Protection (now the Department of Home Affairs) (Department) published, in error, a detention report on its website that contained embedded personal information (Data Breach).

The report contained the personal information of all 9,258 persons who were in immigration detention on 31 January 2014.

On 30 August 2015, a representative complaint was made to the Office of the Australian Information Commissioner (OAIC) on behalf of all persons whose information was published by the Department in error (Class Members). The complaint requested the Department provide an apology and compensation.

On 9 February 2018, the original representative complainant’s solicitor advised the OAIC that their client had passed away. On 10 October 2018 the Commissioner made a decision to replace the original representative complainant with another class member (the representative complainant) pursuant to s 38B(1) of the Privacy Act 1988 (Cth) (Privacy Act). Slater and Gordon act for the representative complainant. Information about Slater and Gordon is available on their website.

On 24 January 2018 the Commissioner gave notice (the Notice) that if class members believed they had suffered loss or damage as a result of the data breach and wanted the opportunity to potentially recover compensation for that loss or damage, they needed to provide information about their loss or damage to the OAIC by 4:00pm on 19 April 2018.

The due date for responding to the Notice was extended to 19 October 2018. The OAIC granted further extensions on the due date to some class members and submissions were finalised on 22 April 2019.

Determination

On 11 January 2021, the Commissioner issued a determination under section 52 of the Privacy Act (the Determination).

The Determination found that:

• as a result of the Data Breach, the Department has engaged in conduct that interfered with the privacy of an individual; and
• Class Members who made submissions and/or provided evidence of loss or damage in response to the Notice (Participating Class Members) are to be paid compensation in the manner determined by the Commissioner.

The Commissioner determined that compensation is to be paid to Participating Class Members in accordance with the categories of loss or damage set out in the below table (Table 1).

Table 1

Table of categories of loss or damage experienced by members of the class and indicative quantum of compensation

Table 1 has been developed to assist with the calculation of compensation for non-economic loss. It is not intended to assist with the calculation of damages for economic loss. Economic loss is to be paid to Participating Class Members who have claimed that they have suffered economic loss as a result of the Data Breach and have provided evidence to substantiate that loss. Damages for economic loss will be assessed on a case by case basis.

The Determination sets out the process to be followed by the Department when assessing and finalising claims from Participating Class Members to be paid compensation for loss or damage arising from the Data Breach.

In summary, the process involves:

• the Department assigning an amount of compensation for each Participating Class Member based on the submissions and/or evidence of loss or damage they provided and in accordance with a table of categories developed to reflect the claims made by class members and to assist with the calculation of compensation for non-economic loss
• the Department communicating the assessment of the proposed amount of compensation and relevant evidence to the Participating Class Member or their representative and seeking their agreement to the amount of compensation
• where the Department and the Class Member do not agree on the amount of compensation, the Department may re-assess the amount of compensation, and seek agreement from the Participating Class Member or their representative on the re-assessed amount of compensation
• to the extent that the parties are unable to agree on the category in the Table into which the Participating Class Member is assigned after re-assessment, and there is some evidence provided by each party for the divergent views, further submissions should be obtained through expert assessment, except where the Participating Class Member has not responded to the respondent’s assessment within 28 days after receiving the assessment, or within 28 days after receiving the re-assessment (if any). The Department may also refer a matter for expert assessment at any time following preliminary assessment.

The Commissioner will declare the amount of compensation payable for any claims that remain unresolved at the conclusion of the process.

The Commissioner found that Class Members who did not provide a submission and/or evidence to the OAIC prior to the due date, and who did not opt out, have not substantiated that they have suffered loss or damage as a result of the interference with their privacy, and declared that it would be inappropriate for any further action to be taken in relation to those individuals.

Frequently asked questions

I am unsure if the Determination applies to me

If you were in immigration detention on mainland Australia or on Christmas Island as at midnight 31 January 2014, and did not opt out of being part of the Representative Complaint, the Determination extends to you as a ‘Class Member’.

Class Members include the 5,867 people who were in immigration detention facilities and alternative places of detention (including 3,967 people in immigration detention on the mainland and 1,900 in immigration detention on Christmas Island) as well as the 3,391 people who were living in the community under a residence determination, as at midnight 31 January 2014.

Are all class members to be paid compensation?

No.

Class Members who made submissions and/or provided evidence in response to the Notice, which demonstrate that the Class Member suffered loss or damage as a result of the Data Breach, are to be paid compensation in the manner determined by the Commissioner.

Class Members who did not provide a submission and/or evidence of loss or damage to the OAIC prior to the deadline, and who did not opt out, have not substantiated that they have suffered loss or damage as a result of the interference with their privacy. Therefore, they will not be paid compensation.

How will I know if I am to be paid compensation?

Class Members who made submissions and/or provided evidence in response to the Notice, which demonstrate that the Class Member suffered loss or damage as a result of the Data Breach, are to be paid compensation in the manner determined by the Commissioner.

If you are one of these Participating Class Members, the Department will write to you to advise you of its assessment of your claim, and to give you an opportunity to accept or reject their assessment.

If you are unsure whether you are one of the Class Members who is to be paid compensation in the manner determined by the Commissioner, you may contact the OAIC by email at enquiries@oaic.gov.au.

What are the next steps?

If you are one of the Participating Class Members, the next step will be for the Department to write to you to advise:

• its assessment of the category of loss or damage your claim falls in with reference to Table 1
• its assessment of the amount of compensation payable to you for non-economic loss and/or economic loss
• its reasons for the assessment, and
• a form to be completed by you to indicate your agreement or disagreement with the Department’s assessment.

You will have 28 days after you receive the Department's assessment to respond to the assessment. If you require further time to consider the assessment, please contact the Department to request an extension of time.

What if I agree with the Department’s assessment?

If you agree with the Department’s assessment of compensation for your claim, you may fill out the response form provided to you by the Department with the assessment. In the response form you should advise the Department that you agree with the assessment, in which case the Department will pay you within a reasonable period the agreed amount of compensation to your nominated bank account. Generally, this would occur within 14 days of agreement being reached, subject to confirmation from Medicare regarding any reimbursement obligations, as relevant.

Reimbursement and notification obligations arise in respect of certain professional services that have been provided to you but have been paid by Medicare. More information is provided below. An award of compensation may also affect any Centrelink payments you are receiving.

You should return the response form to the Department within 28 days of receiving the Department's assessment.

What if I disagree with the Department’s assessment?

If you disagree with the Department’s assessment of compensation for your claim, you should fill out the response form provided to you by the Department to indicate you reject their assessment. You should return the response form to the Department within 28 days of receiving the Department's assessment.

In most instances, the Department will reassess your claim for compensation and provide you with a further opportunity to either accept or reject their reassessment. In some instances, the Department may opt to refer your claim for expert assessment in lieu of re-assessment. You will have another 28 days after receiving the Department's reassessment to either accept or reject it. Again, if you require further time to consider the reassessment please contact the Department to request an extension of time.

If you reject the Department’s reassessment on the basis that you disagree on the category in the Table into which you have been assigned, and there is some evidence provided by each party for the divergent views, further submissions may be obtained through expert assessment. In some instances, the Department may instead opt to refer your claim for expert assessment in lieu of re-assessment.

What if I do not respond to the Department’s assessment or re-assessment?

Subject to the granting of any extension of time, if you fail to respond to the Department’s assessment within 28 days after you receive the assessment, or you fail to respond to the Department’s re-assessment (if any) within 28 days after you receive the re-assessment, the Department will advise the OAIC that you have not responded, and the Commissioner will proceed to declare the quantum of compensation for your claim.

What is expert assessment?

Expert assessment involves an independent third-party expert making an assessment. The expert uses his or her expertise and knowledge to make an assessment based on the evidence presented by the parties.

How will the expert/s be chosen?

The expert/s will be independent and will have suitable qualifications and experience to undertake the appointed task, as identified by the OAIC.

The expert/s will be chosen by both the Department and Slater and Gordon (collectively the parties). Once the parties have decided on the expert/s, the parties will provide the OAIC with the names of the expert/s, details of their background, qualifications and experience, and a brief explanation of why they are suitable, for the Information Commissioner’s approval.

How will the expert make their assessment?

The expert will make their recommendation in accordance with the criteria for assessing economic and non-economic loss outlined in the Commissioner’s determination available here.

The expert shall assign an amount of damages for economic and/or non-economic loss claimed by the Participating Class Member. The quantum of damages for non-economic loss will be assigned by the expert with reference to Table 1 above.

Table 1 has been developed to assist with the calculation of compensation for non-economic loss. It is not intended to assist with the calculation of damages for economic loss. Damages for economic loss will be assessed on a case-by-case basis.

The expert assessment process will be conducted on the papers. The expert will make an assessment recommending the amount to be awarded to the Participating Class Member based on:

• the submissions and/or evidence of loss or damage provided by the Participating Class Member to the OAIC prior to the deadline in the Notice
• the Department’s assessment and reasons
• the Department’s reassessment (if any) and reasons
• any information contained in the Participating Class Member’s response form/s.

The expert will provide their recommendation and accompanying reasons, directly to the OAIC, copying in the parties.

Will I be given an opportunity to provide further submissions or evidence to the expert before or after they make their assessment?

No.

The parties will not have an opportunity to provide further submissions or evidence to the expert, whether orally or in writing.

Is the expert’s assessment binding?

No.

The assessment will have effect as a recommendation and will not be binding on the parties.

Will I be given the opportunity to accept or reject the expert’s assessment?

Yes.

There will be no right to provide submissions or evidence in response to the expert’s assessment. However, you will have the opportunity to either accept or reject the expert’s assessment.

What if I agree with the assessment of the expert?

If you agree with the assessment of the expert, you should advise the Department that you agree. If the Department also agrees with the assessment, the Department will pay you the agreed amount of compensation within a reasonable period. Generally, this would occur within 14 days of agreement being reached, subject to confirmation from Medicare regarding any reimbursement obligations, as relevant.

Reimbursement and notification obligations arise in respect of certain professional services that have been provided to you but have been paid by Medicare. More information is provided below.

What if the Department or I disagree with the assessment of the expert?

If you disagree with the expert’s assessment of your claim, you should advise the Commissioner that you disagree. Alternatively, the Department may disagree with the expert’s assessment of your claim. In both of these circumstances the Commissioner will determine the amount of compensation for your claim. This will occur as soon as possible, but no later than 12 months from the date of the determination.

After determination, the Department will then pay you the amount of compensation determined by the Commissioner within a reasonable period. Generally, this would occur within 14 days of being notified of the determination, subject to confirmation from Medicare regarding any reimbursement obligations, as relevant.

What is the role of the representative complainant?

The representative complainant made the privacy complaint to the OAIC on behalf of class members and represents the interests of class members. Slater and Gordon act for the representative complainant.

While the representative complainant has had and will continue to have input into the process for managing the claims of class members generally, such as choosing the expert/s with the Department and assisting with the finalisation of template correspondence to Participating Class Members, the representative complainant does not have a role in resolving every individual claim.

What is the Department’s role?

The role of the Department is to:

• assess which category of loss or damage the claim falls in the above Table 1
• propose an amount of compensation payable on the claim
• seek agreement on the amount of compensation with each Participating Class Member
• undertake a re-assessment of a disputed claim if it wishes to do so
• choose the expert/s with the representative complainant, and present the expert/s to the Commissioner for approval
• engage in expert assessment with the class member in certain circumstances
• advise the OAIC of claims that remain unresolved.

What is the Commissioner’s role?

The Commissioner will oversee the process and determine the amount of compensation payable for any claims that remain unresolved at the conclusion of the process.

In overseeing the process, the Commissioner may give such further directions (if any) as she thinks are fair in relation to the manner in which a Participating Class Member is to establish his or her entitlement to the payment of an amount under the determination, or the manner for determining any dispute regarding the entitlement of a Participating Class Member to the payment.

How will the receipt of past Medicare benefits affect the payment of compensation?

Reimbursement and notification obligations arise in respect of certain professional services that have been provided to you, but which have been paid by Medicare.

If the amount of compensation awarded to you as a result of the Data Breach is above $5,000, and you are the holder of a Medicare card, you will need to request a Notice of Past Benefits from Medicare before any compensation can be paid to you. The first step in requesting a Notice of Past Benefits is to request a Medicare History Statement. You can request a Medicare History Statement by visiting the following website: https://www.servicesaustralia.gov.au/individuals/forms/mo026.

Will an award of compensation affect my Centrelink payments?

An award of compensation to you may affect any Centrelink payments you are receiving. If you are receiving Centrelink payments, you should call Centrelink on 1800 777 653 or 131 202 (Multilingual Phone Service) to discuss any impact on your personal circumstances.

Where can I obtain free assistance?

If you live in Victoria:

If you live in New South Wales or the Australian Capital Territory or in detention in Queensland:

If you live in South Australia or Tasmania:

If you live in Northern Territory:

OR

If you live in Western Australia:

OR

If you live in Queensland or if the organisations listed above are not able to answer your questions you can contact:

OR

Further information

If you have any further enquiries about this matter, you may contact the OAIC by email to enquiries@oaic.gov.au.

If you need assistance from the OAIC in a language other than English, please call the Translating and Interpreting Service on 131 450 then ask for 1300 363 992. Currently the OAIC accepts telephone enquiries on Tuesdays, Wednesdays, and Thursdays from 10am to 4pm.

Free translation assistance

The Department will arrange for all of its correspondence to be translated into one of the 19 languages. You will be contacted by the Department early in the process asking you to indicate if you would like to receive communications in a language other than English.

The Department will also arrange for any information you submit to it, in one of these 19 languages, to be translated into English.

The Department will cover the costs of these translation services.