The recent decision of the acting Privacy Commissioner upholding the Department of Human Services’ release of an individual’s personal information to the media was short on detail. Beyond the specifics of the individual case, a range of questions now arise for APS leaders. Is policing the accuracy of all public complaints a core function of all government departments and agencies? How will the APS confront the resulting challenges of engaging with, and responding to, the media?
What was the Privacy Commissioner’s finding?
The acting Privacy Commissioner reiterated that where a person complains publicly about an agency, they are considered reasonably likely to be aware that the agency may respond publicly and in a way that reveals personal information relevant to the issues of they have raised.
As this matter was concluded through a brief statement rather than a formal determination, we remain substantially in the dark about the specifics of the Centrelink case and the breadth of the exemption. This piece is intended to be forward looking – focusing on the confusion that now marks the public service’s power to “correct the record”.
Where does the ‘reasonable expectation’ of release come from?
The expectation derives from Australian Privacy Principle 6 which states that an action by an entity does not breach the Act if:
6(2)(a)(ii) the individual would reasonably expect the APP entity to use or disclose their personal information for the secondary purpose, and that purpose is related to the primary purpose of collection, or, in the case of sensitive information, directly related to the primary purpose, or
The acting Commissioner’s statement cites the earlier preliminary view of the Commissioner in 2010 – L v A Government Agency, which first exempted media releases of personal information. This earlier view applied the previously applicable Information Privacy Principle 11.1, which exempted the disclosure of personal information where the individual was held likely to be aware the disclosure “usually made”. The L decision did not, however, supply any prevalence analysis, or evidence of public knowledge of, media disclosures of personal information by government in response to public complaints.
Another significant omission is the failure of either L or the recent decision to make any reference to the legislation governing the relevant Department, the Social Security Administration Act 1999. Surely the public can only “expect” conduct which falls within the existing legal powers of the government entity? Or is this idea somehow undermined by the fact that APP 6 contains a separate exemption for actions which are “authorised by or under Australian law”? The basis for the expectation has not been fully outlined, and its existence shows how the Privacy Act may be primed to exempt uses of personal information by government which may not have been specifically authorised by existing legislation.
Those involved in frontline decision-making need stronger guidance on what type of statutory language allows for media releases and the conditions that attach to the exercise of any such power. The current ‘expectation’ seems unworkably general, silent on key questions such as who releases the information, how the information is released or even the underlying rationale for the releases.
Does this ruling apply across all of Government?
The finding underlines that where any government agency releases personal information that is relevant to the issues publicly raised by the individual, no breach of the Australian Privacy Principles will occur. APP 6 is, however, directed at defining what constitutes a breach of the Privacy Act, not with laying out the process by which every agency carries out any such releases. The process for any release may vary based on the specific legislation regulating the relevant department. This is why the Department of Human Services, citing the Social Security Administration Act, appears to have held itself to a slightly higher standard before the Senate inquiry than is contained in the Privacy Commissioner’s reasoning.“PS leaders need to secure up-to-date legal advice on their own governing legislation and map the L principle onto the roles, processes and administrative powers contained in it.”
Some legislation may include specific provisions stating that the use and disclosure of personal information is permitted where in compliance with the Australian Privacy Principles. I, and other submitters to the inquiry such as Victoria Legal Aid, argued that the text of the Social Security Administration Act actually limited media releases or required a public interest certificate be issued prior to a release. Alongside the contestable nature of L as a precedent, the Department came under pressure because of these efforts to jar loose the assumption that the power to make media releases automatically falls within the “general” administrative powers of government agencies.
One should not simply slide into the mindset that anything that is not actively prohibited is permitted. APS leaders need to secure up-to-date legal advice on their own governing legislation and map the L principle onto the roles, processes and administrative powers contained in it.
Who can release personal information?
Readers may have been surprised that it was administrative officials, not the Minister or his staffers, who released the information in the Centrelink dispute. Media reports at the time suggested that some additional information had been inadvertently released by the Minister’s Office. The question of who in the organisation can release information is left unaddressed by the Commissioner’s decision. The Commissioner’s statement refers solely to “the Department”, a corporate entity vested with no relevant administrative powers under the Social Security Administration Act.
The identity of office holders vested with the power to release (if any) will have to be clarified by reference to the governing legislation of each public body. The Social Security Administration Act (and other legislation such as the NDIS Act), contains a public interest certification power, whereby the Secretary can release information to correct the record on public interest grounds. The relevant disallowable instrument requires that the Secretary be satisfied that the factually incorrect or misleading media coverage represents a threat to the integrity of the system. The separate prospect that a Minister could disclose personal information to correct the public record has not been analysed under the Privacy Act (or court decision). A minister’s power to release in furtherance of a parliamentary process may be accepted, especially given a Minister’s role under sections 61 and 64 of the Constitution.
In the Centrelink dispute, however, the Department did not use either of these two avenues. Instead it argued for the separate right to make an “administrative” release, under section 202 of the Act. This allows “a person” to disclose information “for the purposes of the social security law”. There is an obvious ambiguity around who holds the power. Can a branch manager or communication staff respond to local media, or must it be a Deputy Secretary (as occurred in this case)? Has every public body functioning delegations in relation to media engagement? The acting Privacy Commissioner continued the practice whereby the exemption is applied to “the Department” and did not discuss whether the public’s expectations are affected by the identity of the person authorising release or the nature of the power used.
When can personal information be released to the media?
During the robodebt inquiry, the Department of Human Services argued that the releases of personal information were proportionate responses to factual errors or misleading impressions which threatened the integrity of the system. Media coverage and ministerial comments continually justified the release by citing the need to “correct the record”.
When you read the L decision, however, no misleading impression or factual error is required. The only limitation under the Privacy Act is that a departmental response is “confined to responding to the issues raised”. The term “issues” is on its face quite permissive – does it allow the release of information just to add context to specific factual claims? The L decision does not expressly impose a proportionality requirement, or that a level of harm to public administration might occur without a correction being issued. The decision also states the public expects a disclosure of relevant personal information where individuals “complain publicly” – not just in the media.
Privacy decisions and guidelines have equally not developed any explanation of the nature of relationship between the primary purpose of collection – e.g. the administration of social security law and the secondary use – the issuing of a media response. The rationale and conditions for undertaking a media release seem to be found in the primary legislation under which the information was gathered. The existing decisions provide little insight into how the public’s expectation is affected by the surrounding statutory context.
DHS’s experiences embody the difficulty of laying down the boundaries of a power to release personal information to the media. During the senate inquiry the goal was stated as being variously to “correct false statements” “correct the record”, correct “a misleading impression”, to clarify “unreasonable and inaccurate assumptions”. Each of these would set a different limit to the power. The Department’s position also rested on the argument that effective public administration was endangered by the original article, and that the release was required to preserve “public confidence” in the welfare system and avoid the diversion of staff resources. In the aftermath of this controversy, agencies will need to produce a clear definition of how they perceive their powers and the outcomes sought.
How is information to be released?
Putting the merits of media releases to one side, a disappointing aspect of Privacy Commissioner’s decision is failure to provide for any procedural safeguards. The “expectation” of the public is strikingly ignorant of the most significant norms regulating interaction between government and its citizens: procedural fairness and reasonableness. Any exercise of public power, including media releases, attracts these fundamental principles. The Privacy Commissioner could have provided a degree of reassurance to the public by simply underlining their abiding operation.
One danger is that when a disclosure is made in a private briefing, the individual concerned may remain unaware that it has occurred. The types of questions that any public body pursuing a release should ask include:
Has the Department contacted the person and asked them to implement a correction?
Will the individual be notified of planned and eventual content of the disclosure of their personal information? This safeguard is particularly important in ensuring the individual does not volunteer extra information under questioning from the journalist due to lack of knowledge of what has been disclosed.
Has the Department considered the interests of third parties who may have their personal reputations or financial interests affected by a disclosure? Have they been notified?
Given the intense nature of media coverage, the potential impact on vulnerable individuals is a relevant consideration to the power to release – an individual’s views could be attributable to impaired capacity, for example.
Reasonableness requires identifying the justification for the release and considering available alternative actions available to achieve that end. While it may harbour at times legitimate feelings of injustice which come with a “media beat-up”, the public service should value the standard protections against media inaccuracy. DHS itself secured a Press Council ruling in relation to FTB debt reporting earlier this year. The Deputy CEO of the National Disability Insurance Agency, Vicki Rundle, provided an example of a freestanding, positively framed media response in a recent newspaper piece.
The Centrelink dispute raises many questions about the nature of media management within Departments. What was justification for placing the issuing of the correction under the editorial control of a journalist rather than publishing the correcting statement directly on the departmental website? How was the goal of protecting the integrity of the system rationally furthered by leaving an original piece unamended, but placing its “correction”, following the passage of a materially significant period of time, in an op-ed piece in a different circulation outlet?
The need for an in-depth first principles review of best practice in media engagement by APS officials and ministerial staffers seems undeniable.
Contradiction and confusion across Government
The issues canvassed in this article arise across government, as was underlined by the Mandarin’s own reporting on a question submitted to the Australian Public Service Commission by a concerned public servant. Further proof of this was the confused public debate which occurred in March of last year, when the Department of Veterans’ Affairs proposed to amend its legislation to make provision for the release of personal information to correct the record through the issuing of a public interest certificate by its Secretary.
The Minister for Veterans Affairs argued that the proposed addition of a public interest certification system was actually a safeguard, limiting the Department’s ability to conduct administrative releases. This flatly contradicted DHS’ defence at the senate inquiry that the existence of a public interest certification system needed to be read entirely separately from a power to make ‘administrative releases’. The Department of Veterans Affairs then published a statement describing its existing administrative powers to release in broad and unqualified terms. Finally, after a week of advocacy, veterans’ advocates and at least one Senator, walked away believing that, by blocking the certification system, they had protected veterans from disclosures. The latter belief was not vindicated by the Privacy Commissioner’s finding in the Centrelink investigation. We have rarely seen a public debate so affected by confusion and contradiction.
Given these outstanding tensions and widespread public concern, senior APS leaders need to create codes of conduct fully outlining the prevailing approach to media engagement and identifying procedural safeguards accompanying any releases. The Office of the Privacy Commissioner needs to begin rebuilding public confidence by driving the resolution of the issues outlined in this article.
Darren O’Donovan is a Senior Lecturer in Administrative Law at La Trobe Law School.