VICTORIAN CIVIL AND ADMINISTRATIVE TRIBUNAL
human rights DIVISION
HUMan rights LIST	
vcat reference No. H256/2022	
CATCHWORDS	
Human Rights List – interference with privacy – words and phrases ‘unless’ and ‘as well as’ – an outsourcing party may pass responsibility for interferences with privacy to a contracted service provider where a State contract exists and provides for that arrangement – liability does not remain with the outsourcing party - the substance of the complaint to be considered by VCAT must be identical to that considered by the Commissioner – Privacy and Data Protection Act 2014 (Vic) s17, 77 – Jurecek v Transport Safety Vic [2015] VCAT 253 – Bruce v Victorian Workcover Authority (WorkSafe) (Human Rights) [2022] VCAT 34	

complainant	Ekaterina Send	
RESPONDENT 	Department of Jobs, Precincts and Regions	
WHERE HELD	414 La Trobe Street, Melbourne	
BEFORE	A. Smith, Senior Member	
HEARING TYPE	Hearing	
DATE OF HEARING	30 October 2024	
DATE OF ORDER	30 October 2024	
DATE OF WRITTEN REASONS	28 November 2024	
CITATION	Send v Department of Jobs, Precincts and Regions (Human Rights) [2024] VCAT 1130	

Order
For reasons expressed at the hearing:
1	Under section 77(1)(b) of the Privacy and Data Protection Act 2014 (Vic), VCAT finds the complaint, insofar as it relates to a contravention of Information Privacy Principles 6.1, is proven but declines to take any further action in the matter.
2	The complaint is otherwise dismissed.
3	No order as to costs.

A. Smith
Senior Member			

APPEARANCES:		
For Complainant	In person	
For Respondent	Mr. J. Pizer SC of counsel	

Reasons
Background 
1	Ekaterina Send (the complainant) successfully applied to be part of the Department of Jobs, Precincts and Regions’ (the respondent) Digital Jobs Program in 2021. The respondent contracted with Hudson Global Resources (Aust) Pty Limited (Hudson) to assist with the recruitment process for that program. This involved the initial submission of the applicant’s online application and resume. Next, she participated in two personality assessments. Hudson conducted one of the assessments and subcontracted out to Sapia & Co Pty Ltd (trading as Sapia.ai) (Sapia), previously called PredictiveHire, for the other. There was no contractual relationship between the respondent and Sapia. Though the outcome of the recruitment process was favourable for the complainant, she considered that the conclusions drawn by the assessment programs were inaccurate and unfair to her. She complained to the Office of the Victorian Information Commissioner (the Commissioner). The complainant alleges that the respondent handled personal information about her in breach of Information Privacy Principles (IPPs) 1.1, 1.3, 1.4, 2.1, 3.1, 5.1, 6.1, 9.1, and 10.1.
2	On 29 July 2022, the Commissioner referred the complainant’s privacy complaint against the respondent to VCAT under section 66(4) of the Privacy and Data Protection Act 2014 (Vic) (the Act). 
3	VCAT refused the respondent’s application to strike out or dismiss the complaint under section 75 of the Victorian Civil and Administrative Tribunal Act 1998 (Vic) (VCAT Act) on 21 November 2023. 
4	Further directions hearings on 21 December 2023, 31 January 2024 and 23 July 2024 ordered exchanges of information and narrowed the proceedings to the following preliminary questions: 
A.	Is the respondent liable under the Act for an act done by Hudson (or by one of Hudson’s subcontractors) if:
a.	the act was done for the purposes of the State Contract between the respondent and Hudson; and
b.	the act constituted an interference with the complainant’s privacy? 
B.	For the purposes of IPP 6.1, does the respondent ‘hold’ – or has it ever ‘held’ – the ‘employer report’ referred to in paragraph 45 of the complainant’s Statement of Claim?
5	The parties filed and exchanged extensive written submissions on the two questions as well as amended Points of Claim and Defence and witness statements. Taking into account those documents and submissions made at the hearing, I decided the preliminary questions on 30 October 2024 and gave oral reasons for my orders set out above. The complainant requested a statement of reasons at the conclusion of the hearing. This statement of reasons reiterates the reasons I gave at that time, though it includes more background information that it was not necessary to repeat in my oral reasons, as the parties already had a comprehensive knowledge of the background. 
Preliminary question A 
Legislation
6	Question A centred upon the construction of section 17 of the Act which states (with emphasis added):
(1)	Subject to this section, the status or effect for the purposes of this Act (other than Part 4) of an act or practice is not affected by the existence or operation of a State contract.
(2)	A State contract may provide for the contracted service provider to be bound by the Information Privacy Principles and any applicable code of practice with respect to any act done, or practice engaged in, by the contracted service provider for the purposes of the State contract in the same way and to the same extent as the outsourcing party would have been bound by them in respect of that act or practice had it been directly done or engaged in by the outsourcing party.
(3)	If a provision of a kind referred to in subsection (2) is in force under a State contract, the Information Privacy Principles and any applicable code of practice apply to an act done, or practice engaged in, by the contracted service provider in the same way and to the same extent as they would have applied to the outsourcing party in respect of that act or practice had it been directly done or engaged in by the outsourcing party.
(4)	An act or practice that is an interference with the privacy of an individual done or engaged in by a contracted service provider for the purposes of the State contract must, for the purposes of this Act (other than Part 4) and any applicable code of practice, be taken to have been done or engaged in by the outsourcing party as well as the contracted service provider unless—
(a)	the outsourcing party establishes that a provision of a kind referred to in subsection (2) was in force under the State contract at the relevant time in relation to the act or practice; and
(b)	the Information Privacy Principle or applicable code of practice to which the act or practice is contrary, or with which it is inconsistent, is capable of being enforced against the contracted service provider in accordance with the procedures set out in this Act.
(5)	Section 118(1) does not apply to an act done or practice engaged in by a contracted service provider acting within the scope of a State contract.
Issues not in dispute
7	There was no dispute that the information or opinion collected, stored or otherwise treated in the assessment and recruitment process was ‘personal information’ within the meaning of the IPPs. 
8	The parties agree that the respondent is an ‘outsourcing party,’ and that Hudson is a ‘contracted service provider’ for the purposes of section 17. The respondent entered into a contract with Hudson on 25 May 2021 engaging Hudson to conduct the recruitment process, which is a State contract within the meaning of the Act. Clause 19.7(a) of that contract mirrored language in subsections 17(2) and (3) and Husdon’s activities in assessing candidates were undertaken as part of the State contract which included the terms set out in section 17(2). 
9	There was also no dispute that, at the time of the referral, the IPP was capable of being enforced against the contracted service provider, Hudson. 
Key issues in dispute 
10	The respondent argues that all the allegations in the complaint, except the alleged breaches of IPP 6.1, relate to the treatment of personal information by Hudson. It says that because Hudson and the respondent had a State contract, the provisions in section 17(4)(a) and (b) have the effect that liability for any alleged breaches can only be brought against Hudson. The respondent argues that section 17 creates an unambiguous ‘yes/no’ situation that - if the conditions in section 17(4)(a) and (b) are established - only the contracted service provider is liable for breaches of the IPPs. The meaning of section 17 has not been augmented nor diminished by the newer legislation. 
11	Sources cited for the complainant’s and the respondent’s interpretations included the Explanatory Memoranda and Second Reading Speeches created for the Information Privacy Act 2000 (Vic) and the 2014 legislation, and the Compatibility Statement for the 2014 legislation.  
12	The Explanatory Memorandum for the 2014 legislation states:
Clause 17 explains the application of the Bill to outsourcing arrangements. It provides for differential application in respect of Part 4.
13	The preceding legislation was passed based on the following Explanatory Memorandum:
Clause 17 deals with the application of the Act to outsourcing arrangements. It is intended that providers of contracted services will be bound under the Act to the same extent as the organisation seeking to outsource one or more functions. …
This policy is achieved by allocation of responsibility for any contraventions of the Act which occur in the context of outsourcing. In order to avoid continuing liability for contravention of the IPPs, the outsourcing organisation must ensure two things, set out in sub-clause (4). The first is that a suitable contract is operating to pass that responsibility to the service provider. The contract will specify any particular responsibilities set out in the outsourcing organisation’s approved code (if applicable) by which the contracted service provider is to abide. The second requirement is that the IPPs or code must be enforceable against the contracted service provider within the Victorian jurisdiction (see sub-clause (4)(b)). The purpose of this sub-clause is to ensure that individuals whose personal information is misused outside Victoria retain a practical means to address contraventions.
14	The respondent argues that the earlier Explanatory Memorandum gives context to the latter legislation, given the terms are substantially the same. 
15	The Compatibility Statement notes that the substantive provisions of the latter legislation are unchanged from the former. The Second Reading Speech for the latter legislation did not specifically address section 17, but noted that the Bill reenacted many key provisions, notably the IPPs. 
16	The complainant argues that section 17 sets up an ambiguous situation that - regardless of whether the conditions in section 17(4)(a) and (b) are established - either the contracted service provider or the outsourcing party is liable for breaches of the IPPs. She argued this on:
(i)	grammatical grounds (‘natural and ordinary linguistic meaning’), 
(ii)	grounds that the Act is beneficial legislation and ambiguity should be resolved in accordance with its aims,
(iii)	the difficulties complainants would have in proving breaches of the IPPs if they are unable to access State contracts or know who the correct respondent is, 
(iv)	the need for government agencies to act as model litigants,  
(v)	changes in the digital environment between the 2000 legislation and the current Act, mean that the words in section 17 – though unchanged – have different emphases because of the legislature’s stated intention to enhance individual’s rights to privacy with the amending legislation.
Resolution of preliminary question A
17	The approach I have taken is to consider whether the ordinary meaning of the words in the statute are consistent with the language and purpose of all of the provisions in the statute, after consideration of the meaning the legislature intended them to have. 
18	My reading of the inclusions and omissions in the Explanatory Memoranda, the Second Reading Speeches is that the legislature creating the 2014 Act considered that the former section 17 met its purpose and did not need adjustment to meet the needs of the new legislation. The Compatibility Statement confirms that relevant authorities at the time did not consider the outcome of the new section 17 to be any different to the former. In terms of the legislature’s intention regarding the original section 17, I note the phrase in the initial Explanatory Memorandum: 
The first is that a suitable contract is operating to pass that responsibility to the service provider. 
(emphasis added)
19	I conclude that the operation of the words ‘as well as’ and ‘unless’ in section 17 create a filter or exclusion that operates to assign responsibility for interferences with privacy. This is consistent with the literal and grammatical meaning from a plain reading of the provision. Before the filtering word ‘unless’ appears, the situation is that the outsourcing party ‘as well as’ the contracted service provider might be liable for interferences with privacy – a dual liability situation. But if the two conditions specified in paragraphs (a) and (b) are met, the word ‘unless’ filters out or excludes the possibility that the outsourcing party can be liable for interferences with privacy, leaving only the contracted service provider having that responsibility.  
20	As I do not see any ambiguity between the intention of the legislature and the ordinary grammatical meaning of the words, I do not consider that other arguments from the complainant about the beneficial nature of the legislation, the role of government agencies as model litigants, etc. need to be determined.  
21	As to the question: Is the respondent liable under the Act for an act done by Hudson (or by one of Hudson’s subcontractors) if:
a.	the act was done for the purposes of the State Contract between the respondent and Hudson; and
b.	the act constituted an interference with the complainant’s privacy? 
The answer is no. In other words, the respondent has established that the provision in section 17(2) existed in its contract with Hudson and that a breach of the IPP is capable of being enforced against the contracted service provider. This contract passes any responsibility the respondent might have had for interferences with the complainant’s privacy to Hudson. 
22	The effect of my answer to the preliminary question is that the complainant complained against the wrong respondent and the complaint should be dismissed except as to the alleged interferences with privacy arising from the operation of IPP 6.1, which is considered under preliminary question B. 
Preliminary question B
Legislation
23	IPP 6.1 requires that if an organisation holds personal information about an individual, it must provide the individual with access to the information on request by the individual, except to the extent that any of the exceptions apply. 
The complaint
24	The referral from the Commissioner states:
Ms Send asserts that the Department contravened IPP6.1 because it did not provide her with access to her personal information relating to the Program upon request. 
25	Ms Send’s particulars of complaint state:
I requested to access [the employer report] and the access was denied on every occasion:
(a)	I contacted Hudson by email on 30.0802021 and 3.9.2021 requesting access …,
(b)	I requested access via the privacy complaint that I filed with OVIC on 02.02.2021,
(c)	I also requested access in the email correspondence with Sapia (formerly PredictiveHire) CEO
26	The complainant argued that her personal information held by Hudson or Sapia was within the control of the respondent due to the terms of the contact between the respondent and Hudson.
The response 
27	The respondent did not argue that any of the exceptions in IPP6.1 apply. 
28	The respondent made arguments that the term ‘employer report’ was unclear, and that the respondent had never held such a report. In its written submissions, the respondent stated that, in relation to the question whether it had control or powers to require the production of a report from Hudson, it had sent a direction to Hudson on 14 October 2024, under the terms of clause 19.7(b) of the State contract, directing Hudson to require Sapia to provide a copy of the report. The written submissions stated that if the direction resulted in production of the report, the respondent would provide the report to the complainant.
29	At the hearing, the respondent tendered email exchanges between itself and Glenn Boswell of Hudson and Barb Hyman of Sapia from 14 October 2024 to 24 October 2024. Glenn Boswell was called on short notice as a witness to the hearing to verify the contents of the emails. These emails established that:
a.	The Sapia program generated a score and a recommendation that was shared with the complainant. It also generated a ‘Talent Insights Report’ which was not shared with the complainant as it is ‘confidential to the customer in this case Hudson,’ 
b.	Hudson terminated its contract with Sapia in 2024. The report and all the data behind it were deleted in 2024 as part of re-platforming sapia.ai. The data was not transferred to the new platform because Hudson was no longer a customer of Sapia, and
c.	‘If the report still existed today, [Sapia] would share it given the direction by the Department.’
30	The respondent argued that Hudson never had the report and does not currently have the report, and Sapia held the report but does not now. It argued that the amended points of claim suggested that the claim is ongoing and relates to the present time. Because the respondent presently does not have the document requested, it argued that the complaint should be dismissed. 
Resolution of preliminary question B
31	I note that SM Steele’s orders only related to whether the respondent ‘held’ the ‘employer report.’ But the submissions of both parties also correctly contemplated the question of whether the information was within the respondent’s ‘control.’ Additionally, while the term ‘employer report’ emerged during the email exchanges that the complainant had with Hudson and Sapia in 2021 and was the subject of the complaint, it appears the ‘Talent Insights Report’ referred to in the email exchanges is the equivalent of an ‘employer report.’ 
32	After hearing the evidence and submissions on this question, I raised with counsel for the respondent that I could not accept his submissions that the complaint relates to an ongoing or present refusal to provide the information because the substance of the complaint to be considered by VCAT, must be identical to that considered by the Commissioner up until the date of the referral, 29 July 2022. Therefore the appropriate question was whether the respondent had control over the information up until 29 July 2022. 
33	Counsel agreed that, on that basis, it was open to me to conclude from the evidence of Mr Boswell that the Talent Insights Report was under the control of the respondent up until the date of the referral based on (i) the contractual provisions that enabled the respondent to issue directions to Hudson, and (ii) that Hudson could have obtained the report from Sapia and handed it to the respondent. Counsel suggested that, if I so concluded, the appropriate course was to find the complaint of breach of IPP 6.1 proven but decline to take further action pursuant to section 77(1)(b) of the Act.
34	The complainant was not seeking financial compensation and agreed that the course suggested by the respondent was appropriate. 
35	Accordingly, I found the complaint of breach of IPP 6.1 proven but declined to take further action pursuant to section 77(1)(b) of the Act.

A. Smith
Senior Member