Jurecek v Director of Transport Safety Victoria [2016] VSC 285

In October 2016, the Supreme Court of Victoria decided a case which was the first of its kind, dealing with the intersection of privacy law, social media and disciplinary investigations. We acted for Transport Safety Victoria (TSV). Although this case deals with the Information Privacy Principles applicable to Victorian public sector employers, similar obligations relating to collection of personal information apply to other public sector organisations throughout Australia.

TSV, as the employer, was made aware of an incident involving abusive Facebook posts and messages sent by TSV employee Lara Jurecek to a colleague. TSV commenced a preliminary investigation. Given the abusive posts, this involved reviewing Ms Jurecek’s Facebook page (which she operated under a pseudonym).

During the preliminary ‘information gathering’ phase of the investigation, Ms Jurecek was not notified of the searches being conducted or the accessing of her Facebook page. However, in accordance with the principles of procedural fairness, once allegations were formulated they were put to Ms Jurecek and she was provided with an opportunity to respond.

Following an investigation which determined that Ms Jurecek had engaged in misconduct, Ms Jurecek lodged a complaint with the Privacy Commissioner, which was subsequently referred to VCAT. Ms Jurecek alleged that TSV had breached the Information Privacy Principles (IPPs) (of the then Information Privacy Act 2010 (Vic), now the Privacy and Data Protection Act 2014)) which applied in relation to the collection, notification and use of personal information.

Of greatest concern for public sector employers was the argument that TSV had breached IPP 1.3 and IPP 1.5 (regarding notification of collection) by failing to immediately alert Ms Jurecek of the collection of her personal information. TSV submitted that, if accepted, this argument would create an unwieldy and ongoing administrative burden for public sector employers and fundamentally undermine an employer’s prerogative to investigate potential employee misconduct.

The VCAT determined that IPP 1.3 (and 1.5) did not impose an obligation of immediate notification, as such an interpretation could jeopardise the integrity of disciplinary investigations. Justice Bell of the Supreme Court agreed with the Tribunal’s findings and dismissed all grounds of Ms Jurecek’s appeal. Importantly, Justice Bell noted that the concept of when notification is practicable must balance the protection of privacy with the purposes of collection.

The fundamental takeaway for public sector employers is that employers subject to privacy legislation should be actively aware of their obligations under the relevant privacy principles. In this case the IPPs were complied with, largely by virtue of TSV’s adherence to its disciplinary procedures and the requirements of procedural fairness. However, Justice Bell warned that this ‘default’ compliance will not always be sufficient.