Claimants commonly include aggravated damages as part of their privacy claim; however, until recently, they had never been awarded. As a result, there has been little practical guidance on what circumstances would justify their award.

That changed in the case of HW and Freelancer International Limited, which marked the first award of aggravated damages by the Federal Privacy Commissioner in a determination.

Background

Freelancer is a large online freelancing marketplace where employers post work they need to be done and freelancers offer quotes to complete the project.

HW registered with Freelancer and provided personal information as part of the user registration process.

Over the next few years, a series of disputes arose between HW and Freelancer, with HW undertaking work and having his account (and funds in those accounts) frozen for various reasons.

The relationship between the parties degenerated further when HW posted an article about Freelancer on his personal blog (under a pseudonym), which was then published on a business blog site. In response, Freelancer emailed HW stating it was aware of the blogs and alleged that HW had vandalised Freelancer's Wikipedia page. It requested that the blog posts be removed or action would be taken.

What followed was a series of further blog posts by HW and Freelancer disclosing HW's name and pseudonyms on various webpages.

After a methodical exploration of each of the claims, the Privacy Commissioner found that Freelancer had breached its obligations under the Privacy Act 1988 (Cth) (Privacy Act).

General damages

In coming to his award of general damages for non-economic loss, the Privacy Commissioner considered:

  • the impact of the privacy breaches on HW
  • the numerous instances of the breaches
  • the fact that the breaches were made to the general public over a protracted period, and
  • that information of a sensitive nature, in at least one instance, was also disclosed.

Aggravated damages

Following his award of general damages, the Privacy Commissioner examined whether he should make an award for aggravated and punitive damages.

Examining punitive damage first, the Privacy Commissioner held that he didn't have the power to award punitive damages under the Privacy Act because it doesn't fall within the "by way of compensation" requirement of s 52(1)(iii).

However, the Privacy Commissioner followed authority, holding that aggravated damages does fall within the scope of s 52(1)(iii). He then restated the guiding principles set down in 'BO' v AeroCare Pty Ltd [2014] AlCmr 32 to determine whether or not an award for aggravated damages is warranted:

  • Did the defendant behave "high-handedly, maliciously, insultingly or oppressively"?
  • Did the manner in which a defendant conducted their case exacerbate the hurt and injury suffered by the plaintiff?

In considering these principles, it was noted that the Macquarie Dictionary defines:

  • "high-handed" as "overbearing", with dictatorial; haughtily or rudely arrogant"
  • "maliciously" as "showing malice" and suffering on another"
  • "insultingly" as "treat[ing] insolently or with contemptuous rudeness; affront", and
  • "oppressive" as "burdensome, unjustly harsh or tyrannical".

Unlike previous cases, after considering these principles the Privacy Commissioner found that an award of aggravated damages was just justified. Importantly, in coming to this conclusion, the Privacy Commissioner noted it was the manner in which Freelancer carried out its improper conduct, not the conduct itself, that was the basis for the award.

The Privacy Commissioner stated that aggravated damages in this case was appropriate, despite the compensation being for injury to feelings which was compensated for in HW's claim for general damages. This was because:

  • Freelancer's conduct in improperly disclosing HW's personal information was aggravated by its apparent disregard for his privacy and its own privacy obligations, as it continued to publish HW's information online despite being made aware it breached privacy legislation and was contrary to its own privacy policy
  • the manner in which Freelancer conducted itself highlighted Freelancer's apparent contempt of, or at best, indifference to HW's complaints about its interference with his privacy. This conduct could be described as malicious, oppressive and/or high-handed, falling within the scope of the Macquarie Dictionary definition of those terms, and
  • the way in which Freelancer disclosed HW's personal information exacerbated his frustration, anger, humiliation and emotional distress.

The Commissioner also noted aggravated damages were justified even though Freelancer had not ignored the complaint made to the Office of the Australian Information Commissioner nor refused to conciliate and negotiate with HW. This was due to Freelancer's high-handedness during the period of its improper conduct and its apparent indifference to the effect of its conduct toward HW. In other words, aggravated damages can be awarded as a result of the conduct itself, not only due to the conduct in subsequent proceedings.

To come to a decision on quantum, the Privacy Commissioner looked at compensation awards in discrimination cases, noting that awards were in the range of $500-$7,500, with a majority of awards toward the higher figure of $7,500

The Privacy Commissioner ultimately awarded HW $5,000 for aggravated damages.

What this means for agencies

This decision demonstrates that going forward the Privacy Commissioner will award aggravated damages where it is appropriate to do so. It highlights that liability for improper conduct (that would justify aggravated damages) cannot be overcome simply by taking a reasonable and conciliatory approach in subsequent proceedings, and establishes a precedent range for the quantum of aggravated damages awards of $500-$7,500, with a tendency toward the $7,500 end.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.