Employer takes employee's work laptop, personal cellphone, USB drive without his knowledge
Stonewood Group Ltd has been ordered by the Human Rights Tribunal to pay a former employee $60,000 in damages after it unlawfully collected and mishandled his personal data.
The case stems from an incident in March 2019, when BMN, a former employee of Stonewood, was invited to a coffee meeting where he received a letter with concerns about his performance.
While BMN was away, his work laptop, personal cellphone, and USB drive were removed from his desk by Stonewood's executive director, Vicki Chow, without his knowledge.
BMN was terminated a week later, with the incident over his personal devices sparking a series of attempts to retrieve his private data.
BMN's personal information, which included sensitive files such as tax records and medical information, was stored on the devices. Despite his repeated requests, Stonewood failed to return the data promptly, citing ongoing investigations into the content of the laptop.
This failure led BMN to lodge a formal complaint, claiming a breach of the Privacy Act 1993, alleging that Stonewood had unlawfully collected and withheld his personal information.
The Tribunal found that Stonewood violated various Information Privacy Principles (IPP) that govern the collection, use, and protection of personal information under the Privacy Act.
It concluded that Stonewood had collected BMN's personal information when it removed his devices from his desk without his knowledge.
"The collection of BMN's personal information was a deliberate act, which could be described as subterfuge," the Tribunal said in its decision. "BMN was taken out of the office, while his information was collected in front of his colleagues."
While Stonewood argued that it had merely received unsolicited information, the Tribunal ruled that the company had actively taken the devices and, by extension, the personal data contained on them.
"Stonewood did collect BMN's personal information when it took the active step of, without any warning or permission, uplifting his work laptop, his personal cellphone, and personal USB."
Stonewood also failed to justify why it did not collect the data directly from BMN. According to the Tribunal, there was no valid reason for bypassing BMN in the process, especially given that the devices were taken from his desk while he was away from the office.
Further violations were found under IPP 4, which prohibits the unfair or unreasonable intrusion upon an individual's personal affairs.
The Tribunal emphasised that the removal of BMN's personal devices was carried out without his consent and in a manner that could not be considered reasonable.
"There were alternative ways that Stonewood could have taken BMN's work laptop whilst ensuring his personal information was not being collected in a manner that was unfair or unreasonably intrusive on his personal affairs," the Tribunal said.
The Tribunal determined that the breach of privacy had caused BMN significant emotional harm, including anxiety and depression.
Evidence presented during the case showed that BMN had been diagnosed with acute anxiety and depression three weeks after the incident, a direct result of his inability to access personal information such as medical records and tax documents.
In light of the ruling, the Tribunal has ordered Stonewood to provide BMN with a full and complete copy of all his personal information held by the company. This includes his work laptop and personal USB drive.
Stonewood is also required to return these items to BMN within 20 working days, or if the USB drive cannot be located, to make reasonable efforts to find it.
In addition to the return of his personal data, the Tribunal awarded BMN damages for pecuniary loss amounting to $394.87, covering expenses incurred in his attempts to retrieve the data.
The Tribunal also awarded him $60,000 in damages for the emotional distress caused by the breach, marking a significant compensation for the emotional and reputational harm suffered.
