Published on Office of the Information Commissioner Queensland (https://www.oic.qld.gov.au)

Home Information for  >  Information privacy officers  >  Case notes  >  Privacy Case Note 01-2011 (National Privacy Principle 1,2 & 3)

Privacy Case Note 01-2011 (National Privacy Principle 1,2 & 3)

Case note number: 01/2011

Privacy principles:

National Privacy Principle 1 – collection of more personal information than was necessary for the activity; National Privacy Principle 2 – disclosure of personal information to persons other than the individual concerned; National Privacy Principle 3 – failure to ensure the accuracy of personal information before using or disclosing it.

The complaint

The Respondent Agency operates a program which allows people to nominate individuals for inclusion in a public display commemorating them and certain events in their life. The Complainant was nominated by a third party for inclusion in the display, but the Agency at no point asked the Complainant if they agreed to have their personal information placed on public display.

The Complainant made a complaint to OIC about the Respondent Agency’s actions. The complaint was that:

  • The Complainant’s personal information had been made public by way of inclusion in the display without consent.
  • There were inaccuracies in the personal information which had been included in the display.
  • This was personal information which they explicitly wished to be kept private.
  • Having raised the issue informally with the Respondent Agency, requesting that the personal information be removed, the agency advised that it would take eight weeks for this to be done.
  • When the display was inspected eight months later, the personal information was still included in the public display.

OIC conducted preliminary inquiries under section 167 of the IP Act and found that, in addition to the above points, the nomination form collected more personal information that was necessary for the program.

Jurisdiction

The right to make a privacy complaint arose on 1 December 2010. Section 166(3)(a) of the IP Act requires privacy complaints to be made to the agency through the agency’s complaint management system. A privacy complaint may only be accepted by the OIC if 45 business days have passed and the Complainant has not received a satisfactory response from the agency.

While the Complainant discussed the issue with the Respondent Agency some months prior to bringing the complaint to the OIC, this occurred before the commencement of the IP Act and the right to make a privacy complaint. OIC subsequently declined to accept the complaint in accordance with section 166(1)(b) of the IP Act. OIC advised the Complainant that, because of the requirements in section 166(3)(a), the complaint could not be accepted. The Complainant was advised to make a complaint to the Respondent Agency through its complaint system; if 45 business days passed without a satisfactory response, the OIC would have jurisdiction to accept it.

Further actions

The complaint revealed that there was an ongoing practice which was non‐compliant with the privacy principles, and which affected more individuals than just the Complainant. As such, despite not being able to accept the complaint, the Privacy Commissioner contacted the Respondent Agency to discuss the program.

Following discussions between the Privacy Commissioner and the Respondent Agency, it agreed to amend the program. The amended practices included contacting nominated individuals to seek their agreement to being included in the public display and to check the accuracy of the nomination information. The nomination form was amended to collect only necessary and relevant personal information. The Respondent Agency also agreed to remove the Complainant’s personal information from the public display.