Privacy Case Note 01-2012 (Information Privacy Principle 11)
Case note number: 01/2012
Privacy principles: Information Privacy Principle 11 - disclosure of personal information to a person other than the individual it is about
The complaint
The Complainant made a complaint to the Agency about business operators in their area. The Complainant took a number of steps to ensure that their complaint would remain confidential. The fact that the Complainant had made a complaint about business operators was subsequently published in an local industry newsletter. Although the Complainant was not named personally, they contended that the disclosure of an associated business name enabled the identification of them as the source of the complaint.
The Complainant contended the publication was a breach of the Agency’s privacy obligations.
In response to the Complainant’s formal complaint to it, the Agency stated a view that the Complainant’s confidentiality had not been breached. Dissatisfied with the Agency’s response, the Complainant brought the matter to the OIC.
Jurisdiction
The complaint satisfied all the criteria in section 166 of the IP Act.
Under section 168(1)(f) of the IP Act, the Information Commissioner may decline to deal with a complaint where more than 12 months have elapsed since a complainant first becomes aware of the act or practice the subject of their complaint. As the Complainant did not lodge their complaint with OIC until more than 13 months after they became aware of the alleged breach, the Privacy Commissioner considered whether to accept the complaint. The Agency was invited to provide a submission on whether OIC should not accept the complaint.
On the basis that:
- the alleged breach was well documented and didn’t require the personal recollection of the parties involved; and
- the Agency had not provided any information showing that it would suffer prejudice from OIC’s acceptance of the complaint
the Privacy Commissioner decided to accept the complaint.
The alleged breach of the privacy principles
Information Privacy Principle 11 (IPP 11) states that an agency having control of a document containing an individual’s personal information must not disclose the personal information to a third party unless one (at least) of six exemptions applies.
The Privacy Commissioner reached a view that the naming of the business in the newsletter meant that the Complainant’s identity was reasonably ascertainable because:
- the fact that the Complainant owned and operated the business was well known in their locale; and
- the Complainant’s business had a web-site which identified them as the owner and operator.
The complaint process
The Complainant had sought that the apology come from the officer of the Agency alleged to have disclosed the Complainant’s personal information. After protracted communication lasting several months, the Agency provided a letter of apology which the Complainant considered to be unsatisfactory because of a perceived lack of sincerity and the fact that it did not come from the relevant officer. Communication then took place concerning a new apology.
The Complainant sought that there be a public apology from the officer involved. The Respondent Agency did not agree to the apology being made public, but did provide a second letter of apology written by the involved officer. The Complainant indicated that they would accept this apology and the complaint was resolved on this basis.
