Privacy Case Note 01/2014 (Section 33)
Case note number: 01/2014
Privacy principles: Section 33 – Transfer of personal information outside of Australia
The complaint
The Complainant lodged a complaint about a community consultation process carried out by a local council (the Agency). The Agency had engaged a private sector provider to conduct an online survey about local issues.
The surveys were conducted using ‘Survey Monkey’ – an online survey tool based in the USA. If a survey participant’s personal information is collected in the course of responding to a Survey Monkey survey,1 that personal information is ‘transferred’ to the USA.
The Complainant claimed that survey participants were not informed that their personal information would be sent outside of Australia and neither was their consent to this transfer obtained. The Complainant alleged that this constituted a breach of section 33 of the IP Act.
The Complainant requested that OIC order the Agency to cease conducting the survey.
The alleged breach of the privacy principles
Section 33 of the IP Act sets out the conditions under which personal information can be transferred outside of Australia. The purpose of section 33 is to ensure that when an individual’s personal information leaves Australia, it retains privacy protections similar to those enjoyed in Queensland.
One of the conditions under which an individual’s personal information can be transferred is if the individual agrees to the transfer.
Jurisdiction
The Complainant had not themselves completed the online survey but rather was complaining about the survey in principle and the potential transfer of their personal information outside of Australia.
A privacy complaint is defined in section 164 of the IP Act as an act or practice that has happened and which constitutes a breach of an individual’s privacy. The definition does not encompass hypothetical or potential privacy breaches.
As there had been no act or practice by the Agency in relation to the Complainant’s personal information, the complaint did not satisfy the meaning of a privacy complaint under section 164 of the IP Act.
OIC informed the Complainant that accordingly, it did not have the jurisdictional authority to deal with the complaint.
Follow up
While the complaint was not within OIC’s jurisdiction, OIC informally contacted the Agency and provided it with information on how section 33 operates in relation to online surveys using overseas-based tools.2 The Agency was receptive to the information and advised of its plans to ensure future surveys complied with section 33 of the IP Act.
The Agency undertook to amend the information accompanying the survey so that potential participants were informed that participation in the survey was voluntary and if they chose to participate, they would be agreeing that any personal information they provided would be transferred overseas.
[1] It is up to the designer of the survey whether or not a survey collects the personal information of participants. An anonymous survey would not involve privacy issues.
[2] See OIC’s guideline on Surveys and the Privacy Principles.