Privacy Case Note 01/2015 Information Privacy Principle 11 - Disclosure of personal information

Case note number: 01/2015

Privacy principles: Information Privacy Principle 11 –Disclosure of personal information

The complaint

The Complainant had requested and received access to documents about him from a government agency (the Agency) through a formal application under the Information Privacy Act 2009. Through an administrative oversight, the Agency posted the Complainant’s documents on its Disclosure Log.

When the Complainant brought this to the attention of the Agency it communicated to the Complainant that the document had been removed from the Agency’s Disclosure Log. However, this was not wholly correct. While the agency removed the links to the documents from its Disclosure Log, the documents themselves remained on the Disclosure Log for a number of days and could still be found through an internet search.

Additionally, the Complainant did not consider the Agency process for dealing with a privacy complaint to be satisfactory.

Disclosure of personal information

This was a matter where the Agency did not contest that it had breached the Complainant’s privacy. The Agency acknowledged that it had mistakenly posted the Complainant’s personal information on its Disclosure Log. The Agency also acknowledged that it had provided the Complainant with incorrect information when it informed the Complainant that the documents had been removed from its Disclosure Log.

The Agency had apologised twice for its errors – firstly for the initial posting and then subsequently for providing the Complainant with incorrect information but the Complainant did not consider these apologies to be sincere.

Complaint about process

While the Complainant was aggrieved about the initial posting and what they considered to be a slow remediation, a significant issue for the Complainant was the way that the Agency dealt with their complaint and particularly what the Complainant saw was inadequate privacy complaint procedures. The Agency had provided the Complainant with undertakings that it would review its processes but the Complainant felt that these were empty promises because the Agency had not updated them on the progress of the review.

Agency response

The Agency maintained a conciliatory approach to the complaint throughout. The Agency’s position was that it had made a mistake for which it took responsibility and the mistake had shown up shortfalls on procedures which needed to be remedied.

The Agency had conducted a review about its system for posting to its Disclosure Log and had instituted a new mechanism for the postings. The Agency had also reviewed its Complaints Policy and re-written it to provide a specific more fulsome process for dealing with privacy complaints.

The Agency communicated the information about its new process for its Disclosure Log to the Complainant and provided the Complainant with a copy of its new Complaints Policy. The Agency also issued another apology which encompassed both the posting and the provision of incorrect information.

Outcome

The Complainant indicated the changes made by the Agency to its procedures and its re-issued apology resolved the complaint for them.