Privacy Case Note 02-2011 (Information Privacy Principle 10 & 11)

Case note number: 02/2011

Privacy principles: Information Privacy Principle 10 – using personal information for the purpose for which it was collected; Information Privacy Principle 11 – disclosure of personal information.

Other sections: Section 202.

The complaint

The Respondent Agency was conducting an investigation which related to the Complainant. It outsourced some of its functions to a third party and provided it with information about the Complainant. The Complainant made a complaint to the Respondent Agency, not about the Complainant’s personal information, but about personal information of the Complainant’s relatives being included in the information given to the third party.

The complaint was first made to the respondent agency, which advised the Complainant that its actions had been standard practice. Dissatisfied with the Respondent Agency’s response, the Complainant brought the matter to the OIC.

Jurisdiction

The Respondent Agency was a local government. Section 202 provides that the privacy principles did not apply to local government until 1 July 2010. As the date on which the Respondent Agency gave the information to the third party was before 1 July 2010, the Complainant could not make a privacy complaint to the OIC. The OIC advised the Complainant of this fact.

Additionally, under section 164, a complaint may only be made about an interference with the privacy of the individual making the complaint. As such, even if the obligation to comply with the privacy principles had applied to the Respondent Agency in this circumstance, the OIC would have been unable to accept the complaint.