Case note number: 02/2012
Privacy principles: National Privacy Principle 2 – must not disclose personal information for a secondary purpose. Section 196 of the IP Act – power of person acting for another person.
The Complainants alleged that an officer of the Agency had disclosed their deceased parent’s records to another entity. The alleged disclosure of records occurred after the parent had died. The Complainants were executors of their parent’s will and considered their standing as executors, along with the provisions of the Succession Act 1981, allowed them to make a privacy complaint on their parent’s behalf.
Section 166(3)(a) of the IP Act requires privacy complaints to be made to the agency through the agency’s complaint management system before a complaint can be made to OIC. A privacy complaint may only be accepted by the OIC if 45 business days have passed since the complaint was lodged with the agency and the Complainant has not received a satisfactory response from the agency.
Although the Complainants contended that they had made a privacy complaint to the Agency, the Complainants had provided no information that a complaint had been made.
The alleged breach of the privacy principles
The Complainants’ contended that the Agency’s disclosure to the other entity of their late parent’s records was a breach of the parent’s privacy. Because of the specific wording of the definition of personal information in section 12 of the IP Act, the privacy protections in the IP Act do not apply to deceased persons. As the alleged disclosure did not occur until after the death of the parent, there is no capacity in the IP Act for a privacy complaint to be made concerning it.
The complaint process
The Complainants contended that by virtue of the fact that they were the executors of their late parent’s will, they had the authority to make a privacy complaint on their parent’s behalf. The Privacy Commissioner examined both the terms of the will and the provisions of the Succession Act 1981 but considered that, in the absence of a specific authority from their late parent, the Complainants did not have the authority to make a privacy complaint on behalf of their late parent. The Privacy Commissioner did not consider that the status of executor was sufficient in itself to be an authority to bring a privacy complaint on behalf of the testator.
As the Complainants did not provide information that they had first made the complaint on their late father’s behalf to the Agency, the Privacy Commissioner considered that section 166(3) of the IP Act was not satisfied.
Accordingly, the Privacy Commissioner declined to accept the complaint.