Privacy Case Note 03-2011 (Information Privacy Principle 8)
Case note number: 03/2011
Privacy principles: Information Privacy Principle 8 – reasonable steps must be taken to ensure personal information is accurate, complete and up to date.
The complaint arose when a third party received mail intended for the Complainant; the envelope bore the Complainant’s name but had the incorrect address. The recipient of the incorrectly addressed envelope was a business client of the Complainant, who opened the envelope and discovered personal information of a negative nature about the Complainant. The Complainant became aware of these facts when the client contacted the Complainant, displeased that the Complainant was deliberately using their address.
The Complainant made inquiries with the agency that sent the letter and it advised that the address to which the letter had been taken off a Master Document provided by the Respondent Agency.
Based on these inquiries, the Complainant made a privacy complaint to the Respondent Agency on 5 February 2010, requesting that the Respondent Agency ensure it had the correct address, rectify any errors in its data management system which might have led to the wrong address being provided, and raised the issue of possible compensation for lost business. No response was received and a follow up letter was sent on 8 April 2010.
On 15 April, the Complainant received a letter advising that the matter was being referred to the legal unit of the Respondent Agency. On 28 April the Complainant received a single page response to his complaint which stated that the Respondent Agency records held the correct address, that there were no data management errors in any program it used, and that matters of compensation would have to be raised with another part of the agency. The letter contained no acknowledgement that the Complainant had been negatively affected by the actions of the Respondent Agency.
The Complainant was not satisfied with this response and, as 45 business days had elapsed since initially making the complaint, brought it to the OIC.
The complaint satisfied all the criteria in section 166 and was about an action that took place after the right to complain had commenced. The Privacy Commissioner accepted the complaint and advised the Complainant and the Respondent Agency on 27 May 2010 that the complaint would be mediated.
The alleged breach of the privacy principles
The complaint alleged a breach of Information Privacy Principle 8 (IPP 8), which is the obligation to take reasonable steps to ensure personal information is accurate, complete and up to date. Information acquired throughout the mediation process revealed that the Respondent Agency had at all time been in possession of identity documents which bore the Complainant’s correct address and had the correct address recorded in its database. Despite this, the Master Document, a document created by the Respondent Agency and provided to other agencies, had the wrong address listed as the Complainant’s residential address. The Respondent Agency offered no information to refute that there had been a breach of IPP 8.
The complaint process
A significant problem throughout the mediation process was the intransigence of the Respondent Agency. Upon receipt of the acceptance letter, the Respondent Agency contacted the OIC and requested a copy of all correspondence between the Complainant and the Respondent Agency. At this time, the OIC requested a copy of the Master Document which contained the Complainant’s wrong address. On 3 June, the Respondent Agency advised it had located the Complainant’s file, and the complaint was being referred to the legal unit.
Despite numerous phone calls, it was not until 30 June that the OIC was able to speak to a legal officer with responsibility for the privacy complaint. When the OIC spoke to her she advised she had to seek instructions in the matter.
Inquiries with the Complainant revealed that the only link between the Complainant and the wrong address was in connection with an entirely separate matter dealt with by the Respondent Agency several years earlier; the Complainant had never lived at that address but a former referee had. The Respondent Agency refused to provide an explanation as to how this address was put on the Master Document, as it contended it already provided the Complainant with an explanation (no such explanation had been provided), and stated that it was not responsible for the breach or any loss arising from it.
As the Respondent Agency did not comply with OIC’s request for a copy of the Master Document, the Complainant decided to acquire it and asked his solicitor to do so; the solicitor was able to get one from another agency. The process took some time, and a copy was obtained at the end of August 2010. This was provided to the OIC and to the Respondent Agency by the Complainant.
The OIC contacted the Complainant and Respondent Agency in early September 2010 to follow up receipt of the Master Document and determine the parties’ position. The Complainant advised that the clients who had received the negative personal information had altered their business relationship with the Complainant, and had spoken to other clients, with a resulting significant downturn in the Complainant’s business. The Respondent Agency advised that an offer of settlement had been sent to the Complainant.
The OIC followed up with the Complainant regarding the offer of settlement and was advised that they had not received an offer of settlement. What had been received was instead a demand that the Complainant swear an affidavit setting out a detailed course of events relating to the complaint, beginning with the Complainant’s initial contact with the Respondent Agency and ending with the Complainant’s first letter of complaint to the Respondent Agency in February 2010, and include relevant documents in support of the Complainant’s claim.
Discussions with the Respondent Agency produced little of value towards the resolution of the complaint. It asserted that the wrong address was the Complainant’s fault because at some point the Complainant had provided it to the Respondent Agency, despite the Respondent Agency having the Complainant’s correct address in its records and on other documents.
After discussions with the Complainant, the OIC determined that the only chance of resolving the complaint was to convene a meeting between the Complainant and the Respondent Agency. Delays by the Respondent Agency meant this meeting did not happen until 30 November 2010. Agreement was not able to be reached, and the Privacy Commissioner determined that, under section 175 of the IP Act, the complaint was not able to be mediated and that, under section 176, the Complainant could request the OIC refer the complaint to QCAT.