Privacy Case Note 03/2014 (Section 23(3))

Case note number: 03/2014

Privacy principles: Section 23(3) – Disclosure of personal information

The complaint

A private sector contractor wished to enter a private property in the course of carrying out contracted work for a local council (the Agency). The owner of the property (the Complainant) does not live on the property and does not have a listing in the White Pages.

The contractor requested the name and contact telephone number of the Complainant so they could contact them to obtain their permission to enter the land. The Agency provided these details to the contractor who duly contacted the Complainant.

The Complainant’s privacy complaint was the Agency’s provision of their name and telephone number to the contractor was a breach of Information Privacy Principle 11 (IPP 11).

Disclosure of personal information

IPP 11 states that a government agency – which includes a local council – must not disclose an individual’s personal information to a third party unless one of the six exemptions in IPP 11 apply.1

The Complainant’s name and contact telephone number would constitute their personal information.2

‘Disclosure’ is defined in section 23(2) of the IP Act as:

An entity (the first entity) discloses personal information to another entity (the second entity) if—

(a) the second entity does not know the personal information, and is not in a position to be able to find it out; and
(b) the first entity gives the second entity the personal information, or places it in a position to be able to find it out; and
(c) the first entity ceases to have control over the second entity in relation to who will know the personal information in the future.

Application of section 23(2) to the complaint

All local councils are required under law to keep a Land Record register.3  A Land Record contains the name and postal address of the owner of each parcel of rateable land and is publicly available. The contractor would have been able to find out the name of the Complainant from the Agency’s Land Record register.

The Land Record did not have the contact telephone number of the Complainant. However, the Complainant had a distinctive name and lived in a relatively small place in Australia. The Complainant operated a professional business from their home and had a strong online presence including advertising their services online. The ‘business’ contact details listed online included the same telephone contact number that had been provided by the Agency. A simple online search of the Complainant’s name would have brought up the Complainant’s telephone contact number through the first listed search result.

Outcome

OIC declined to accept the complaint pursuant to section 168(1)(c) of the IP Act on the basis that the Agency had not ‘disclosed’ the Complainant’s personal information to the contractor.

OIC considered that because the contractor was in a position to be able to find out both the Complainant’s name and telephone contact details that had been provided by the Agency from publicly accessible sources – the local council’s Land Record register and an online search respectively – there had been no disclosure as defined in section 23(2) of the IP Act. While it could be considered unusual that a person may need to go to more than one public source of information to obtain the information they are seeking concerning an individual, section 23(2) of the IP Act does not require that information be obtained from a single source. Also section 23(2) does not necessarily require that the information was actually sourced elsewhere; it is sufficient that there is a capacity for the information to be able to be found elsewhere.

[1] These include, with the agreement of the individual concerned, required or authorised under a law, for law enforcement purposes and public health and safety.
[2] Section 12 of the IP Act.
[3] Section 154(2)(a) of the Local Government Regulation 2012.