Privacy Case Note 05-2011 (Information Privacy Principle 11)

Case note number: 05/2011

Privacy principles: Information Privacy Principle 11 – disclosure of personal information to a person other than the individual it is about.

The complaint

The Complainant had previously been employed by the Respondent Agency and made a number of complaints about actions of officers within the Respondent Agency. Only one of these complaints related to privacy. A report about the Complainant was disclosed to a third party agency in relation to a claim made by another officer. The Complainant was advised of this by a colleague, who had received an unedited copy from the third party agency.

The complaint to the Respondent Agency acknowledged that some portions of the report were relevant to the other officer’s claim, but that significant parts contained the Complainant’s personal information and were of no relevance. The Complainant said that the report should have been edited to remove that personal information. The Complainant also alleged that the report had been deliberately given to the third party agency by a named officer as revenge against the Complainant.

The Respondent Agency advised the Complainant that it was standard practice to give reports of this kind to the third party agency, that it was justified in doing so, and that the named officer had had nothing to do with the disclosure. It indicated in its response to the Complainant that it would take no further action in relation to the matter.

The Complainant was not satisfied with this response and brought the complaint to the OIC.

Jurisdiction

The OIC made preliminary inquiries under section 167 to determine the date of disclosure to the third party agency; the Respondent Agency confirmed this occurred in February 2010. As the complaint satisfied all the criteria in section 166 and was about an action that took place after the right to complain had commenced, the Privacy Commissioner accepted the complaint. The Complainant and the Respondent Agency were advised on 13 September 2010 that the complaint would be mediated.

The alleged breach of the privacy principles

Inquiries with the Respondent Agency and the Complainant during the complaint mediation process revealed the following Information Privacy Principles (IPPs) may have been breached: IPP 2 – the Complainant was not advised that their personal information would be disclosed to a third party at the time of collection; IPP 9 – irrelevant personal information was included in the report prepared about the Complainant; and IPP 11 – the report given to the third party agency contained personal information which was not relevant to the reason the report was disclosed.

The complaint process

The Respondent Agency advised the OIC that it was satisfied it had not breached the privacy principles, and outlined how its actions were consistent with IPPs 2, 9 and 11. This was provided to the Complainant, who maintained the position that the entire report should not have been given to the third party agency. The Complainant indicated that an apology from the Director‐General would be acceptable, but that true accountability required disciplinary action to be initiated against the named officer accused of disclosing the report.

The Respondent Agency provided a draft letter to the OIC which contained a statement of regret for the negative impact on the Complainant, and a list of seven actions they intended to implement to ensure greater privacy compliance and education of staff on processes relevant to the complaint. The Complainant was not satisfied with the statement of regret and reiterated that an apology was required, but that such a letter might have been satisfactory if received at the beginning of the complaint process.

The Respondent Agency redrafted the letter to include a statement of apology for the distress caused, but the Complainant was not satisfied and, for the first time in the mediation process, raised the issue of liability for distress caused by the agency’s actions. Based on the Complainant’s response, the Privacy Commissioner determined under section 174(b) that the complaint was not able to be mediated and advised the Complainant that, under section 175, the complaint could be referred to the Queensland Civil and Administrative Tribunal for determination.