Privacy Case Note 06-2011 (Information Privacy Principle 1, 3 & 11)

Case note number: 06/2011

Privacy principles: Information Privacy Principle 1 – collection of personal information must be for a lawful function of the agency, personal information must not be collected by unlawful or unfair means; Information Privacy Principle 3 – personal information collected must me relevant to the purpose for which it was collected, complete and up to date; Information Privacy Principle 11 – disclosure of personal information to a person other than the individual it is about.

The complaint

Officers of the Respondent Agency were investigating the renting out of a non‐habitable dwelling by the Complainant in breach of local laws. As part of the investigation, the officers asked the tenants of the non-habitable dwelling about their Tenancy Agreement with the Complainant to establish that there was a rental arrangement in place. Shortly thereafter the Respondent Agency issued the Complainant with a Show Cause notice under the relevant legislation.

The Complainant made a privacy complaint to the Respondent Agency, stating that the officers’ questioning of the tenants was a breach of the Complainant’s privacy. The Respondent Agency wrote to the Complainant advising that it was dismissing the complaint on the grounds that the Tenancy Agreement contained the personal information of the tenants and not the Complainant.

The Complainant was not satisfied and brought the complaint to the OIC.

Jurisdiction

Section 166(3)(a) of the IP Act requires privacy complaints to be made to the agency through the agency’s complaint management system. A privacy complaint may only be accepted by the OIC if 45 business days have passed and the Complainant has not received a satisfactory response from the agency. Preliminary inquiries made under section 167 revealed that only seven days had elapsed since the Complainant made the complaint to the Respondent Agency. As such, the Privacy Commissioner advised the Complainant that there was no jurisdiction to accept the complaint.

The alleged breach of the privacy principles

The Complainant indicated that the complaint was based on the officers’ discussions with the tenants about the Tenancy Agreement being unfair and unreasonable and that as part of those discussions, the Complainant’s personal information was disclosed to the tenants. The relevant Information Privacy Principles (IPPs) are IPP 1 and IPP 3, which govern the collection of personal information about an individual from a third party and IPP 11 which safeguards against unauthorised disclosure of personal information. As part of the OIC’s preliminary inquiries under section 167, the Respondent Agency provided information that indicated that its action were compliant with the privacy principles. The officers’ viewing of the Tenancy Agreement was necessary for their investigation, and the conduct of investigations of that kind is a lawful function of the Respondent Agency. As such, there was nothing in the material supplied by the Respondent Agency to indicate a breach of the privacy principles.

The complaint process

As the complaint was brought to the OIC before 45 business days had elapsed from date the Complainant made the complaint to the Respondent Agency, the OIC advised the Complainant that the complaint could not be accepted.

Further actions

The OIC advised the Respondent Agency that a Tenancy Agreement contains personal information of both the tenant and the landlord, where the landlord is an individual, and so the grounds on which the complaint was dismissed were not correct.