Privacy Case Note 08-2011 (Chapter 2, Part 4 & Information Privacy Principle 11)

Case note number: 08/2011

Privacy principles: Chapter 2, Part 4 – the obligation to take reasonable steps to bind service providers to the privacy principles; Information Privacy Principle 11 – disclosure of personal information to a person other than the individual it is about.

The complaint

The Complainant and another person, Person A, were employed by the same Queensland agency. Person A made a complaint to the agency, stating that the Complainant had sent agency documents to someone in breach of the agency’s policies. Person A advised that an employee of the transport company which delivered the parcel of documents had confirmed the date the parcel was sent, the person to whom it was sent, and had viewed the CCTV footage to confirm the parcel had been delivered.

The Complainant made a complaint to the transport company about the disclosure of personal information claiming that it had breached Information Privacy Principle 11. The transport company repeatedly denied that any of its employees had provided Person A with information about the Complainant’s parcel. Dissatisfied with this response, the Complainant brought their complaint to the OIC.

Jurisdiction

Generally, private companies are not subject to the Information Privacy Act but the company in question had a contract with a Queensland agency. In some circumstances, Chapter 2, Part 4 of the IP Act may require a Queensland agency to take reasonable steps to bind the private company to the privacy principles in the IP Act.

The OIC made preliminary inquires under section 167 of the IP Act. The agency advised that the contract was signed in 2006, well before the commencement of the IP Act. As such, the obligations under Chapter 2, Part 4 was not applicable to the contract, and there could be no breach of the privacy principles. The Privacy Commissioner decided there was no jurisdiction to accept the Complaint and advised the Complainant.