Privacy Case Note 09-2011 (Information Privacy Principle 11)
Case note number: 09/2011
Privacy principles: Information Privacy Principle 11 - disclosure of personal information to a person other than the individual it is about
The Complainant had made complaints to the Agency about a number of issues concerning the Complainant’s child and estranged partner (an employee of the Agency). The Complainant alleged the complaints were between the Agency and them but that nonetheless, the Agency disclosed information concerning the complaints to the Complainant’s estranged partner.
Dissatisfied with the Agency’s handling of their concerns, the Complainant brought the matter to the OIC.
The OIC conducted preliminary inquiries under section 167 to determine if the privacy complaint could be accepted.
The alleged breach of the privacy principles
Information Privacy Principle 11 (IPP 11) states that an agency having control of a document containing an individual’s personal information must not disclose the personal information to a third party unless one (at least) of six exemptions applies.
The complaint process
Initial inquiries with the Respondent Agency and the Complainant during the complaint mediation process focussed on establishing whether the information had in fact passed between the Agency and the estranged partner.
In the course of these inquiries, the Complainant indicated a strongly-held view that the Agency’s guidance material on its communication with estranged parents did not sufficiently consider the perspective of both parents but rather favoured the parent who had day-to-day custody of the child.
The Privacy Commissioner made inquiries with the Agency as to its resources on this issue. The Agency advised that it did have a policy on point and that the policy was currently under review.
OIC inquired of the Agency whether, as a way of resolving the Complainant’s grievance, it would be amenable to the Complainant providing a submission on the policy putting their viewpoint. The Respondent Agency agreed to provide the Complainant with a copy of the policy (under review) and an opportunity to make comment on it within a reasonable timeframe.
The terms for the submission were that the Agency would consider the Complainant’s submission but it would not guarantee that their view would necessarily be incorporated into the revised policy. The Complainant accepted this term and on the basis that they were to be given an opportunity to provide feedback on the policy being reviewed, the Complainant agreed to no longer pursue their privacy complaint.
The agreement reached between the Agency and the Complainant did not directly address the subject matter of the privacy complaint. However, it was the Agency’s willingness to engage with the Complainant on their core grievance that satisfactorily resolved the complaint.