Complaint Determinations 1

View printable version of this page

Case Citation: Determination No. 1 of 1993

Between, "A", Complainant and the Secretary, Department of Defence, Respondent

Made under: Privacy Act 1988, section 52

History

This determination relates to a complaint lodged by, "A", in July 1991 under section 36 of the Privacy Act 1988 against the Secretary, Department of Defence, regarding an alleged unauthorised disclosure of personal information about him.

1. Evidence

While the Respondent has not formally accepted the facts of the complaint, I note that he has not made any representations to me in relation to the facts following the notice issued by me under section 43(5) of the Privacy Act. However, the Respondent has requested me to deal with the issues and law and any remedies by way of determination.

In December 1990 A applied for a job as a sales representative with a finance company in Newcastle. He was interviewed on a Friday afternoon and immediately offered the position to start the following Monday. In the course of the interview he advised that he had previously been enlisted in the Army. As he had not provided a discharge certificate the employer contacted the Townsville Army Base after the interview. The employer has confirmed that the Townsville Army Base advised that A had been discharged the previous January because he had been Absent Without Leave for greater than six months. On arrival at work the following Monday morning the employer dismissed him and angrily asked him to leave immediately. A subsequently ascertained that his Army record had been disclosed to the employer.

The usual practice of the Army on discharge is to provide the member with a certificate setting out the soldier's rank and period of service but no reason for discharge is given. In this case, as the member was Absent Without Leave at the time of discharge, I accept that this procedure could not be followed.

The rules which apply to disclosures to third parties about a former member's service are contained in the Army Manual of Personnel Administration (MPA) Volume 1 Chapter 2. These rules were not observed in this case, at this base on this occasion; in particular in that details of the basis of discharge were given.

2. Law

The disclosure was unauthorised and is affected by two Information Privacy Principles (IPPs), 4 and 11. IPP 4, so far as is material, states:

"A record-keeper who has possession or control of a record that contains personal information shall ensure:"

(a) that the record is protected, by such security safeguards as it is reasonable in the circumstances to take, ... against unauthorised ... disclosure,"

IPP 11.1 contains two basic propositions: one, a record keeper [the Army] has a duty not to disclose any information to any third party; and two, that duty is subject to certain exceptions, being those contained in (a) to (e) of IPP 11.

In this case the exceptions have no relevance as the disclosure was not in accordance with established policy setting out what is permitted to be disclosed and in what circumstances. It appears clear, in light of the employer's information that an employee of the Department of Defence disclosed the information. The employer said that the information was obtained from the Townsville Army Base by telephone.

Section 8 of the Act states that "an act done ... by ... a person employed by ... an agency in the performance of the duties of a person's employment shall be treated as having been done ... by ... the agency ...".

I consider that in dealing with complaints of unauthorised disclosure I should treat an agency as bound by an employee's act, within the meaning of section 8, unless there is persuasive evidence that an employee had intentionally sought to act outside the scope of employment by, for example, flagrantly breaching accepted agency standards or defying specific directions. No such evidence was placed before me in this case.

3. Findings

I find that the respondent agency did not in the circumstances ensure that the record was protected by such security safeguards as it was reasonable to take against unauthorised access, or disclosure or other misuse as required by Information Privacy Principle 4; and that the disclosure was not authorised by IPP 11. Accordingly, I find A’s complaint substantiated in that, in my view, there has been a breach of Information Privacy Principle 4 and, as a consequence, also of IPP 11.

A. Economic Loss

A had, at the time the disclosure took place, been offered a position with a finance company. Probably, as a result of that disclosure he lost the opportunity to establish a career in which he was interested and which he expected to find fulfilling. A was dismissed before he had the opportunity to commence work and it is my view that his dismissal was a probable result of the unauthorised disclosure.

The position which A had gained carried an annual salary of $28,000, a car (including a private use component) and the opportunity for travel. I consider that A is entitled to a sum of money in compensation for lost wages. I appreciate that there is no guarantee that A would have continued in the job. However, a probationary period of at least one month would be the normal expectation of a person who had gained such a position. I therefore consider that A is entitled to be compensated for the loss of 30 days' salary. He is also entitled to be compensated for the loss of the use of a vehicle for that time. The total amount of economic loss is $2,500.

B. Non-economic Loss

A also suffered considerable humiliation and embarrassment. A states that on the day he reported to commence work the manager refused to shake his hand, told him to leave the office and that this caused him considerable embarrassment and distress. His representations to my office include a number of references to the humiliation he felt when he was dismissed from his employment. I consider that the events of that day and the humiliation and embarrassment suffered by A were a direct consequence of the disclosure by the Army. While the ramifications of the disclosure were serious for A, they do refer to an isolated incident and the damage is, in my view, restricted to that event. I am of the view that having regard to all the circumstances of the case, compensation in the amount of $2,500 for non-economic loss would be appropriate.

4. Determination

I declare, in accordance with section 52(1)(b)(iii) of the Privacy Act 1988, that A is entitled to $5,000 as compensation for the embarrassment caused by the disclosure, and for the wages lost as a result of the disclosure. I also declare, in accordance with section 52(1)(b)(ii) of the Privacy Act that the Department of Defence should pay A the amount of $5,000 as compensation for the interference with his privacy.

Dated 22 December 1993

KEVIN O'CONNOR
Privacy Commissioner