Disclaimer: The summaries below have been extracted from the 2000-2001 Annual Report of the Privacy Commissioner. They illustrate how the Privacy Commissioner has previously resolved privacy complaints and should not be relied on as legal advice.

• Disclosure of personal information and tax file number information under FOI - IPP 11, TFN
• Improper use of personal information in a referee's report - IPP 10
• Disclosure of personal information about an income support case - IPPs 4 and 11
• Disclosure of personal information to a partner - IPPs 10 and 11
• Disclosure amongst staff in a department - IPPs 10 and 11
• Disclosure to an ex-wife - IPP 11

• Unauthorised disclosure of personal information by a credit provider - s. 18N(1), 18N(9)

• Default notification lodged with a credit reporting agency - s. 18E(8)(c)

Disclosure of personal information and tax file number information under FOI - IPP 11, TFN

The complainant's personal information and tax file number (TFN) were disclosed by the Child Support Agency (CSA) when it released records to the complainant's former spouse under a Freedom of Information request, without deleting the complainant's address and TFN on the copies provided.

The complainant had complained directly to CSA before coming to this Office and CSA had acknowledged that it had breached IPP 11 in s. 14 of the Privacy Act and Guideline 2.4 of the Tax File Number Guidelines issued under s. 17 of the Act. IPP 11 provides that personal information must not be disclosed unless one or more of five exceptions apply. Guideline 2.4 provides that TFN information shall only be used or disclosed as authorised by taxation, assistance agency or superannuation law.

The complainant was dissatisfied with CSA's response and brought the matter to this Office. As a result of conciliation by this Office, CSA apologised to the complainant and paid compensation to the amount of $1156.

The investigation was closed under s. 41(2)(a) on the grounds that the respondent had adequately dealt with the matter.

Improper use of personal information in a referee's report - IPP 10

This matter concerned the improper use of personal information by the then Department of Employment, Education, Training and Youth Affairs (DEETYA) that employed the complainant. Responsibility for the complaint passed to the Department of Employment, Workplace Relations and Small Business due to a portfolio restructure. The complainant sought an interstate transfer to another position within the Department. The complainant nominated a supervisor as a referee in the process. The supervisor was contacted and provided information not only about the complainant's work performance but also about the complainant's medical condition and past absences of leave. The complainant was judged unsuitable for the transfer.

The complainant lodged a grievance with DEETYA, which partially upheld it. The complainant subsequently lodged a complaint with this Office as she was dissatisfied with the action taken to address her complaint.

This Office investigated the complaint and found that:

• the use of information about the complainant's work performance was used for a purpose directly related to that for which it was obtained and was in accordance with IPP 10.1(e);
• the use of the information about the complainant's medical condition and absences of leave was not authorised by IPP 10. However, the use of the information did not deprive the complainant of transfer or promotion opportunities.

The agency acknowledged that it had breached the complainant's privacy. However it took appropriate action to counsel the supervisor/referee and had already arranged an interstate transfer for the complainant as well as meeting relocation costs of $3500. In these circumstances, the Office took the view that the agency had adequately dealt with the complaint and discontinued the investigation under s. 41(2)(a).

Disclosure of personal information about an income support case - IPPs 4 and 11

The matter concerned the disclosure by Centrelink of information that identified a person who had provided a public denunciation to Centrelink. The complainant provided a handwritten denunciation to the agency about a member of the complainant's ethnic community allegedly committing welfare fraud. The investigating officer interviewed the client and took the written denunciation to the interview. The client recognised the complainant's handwriting during the interview. The complainant was subsequently ostracised from the complainant's close knit ethnic community, estranged from the complainant's family, vilified and abused in public. The complainant suffered stress, anxiety and other health problems as a result of the disclosure.

Centrelink offered an amount of compensation that was not accepted by the complainant who then obtained legal advice about compensation and instituted legal action. After some negotiations with Centrelink, the matter was eventually settled out of court in the complainant's favour.

The issues involved were the security and storage of personal information under IPP 4 and the disclosure of personal information under IPP 11. The amount of compensation reflected the extreme effects of the disclosure on the complainant's life.

Disclosure of personal information to a partner - IPPs 10 and 11

The issues in this complaint were the use of personal information under IPP 10 and the disclosure of that information to a partner under IPP 11.

The complainant migrated to Australia from China with her son. She later entered into a defacto relationship, which ended due to alleged violence. Following this, permanent residential status was granted. She subsequently made an application to the Department of Immigration and Multicultural Affairs (DIMA) to sponsor her husband from China. DIMA declined the application on the basis of her estrangement from her husband, the application for permanent residency showing no intention to return to China to reconcile with her husband, the fact of the defacto relationship, and other factors such as a lack of financial, social or parental involvement with her husband. These factors showed no ongoing, permanent commitment to the relationship with her husband and the decision to deny the sponsorship and the reasons for that decision were provided to her husband, including the information about the defacto relationship.

The complainant alleged the provision of the assessment of her situation to her husband was a disclosure that had considerable consequences on her life, her relationship with her husband and on her family relationships with relatives in China. DIMA admitted the breach of privacy and offered compensation of $5000.

However, there were strong grounds to show that the disclosure was allowable under IPP 11. The complainant would be reasonably likely to be aware under IPP 11.1(a) that her husband would be informed of the reasons for a decision to deny him a visa. The use of the information about the defacto relationship under IPP 10.1(e) was directly related to the purpose for which the information was obtained, which was to assess whether there was an ongoing, committed marital relationship.

Negotiations over the amount of damages included the complainant's claims about the effect of the disclosure on her life, the life of her son in Australia, the effect on her familial relationships in China and her inability to be reunited with her husband. The compensation offered by DIMA was considered appropriate in the circumstances and, when the complainant turned down the offer as being inadequate, the matter was closed with no compensation paid.

Disclosure amongst staff in a department - IPPs 10 and 11

The complainant was employed with Centrelink and alleged that other staff had been made aware of details about a grievance that the complainant had made against a former manager from when the complainant was employed with the then Department of Employment, Education, Training and Youth Affairs (DEETYA). The complainant alleged that Centrelink staff had accessed the grievance file and disclosed information internally. The complainant alleged that, due to staff transfers between DEETYA and Centrelink, information known to former DEETYA staff about the grievance had been disclosed to Centrelink staff. The complainant also alleged that personal information about an ongoing compensation claim had been disclosed to Centrelink staff in breach of IPP 11.

It was established that the complainant's personnel and compensation files had been transferred to Centrelink, however the grievance file had been retained as the grievance had been finalised prior to the transfer. There was no evidence of a disclosure of the grievance to Centrelink staff in breach of IPP 11 nor evidence that Centrelink had used the information in breach of IPP 10.

The Privacy Act protects against disclosure of personal information from a record and does not protect, and cannot protect against alleged disclosures through gossip, rumour and innuendo.

The transfer of the compensation file to Centrelink was appropriate as Centrelink Managers and case officers were required to manage and action any ongoing injuries and the resultant effect on the complainant's ability to perform the required functions. The use of the information about the compensation matter was permitted under IPP 10. Investigation of the complaint was discontinued under s. 41(1)(a) on the grounds that there had been no breach of the Privacy Act.

Disclosure to an ex-wife - IPP 11

On an assessment sheet sent to the complainant's ex-wife, the Child Support Agency (CSA) disclosed the name of the child by the complainant's subsequent defacto for which he was liable for maintenance. There were no exceptions to IPP 11, which would allow the disclosure to the ex-wife. The ex-wife then accused her former husband of being the father of his defacto's child while still married to her and CSA apologised to all parties. The complainant took legal advice and the matter was referred to the Office. No further legal charges were incurred from that point but the compensation claim of $850 for legal costs was declined by the CSA on the grounds that the problems encountered by the complainant because of the disclosure were not solely related to the actions of the CSA. Negotiations failed to resolve the issue and the CSA would only offer to pay $225 in compensation for legal fees. This offer was declined by the complainant's lawyer on his client's behalf.

The view of the Office is that an individual whose complaint against a government agency has been substantiated has a right to reimbursement for a reasonable measure of legal advice on how he or she may pursue the matter. There are many avenues for pursuing complaints about government agencies and many grounds on which this can be done, depending on the issue in question. It is unrealistic to think that a complainant will always be able to identify the appropriate avenue and grounds without legal assistance and unrealistic to expect an average citizen to understand the complexities of law with which they are unfamiliar.

CSA's position in this matter appears hard to justify as their complainant did not pursue a claim for compensation for humiliation or injury to his feelings although he had reasonably strong grounds on which to do so. The Office noted that the costs incurred both by the CSA and this Office in attempting to resolve this matter far outweigh the small and reasonable claim that the complainant was making. In light of this complaint the Privacy Commissioner believes that it would be appropriate for CSA to review its process for resolving similar matters.

Unauthorised disclosure of personal information by a credit provider - s. 18N(1), 18N(9)

The complainant alleged that a credit union breached s. 18N(1) of the Privacy Act when an employee disclosed to a car dealer that the application for finance by the complainant had been 'cancelled' by the complainant. Section 18N(1) provides that a credit provider that is, or has been, in possession or control of a 'report' (as defined) must not disclose 'personal information' (defined in s. 6(1)) derived from the report to another person for any purpose other than those listed in the section. Under s. 18N(9), a 'report' is defined in wide terms to include not only a credit report but also any information which has a bearing on an individual's credit worthiness information generally including a person's credit standing, credit history or credit capacity.

In the Office's view, the fact that the loan application had been cancelled had a bearing on the complainant's credit history and so fell within the definition of a 'report' in s. 18N(1). On the facts of the complaint, none of the exceptions applied to permit the disclosure of this information.

As a result of conciliation with this Office, the credit union agreed to apologise to the complainant for the breach, paid compensation for legal fees incurred of $500 and agreed to conduct privacy training for its staff.

Default notification lodged with a credit reporting agency - s. 18E(8)(c)

The complainant received a default notification where she alleged she was not responsible for the debt and the default had subsequently affected her ability to obtain credit. Investigations revealed that the complainant agreed to be a guarantor for her son's purchase of a mobile telephone and the son did not pay the account, leading to the requirement that she pay her son's debt. The son was provided with notification of the outstanding debt and did not advise the guarantor of his failure to pay. The complainant's address was also not updated and he failed to forward correspondence to her showing her requirement to pay the account.

As the complainant was the guarantor she was liable for the debt her son incurred. The credit provider had met its obligations under section 18E(8)(c) of the Privacy Act to advise at or before the time of the application that information might be provided to a credit reporting agency and a letter had been sent to the last known address under paragraph 2.7 of the Credit Reporting Code of Conduct advising of the overdue payment and requesting payment. As the son had defaulted on the debt, had failed to advise the complainant of that and failed to forward the correspondence from the credit provider, the default listing was correct; there was no breach of the complainant's privacy and the matter closed.