Disclaimer: The summaries below have been extracted from the 1992-1993 Annual Report of the Privacy Commissioner. They illustrate how the Privacy Commissioner has previously resolved privacy complaints and should not be relied on as legal advice.

• Embarrassing collection of information - IPPs 1, 2 & 3
• Bulk disclosure of personal information to staff - IPP 10
• Exchange of information practices - IPPs 2, 3 & 4
• Disclosure of superannuation details to former spouse - IPP 11
• Disclosure of staff details to external business - IPPs 4 & 11
• Distribution of ex-staff personal appraisal program information - IPP 10
• Disclosure of student records to another tertiary institution - IPPs 4 & 11
• Circulation of family details - IPPs 10 & 11
• Disclosure of information to former spouse - IPP 11
• Practices involved in collection of information - IPPs 1 & 3
• Adequacy of personnel management manual guidelines - IPPs 4 & 9
• Exercise of powers under a benefit program against an employee - IPPs 3, 10 & 11
• Access to credit report
• Disclosure of personal credit information to a related corporation
• Disputed entry relating to an overdue account on a credit report
• Mistaken identity by credit provider
• Unauthorised access to a credit report
• Debt recovery enquiries - credit reporting
• Group certificate mailing error - TFN
• Non-provision of Tax File Number
• Collection of Tax File Number by State agency

Embarrassing collection of information - IPPs 1, 2 & 3

The complainant was about to be discharged from hospital.  He telephoned the respondent and requested an ambulance to transport him to his home.  The complainant was upset by the intrusive and apparently irrelevant nature of the personal questions asked by the ambulance communications officer.  He was asked questions such as whether his wife or a relative could drive him home and why he could not travel on public transport.

The respondent admitted that the questions asked of the complainant were such that they may well have caused him embarrassment.  The respondent explained that it had a responsibility to provide an appropriate level of service to serve the community and needed to assess the needs of each person to see whether, for example, they needed to be transported in a fully equipped ambulance or some other form of transport.

The respondent has now produced a Standard Operating Procedures Manual for the use of the communications officers.  This Manual lays down guidelines for the appropriate allocation of transport and also provides guidelines as to those persons who are authorised to request an ambulance.  In future, a patient being discharged from a hospital will politely be advised to put the request through their treating doctor or the hospital staff.

The respondent apologised to the complainant for the embarrassment and offered to meet with him to explain the new procedures.  The new procedures should ensure that the Respondent complies with IPPs 1, 2 and 3 when it collects personal information for the assessment of ambulance transportation.

Bulk disclosure of personal information to staff - IPP 10

Personal legal and medical information regarding the complainant, an employee of the Respondent agency, was kept on various personnel files.  A significant amount of the information was disclosed to third parties in a systematic access exercise.

The third parties were given access to any folios contained in the files in which they were mentioned.  Although not clear prior to investigation, it was accepted that the purpose of the disclosure was preparation for an AAT hearing.  This was held to be a lawful purpose consistent with the agency's obligations to the AAT, and was therefore not in breach of the IPPs.  However the Commissioner expressed concerns to the agency about the manner in which the exercise was conducted, particularly the ''bulk' character of the disclosures.

Exchange of information practices - IPPs 2, 3 & 4

Personal information about the complainant, relating to the complainant's children, was passed to another agency because of an administrative link between the two agencies in relation to the children.  The link results from the dual exercise of a particular function by both a Minister and a delegated senior officer of another agency.

Resolution of the complaint required complex negotiations, initiated by this office, between the two agencies, in order to draw up procedures for the necessary exchange (and to preclude unnecessary exchanges) of information.  In addition, the source agency undertook to revise information collection procedures, and consider providing notices to clients under IPP 2 advising them that disclosure to the second agency is normal practice.

As the ongoing procedural issues could not be finalised in the short-term, the undertakings to develop new procedures were accepted as an adequate response to the complaint, and the complaint file was closed.  The procedural issue was referred to the Policy Section for monitoring.

Disclosure of superannuation details to former spouse - IPP 11

Information regarding the complainant's superannuation entitlements was disclosed by the respondent to the former spouse.  This disclosure resulted in a breakdown in negotiations between the complainant and the former spouse regarding the divorce settlement.  As a result, the complainant had to travel interstate to attend court in person.

The complaint was withdrawn after a settlement was reached between the complainant and the respondent, following investigation of the complaint.  Part of the settlement included a reimbursement of the complainant's leave entitlements which were expended when the complainant attended court

Disclosure of staff details to external business - IPPs 4 & 11

The respondent disclosed the name and address of several complainants who were employees of the respondent, to a private company contracted by the respondent to provide uniforms to its staff.  The contract did not give the company the status of a person in the service of the respondent in terms of the Privacy Act.  Correspondence from the clothing company to the employees of the respondent was sent in bulk to the respondent, where it was distributed without regard to the security of the personal information contained in the letters.

The respondent amended its procedures for ordering the clothing to dispense with providing personal information about staff to the company.  The respondent also advised the company of the need to correspond with staff of the respondent by mailing the letters to staff in individually addressed envelopes.  The respondent also provided further training to its staff on their responsibilities under the Privacy Act.

Distribution of ex-staff personal appraisal program information - IPP 10

The complainant, while an employee of the agency, participated in a compulsory personal development and appraisal program.  When the employment ceased the resulting reports should have been returned to the complainant.  They were not, and were instead circulated to a number of other staff in relation to an outstanding internal promotion review. 

The agency gave an undertaking not to use forms from its internal performance appraisal and development programs in an appeal context without the consent of the officer.

Disclosure of student records to another tertiary institution - IPPs 4 & 11

The complainant alleged that the respondent (a tertiary institution) disclosed his student records to another tertiary institution against his express instructions and an undertaking given by the respondent.  The complainant's records also disappeared from the respondent's storage facility.  The complainant claimed substantial damages for the alleged breaches.

The Commissioner did not continue investigation of the complaint on the basis that the respondent had adequately dealt with it.  The Commissioner was of the view that a student would reasonably be aware that the student records would be passed to another tertiary institution where the student had applied to continue his/her studies.  The respondent apologised for the loss of the records and undertook to amend its procedures to restrict student access to the institute's records area.  The claim for monetary compensation was not considered sustainable by the Commissioner.

Circulation of family details - IPPs 10 & 11

The respondent compiled a list containing personal information about all of the employees and their families in a particular section, and forwarded a copy of the list to the home addresses of each of the employees.  The list was compiled and circulated without the knowledge or consent of the employees.

The respondent had compiled the list in good faith as a means of enabling the partners of its employees to quickly build a social and support network.  The respondent formally apologised to the complainant and took steps to reissue the list containing only information about employees who had consented to the disclosure

Disclosure of information to former spouse - IPP 11

The respondent disclosed the name and date of birth of the complainant's daughter from his present marriage, to his former spouse.

The respondent was required by its enabling legislation to make the disclosure in the course of carrying out its functions under that legislation.  Consequently, the disclosure was not in contravention of the Privacy Act.  However, the Commissioner had in an earlier complaint on the same issue, expressed his concern over this requirement and the respondent undertook to consider the matter with a view towards recommending amendment of the legislation to remove the requirement.

Practices involved in collection of information - IPPs 1 & 3

The complainant objected to the overly intrusive nature of forms used by an agency in processing an application for payment.

Three forms were sent to the complainant.  The Commissioner found one form to be authorised by the relevant legislation.  The other two forms should not have been sent and the personal information should not have been collected.

The agency formally apologised to the complainant and returned the two unauthorised forms.  As a result of the complaint the agency also reviewed its procedures in regard to the use of these forms.

Adequacy of personnel management manual guidelines - IPPs 4 & 9

The complainant, an employee of the agency, appeared before a Disciplinary Appeal Committee, where the charges were upheld.  The resulting Official Conduct Record (OCR) was alleged to have been repeatedly disclosed to selection committees for any position for which the complainant applied, and at least one copy appeared to be held by line management.  This action, on its face, appeared to be consistent with the relevant, but very brief, Personnel Management Manual (PMM) provisions.  It did not however appear to be consistent with the IPPs.

By agreement with the agency, the OCR will be kept on the Personnel file only, and no other copies will be maintained.  In any future selections for which the complainant makes application, the OCR will be given to the Delegate only, and not to the Committee.  The agency will also prepare national guidelines for departmental staff on the use of OCRs, in consultation with the Public Service Commission.

The PMM guidelines on the handling of OCRs will themselves need to be revised to reflect the impact of the Privacy Act.  This case highlights the need to consider privacy implications when referring to the PMMs, since most of the instructions predate the Privacy Act.

Exercise of powers under a benefit program against an employee - IPPs 3, 10 & 11

The complainant was both a client and an employee of an agency, which placed on the complainant's personnel file documents relating to one of its program payments.  It then also disclosed this information to another agency.  The respondent agency also collected information from the complainant's part-time employer using its collection powers under the program legislation.

The agency apologised to the complainant for both actions.  The papers were removed from the personnel file and recalled from the other agency.  The respondent also acknowledged that the use of its legislative collection powers with respect to a benefit program was not appropriate when used to collect information for employment purposes.

Access to credit report

The complainant believed that an employee of the first respondent released credit information to the complainant's landlord (the second respondent).

The first respondent was not the source of the disclosure.  The landlord had accessed the complainant's credit report using the first respondent's computer terminal, though he did not know that such an access was a breach of the Privacy Act.  The second respondent apologised and has undertaken never to repeat this conduct.

Disclosure of personal credit information to a related corporation

The complainant alleged that the respondent had disclosed personal credit information about her account which was overdue to a second corporation.  The complainant also had a credit relationship with the second corporation.

The respondent and the second corporation are related corporations within the meaning of the Privacy Act.  Consequently the disclosure was in accordance with s.18N of the Privacy Act.  The Commissioner was of the view that this was not an ideal outcome, however, the complaint has raised questions about practices of disclosure between related companies.

Disputed entry relating to an overdue account on a credit report

The complainant believed that an entry on a credit report showing that she was overdue in making a payment was incorrect.  She stated that her former spouse had agreed (in a statutory declaration) to make the payments, and as a consequence, she was indemnified from making those payments.  The former spouse failed to make the payments and pay out the loan.

The ''statutory declaration' turned out to be a ''Guarantee and Indemnity' document in which the former spouse was only required to make the payments when the complainant defaulted on her obligations.  The Commissioner concluded that the complainant was not relieved of her requirements to make payments on the loan and consequently the default listing on the credit report was accurate.

Mistaken identity by credit provider

A respondent disclosed credit information relating to the complainant and his wife to his daughter-in-law.  The daughter-in-law had the same surname as the complainant's wife.  The credit provider telephoned the respondent's wife, but the telephone call was answered by the daughter-in-law who confirmed her surname and proceeded to discuss details of the loan.

The respondent has tightened telephone procedures and staff have been instructed to carefully check the identity of the other party.  A minimum check would include the verification of both the given names and surname.  The Commissioner was of the view that the disclosure was neither knowing or reckless.

Unauthorised access to a credit report

The complainant's credit report was accessed without his knowledge or consent.  The respondent was clearly told by complainant's wife (when applying for a loan) that the complainant was not to act as co-guarantor for a loan, however he was treated as such and his credit report was accessed.

The respondent has taken steps to ensure all staff are trained in their obligations to the Privacy Act to ensure compliance in the future.

Debt recovery enquiries - credit reporting

The respondent telephoned the complainant's wife at work in relation to the complainant's overdue loan payment contrary to s.18N of the Privacy Act.  The complainant and his wife were both embarrassed by the disclosure.  The lengthy telephone call had serious and financial repercussions for both the complainant and his wife. 

Complainant was paid $2500 in compensation and received an apology.  No compensation could be paid to the complainant's wife as the losses suffered by her did not fall within the jurisdiction of the Act.  The respondent has initiated significant procedural changes to staff training.

Group certificate mailing error - TFN

The complainant's group certificate containing her Tax file Number was sent to another person as a result of a collation error in the mailing of a batch of group certificates, covering letters and statements.

The respondent formally apologised to the complainant and established a procedure where at least two Accounts officers handle and check the collation of the documents before mailing.  Also, the staff of the respondent were reminded of the obligations imposed by the Tax File Number Guidelines.

Non-provision of Tax File Number

The complainant received a request for a Tax File Number (TFN) from the respondent after a data-matching exercise revealed that the complainant had not supplied a TFN in relation to the payments from the respondent.  The complainant refused to supply a TFN as she was in receipt of payments which were not means-tested nor income tested.  The respondent terminated payments.

The respondent restored the payments and amended its procedures by creating a temporary exemption category for this particular type of payment to ensure that similar requests for TFNs were not repeated.

Collection of Tax File Number by State agency

The complainant was requested to supply his Tax File Number (TFN) by a state government instrumentality which was authorised to collect TFNs by taxation law.  The complainant was not informed of the purpose of the collection of his TFN or that the Respondent was authorised by taxation law to make the request.  Contrary to TFN Guideline number 1, the TFN was requested, along with other information, on a form headed ''Declaration of Identity'.

The respondent apologised to the complainant, explained its lawful authority for collection of TFNs and adopted the standard Australian Taxation Office form for the purpose of collecting TFNs in future.  Staff of the respondent have been given instruction on ascertaining which clients should be requested to provide their TFNs and those clients will be advised, at the time of request, of the reason for collection.