Case Citation: M v Australian Government Agency [2005] PrivCmrA 10

Subject Heading: Disclosure of personal information to a new employer about an incomplete internal investigation.

Law: Information Privacy Principle 11 in section 14, and section 41(2)(a) of the Privacy Act 1988 (Cth)

Facts: The complainant was employed by an Australian Government agency (the agency) and was being investigated by that agency in relation to an allegation of misconduct. The complainant resigned before the investigation was finalised and took up a position with a new employer.

The complainant alleged that the agency disclosed to the new employer that it had been investigating the complainant. The agency investigated the complainant''s allegation and found that one of its employees had contacts with the complainant''s new employer and had disclosed information concerning the investigation to the new employer.

The complainant raised the complaint with the Privacy Commissioner after they and the agency concluded that they could go no further with attempts to resolve the matter.

Issues: Information Privacy Principle 11 in the Privacy Act provides that a record-keeper who has possession or control of a record that contains personal information shall not disclose the information to a person, body or agency (other than the individual concerned) unless:

1. the individual concerned is reasonably likely to have been aware, or made aware under Information Privacy Principle 2, that information of that kind is usually passed to that person, body or agency;
2. the individual concerned has consented to the disclosure;
3. the record-keeper believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or of another person;
4. the disclosure is required or authorised by or under law; or
5. the disclosure is reasonably necessary for the enforcement of the criminal law or of a law imposing a pecuniary penalty, or for the protection of the public revenue.

The issue in this investigation was whether the agency disclosed personal information about the complainant to the new employer and if so, whether any of the exceptions in Information Privacy Principle 11 applied to allow it to do so.

The Privacy Commissioner formed the view that the agency had breached the Privacy Act, on the basis that the agency acknowledged that the disclosure took place in a manner which was not permitted by the Privacy Act.

Outcome: Following discussions between the parties, the matter was resolved on the basis that the agency would provide the complainant with a formal written apology, and an explanation of the findings of the investigation by the agency regarding the improper disclosure. The Commissioner accepted the agency''s view that providing a full copy of the investigation report to the complainant would have an unreasonable impact upon the privacy of other individuals named in the report. The Commissioner then closed the complaint, under section 41(2)(a) of the Privacy Act on the grounds that the agency had dealt adequately with the complaint.

OFFICE OF THE PRIVACY COMMISSIONER June 2005