Case Citation:

J v Home Shopping Retailer [2008] PrivCmrA 10

Subject Heading:

Improper disclosure of personal information

Law:

National Privacy Principle 2.1 in Schedule 3 of the Privacy Act 1988 (Cth)

Facts:

The complainant had purchased items from a home shopping retailer via its televised shopping network. One of the items purchased was intended to be an unexpected gift for the complainant''s spouse.

When the complainant''s spouse later telephoned the retailer to purchase items of their own, an employee disclosed to them that the complainant had already purchased a number of items. The information disclosed by the employee also revealed the nature of the forthcoming gift.

Both the complainant and their spouse approached the retailer concerned about the disclosure of the information in relation to the complainant''s purchases, a disclosure that they claimed had spoiled an otherwise well planned surprise. The complainant suggested a number of things that the retailer might do in order to remedy the matter. Dissatisfied with the response from the retailer, the complainant lodged a complaint with this Office.

Issues:

National Privacy Principle 2.1 provides that personal information collected for a primary purpose may only be used or disclosed for a secondary purpose if one of a number of exceptions in National Privacy Principle 2.1(a)-(h) applies.

National Privacy Principle 4.1 states that an organisation must take reasonable steps to protect the personal information it holds from misuse and loss and from unauthorised access, modification or disclosure.

Outcome:

The Privacy Commissioner commenced preliminary enquiries under section 42 of the Privacy Act in order to establish whether to investigate the matter. The Commissioner also gave consideration to whether the matter had been adequately dealt with by the respondent.

The retailer believed the disclosure of the complainant''s personal information to their spouse to be an unintentional and isolated incident. With this in mind, the retailer indicated that it was willing to resolve the matter without the need for an investigation by the Commissioner.

Although the complainant stated that they had not suffered any direct financial loss as a result of the disclosure of their personal information, they did claim that they suffered a considerable amount of stress and anxiety. For this, the complainant sought financial compensation, and an undertaking that the retailer would not discuss the matter with other employees, nor disclose their personal information to another party.

The retailer considered the suggestions made by the complainant and took a number of steps to remedy the complainant''s concerns.

The retailer confirmed that it had taken steps to remind its call centre staff of the importance of handling its customers'' personal information in accordance with the Privacy Act. It also undertook to monitor the calls made and received in order to ensure quality, and promptly address any privacy matters that might arise.

Further, the retailer confirmed for the complainant that it held no record of the disclosure made, nor of the complaint subsequently made by the complainant. The retailer considered that this would prevent any future discussion of, or reference to, the complaint made by the complainant. Finally, the retailer also offered the complainant a written apology and a substantial discount on the item that was to be a gift for the complainant''s spouse.

Section 41(2)(a) of the Privacy Act gives the Commissioner a discretion not to investigate, or not to investigate further, an act or practice about which a complaint has been made if the Commissioner is satisfied that the respondent has dealt adequately with the matters that gave rise to the complaint.

In this case, the complainant accepted the retailer''s offer and the Commissioner closed the complaint under section 41(2)(a) of the Privacy Act on the basis that the retailer had adequately dealt with the complaint.

OFFICE OF THE PRIVACY COMMISSIONER

June 2008