Case Citation:M v Commonwealth Agency [2003] PrivCmrA 11

Subject Heading: Improper use and disclosure of personal information, accuracy of personal information and security of personal information

Law:Information Privacy Principles4, 8, 9, 10 and 11.

Facts

The complainant worked for Agency A and, following an accident was pursuing a claim with a second agency, Agency B, responsible for providing assistance.

Disclosure of personal information to Agency B

In making the claim the complainant provided Agency B with a medical certificate and information to the effect that the condition was exacerbated by the employment with Agency A. Agency A also provided information from the complainant's doctor to Agency B and following a request from Agency B provided further information. The complainant alleged that Agency A was not authorised to disclose the medical or further information.

Security, use and accuracy of personal information in relation to employment matters Agency A consists of several divisions and, in the course of implementing changes following a reallocation of budgets and resources, the personnel section sent the complainant's curriculum vitae (CV) to another division for that area to assess the complainant's eligibility for a vacancy within the area. The CV was five years old and the complainant alleged that it was not accurate, up to date or correct prior to use.

The complainant also alleged that the reference to the CV to assess suitability for the new position was a use of personal information for a purpose other than that for which it was collected and for which it was not relevant.

The personnel section transmitted the CV to the new division by facsimile and the complainant alleged that the CV was left unattended on the floor of an open area for four days.

Issues

Information Privacy Principle 11

Information Privacy Principle 11 requires that agencies only disclose personal information, other than to the individual concerned, if one or more of certain exceptions apply, including where the individual had consented to the disclosure of the information.

In this complaint the disclosures to Agency B were permitted by several exceptions. These were:

• 11.1(a) which permits disclosures where the individual would be reasonably likely to be aware that the information would be disclosed - the Commissioner considered that as the claim specifically included an element of damage caused by the employment situation the individual would be reasonably likely to be aware that information relevant to the claim would be disclosed to Agency B;
• 11.1(b) which permits disclosures with the consent of the individual concerned - the Commissioner considered consent was implied when the complainant signed a declaration authorising disclosures of information to other parties involved in the management of the injury and specifically mentioned that the injury was exacerbated by her employment; and
• 11.1(d) which permits disclosures which are authorised by law - Agency B's governing legislation provided an authorisation that meant that Agency A was "authorised by law" to provide the information Agency B requested.

Information Privacy Principle 8

Information Privacy Principle 8 requires agencies to take reasonable steps, before using personal information, to ensure that, for the purpose for which the information is to be used, it is accurate, up to date and complete.

While the CV was five years old, it was accurate at the time it was collected. Agency A also had information about the complainant's work over the period of employment and, in an interview prior to making a decision to move the complainant, provided an opportunity for the complainant to update the information the agency had about qualifications and experience and to provide any additional relevant information about her suitability for employment.

Information Privacy Principle 10 requires agencies to use personal information only for the purpose for which it was collected unless one or more of certain exceptions apply. Information Privacy Principle 9 requires agencies to use personal information only where it is relevant to the purpose for which it is being used. The Commissioner took the view that the use of the personal information in the CV to assess qualifications and experience relevant to the position was a use for which the information was originally collected. It was also a use of the personal information for a relevant purpose.

IPP4 requires that an agency takes steps that are reasonable in the circumstances to ensure the personal information in a record is protected against loss, unauthorised access, use, modification, disclosure or other misuse.

While the personnel section sent the CV to a common facsimile in the new area, there was no evidence to show that it was left lying on the floor of an open area for four days. The agency has taken steps to ensure that, when personal information is provided to another area, the area is advised the information is being sent and that a person from the area will collect the information. It also apologised for any distress that may have been caused by any unwarranted delay when the requesting area failed to collect the CV immediately.

Outcome

The Office found no breach of Information Privacy Principles 8, 9, 10 and 11 and found that Agency A had dealt adequately with the security issue under Information Privacy Principles. The investigation was closed under section 41(1)(a) where there was no interference with privacy and under section 41(2)(a) where the respondent had dealt adequately with the allegation that the CV had been left unattended in a common area.

OFFICE OF THE PRIVACY COMMISSIONER SEPTEMBER 2003