Case Citation: N v Australian Government Agency [2005] PrivCmrA 12

Subject Heading: Disclosure of complainant's personal information by an agency to a third party leading to defamation proceedings against the complainant.

Law: Section 6 and Information Privacy Principle 11 in section 14 of the Privacy Act 1988 (Cth)

Facts: The complainant sent two emails to an Australian Government Agency (the agency) containing allegations of a misuse of funds by a third party. The complainant did this as the agency provided funding to an affiliate of the third party. An officer of the agency forwarded the two emails onto that third party. The complainant had also sent one of these emails to other entities.

The agency forwarded both email messages onto the third party, despite its published policy that email messages provided to it would not be used for any other purpose and would not be disclosed without the sender's consent. The third party who had received forwarded copies of these emails from the agency then instituted defamation proceedings against the complainant on the basis of the content of those emails.

Issues: Pursuant to Information Privacy Principle 11.1 in section 14 of the Privacy Act:

A record-keeper who has possession or control of a record that contains personal information shall not disclose the information to a person, body or agency (other than the individual concerned) unless:

1. the individual concerned is reasonably likely to have been aware, or made aware under Principle 2, that information of that kind is usually passed to that person, body or agency;
2. the individual concerned has consented to the disclosure;

Consent is defined in section 6 of the Act as meaning express consent or implied consent.

The agency admitted that there was a breach of its own privacy policy, but argued that there was no breach of Information Privacy Principle 11 on two grounds, namely:

• the complainant was reasonably likely to have been aware that the emails would have been passed onto the third party; and/or
• the complainant impliedly consented to the disclosure by the agency to the third party.

The Commissioner found that the complainant could not have been reasonably likely to have been aware that the emails would have been passed onto the third party. The Commissioner was of this view because the agency's privacy policy required it to seek the complainant's consent before passing the emails onto a third party. The fact that the complainant had sent one of the emails to other entities in addition to the agency did not negate the agency's responsibility not to disclose personal information without the complainant's consent. Therefore the Commissioner took the view that exception (a) to Information Privacy Principle 11.1 did not apply.

The Commissioner also found that the complainant could also not have impliedly consented to the disclosure to the third party as the complainant was not aware of what action, if any, the agency was taking in order to address the allegation contained in the emails. Additionally, the agency's privacy policy lent strong support for this finding, since it stated that information would not be passed on without consent (whether implied or express). Therefore the Commissioner took the view that exception (b) to Information Privacy Principle 11.1 did not apply.

Outcome: As a result of the third party receiving copies of the complainant's emails, the third party took action against the complainant for defamation. The majority of the allegations made by the complainant against the third party were contained in the email of which the agency was the sole recipient. The action for defamation was eventually settled out of court between the complainant and the third party. After the defamation action ceased, the Commissioner conciliated the complaint and the parties reached a confidential settlement to remedy the breach of the Privacy Act. Accordingly, the Commissioner closed the matter under section 41(2)(a) of the Privacy Act on the grounds that the agency had adequately dealt with the matter.

OFFICE OF THE PRIVACY COMMISSIONER June 2005