Case Citation: O v Australian Government Agency B [2005] PrivCmrA 14

Subject Heading: Improper disclosure of contact details by an Australian Government Agency

Law:Information Privacy Principle 11 in section 14, and section 41(2)(a) of the Privacy Act 1988 (Cth)

Facts: The complainant was in dispute with Australian Government Agency A and sought a review of its decision by Australian Government Agency B. The complainant provided personal information including contact details to Agency B on the basis that some of the contact details would be kept confidential. However, in the course of the review Agency B provided information to Agency A that included the complainant's confidential contact details.

On becoming aware of the disclosure the complainant raised the issue with Agency B. Agency B acknowledged the disclosure had occurred in error. It responded immediately by:

• asking Agency A to delete the particular personal information;
• seeking and receiving confirmation that Agency A had cancelled the record; and
• requiring the employee responsible to apologise directly to the complainant for the mistake and for failing to take note of the complainant's request.

Agency A also apologised to the complainant.

However, these actions did not satisfy the complainant and they complained to the Privacy Commissioner.

Issues: Information Privacy Principle11 prohibits agencies from disclosing personal information to third parties unless certain circumstances exist, such as that the individual has consented to the disclosure or the disclosure is required or authorised by or under law.

In this case Agency B admitted that the disclosure in question occurred in error and as such did not meet any of the exceptions to Information Privacy Principle 11.

Outcome: The Privacy Commissioner considered the circumstances of the complaint and the subsequent attempts by the agencies to deal with the matters that gave rise to the complaint, as outlined in the documents lodged by the complainant. The Commissioner formed the view that, given the circumstances of the incident and the subsequent action taken, Agency B had responded adequately to the issues raised.

Section 41(2)(a) of the Privacy Act, gives the Commissioner a discretion not to investigate, or not to investigate further, an act or practice about which a complaint has been made if he or she is satisfied that the respondent has dealt adequately with the matters that gave rise to the complaint.

In this case the complainant was advised that the Commissioner declined to investigate the complaint under section 41(2)(a) of the Privacy Act on the basis that Agency B had adequately dealt with the complaint.

OFFICE OF THE PRIVACY COMMISSIONER June 2005