Case Citation: P v Telecommunications Service Provider [2005] PrivCmrA 15

Subject Heading: Publication of 'silent' telephone number by Telecommunications Service Provider.

Law:National Privacy Principle 2 in Schedule 3 of the Privacy Act 1988 (Cth)

Facts: The complainant received mobile telecommunications services from a telecommunications service provider. At the complainant's request, the telecommunications service provider deemed the complainant's mobile telephone number to be 'silent;' with no corresponding listing of the mobile telephone number, or residential address, in any publicly available telephone directory.

The complainant later upgraded the mobile telephone service and in doing so, was allocated a secondary mobile telephone number by the telecommunications service provider. This number was to be used with the existing mobile telephone handset, specifically for the transmission of data associated with wireless access protocol capability.

The complainant later found that this data transmission number appeared as a mobile telephone number, in the publicly available residential telephone directory listed beside the complainant's previously undisclosed residential address.

Issues: The Privacy Commissioner investigated the complainant's allegations under section 40(1) of the Act.

National Privacy Principle 2 restricts the way in which organisations can use and disclose personal information. It provides that if an organisation collects personal information for one purpose, it can only use or disclose the personal information for a new purpose in limited circumstances. In particular, National Privacy Principle NPP 2.1(a) provides that an organisation can use or disclose the personal information for a new purpose if (i) the new purpose is related to the original purpose, and (ii) the individual would reasonably expect the organisation to use or disclose the information for the secondary purpose.

Additionally, National Privacy Principle 4.1 requires that organisations take reasonable steps to protect the personal information they hold from misuse, loss, unauthorised access, modification and disclosure.

The issues for consideration were whether the telecommunications service provider disclosed the complainant's personal information, being the name, residential address and data transmission number, in accordance with the provisions of National Privacy Principle 2.1(a), and whether the telecommunications service provider took reasonable steps to protect the complainant's personal information in accordance with National Privacy Principle 4.1.

The telecommunications service provider conceded that it had disclosed the complainant's personal information in error, and that this error had resulted in the complainant's personal information being published in the publicly available residential telephone directory.

The Privacy Commissioner formed the view that the disclosure was in breach of National Privacy Principle 2. The Privacy Commissioner also took the view that there was a systemic flaw in the telecommunications service provider's operational software that led to the disclosure of the complainant's personal information and that accordingly the telecommunications service provider had not taken reasonable steps to protect the complainant's personal information. As such, the Privacy Commissioner was also of the view that National Privacy Principle 4 had been breached.

Outcome: The complainant sought compensation to alleviate risks to personal security resulting from the disclosure.

The telecommunications service provider offered the complainant an amount of compensation in full and final settlement of the complaint. In addition, the telecommunications service provider implemented new audit procedures in order to more readily identify and minimise errors and ceased forwarding clients' 'silent' mobile telephone details to the organisation responsible for the publication of the telephone directory, thereby reducing the risk of unauthorised publication.

The complainant accepted the telecommunications service provider's offer of compensation. The Commissioner then decided under section 41(2)(a) of the Act to cease investigation of the complaint on the grounds that the telecommunications service provider had dealt adequately with the matter.

OFFICE OF THE PRIVACY COMMISSIONER June 2005