Case Citation: 

O v Insurance Company [2007] PrivCmrA 17

Subject Heading:

Improper gathering and disclosure of personal information

Law:

National Privacy Principles 1, 2 and 3 in Schedule 3 of the Privacy Act 1988 (Cth)

Facts:

The complainant was involved in a worker's compensation claim against their employer.  As part of the investigation of this claim the insurance company liable for the claim hired a private investigator.  The private investigator interviewed the complainant and learned about an allegation of sexual harassment made by the complainant's colleague against another of the complainant's work colleagues.

The complainant believed that the insurance company subsequently disclosed the information about their knowledge of these allegations to the complainant's employer, which the complainant considered an invasion of their privacy.

Issues:

National Privacy Principle 1.1 provides that an organisation must not collect personal information unless the information is necessary for one or more of its functions or activities.

National Privacy Principle 2.1 provides that an organisation must not use or disclose personal information about an individual for a purpose other than the primary purpose of the collection unless an exception in National Privacy Principle 2.1(a)-(h) applies.

National Privacy Principle 3 provides that an organisation must take reasonable steps to make sure that the personal information it collects, uses or discloses is accurate, complete and up-to-date.

Outcome:

The Privacy Commissioner investigated under section 40(1) of the Privacy Act.

The Commissioner considered that the information about the sexual harassment claim had been gathered as part of a lawful investigation into the factors affecting the complainant's return to work.  As the complainant had identified the allegation as an issue affecting their return to work, the investigator and insurance company acted reasonably in gathering this information.  This meant that the collection of information was consistent with National Privacy Principle 1.

In addition to this, there was no evidence to suggest that the information had been provided to the complainant's employer by either the investigator or the insurer.  Instead, the complainant's employer stated that the matter of the allegation had been raised by one of the parties involved in the alleged sexual harassment following an interview with the investigator.

Finally, since the information provided by both the insurance company and the complainant was consistent, there was no suggestion that the insurer had failed to comply with National Privacy Principle 3.

As there had been no breach of the Privacy Act in this case, the Commissioner closed the matter under section 41(1)(a) of the Privacy Act.

OFFICE OF THE PRIVACY COMMISSIONER

June 2007