Case Citation: 

T v Law Firm [2006] PrivCmrA 19

Subject Heading:

Improper use and disclosure of personal information by a law firm.

Law:

National Privacy Principle 2.1 in schedule 3 of the Privacy Act 1988 (Cth)

Facts:

The complainant made a claim to insurance company A in relation to property damage. In order to assess the claim, the insurance company requested a large amount of personal information from the complainant, which the complainant provided. After assessing the complainant''s claim, insurance company A rejected it and engaged a law firm (the respondent) to defend the rejection of the claim. 

At this time the complainant also had a concurrent insurance matter pending which was an unrelated personal injury claim with insurance company B. Insurance company B had also employed the services of the same law firm as insurance company A. In the course of a discussion between the complainant''s legal representative and the law firm about the complainant''s claim with insurance company B, it became evident that information about the complainant used by the law firm in relation to the complainant''s dealings with insurance company A, had also been used by the law firm in relation to the complainant''s claim with insurance company B. Specifically, information used by the law firm as a basis for insurance company A to reject the complainant''s insurance claim was used by the law firm and disclosed to insurance company B to support insurance company B''s case against the complainant.

The complainant wrote to the Privacy Commissioner seeking an investigation into the matter.

Issues:

National Privacy Principle 2.1 provides that an organisation must not use or disclose personal information about an individual for a purpose other than the primary purpose of the collection unless an exception in National Privacy Principle 2.1(a)-(h) applies.

The issue for consideration before the Commissioner was whether the use and disclosure of the complainant''s information by the law firm was permitted by National Privacy Principle 2.1.

Outcome:

Preliminary enquiries made under section 42 of the Privacy Act with insurance company A revealed that the law firm had requested documents in relation to the claim that insurance company A had rejected, to use as part of the case against the complainant by insurance company B.  

The Commissioner investigated the complaint under section 40(1) of the Privacy Act. In response to the Commissioner''s investigation the law firm admitted that it did use personal information obtained during the investigation of the complainant''s property insurance claim with insurance company A for the purpose of defending insurance company B against the complainant''s personal injury claim. 

The law firm stated that it believed it was authorised to disclose the complainant''s personal information under National Privacy Principle 2.1(f), which states that information may be used or disclosed for a purpose other than the primary purpose of collection if ''the organisation has reason to suspect that unlawful activity has been, is being or may be engaged in, and uses or discloses the personal information as a necessary part of its investigation of the matter or in reporting its concerns to relevant persons or authorities.''

The law firm stated that it had reason to suspect unlawful activity on behalf of the complainant. However, the Commissioner took the view that the use of the information by the law firm and its disclosure to insurance company B was not a necessary part of an investigation of the complainant''s suspected unlawful activity, or part of reporting suspected unlawful activity to the relevant persons or authorities. Rather, the law firm used information it had collected whilst being contracted to a different insurance company and working on a different matter, to strengthen its legal brief against the complainant in relation to their claim with insurance company B. The Commissioner found that the law firm had been in breach of National Privacy Principle 2 in using and disclosing the complainant''s personal information.

The complainant was given an opportunity to state what they were seeking in resolution of the complaint. The complainant claimed to have suffered financially, and sought an amount of compensation stating their personal injury case had failed as a result of the actions of the law firm. In conciliating the outcome of the complaint the Commissioner considered the law firm''s view that it was more than likely that the information used and disclosed by the law firm would have been presented in the personal injury case had it proceeded to trial. 

The complainant also sought an apology and compensation for hurt and humiliation. The law firm agreed to the provision of an apology and an amount of compensation in the interests of resolving the matter. The Commissioner contacted the complainant putting forward the law firm''s offer and requested the complainant indicate whether they were satisfied with the offer and if they were not, their reasons and a proposed counter offer. The complainant was willing to accept the apology but sought a different amount of compensation. 

The Commissioner requested further substantiation of the complainant''s claim that they had suffered hurt and humiliation. The complainant failed to provide further substantiation. The Commissioner was satisfied that in offering an apology and an amount of compensation, the law firm had taken adequate steps to resolve the complaint. The Commissioner closed the complaint under section 41(2)(a) on the basis that the respondent had adequately deal with the complaint. 

OFFICE OF THE PRIVACY COMMISSIONER August 2006