Case Citation:A v Insurer [2002] PrivCmrA 1

Subject Heading: Adequacy of privacy statement in relation to the collection of personal information

Law: National Privacy Principle 1.3

Facts

The complainant alleged that the privacy statement on the insurer's travel insurance claim form was deficient for the following reasons:

• unless she provided her personal information, her claim would not be processed;
• the form stated that personal information about the complainant would be disclosed to "other consultants" that were not otherwise specified; and
• the statement needed clearer information about the parties to whom her personal information would be disclosed.

Issues

(1) National Privacy Principle 1.3 requires that, at or before the time an organisation collects personal information about an individual directly from the individual, the organisation must take reasonable steps to ensure that the individual is aware of a number of specified matters. It appeared that the privacy statement was only brought to the individual?s attention when they made a claim, rather than when they entered into the insurance contract and provided their personal information to the insurer. The office took the view that the statement should be provided to the individual at the time the contract of insurance is entered into, so that they can make an informed decision about whether they wish to enter into the contract.

(2) The statement reads, in part: 'We may also disclose personal information including sensitive information about you such as health information to medical practitioners, other health professionals, reinsurers, legal representatives and other consultants'. National Privacy Principle 1.3(d) requires that the individual be made aware of 'the organisations (or the types of organisations) to which the organisation usually discloses information of that kind?'. It is questionable whether 'consultants' adequately identifies the type of organisation to which personal information may be disclosed. The Office recommended that the insurer provide a more specific description.

(3) The privacy policy also states that "By signing the claim form, you consent to us and those organisations [emp added] and other professionals collecting and disclosing sensitive information about you?". On reading the above phrase it appears that the personal information provided to the insurer by the claimant could be passed on by the insurer to the types of organisations mentioned who could in turn pass on the information without restriction. It is not stated to whom those other organisations would be disclosing the information.

Outcome

As a result of the investigation, the insurer agreed to implement the following changes in relation to each of the issues raised.

Issue 1. The insurance product in question was bundled together with a number of credit card products so that the individual dealt directly only with the credit card providers; the only time the individual dealt directly with the insurer was if he or she made a claim. The insurer agreed to contact the card providers to arrange for the inclusion of new terms and conditions in the contract so that, before they enter into the contract, potential claimants would be told what would happen with their personal information and why the insurer needed to collect it.

Issue 2. The privacy policy has been reworded to make it clearer to whom personal information is passed in relation to each insurance product. The term 'other consultants' remains but specific lists are located on the insurer's website and can be obtained from it on request, to specifically define who 'other consultants' and professionals are for each of its insurance products.

Issue 3. The travel claim form now makes clearer the persons to whom the insurer discloses personal information. The relevant section now reads, "By signing this Claim Form, You consent to those organisations and other professionals collecting, and Us disclosing sensitive information about You for this purpose".

The investigation was closed under s.41(2)(a) of the Privacy Act, on the grounds that the insurer had adequately dealt with the matter.

OFFICE OF THE PRIVACY COMMISSIONER DECEMBER 2002