Case Citation:

T v Private Community Centre [2008] PrivCmrA 20

Subject Heading:

Failure to provide adequate notice when collecting personal information;  improper disclosure of personal information;  failure to take reasonable steps to provide privacy policy and failure to provide access to personal information

Law:

National Privacy Principles 1.3, 2.1, 5.1 and 6.1 in Schedule 3 of the Privacy Act 1988 (Cth)

Facts:

The complainant and their ex-spouse shared care of their two children.  When being transferred from the care of one parent to the other, the children were left by one parent in a private room at the community centre and then taken by centre staff to another private room, in which the other parent would meet them.  The private rooms were subject to recorded video surveillance. 

The complainant claimed that, for the first six months that they used the community centre, they were not aware that video surveillance took place in private rooms.  Specifically, the complainant claimed that they were not notified that their personal information would be collected by way of video surveillance. 

The complainant also alleged that the community centre had disclosed to their ex-spouse copies of letters the complainant had sent to the centre.  The complainant said that correspondence from their ex-spouse alluded to information that their ex-spouse could only have been obtained from the centre.  The complainant claims that they also requested a copy of the centre's privacy policy and access to any surveillance footage in which the complainant appeared.

Issues:

National Privacy Principle 1.3 provides that at or before the time (or if that is not practicable, as soon as practicable after) an organisation collects an individual's personal information, it must take reasonable steps to ensure an individual is aware of a number of factors, including the purposes for which the information is collected.

National Privacy Principle 2.1 provides that an organisation must not use or disclose an individual's personal information for a purpose other than the primary purpose of collection unless one of a number of exceptions applies.

National Privacy Principle 5.1 provides that an organisation must set out in a document clearly expressed policies on its management of personal information.  The organisation must make the document available to anyone who asks for it.

National Privacy Principle 6.1 provides that, if an organisation holds personal information about an individual, it must provide the individual with access to the information on request by the individual unless one of a number of exceptions applies.

Outcome:

The Privacy Commissioner conducted preliminary enquiries into this complaint under section 42 of the Act to decide if the complaint should be investigated.

The community centre provided the Commissioner a copy of a document that the complainant signed when they first applied to use the centre's services.  This document stated that video surveillance was conducted in the centre's private rooms.  The community centre also claimed that it had explained to the complainant that it conducted video surveillance for security reasons.  The Centre also provided the Commissioner with photographs of large signs displayed in the centre that advised patrons that it conducted video surveillance.  The Commissioner was of the view that the community centre had taken reasonable steps for the purposes of NPP 1.3 to ensure that the complainant was aware of the circumstances in which their personal information was collected, including by placing prominent signs on its premises, and by informing the complainant both verbally and in writing, that video surveillance would take place for security reasons. 

The community centre advised that it had not disclosed any of the complainant's personal information to the complainant's ex-spouse, including the letters they had written to the centre, and it provided general information about its data security measures.  These measures included having a ''clean desk' policy, storing client information in locked cabinets and drawers, and ensuring that personal information that is no longer required by the centre is securely disposed of.  The Commissioner considered the steps taken by the centre to protect the personal information it holds, and noted that there was no evidence to show that the complainant's personal information was disclosed to their ex-spouse in breach of NPP 2.1. 

The community centre provided the Commissioner with all correspondence it had exchanged with the complainant since they began using its services.  None of the correspondence contained a request from the complainant for the centre's privacy policy.  However, the centre advised that when this Office made it aware that the complainant was seeking a copy of its privacy policy, it had mailed a copy of it to them.  As the centre provided the complainant with its privacy policy after being made aware that the complainant was seeking a copy of it, the Commissioner considered that the centre had complied with National Privacy Principle 5.1.

The community centre provided evidence that it had given the complainant a compact disc containing all surveillance footage in which the complainant had appeared.  The Commissioner therefore considered that the centre provided the complainant with access to their personal information as requested and did not breach National Privacy Principle 6.1.

As there had been no breach of the Privacy Act in this case, the Commissioner decided not to investigate the matter and closed the complaint under section 41(1)(a) of the Privacy Act.

OFFICE OF THE PRIVACY COMMISSIONER

August 2008