Case Citation:

V v Commonwealth Agency [2008] PrivCmrA 22

Subject Heading:

Improper collection and disclosure of personal information and failure to provide notice of collection of personal information

Law:

Information Privacy Principles 1.1, 1.2, 2 and 11 in Part III Division 2 of the Privacy Act 1988 (Cth)

Facts:

When applying for a service, the complainant's partner submitted an application form to the Agency, and attached a letter of support from the complainant.  The Agency then met with and interviewed the complainant.  Based on the information it received from the complainant, the partner's application was granted.

 A law enforcement body told the Agency that the statements made by the complainant were inaccurate.  Providing false or misleading information or documents to the Agency is considered an offence under the Agency's governing legislation.

The Agency commenced an investigation into the complainant's conduct.  The Agency asked the complainant to attend a second meeting.  The Agency also took steps to verify the information it received from the law enforcement agency with third party sources, including the complainant's employer.

The complainant subsequently claimed that the Agency did not clearly state the purpose of the second meeting. The complainant believed it was to discuss their partner's application, rather than their own conduct in supporting that application.

The complainant also claimed that the Agency had acted improperly by disclosing their personal information to, and collecting their personal information from, their employer, during the investigation.

Issues:

IPP 11 prohibits agencies from disclosing personal information to anyone other than the individual concerned, unless an exception applies.  IPP 11.1(e) states that an agency may disclose personal information if the disclosure is reasonably necessary to enforce the criminal law.

IPP 2 requires that when an agency collects personal information from an individual, it must take any steps that are reasonable in the circumstances to make sure that the individual is aware of why the agency is collecting the information and what the agency's legal authority is to collect the information.

IPP 1.1 regulates the way in which agencies collect person information.  It provides that agencies may only collect personal information:

• for a lawful purpose that is directly related to their functions or activities; and
• that is necessary for or directly related to that purpose.

IPP 1.2 also states that agencies must not collect personal information by unlawful or unfair means.

Outcome:

The Privacy Commissioner opened an investigation into the matter under section 40(1) of the Privacy Act.

The Agency advised the Commissioner that it is required to investigate suspected breaches of its governing legislation.  In this case, the Agency informed the complainant's employer that it was investigating the complainant's conduct in relation to a possible offence under its governing legislation.  The Agency also advised that no other personal information about the complainant was disclosed to the employer.

The Commissioner was satisfied that the Agency's disclosure of the complainant's personal information, within the limits described, was reasonably necessary for the enforcement of the criminal law.  As such, the Agency was entitled to rely on IPP 11.1(e) to permit the disclosure.

The Agency further advised that, prior to the second meeting, its officers informed the complainant of the reason for the meeting and the legal authority under which the complainant's information was being collected.  Having considered this information, the Commissioner was satisfied that the complainant had been notified of the matters set out in IPP 2.

As one of the Agency's core functions is to enforce its governing legislation, the Commissioner was satisfied that the Agency had complied with IPP 1.1.  As the complainant was offered the opportunity not to participate in the second meeting, the Commissioner was satisfied that IPP 1.2 had been observed.

The Commissioner closed the complaint under section 41(1)(a) of the Privacy Act as she was satisfied that there had not been an interference with the complainant's privacy.

OFFICE OF THE PRIVACY COMMISSIONER

November 2008