Case Citation:

W v Telecommunications Company [2007] PrivCmrA 25

Subject Heading:

Improper disclosure of personal information; accuracy of personal information

Law:

National Privacy Principles 2.1, 3 and 6.5 in Schedule 3 of the Privacy Act 1988 (Cth)

Facts:

The complainant paid for a combined phone and fax number that operated using a single line.  The primary phone number was listed in hard copy and electronic telephone directories, but with their address suppressed.  A new agreement with the telecommunications company resulted in the addition of a separate dedicated fax number.  After publication of the electronic and hard copy directories, the complainant found that a new listing had been created in relation to the dedicated fax number, which appeared as a telephone number, and also included their address.

The complainant attempted to resolve the issue directly with the telecommunications company. The telecommunications company offered an amount of compensation in an effort to resolve the complaint.  The complainant did not consider this amount satisfactory and complained to the Privacy Commissioner.

Issues:

National Privacy Principle 2.1 provides that an organisation must not use or disclose personal information about an individual for a purpose other than the primary purpose of the collection unless an exception in National Privacy Principle 2.1(a)-(h) applies.  Under National Privacy Principle 2.1(a) the organisation can disclose personal information for a purpose other than the primary purpose, a ''secondary purpose', if the secondary purpose is related to the primary purpose of collection and the individual would reasonably expect the organisation to use or disclose the information for the secondary purpose.

Under National Privacy Principle 3, an organisation must take reasonable steps to make sure that the personal information it collects, uses or discloses is accurate, complete and up-to-date.

National Privacy Principle 6.5 requires that if an organisation holds personal information about an individual and the individual is able to establish that it is not accurate, complete and up-to-date, the organisation must take reasonable steps to correct the information so that it is accurate, complete and up-to-date.

Outcome:

The Privacy Commissioner investigated the matter under section 40(1) of the Privacy Act.

The Commissioner found that the electronic and hard copy directories include one free listing for all customers.  However, the complainant had not previously used this free listing and instead, had opted to pay a fee to have their address suppressed.  In changing the arrangement, the new dedicated fax line had been upgraded to a full service and automatically qualified for the free listing to which the complainant was entitled.  This mistake was not detected by the telecommunications company before the listing was printed in the hard copy and electronic directories.  Additionally, the complainant's address had been listed due to a processing error made by the telecommunications company when changing the complainant's fax line plan. 

The Commissioner found that there was no evidence to suggest the telecommunications company discussed with the complainant options for a suppressed listing or silent number when establishing the dedicated fax line.  The Commissioner also concluded that the complainant's customer record would have shown that they had previously sought, and for a fee been provided with, a service that suppressed their residential address from publication in relation to their primary number.

In this situation, the complainant could not have reasonably expected when upgrading their auxiliary fax line to a full service second line, that their number, or residential address, would be disclosed in the manner described.  The Commissioner found that this disclosure didn't satisfy the reasonable expectations test in National Privacy Principle 2.1(a).  As none of the other exceptions in National Privacy Principle 2.1(b)-(h) applied, the Commissioner was satisfied that the telecommunications company had breached National Privacy Principle 2.1 in this regard.

The Commissioner found that the telecommunications company had in place a number of policies and mechanisms for the proper collection and use of data, and that the printing of the complainant's address and fax number had occurred as a result of an uncommon combination of events.  Therefore the Commissioner was satisfied that whilst these events impacted the complainant in this case, the company had taken reasonable steps to ensure its policies and procedures were sufficient to meet the requirements of National Privacy Principle 3.

The Commissioner also found that the complainant had attempted to resolve the matter with the telecommunications company a number of times, but the company did not take timely action to correct the error once they were informed of it.  The Commissioner was satisfied that the company had failed to fulfil the requirements of National Privacy Principle 6.5.

The complainant subsequently agreed to a settlement proposed by the telecommunications company.  Satisfied that the matter had been adequately dealt with, the Commissioner decided not to investigate the matter further under section 41(2)(a) of the Privacy Act.

OFFICE OF THE PRIVACY COMMISSIONERDecember 2007