Case Citation:

B v Hotel [2008] PrivCmrA 2

Subject Heading:

Improper disclosure of personal information by an organisation

Law:

National Privacy Principle 2.1 in Schedule 3 of the Privacy Act 1988 (Cth)

Facts:

The complainant stayed overnight with their spouse at one of the premises of a hotel chain.  About three weeks later the complainant received a package from the hotel, which contained garments that did not belong to them.  The complainant re-sealed the parcel, marked it ''return to sender' and put it back in the post. 

Soon after the complainant received a letter in the post from the person who owned the garments.  This individual has the same first and last name as the complainant and had also recently been a guest of the respondent hotel. 

The complainant had not had any previous contact with that individual.

Issues:

National Privacy Principle 2.1 provides that an organisation must not use or disclose personal information about an individual for a purpose, other than the primary purpose of the collection, unless an exception in National Privacy Principle 2.1(a)-(h) applies.

Outcome:

The Privacy Commissioner opened an investigation into the matter of the disclosure of the complainant's personal information, that is, their name and address, by the hotel, under section 40(1) of the Privacy Act.

During the investigation, the hotel did not dispute that it disclosed the complainant's personal information to a third party, being the individual who owned the garments.  The hotel did offer the explanation that the disclosure was a result of the two individuals having the same first and last name. 

The Commissioner was of the view that the hotel disclosed the complainant's personal information to a third party, and considered whether the disclosure was permitted by NPP 2.1. 

The Commissioner formed the view that the disclosure of the complainant's personal information did not appear to be consistent with the primary purpose for which the information was collected and none of the exceptions listed in NPP 2.1 applied to permit the disclosure.

Consequently, the Commissioner was satisfied that there had been an interference with the complainant's privacy.

The Commissioner considered it appropriate to attempt, by conciliation, to effect a settlement of the matters that gave rise to the investigation.

The hotel offered the complainant a written apology, an explanation of the steps the hotel took to investigate the matter, advised that it had reaffirmed to employees the importance of adherence to their privacy policy, and a goodwill gesture of a voucher for one night's complimentary accommodation to the complainant. 

This offer was accepted by the complainant.  The Commissioner then closed the complaint under section 41(2)(a) of the Privacy Act  on the grounds that the hotel had adequately dealt with the complaint.

OFFICE OF THE PRIVACY COMMISSIONER May 2008