Subject Heading: Disclosure of personal information collected prior to commencement of the National Privacy Principles.

Law:National Privacy Principle 2.1 and section 16C of the Privacy Act 1988 (Cth).

Facts: In September 2003 financial institution A was joined as a respondent to an action in the District Court. A representative of the applicant to that action, financial institution B, filed an affidavit containing 13 portfolio valuations of its former clients which it alleged were obtained from financial institution A.

The portfolio valuation contained the name, address and financial details of the complainant. The complainant lodged a complaint with the Privacy Commissioner under section 36 of the Privacy Act alleging that there had been two improper disclosures of his personal information, firstly by financial institution A to financial institution B and secondly, by financial institution B into court.

Issues: National Privacy Principle 2.1 in the Act states that "An organisation must not use or disclose personal information about an individual for a purpose (the secondary purpose) other than the primary purpose of collection unless" an exception applies. This means that the use and disclosure of personal information is limited to the main reason for which it was collected, apart from a number of other limited circumstances, including where the individual gives consent to other uses and disclosures.

Section 16C(1A) of the Act states that National Privacy Principle 2 "applies only in relation to personal information collected after the commencement of this section". The National Privacy Principles and this section came into operation on 21 December 2001. Therefore, National Privacy Principle 2 does not apply to personal information collected before this date.

As it was not clear whether the Privacy Commissioner had the power to investigate the complaint, preliminary inquiries were undertaken under section 42 of the Act to ascertain the date when the personal information in the portfolio valuation was collected. The portfolio valuation was dated 15 December 2001 and the Office was satisfied that both financial institution A and financial institution B collected the information prior to 21 December 2001.

Outcome: Since National Privacy Principle 2 only applies to information collected after 21 December 2001, the disclosures by financial institution A and financial institution B did not come within the jurisdiction of the Privacy Commissioner. For this reason the Privacy Commissioner declined to investigate the complaint under section 41(1)(a) of the Act.

OFFICE OF THE PRIVACY COMMISSIONER

February 2004