Case Citation: C v Commonwealth Agency [2005] PrivCmrA 3

Subject Heading: Disclosure by an Australian Government agency under National Privacy Principles to its legal counsel.

Law:National Privacy Principle 2.1 and section 7B(3) of the Privacy Act 1988 (Cth).

Facts: The complainant and his wife were employees of the respondent. The complainant's wife was the applicant in proceedings against the respondent in the Administrative Appeals Tribunal for compensation in relation to a health and safety issue. During proceedings the complainant's wife submitted to the Tribunal that she was not able to afford certain medical expenses. In reply, the respondent obtained information about the complainant's income from its payroll department which it submitted to the Tribunal as evidence of the applicant's financial standing.

The complainant argued that the respondent was not permitted to disclose his personal information to the respondent's legal counsel in relation to a matter which did not concern the complainant.

The Commissioner commenced preliminary enquiries into this matter under section 42 of the Act to determine whether the complaint fell within the Commissioner's jurisdiction, and if so, to determine whether the disclosure may have been a breach of the Act.

Issues: The respondent in this case was an Australian Government agency which is subject to the Information Privacy Principles, but also has obligations under the National Privacy Principles with respect to personal information it holds in connection with its commercial activities. In this case the complainant's employment related to the respondent's commercial activities and as such, the disclosure was regulated by the National Privacy Principles.

As the complainant was an employee of the respondent, the Commissioner had to consider whether the exemption in section 7B(3) of the Act applied to the information in question. Under section 7B(3), an act or practice that is directly related to a current or former employment relationship between the organisation and the individual and an employee record relating to the individual, is exempt from the National Privacy Principles.

The Commissioner was satisfied that whilst the personal information relating to the complainant was an employee record, the act of disclosing it to legal counsel (in relation to proceedings involving the complainant's wife) was not an act which was directly related to the complainant's employment, and as such was subject to the National Privacy Principles and did not fall within the employee record exemption in section 7B(3) of the Act.

National Privacy Principle 2 sets out the general principle that an organisation must only use or disclose personal information about an individual for the primary purpose of collection. Use and disclosure for a secondary purpose is not allowed except where such a use or disclosure falls within the exceptions listed in National Privacy Principle 2.

The respondent advised that the disclosure of the complainant's personal information was for the purpose of gaining legal advice, and for the preparation of legal proceedings. The respondent advised that it was therefore the subject of legal professional privilege and that the disclosure of the information was permitted under National Privacy Principle 2.1(g) which permits a use or disclosure if it is required or authorised by or under law.

The Commissioner formed the view that the disclosure of the complainant's personal information to the respondent's legal counsel was authorised by law, as it was subject to legal professional privilege. Therefore the exception in National Privacy Principle 2.1(g) applied.

Outcome: In all of the circumstances, the Commissioner decided under section 41(1)(a) of the Act not to investigate the matter further on the grounds that the disclosure of personal information was authorised by law and therefore did not breach National Privacy Principle 2.1.

OFFICE OF THE PRIVACY COMMISSIONER February 2005

1 Section 7A(3) provides that the acts or practices of an agency listed in Division 1 of Part II of Schedule 2 of the Freedom of Information Act 1982, in respect of documents relating to the agency''s commercial activities, are to be treated as the acts or practices an organisation. This means that the commercial activities of these agencies are subject to the National Privacy Principles not the Information Privacy Principles.