Case Citation: 

E v Insurance Company [2008] PrivCmrA 5

Subject Heading:

Improper disclosure of personal information

Law:

National Privacy Principle 2.1 in Schedule 3 of the Privacy Act 1988 (Cth)

Facts:

The complainant held an insurance policy with an insurance company.  

Following a car accident involving the complainant and a third party, the complainant submitted the necessary documentation to the complainant's insurance company. The documentation included the complainant's contact details.  

The complainant alleged that during the course of handling the insurance claim the insurance company disclosed the complainant's contact details to the third party who was involved in the car accident. The third party subsequently contacted the complainant via telephone wanting to discuss the amount of money the third party was being required to pay as a result of the accident.

The complainant lodged a complaint with the insurance company and received a cheque in the mail from the insurance company without an accompanying letter.  It was unclear to the complainant whether the cheque was in settlement of the insurance claim, the privacy complaint or both. 

Issues:

National Privacy Principle 2.1 provides that an organisation must not use or disclose personal information about an individual for a purpose, other than the primary purpose of collection, unless an exception in National Privacy Principle 2.1(a)-(h) applies.

Outcome:

The Privacy Commissioner conducted preliminary enquiries into this matter under section 42 of the Privacy Act.

The Commissioner contacted the insurance company in order to ascertain what had occurred.  At this point, the insurance company requested that its dispute resolution team be allowed to investigate the complaint in the first instance and the Commissioner agreed.  

After conducting its own investigation into the complaint, the insurance company acknowledged that it had inadvertently disclosed the complainant's contact details to the third party.  The insurance company also confirmed that the cheque should have come with a letter explaining that it was in settlement of the privacy complaint only.

The insurance company wrote to the complainant and indicated that the third party would not be contacting the complainant regarding the insurance claim and provided the complainant with a written apology.

As the complainant was satisfied with the insurance company's actions, the Commissioner closed the complaint under section 41(2)(a) of the Privacy Act on the ground that the insurance company had adequately dealt with the complaint.

OFFICE OF THE PRIVACY COMMISSIONER May 2008