Case Citation:U v Major Banking Institution [2004] PrivCmrA 9

Subject Heading: Disclosure of personal information and credit worthiness information / declined to investigate on the basis that the respondent had adequately dealt with the matter.

Law:National Privacy Principle 2.1; section 18N(1) and section 41(2)(a) of the Privacy Act 1988 (Cth)

Facts: A default notice regarding the complainant's overdue private bank account was disclosed by the respondent to the complainant's spouse, from whom she was separated. The complainant brought her concerns to the respondent's attention. The respondent wrote to the complainant stating that the error was caused by out-of-date information being held on its database, and that it was at the time, unaware of the complainant's changed circumstances. The respondent apologised for the incident.The complainant was not happy with the outcome and wrote to this Office seeking compensation.

Issues:National Privacy Principle 2.1 provides that personal information collected for a primary purpose may only be used or disclosed for a secondary purpose if one of a number of exceptions in National Privacy Principle 2.1(a)-(h) applies. Section 18(N)(1) of the Act prohibits credit providers from disclosing information about individual's credit worthiness, credit standing or credit history to unauthorised third parties.

As the account was a private bank account, and the complainant's spouse from whom she was separated was never an account holder, it appeared that the respondent had breached National Privacy Principle 2.1 and section 18N(1) in disclosing information about the complainant's overdue account to the spouse.

Outcome: Although the complainant was seeking compensation for the actions of the respondent, in the view of the Office, the complainant had not substantiated a claim for compensation.

Where the Commissioner finds a breach of the Act, the compensation sought (which can include compensation for injury to the complainant's feelings or humiliation suffered) for the damage or loss suffered must be a direct result of the particular action that was a breach of the Act. An individual is usually only compensated for actual loss or damage rather than potential loss or damage (eg income not generated) unless it was reasonably foreseeable at the time of the breach that this future loss or damage would occur.

The complainant had not established a clear nexus between any loss suffered and the breach by the respondent which resulted in the account information being passed to the complainant's spouse, from whom she was separated.

The Commissioner has a discretion under section 41(2)(a) of the Act to decline to investigate a complaint where he or she is of the view that the respondent has adequately dealt with the complaint. In the absence of any supporting documentation as to why the complainant believed she was entitled to compensation, the Commissioner was of the opinion that an apology from the respondent was an appropriate response to the complaint.

Accordingly, the Commissioner declined to investigate the complaint pursuant to section 41(2)(a) of the Act, on the grounds that the respondent had adequately dealt with the matter.

OFFICE OF THE PRIVACY COMMISSIONER June 2004