Case Citation:

J v Utility Company and Industry Group [2006] PrivCmrA 9

Subject Heading:

Collection and disclosure of personal information by an industry group, disclosure of personal information by a utility company.

Law:

National Privacy Principles 1.1 and 2.1(a) in the Privacy Act 1988 (Cth)

Facts:

The complainant was a member of an industry group and a sole trader who was concerned about a letter from their industry group that included an analysis of the complainant''s utility consumption dating back several years.

The industry group letter advised it had contacted the utility company as part of its attempts to assist its members lower their utility costs. It went on to say that the utility company had agreed to analyse the utility usage for members in the complainant''s region to help them consider their usage in more detail.

The complainant wrote to the Privacy Commissioner after complaining to the industry group about the collection of their personal information from the utility company, and to the utility company for disclosing their personal information to the industry group. The complainant was concerned that information of this kind, if released to other parties, might result in the loss of commercially sensitive information integral to the effective running of their business.

While business information is not usually covered by the Privacy Act, in this case, as the complainant was a sole trader, the information was found to identify the complainant.

Issues:

National Privacy Principle 1.1 requires organisations to only collect personal information if the information is necessary for one or more of its functions or activities.

National Privacy Principle 2.1 provides that an organisation must not use or disclose personal information about an individual for a purpose other than the primary purpose unless certain exceptions apply.

The Commissioner investigated the matter seeking to establish whether the disclosure of the complainant''s personal information by the utility company, and the disclosure and subsequent collection of the information by the complainant''s industry group, was consistent with the National Privacy Principles.

Outcome:

The Commissioner found no evidence that either the utility company or the industry group had disclosed information about the complainant to any other organisations or individuals.

The industry group advised that it was seeking to assist its members reduce their utility costs and to this end provided the utility company with the names and addresses of those members located in particular geographical areas. However, it also stated that it expected that the utility company would develop a methodology which would analyse the utility consumption patterns of those members and then make recommendations to its customers as to reduced production costs; that is, it did not expect to actually receive its members'' personal information.

However the utility company found that its system would not allow the extraction of aggregated regional data, only the extraction of data relating to each individual industry member within the particular geographical area in question. The utility company then extracted the names and addresses of the industry members from its records, in conjunction with members'' utility consumption patterns, and disclosed this information to the industry group. The utility company argued that it was on the understanding that the request had been endorsed by the elected members of the industry group''s board, and the consent of each individual member. The Commissioner''s investigation revealed that the negotiations between the industry group and the utility company had been conducted orally and were not supported by file notes or other documentation.

In considering the actions of the utility company, the Commissioner noted that the utility company admitted that it had disclosed the complainant''s information in a way that contravened its own privacy policy. The Commissioner also took into account the fact that the utility company could not provide any evidence to support its contention that it believed members had provided the industry body with their consent for the collection and disclosure of their personal information. In view of the lack of evidence as to consent, the Commissioner considered whether the disclosure of personal information, including personal contact details, to the complainant''s industry body was related to the provision of utility services, which was the primary purpose for which the utility company held the complainant''s personal information. The Commissioner was not satisfied on this count; furthermore, the Commissioner considered there was insufficient evidence for the utility company to be satisfied that the complainant would have reasonably expected this disclosure. The Commissioner concluded that disclosure was inconsistent with National Privacy Principle 2.1(a).

In considering the actions of the industry group, the Commissioner considered the fact that it had disclosed the complainant''s personal information to the utility company for the purpose of identifying ways in which to improve industrial efficiency for its members. The subsequent collection was for the same purpose. The Commissioner considered the published role and functions of the industry group, which included acting as a representative body on behalf of its industry members and providing advice and assistance. The Commissioner also took account of the advice provided to members about activities the industry group might undertake, which included considering ways to reduce production costs.

The Commissioner concluded that it was likely that the disclosure by the industry body of the personal information in question was consistent with the primary purpose for which the personal information had first been collected, or at least was related to the primary purpose, and in view of information provided to members, would have been ''reasonably expected'' by the individuals concerned. The Commissioner also considered that the collection of personal information about members'' usage of the utility product was ''necessary'' for the purpose of providing advice to members.

The Commissioner decided that the industry group''s disclosure of personal information to, and collection from the utility company about its members was consistent with National Privacy Principle 1.1 and National Privacy Principle 2.1 respectively, and therefore the industry group was not in breach of the Privacy Act.

The utility company apologised to the complainant and stated that it was willing to compensate the complainant for any distress the disclosure may have caused. The complainant remained dissatisfied with the outcome of the complaint and did not accept the resolution proposed by the utility company. Rather the complainant was seeking a finding that there had been deliberate collusion between the parties. The Commissioner was not in a position to make such a finding.

The Commissioner also considered that the utility company''s attempts at conciliation were reasonable in the circumstances and in view of this the Commissioner subsequently closed this aspect of the complaint in accordance with section 41(2)(a) of the Privacy Act, on the grounds that the matter had been adequately dealt with by the utility company. The Commissioner declined to investigate further the complaint against the industry body under section 41(1)(a) on the basis that there was no interference with privacy since the collection and disclosure of the complainant's personal information was permitted under the Privacy Act.

OFFICE OF THE PRIVACY COMMISSIONER April 2006