Case Citation: L v Insurer [2005] PrivCmrA 9

Subject Heading: Transfer of personal information by an insurer subject to the General Insurance Information Privacy Code.

Law: Sections 13A and 36 of the Privacy Act 1988(Cth)

Facts: The complainant was involved in a car accident, and lodged a personal injury claim with the insurance company of the driver considered by the complainant to be at fault. According to the complainant the insurance company copied their personal injury claim application and forwarded a copy to the complainant's own insurer. The complainant had not lodged a claim with their own insurance company.

The complainant contacted the other driver's insurer, asking why it had forwarded a copy of the claim to their own insurer. The complainant was advised that it was 'standard industry practice' to do so. The complainant then put the complaint in writing to the other party's insurer and allegedly received no response.

Issues: The first question that arose was whether the action, if substantiated, would be an interference with privacy as defined in section 13 of the Privacy Act. In particular, section 13A(1)(a) and (b) provide:

For the purposes of this Act, an act or practice of an organisation is an interference with the privacy of an individual if:

1. the act or practice breaches an approved privacy code that binds the organisation in relation to personal information that relates to the individual; or
2. both of the following apply:
   1. the act or practice breaches a National Privacy Principle in relation to personal information that relates to the individual;
   2. the organisation is not bound by an approved privacy code in relation to the personal information; or

Further section 36 provides that:

1. Subject to subsection (1A), an individual may complain to the Privacy Commissioner about an act or practice that may be an interference with the privacy of the individual. (1A) Subsection (1) does not apply to a complaint by an individual about an act or practice of an organisation that is bound by an approved privacy code that:
   1. contains a procedure for making and dealing with complaints to an adjudicator in relation to acts or practices that may be an interference with the privacy of an individual; and
   2. is relevant to the act or practice complained of.
   (1B) Subsection (1A) does not prevent an individual from making a complaint under an approved privacy code to the adjudicator for the code if the adjudicator is the Commissioner.

Section 36(1A) thus prevents an individual from making a complaint about an act or practice of an organisation that is bound by an approved privacy code that includes a procedure for making a complaint to an adjudicator.

The Commissioner's enquiries revealed that the other party's insurer was a signatory to the General Insurance Information Privacy Code. This code provides that complaints about acts or practices that may be a breach of the code may be made to the Insurance Enquiries and Complaints Ltd.

Outcome: The Commissioner therefore could not investigate the matter under section 40(1) as a complaint could not be made under section 36. The complainant was therefore referred to Insurance Enquiries and Complaints Ltd (now known as the Insurance Ombudsman Service Limited).

OFFICE OF THE PRIVACY COMMISSIONER June 2005