Case Citation: 

G v Law Firm [2007] PrivCmrA 9

Subject Heading:

Inappropriate use and disclosure of information gathered by a law firm

Law:

National Privacy Principle 2 in Schedule 3 of the Privacy Act 1988 (Cth)

Facts:

The complainant insured their home with an insurance company.  Shortly afterwards, the complainant made a claim and allowed the insurance company to undertake a number of investigations into their claim, including a criminal history check.  The insurance company decided to reject the claim, and engaged a law firm to defend it in any resulting action from the complainant.

The law firm was also representing a second insurance company which happened to be involved with a separate case involving the complainant.  On behalf of the second insurance company, the law firm requested access to the information gathered by the first insurance company, including the criminal history check. 

The law firm approached the complainant's solicitor for the second insurer case and informed them that they were aware of the information gathered by the first insurer, with a view to settling the matter before it proceeded to court.

Issues:

National Privacy Principle 2.1 provides that an organisation must not use or disclose personal information about an individual for a purpose other than the primary purpose of the collection unless an exception in National Privacy Principle 2.1(a)-(h) applies.

The issue for the Commissioner was whether an exception to National Privacy Principle 2 applied which permitted the use and disclosure by the law firm.

Outcome:

The Privacy Commissioner investigated the matter under section 40(1) of the Privacy Act 1988 (Cth).  The law firm claimed that it used and disclosed the complainant's personal information on the basis that it believed the complainant was engaged in unlawful activity by attempting to recover damages for an incident which did not occur in the circumstances which the complainant had alleged. 

After consideration, the Commissioner was of the opinion that the law firm had reason to suspect unlawful activity had or was being engaged in.  However, the Commissioner was of the opinion that the use and disclosure was not a necessary part of an investigation into suspected unlawful activity or part of reporting suspected unlawful activity to the relevant persons or authorities.  The law firm instead used the information to add weight to the second insurance company's legal argument in defending against the complainant's insurance claim. The Commissioner did not believe any other exception in National Privacy Principle 2 permitted the disclosure.  For this reason the Commissioner considered that the law firm acted contrary to National Privacy Principle 2.

The matter proceeded to conciliation and the law firm offered a sum of compensation and an apology.  The complainant claimed a higher amount of compensation.  However, the complainant did not substantiate their claims to a higher amount of compensation.  

Given the complainant could not substantiate an entitlement to a higher amount of compensation and was not seeking any procedural changes to the law firm's practices, the Commissioner was satisfied that the law firm had adequately responded to the matter by making the offer of compensation and apologising.  The complaint was closed under section 41(2)(a) of the Privacy Act.

OFFICE OF THE PRIVACY COMMISSIONER

June 2007