Case Citation:
 

B v Cleaning Company [2009] PrivCmrA 2
 

Subject Heading:

Disclosure of personal information and the employee records exemption

Law:

National Privacy Principle 2.1 in Schedule 3, and Section 7B(3) of the Privacy Act 1988 (Cth)

Facts:

The complainant was employed by a large cleaning company for several years before resigning from their position.
  At the time of their resignation, the complainant owed a sum of money to another organisation and had entered into a repayment arrangement.
  The complainant then defaulted on that arrangement.

The organisation contacted the complainant's former employer, the cleaning company, seeking information as to the complainant's whereabouts.
  A statement later provided to the complainant by the organisation indicated that the cleaning company had disclosed the complainant's personal information to the organisation, including their address and financial details.

The complainant complained that the personal information collected for the purposes of their employment was inappropriately disclosed by the cleaning company.

Issues:

Section 7B(3) of the Privacy Act exempts the handling of employee records.
  To be exempt, the act or practice complained of must be related to a current or former employment relationship, and the personal information subject to the complaint must be held in an employment record.

NPP 2.1 provides that an organisation must not use or disclose personal information about an individual for a purpose other than the primary purpose of collection unless an exception in National Privacy Principle 2.1(a)-(h) applies.

Outcome:

The Privacy Commissioner investigated the matter under section 40(1) of the Privacy
 Act.
 

The Commissioner examined the information available and was of the view that the complainant's personal information had been disclosed by the cleaning company.

The cleaning company claimed that the disclosure was subject to the employment records exemption and that it did not have to comply with the requirements of NPP
 2.1.

The Commissioner found that the personal information in question was held in an employment record by the cleaning company.
  The cleaning company was clearly the former employer of the complainant.

However, the act or practice complained about was the disclosure of the complainant's personal information to an organisation to which the complainant was personally indebted.
  This disclosure was not related to their employment and was therefore an act or practice unrelated to the administration of the complainant's employment with the cleaning company.
  As such, the disclosure was not exempt and must comply with NPP 2.1.

The Commissioner formed the view that none of the exceptions listed at NPP 2.1 applied to the disclosure and found that the cleaning company had interfered with the complainant's privacy.

The cleaning company agreed to the conciliation of this matter under section 27(1)(ab) of the Privacy Act.
  It apologised to the complainant and agreed to develop and implement privacy training for all staff in the management of personal information.

The Commissioner closed the complaint under section 41(2)(a) of the Privacy
 Act on the grounds that the cleaning company had dealt adequately with the matter.

OFFICE OF THE PRIVACY COMMISSIONER

May 2009