pdf (79.18 KB)

Case Citation: 

I v Insurance Company [2009] PrivCmrA 11 

Subject Heading:

Disclosure of personal information

Law:

National Privacy Principle 2.1 in Schedule 3 of the Privacy Act 1988 (Cth)

Facts:

The complainant lodged a claim with their insurance company for damage done to their home.  The insurance company engaged a repairer who visited the premises to assess the damage and to prepare a quote for the cost of the repairs.

The complainant was not satisfied with the assessment carried out by the repairer and expressed their concerns in a letter to the insurance company.  The complainant was later directly contacted by the repairer, angry about the statements made by the complainant in the letter.  The complainant alleged that the insurance company had inappropriately disclosed a copy of their letter to the repairer.    

Issues:

National Privacy Principle 2.1 provides that an organisation must not use or disclose personal information about an individual for a purpose other than the primary purpose of collection unless an exception in National Privacy Principle 2.1(a)-(h) applies.  

Outcome:

The Privacy Commissioner investigated the matter under section 40(1) of the Privacy Act. 

The insurance company claimed that to properly investigate the allegations made by the complainant about the repairer's assessment, it was necessary to provide the repairer with a copy of the complainant's letter.  The insurance company claimed that providing a copy of the letter was related to the purpose for which the information was first collected, and that the complainant would have expected the disclosure to occur.

NPP 2.1(a) permits an organisation to use or disclose personal information for a secondary purpose where that purpose is related to the primary purpose of collection, and the individual would reasonably expect the disclosure.

The Commissioner found that the primary purpose of collection of the information was to process the complainant's insurance claim.  The Commissioner accepted that the insurance company disclosed the information to the repairer for a related secondary purpose which was to investigate the complaint about the service that had been provided.

The Commissioner also accepted that in receiving a complaint about the repairer, the complainant might expect the insurance company to make enquiries of the repairer to establish whether the complaint was true.  However, the Commissioner did not accept that the complainant would have expected that a full copy of their letter, including the statements made about the repairer, would be disclosed directly to the repairer. 

The Commissioner did not consider that the disclosure of the complainant's letter was permitted by NPP 2.1(a) and formed the view that the insurance company had interfered with the complainant's privacy.

The insurance company apologised to the complainant and agreed to amend its staff training program to incorporate the handling of personal information collected in relation to customer complaints.        

The Commissioner closed the complaint under section 41(2)(a) of the Privacy Act on the basis that the insurance company had adequately dealt with the complaint.

OFFICE OF THE PRIVACY COMMISSIONER

August 2009