pdf (31.53 KB)

Case Citation:

N v Commonwealth Agency [2009] PrivCmrA 17

Subject Heading:

Use of personal information by a Commonwealth agency

Law:

Information Privacy Principles 10 and 11 in Part III Division 2 of the Privacy Act 1988 (Cth)

Facts:

The complainant was an employee of a Commonwealth agency.  The complainant had lodged several complaints against the agency relating to their conditions of employment.  The agency engaged a contractor to investigate its handling of the complainant's various complaints, and in doing so gave the contractor a copy of the complainant's personnel and related files.

The complainant claimed that the agency improperly disclosed their personal information to the contractor without consent.

Issues:

IPP 10 requires agencies to use personal information only for the purpose for which it was collected unless an exception applies.

IPP 10.1(e) allows agencies to use personal information for a purpose directly related to the purpose for which the information was obtained.

IPP 11 prohibits agencies from disclosing personal information to anyone other than the individual concerned, unless an exception applies.

Outcome:

The Privacy Commissioner investigated the matter under section 40(1) of the Privacy Act.

In assessing the complaint, the Commissioner first considered whether the agency had used or disclosed the complainant's personal information.

Under the Commissioner's Plain English Guidelines to the Information Privacy Principles, the test for establishing whether personal information has been used or whether it has been disclosed is whether the agency maintains control over the personal information.  An agency maintains control over personal information if it gives the personal information to an external person to use for a limited purpose that assists or benefits the agency.  The external person must be bound by an agreement that requires it to use the information only for that limited purpose, and allows the agency to access, change or retrieve the personal information.

In this instance, the agency entered an agreement with the contractor for the limited purpose of investigating the complainant's allegations, and provided the contractor with the complainant's personal information for that sole purpose. Further, the contractor returned its copy of the complainant's personal information to the agency at the conclusion of its investigation.  On that basis, the Commissioner decided that the agency had maintained control over the complainant's personal information, and had therefore ‘used’ that information, but had not ‘disclosed’ it.

The Commissioner then considered whether the use was permissible under IPP 10. 

The Commissioner was satisfied that the agency's collection of personal information in the personnel and related files was for the purpose of administering the complainant's employment.  As the contractor was engaged to investigate complaints about the complainant's working conditions, the Commissioner considered the use to be directly related to the administration of the complainant's employment. 

Therefore, the Commissioner was of the view that the agency's use of the complainant's personal information was permissible under IPP 10.1(e), and as such, the issue of consent was not considered.

The Commissioner closed the investigation under section 41(1)(a) of the Privacy Act on the grounds that the agency had not breached the Privacy Act.

OFFICE OF THE PRIVACY COMMISSIONER

November 2009