pdf (94.37 KB)

Case Citation:

O v Automotive Company [2009] PrivCmrA 18

Subject Heading:  

Denial of access to personal information

Law:

National Privacy Principle 6.1 in Schedule 3 of the Privacy Act 1988 (Cth)

Facts:

The complainant made an application to acquire a car dealership from an automotive company.  When assessing the application, the automotive company contacted the complainant's referees.  The referees provided information about the complainant on the condition that this information be treated confidentially. 

The automotive company rejected the complainant's application.  The complainant subsequently requested access to the information the automotive company held about them.  The automotive company denied the complainant access to their information for the reason that providing access would constitute a breach of its duty of confidence to the referees.

The complainant claimed that the automotive company had interfered with their privacy by failing to provide them with access to their personal information.

Issues:

National Privacy Principle 6.1 provides that, if an organisation holds personal information about an individual, it must provide the individual with access to the information on request by the individual unless one of a number of exceptions apply.  These exceptions include where:

• providing access would be unlawful (NPP 6.1(g)); or
• denying access is required or authorised by or under law (NPP 6.1(h)).

Outcome:

The Privacy Commissioner investigated the matter under section 40(1) of the Privacy Act.

It is the Commissioner's view that common law and equitable obligations constitute ‘law' for the purposes of the Privacy Act.  This means that if an individual's personal information was subject to an equitable duty of confidence, then an organisation would be entitled to rely on NPP 6.1(g) or NPP 6.1(h) to deny the individual access to that information.

The Commissioner considered the information provided by the parties about whether an equitable obligation applied.  In particular, the Commissioner considered whether the circumstances in the complaint would satisfy the three elements of a successful cause of action for an equitable breach of confidence as set out by Megarry J in Coco v AN Clark (Engineers) Ltd[1] and subsequent cases. 

First, the Commissioner was satisfied that the information collected from the referees had the necessary quality of confidence about it, as this information contained the referees' opinions about the complainant, and was not public knowledge.

Second, the Commissioner was satisfied that the information was provided by the referees in circumstances importing an obligation of confidence.  The circumstances included that the automotive company had prefaced each communication with the referees that the communication would remain confidential.

Third, the Commissioner was satisfied that it would be an unauthorised use of the information for the automotive company to provide the complainant with access, as the referees had provided the information on the condition it would remain confidential.

The Commissioner formed the view that the three elements of a successful cause of action for an equitable breach of confidence were made out in the circumstances.  As such, the automotive company could rely on NPP 6.1(g) to deny the complainant access to their information.  Providing access would be unlawful in that it would give rise to an action for breach of confidence.

The Commissioner also formed the view that that the automotive company could rely on NPP 6.1(h) to deny the complainant access to their information, as denying access is required by the law of confidence.

The Commissioner closed the complaint under section 41(1)(a) of the Privacy Act on the grounds that the automotive company had not interfered with the complainant's privacy.

OFFICE OF THE PRIVACY COMMISSIONER
December 2009

[1] Coco v AN Clark (Engineers) Ltd [1969] RPC 41.