pdf (100.38 KB)

Case Citation:

T v Commonwealth Agency [2009] PrivCmrA 23

Subject Heading:

Accuracy of personal information and use of personal information for a relevant purpose

Law:

Information Privacy Principle 8 and 9 in Part III Division 2 of the Privacy Act 1988 (Cth)

Facts:

The complainant was an employee of a Commonwealth agency.  The agency investigated the conduct of the complainant.  As part of the investigation, the agency prepared a report of the complainant's attendance at work.  The agency also examined the complainant's use of work emails to send and receive inappropriate material.

The complainant alleged that the attendance report was incorrect and that the agency did not take reasonable steps to ensure their personal information was correct before using it to make a decision about their conduct.  The complainant also alleged that the agency misused the complainant's personal information by examining emails that were not relevant to the conduct matter the agency was investigating.

Issues:

IPP 8 requires that an agency not use personal information without taking such steps (if any) as are, in the circumstances, reasonable to ensure that, having regard to the purpose for which the information is proposed to be used, the information is accurate, up-to-date and complete.

IPP 9 requires that an agency not use personal information except for a purpose to which the information is relevant.

Outcome:

The Privacy Commissioner investigated the matter under section 40(1) of the Privacy Act.

The Commissioner compared the report on the employee's attendance prepared by the agency against the complainant's time sheet and building access records.  The Commissioner also investigated what steps the agency undertook prior to finalising the report to ensure the complainant's personal information was accurate. 

The Commissioner's investigation established that the report contained inaccurate personal information.  The agency could have avoided the inaccuracies if it had re-checked the dates prior to finalising the report.  There was an increased need for the information in the report to be accurate because it was used in decision making about the employee's conduct.  As such, the Commissioner formed the view that, in the circumstance of the complaint, the agency had failed to take reasonable steps to ensure the accuracy of the attendance report prior to finalising it and had interfered with the complainant's privacy.

The Commissioner conciliated this aspect of the complaint under section 27(1)(a) of the Privacy Act.  The agency apologised to the complainant, amended the inaccuracy in the attendance report and compensated the complainant.  The Commissioner formed the view that the agency had adequately dealt with the matter and closed this aspect of the complaint under section 41(2)(a) of the Privacy Act.   

The Commissioner also considered whether the agency had used the complainant's work emails for an irrelevant purpose.  The agency had examined the complainant's work emails as part of its investigation.  The purpose of the examination was to determine whether the complainant had engaged in misconduct.  The Commissioner was satisfied that the use of the complainant's emails was relevant to the purpose.  Therefore, the Commissioner formed the view that the agency had not interfered with the complainant's privacy and closed this aspect of the complaint under section 41(1)(a) of the Privacy Act.

OFFICE OF THE PRIVACY COMMISSIONER

December 2009