pdf (81.19 KB)

Case Citation: 

U v Telecommunications Company [2009] PrivCmrA 24

Subject Heading:  

Improper use of personal information and related bodies corporate provision

Law:

National Privacy Principles 2 and 3 in Schedule 3, and section 13B of the Privacy Act 1988 (Cth)

Facts:

The complainant received a letter from a telecommunications company welcoming them as a new customer.  The complainant claimed that they were not, and never had been, a customer of that company.  The complainant contacted the telecommunications company, who confirmed that they were not a customer.  The telecommunications company suggested that the letter was sent to the customer by mistake and that their details may have been sourced from a related company.

Issues:

Section 13B of the Privacy Act states that a body corporate collecting or disclosing personal information (other than sensitive information) from or to another related body corporate is not an interference with privacy.

NPP 2 provides that an organisation must not use or disclose personal information other than for the primary purpose of collection, unless an exception applies.

NPP 3 states that an organisation must take reasonable steps to make sure that the personal information it collects, uses or discloses is accurate, complete and up-to-date.

Outcome:

The Privacy Commissioner made inquiries of the telecommunications company under section 42 of the Privacy Act to ascertain whether it had interfered with the complainant's privacy. 

The Commissioner established that the telecommunications company, which was a body corporate, had obtained the complainant's personal information from another body corporate after a corporate acquisition.  As such, the Commissioner found that the complainant's personal information had been shared between two related bodies corporate in accordance with section 13B of the Privacy Act.

The Commissioner then considered whether the telecommunications company's handling of the complainant's personal information was permitted by the NPPs.

With regards to NPP 2, the Commissioner was satisfied that the use of the complainant's personal information in this instance was consistent with the primary purpose for which it was originally collected, namely providing a telecommunications service to the complainant.

Further, while the telecommunications company conceded that the welcome letter was sent in error, the Commissioner was of the view that it had reasonable processes in place as required by NPP 3.

Consequently, the Commissioner decided not to investigate the matter under section 41(1)(a) of the Privacy Act on the grounds that the respondent had not interfered with the complainant's privacy.

OFFICE OF THE PRIVACY COMMISSIONER
December 2009