pdf (300.83 KB)

Case Citation:

E v Private School [2010] PrivCmrA 6

Subject Heading:

Disclosure of personal information

Law:

National Privacy Principle 2.1 in Schedule 3 of the Privacy Act 1988 (Cth)

Facts:

The complainant told a private school they were considering legal action against the school.  The school replied that it would defend any legal action.  In an attempt to conciliate the matter and avoid court action, the complainant sent the school a copy of their intended legal claim.

A third party subsequently advised the complainant that the school had told them that the complainant's dispute was proceeding to court and they may be required to attend as a witness. The complainant alleged that their personal information was improperly disclosed by the school.

The complainant later lodged the claim with the appropriate court.

Issues:

NPP 2.1 provides that an organisation must not use or disclose personal information about an individual for a purpose other than the primary purpose of collection unless one of the exceptions in NPP 2.1(a)-(h) applies.

The school claimed the NPPs did not apply to the personal information contained in the intended claim, because the information was not solicited and therefore not collected by the school.

Outcome:

The Privacy Commissioner investigated the matter under section 40(1) of the Privacy Act.

The Commissioner took the view that the NPPs apply to both solicited and non-solicited information and therefore the school's actions were governed by the NPPs. 

NPP 2.1 permits an organisation to use or disclose personal information for the primary purpose of collection.  NPP 2.1(a) also permits the use or disclosure of personal information for a secondary purpose where that purpose is related to the primary purpose of collection, and the individual would reasonably expect the disclosure.

In the Commissioner's opinion the school's reason for retaining the intended claim was consistent with the primary purpose of collection.  This purpose was to defend, or avoid, any legal action brought by the complainant.

The Commissioner found the school had discussed the intended claim with the third party before it was lodged with the court.  However, the Commissioner formed the view that the discussion constituted a disclosure of the complainant's personal information which was made for the primary purpose of collection.

The Commissioner considered that even if the disclosure was for a secondary purpose it would have been authorised under NPP 2.1(a). The disclosure was for a directly related secondary purpose and the disclosure was within the complainant's reasonable expectations given any evidence provided to support the claim could be legitimately tested by the school, including contacting any witness named.

Therefore, the Commissioner formed the view the disclosure was in accordance with NPP 2.1, and closed the complaint under section 41(1)(a) of the Privacy Act.

Office of the Privacy Commissioner
May 2010