pdf (325.58 KB)

Case Citation:

Own Motion Investigation v Insurance Company [2010] PrivCmrA 1

Subject Heading:

Disclosure of personal information

Law:

National Privacy Principle 2 in Schedule 3 of the Privacy Act 1988 (Cth)

Facts:

While completing an insurance company claim form, an individual became concerned about how their personal information might be used after collection.  In particular, the company was asking the individual to consent to it disclosing the individual's personal information to 'anybody.'  

The individual did not sign the form and instead wrote to the Privacy Commissioner to notify the Commissioner that the form may not comply with the Privacy Act.

Issues:

NPP 2.1 provides that an organisation must not use or disclose personal information about an individual for a purpose other than the primary purpose of collection unless an exception in NPP 2.1(a)-(h) applies. 

Outcome:

The Commissioner commenced an own motion investigation under section 40(2) of the Privacy Act. 

The Commissioner examined the form and noted that a clause did require individuals to agree that the company 'may disclose to anybody any information about you.'

The Commissioner advised the insurance company that the terms under which it was seeking individuals' consent to disclose their personal information were very broad.  The Commissioner's view was that to rely on such a consent where there is no clear purpose for personal information to be disclosed would be inconsistent with NPP 2.1. 

The insurance company stated that its practice was not to rely on individual's consent to disclose to 'anybody' but to rely on more specific authority, such as later consents from customers.   

The Commissioner's investigation prompted the insurance company to remove the broad terms from the form.

The Commissioner therefore ceased the own motion investigation into the matter on the basis that the insurance company had adequately dealt with the matter.

Office of the Privacy Commissioner

May 2010