pdf (145.63 KB)

Case Citation:

N v Restaurant [2010] PrivCmrA 17

Subject Heading:

Disclosure of personal information

Law:

National Privacy Principle 2.1 in Schedule 3 of the Privacy Act 1988 (Cth) and section 6 in Part II of the Privacy Act.

The following case was decided by the Privacy Commissioner prior to 1 November 2010. On 1 November 2010 all the powers of the Privacy Commissioner under the Privacy Act were conferred on the Australian Information Commissioner.

Facts:

The complainant applied for a job at a restaurant while employed at another local restaurant. The complainant cited their current employer in their curriculum vitae but did not include them as a referee.

A staff member from the respondent restaurant attended an evening business function which was also attended by the complainant's employer. The complainant alleged the restaurant disclosed their personal information to their current employer by mentioning that a member of its staff had applied for a position at the respondent restaurant. 

The complainant was not mentioned by name. However, because the current employer telephoned the complainant that night to verify the information, the complainant considered the employer had identified them from the information disclosed by the respondent.

The complainant claimed their relationship with their employer had been jeopardised as a result of the alleged disclosure.

Issues:

Section 6 of the Privacy Act defines personal information as 'information or an opinion ... about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion.'

NPP 2.1 provides that an organisation must not use or disclose personal information about an individual for a purpose other than the primary purpose of collection unless an exception in NPP 2.1(a)-(h) applies.

Outcome:

Section 27(1)(a) of the Privacy Act requires the Commissioner 'to endeavour, by conciliation, to effect a settlement of the matters that gave rise to the investigation'.

The Commissioner opened an investigation into the complaint under section 40(1) of the Privacy Act but did not make a formal finding as both parties agreed to conciliate the complaint.

The respondent apologised for any distress its actions caused. It also reviewed and improved its recruitment information handling procedures.

The complainant accepted the respondent's apology and its revised procedures as an appropriate resolution to their complaint and asked that the Commissioner close the matter.

Satisfied that the matter had been adequately dealt with by the restaurant, the Commissioner closed the matter under section 41(2)(a) of the Privacy Act.

Office of the Australian Information Commissioner
December 2010