Site Changes

On 1 November 2010 the Office of the Privacy Commissioner was integrated into the Office of the Australian Information Commissioner and a new website established at www.oaic.gov.au.

Note 1: Major changes to the Privacy Act 1988 will come into effect in March 2014. Agencies, businesses and not for profits need to start preparing for these changes. For more information go to our privacy law reform page at www.oaic.gov.au
Note 2: From 12 March 2013 content is no longer being added to, or amended, on this site, consequently some information may be out of date. For new privacy content visit the www.oaic.gov.au website.

Types

Topic(s): Credit and finance | Disclosure

O v Financial Institution [2010] PrivCmrA 18

document icon pdf (146.15 KB)

Case Citation:

O v Financial Institution [2010] PrivCmrA 18

Subject Heading:

Disclosure of personal information

Law:

National Privacy Principle 2.1 in Schedule 3 of the Privacy Act 1988 (Cth).

The following case was decided by the Privacy Commissioner prior to 1 November 2010. On 1 November 2010 all the powers of the Privacy Commissioner under the Privacy Act were conferred on the Australian Information Commissioner.

Facts:

The complainant and their partner had divorced. While married, they had established an education fund in both their names to support their children's education.

The complainant's former partner attended a branch of a financial institution to enquire whether a cheque from the educational fund had been paid into the complainant's account. The cheque was made out in the complainant and former partner's names.

The financial institution conducted enquiries on the complainant's account and advised the former partner it would place a trace on the cheque. The financial institution provided details of the deposit to the former partner, including dates and amounts.

The former partner provided these details to the Child Support Agency for use in a reassessment of the complainant's income.

The complainant considered that the financial institution improperly disclosed their personal information to the former partner.

Issues:

NPP 2.1 provides that an organisation must not use or disclose personal information about an individual for a purpose other than the primary purpose of collection unless an exception in NPP 2.1(a)-(h) applies.

Outcome:

The Commissioner opened a formal investigation under section 40(1) of the Privacy Act.

The financial institution denied it had disclosed the complainant's account balance or account number to the former partner, but conceded it had disclosed details of the cheque. It acknowledged that it should not have used the complainant's personal information, contained in the account, to run a trace on the cheque. It could have told the former partner to contact the educational fund as the drawer of the cheque.

Given the financial institution acknowledged it had inappropriately disclosed personal information the Commissioner decided to conciliate the matter as is allowed under section 27(1)(a) of the Privacy Act.

The respondent agreed to issue a written apology to the complainant; conduct an analysis of the complainant's accounts across a specified timeframe to reassure the complainant that no other unauthorised disclosures had occurred; and counsel the staff member who had dealt with the former partner's enquiry.

The respondent also paid compensation to the complainant after the parties signed a Deed of Release.

Consequently the Commissioner closed the complaint under section 41(2)(a) of the Privacy Act on the grounds that the respondent had adequately dealt with the matter.

Office of the Australian Information Commissioner
December 2010