pdf (144.74 KB)

Case Citation:

R v Retailer [2010] PrivCmrA 21

Subject Heading:

Disclosure of personal information

Law:

National Privacy Principles 1.3 and 2.1 in Schedule 3 of the Privacy Act 1988 (Cth).

The following case was decided by the Privacy Commissioner prior to 1 November 2010. On 1 November 2010 all the powers of the Privacy Commissioner under the Privacy Act were conferred on the Australian Information Commissioner.

Facts:

A retailer disclosed a complainant's personal information to a third party insurer so that it could offer the complainant extended warranty on a purchased product. The complainant said they did not expect to receive the offer of an extended warranty in the mail because they had declined to take up the extended warranty in store.

The complainant alleged the retail company had inappropriately disclosed their personal information and had not provided an adequate collection notice.

Issues:

NPP 1.3 provides that at or before the time (or if that is not practicable, as soon as practicable after) an organisation collects an individual's personal information, it must take reasonable steps to ensure the individual is aware of a number of factors. These include, among other things, the purposes for which the information is collected and the organisations (or the types of organisations) to which the organisation usually discloses information of that kind.

NPP 2.1 provides that an organisation must not use or disclose personal information about an individual for a purpose other than the primary purpose of collection unless an exception in NPP 2.1(a)-(h) applies.  

NPP 2.1(a) permits an organisation to use or disclose personal information for a secondary purpose where that purpose is related to the primary purpose of collection, and the individual would reasonably expect the use or disclosure.

Outcome:

The Commissioner conducted preliminary inquiries into the complaint under section 42 of the Privacy Act.

In response to the inquiries the retailer said that it had provided notice to the customer given its privacy policy outlined the information required in NPP 1.3. The privacy policy also outlined that a third party would contact customers about an extended warranty. The retailer's privacy policy was  available in all stores and on its website.

Although the complainant and respondent disagreed as to whether the disclosure was authorised, they wished to resolve the issue. The Commissioner had not taken a view as to whether the retailer had interfered with the complainant's privacy.

The retailer agreed to change its procedures so that staff specifically referred customers to its privacy policy when collecting customer information. It also agreed to retrain staff about the content of its privacy policy. The complainant was satisfied with the respondent's changes to its procedures.

Satisfied that the matter had been adequately dealt with, the Commissioner closed the matter under section 41(2)(a) of the Privacy Act.

Office of the Australian Information Commissioner
December 2010