pdf (343.59 KB)

Case Citation:

T v Investment Services Provider [2010] PrivCmrA 23

Subject Heading:

Disclosure of personal information

Law:

National Privacy Principle 2.1 in Schedule 3 of the Privacy Act 1988 (Cth).

The following case was decided by the Privacy Commissioner prior to 1 November 2010. On 1 November 2010 all the powers of the Privacy Commissioner under the Privacy Act were conferred on the Australian Information Commissioner.

Facts:

An enforcement body was investigating a managed investment scheme run by an investment service provider. The complainant was an investor in the scheme.

The investment service provider became aware that the principal investigator for the enforcement body was a close relative of the complainant. The investment service provider informed the enforcement body of the complainant's interest in the managed investment scheme as it considered there was a material conflict of interest between the complainant's investment and the relative's role as an investigator.

The complainant alleged that the investment service provider had improperly disclosed their information to the enforcement agency.

Issues:

NPP 2.1 provides that an organisation must not use or disclose personal information about an individual for a purpose other than the primary purpose of collection unless an exception in NPP 2.1(a)-(h) applies.

NPP 2.1(h) allows an organisation to use or disclose personal information where the organisation reasonably believes the use or disclosure is reasonably necessary for one or more of the activities listed in NPP 2.1(h) by or on behalf of an enforcement body. NPP 2.1(h)(iv) further requires that the disclosure be reasonably necessary for the enforcement body to prevent, detect or investigate seriously improper conduct or prescribed conduct.

NPP 2.1(f) allows an organisation to disclose personal information for a secondary purpose if it has reason to suspect that unlawful activity has been, is being or may be engaged in, and it uses or discloses the personal information as a necessary part of reporting its concerns to relevant persons or authorities.

Outcome:

The Commissioner investigated the matter under section 40(1) of the Privacy Act.

The investment services provider contended that the disclosure was permitted by NPP 2.1(h)(iv). The Commissioner considered three major elements of NPP 2.1(h)(iv): the involvement of an enforcement body; the respondent having a reasonable belief that the disclosure is reasonably necessary; and the conduct being seriously improper or prescribed.

First, the Commissioner found the body was an enforcement body because it was defined as such in the Privacy Act.

Second, the Commissioner noted the legislative sanctions for staff members in relation to conflicts of interest and breaches of the Code of Conduct. Good investigative practice requires that an investigator must not have or be perceived to have, any conflict of interest in relation to the investigation. The Commissioner accepted that a conflict could reasonably be perceived in this instance. Specifically, the Commissioner took the view that the investment services provider reasonably believed that it was reasonably necessary to alert the enforcement body to the potential conflict of interest of the investigator by disclosing:

• the complainant's interest in the managed investment scheme, and
• that the complainant was a close relative of the investigator.

Third, the Commissioner considered whether the disclosure was to prevent, detect or investigate seriously improper conduct. The investigation by the enforcement body had the potential to result in fines and imprisonment. The Commissioner considered these sanctions indicated the disclosures were to detect and investigate seriously improper conduct.

Consequently, the Commissioner took the view that the disclosure was authorised under NPP 2.1(h)(iv).

NPP 2.1(f) allows an organisation to disclose personal information if it has reason to suspect that unlawful activity has been, is being or may be engaged in, and it uses or discloses the personal information as a necessary part of reporting its concerns to relevant persons or authorities.

Commonwealth legislation imposes sanctions on Australian government employees for failure to disclose or take reasonable steps to avoid a real or apparent conflict of interest, in connection with their employment or the performance of their duties. The Commissioner took the view that the conflict in question had the potential to be unlawful. The Commissioner also took the view that the investment services provider had reason to suspect unlawful activity and the disclosure was a necessary part of reporting its concerns to the relevant body. Therefore, the Commissioner took the view the disclosure was allowed under NPP 2.1(f).

Accordingly, the Commissioner closed the complaint under section 41(1)(a) of the Privacy Act on the grounds that the investment services provider had not interfered with the complainant's privacy because the disclosure was allowed under NPP 2.1(h) and under NPP 2.1(f).

Office of the Australian Information Commissioner
December 2010