Australia: Privacy update: recent cases and federal reforms

In L v Commonwealth Agency [2010] PrivCmr 14, the former Privacy Commisioner (noting that as of 1 November 2010, the former Office of the Privacy Commisioner has been integrated into the Office of the Australian Information Commisioner (OAIC)) (Commisioner) reviewed a decision made by a Government Agency (the Agency) to publicly disclose an individual's private information to the media. The Agency disclosed the information in response to the Complainant making public criticisms to the media about an Agency decision.

IPP 11 prohibits the disclosure of personal information to anyone else other than the individual concerned, unless a relevant exception applies. IPP 11.1(a) provides an exception where the individual is reasonably likely to have been aware or made aware that information of that kind is usually passed to the relevant person, body or agency.

The Commisioner's Plain English Guidelines to Information Privacy Principles 8-11 (guidelines) state that, under IPP 11.1(a), an individual may be considered to be reasonably likely to be aware that under circumstances where that individual complains publicly about an agency, that agency may respond publicly and to the media against those complaints.

The Commisioner found that the information provided to the media by the agency was in direct response to the complainant's criticisms and at no point went beyond those terms. The Commisioner also found that, consistent with the guidelines, the agency may respond in the way it did. Therefore, the Commisioner took a preliminary view that IPP 11.1(a) permitted the disclosure made by the agency.

In another case, I v Commonwealth Agency [2010] PrivCmrA 10, the Commisioner again reviewed a decision to disclose personal information under IPP 11. In this case, the Complainant met with a State Member of Parliament (MP) to raise issues in relation to a decision made by a Government Agency. In the meeting, the Complainant disclosed correspondence made between the Complainant and the Agency.

Resulting from the meeting with the complainant, the MP requested information from the relevant agency. The agency provided that information. The complainant claimed that this was an improper disclosure under IPP 11, as it included information private to the complainant.

IPP 11.1(b) provides an exception to IPP 11 where the individual concerned has consented to disclosure.

Here the Commisioner held that, in having the MP's office make representations on their behalf, the complainant consented to the gathering of information by the MP's office and the disclosure made by the agency. The Commisioner therefore found that, pursuant to IPP 11.1(b), the agency had not improperly disclosed the complainant's private information.

For further findings made by the Commisioner regarding IPP 11 and its exceptions, see K v Commonwealth Agency [2010] PrivCmrA 13; J and Commonwealth Agency [2011] AICmrCN 4; and D v Commonwealth Agency [2010] PrivCmrA 5.

In J and Commonwealth Agency [2011] AlCmrCN 4, the Complainant claimed that during an Administrative Appeal Tribunal (AAT) application, a Government Agency improperly collected and disclosed information personal to the Complainant. The complaint concerned the agency obtaining the Complainant's fingerprints and providing those prints to a law enforcement body for the purposes of analysing certain documents.

The first issue raised concerned the legality of the collection of the information. On this point, the Commisioner held that collection of the information was not in breach of IPP 1. The Commisioner found that the collection related to one of the agency's lawful functions and that the disclosure would ultimately assist the AAT with its decision.

Of particular significance in this case was the distinction the Commisioner was required to make between "use" and "disclosure" of information. If, in having the law enforcement body analyse the prints, the agency was "using" the information it collected, then it would have to comply with the rule as to use of private information under IPP 10. If, on the other hand, the information was "disclosed" in the process, the agency would have to find an exception to the provisions restricting the disclosure of personal information under IPP 11.

The Commissioner turned to the guidelines and noted that passing personal information outside the agency is to be considered "use" if the agency maintains control over the information. The Commissioner noted that control is satisfied under the guidelines where the information is passed "for a limited purpose that assists or benefits the agency" and where there is an agreement that the external body will not use or disclose the information and where the agency is allowed to access, change or retrieve the personal information at any time.

The Commisioner found that the agency submitted the fingerprints for the sole purpose of testing and that the law enforcement body knew of its responsibilities regarding the limited use of the information. It was therefore found that the agency was "using" the information and not "disclosing" it for the purposes of the IPPs. As such, IPP 10 applied to the information but not IPP 11.

IPP 10 provides that information be used consistently with the purpose for which it was collected. As the fingerprints were collected to check the veracity of the documents in question, the submission for testing was clearly a 'use' consistent with the purposes of that collection.

This finding suggests that under certain circumstances, agencies can pass private information to other parties without being considered to have unlawfully disclosed it for the purposes of IPP 11. This will be the case only where the information is given to another party for specific purposes and where the agency is considered to have remained in control of that information.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.