FOIREQ18/00066 000013
FOIREQ18/00066 000014
FOIREQ18/00066 000018
FOIREQ18/00066 000019
FOIREQ18/00066 000026
FOIREQ18/00066 000027
FOIREQ18/00066 000028
FOIREQ18/00066 000029
FOIREQ18/00066 000030
FOIREQ18/00066 000031
FOIREQ18/00066 000032
FOIREQ18/00066 000045
FOIREQ18/00066 000046
FOIREQ18/00066 000047
FOIREQ18/00066 000048
FOIREQ18/00066 000049
FOIREQ18/00066 000050
FOIREQ18/00066 000051
FOIREQ18/00066 000052
FOIREQ18/00066 000053
FOIREQ18/00066 000054
FOIREQ18/00066 000055
FOIREQ18/00066 000056
FOIREQ18/00066 000057
FOIREQ18/00066 000058
FOIREQ18/00066 000059
FOIREQ18/00066 000060
FOIREQ18/00066 000061
FOIREQ18/00066 000062
FOIREQ18/00066 000063
FOIREQ18/00066 000064
FOIREQ18/00066 000065
FOIREQ18/00066 000066
FOIREQ18/00066 000067
FOIREQ18/00066 000068
FOIREQ18/00066 000069
FOIREQ18/00066 000119
FOIREQ18/00066 000120
The Department contends the disclosure was permitted by APP 6.2(a) on the basis the
individual would reasonably expect the Department to disclose personal information
necessary to respond publicly to the matters the individual had raised publicly.
The Department also contends that the APP 6.2(b) exception applies as the use and disclosure
of the complainant’s personal information was authorised under the following Australian
laws:
(i)
s 162(2) of the
A New Tax System (Family Assistance) (Administration) Act 1999 (Cth)
(FAA Act); and
(ii)
s 202(2) of the
Social Security (Administration) Act 1999 (Cth)
(SSA Act).
My view
APP 6.2(a) – reasonable expectation of the disclosure for a secondary purpose
APP 6.2(a)(ii) provides that if an APP entity holds personal information for a primary purpose,
it may use or disclose it for a secondary purpose if the individual would reasonably expect it
to do so, and the secondary purpose is related to the primary purpose.
This exception creates a two-limb test which focuses on both the reasonable expectations of
the individual, and the relationship between the primary and secondary purposes.
The Department has referred to this exception, and to the Guidelines the OAIC has published,
which describe circumstances where an individual may reasonably expect their personal
information to be used or disclosed for a secondary purpose, including:
Where the individual makes adverse comments in the media about the way an APP
entity has treated them. In these circumstances, it may be reasonable to expect that the
entity may respond publicly to these comments in a way that reveals personal
information specifically relevant to the issues that the individual has raised.1
In
L v Commonwealth Agency [2010] PrivCmrA 14 (
L v Commonwealth Agency)2, the OAIC
found that Information Privacy Principle 11.1(a), which was the equivalent of APP 6.2(a) for
agencies at the time, applied. This was on the basis the complainant had complained publicly
about the agency’s handing of their application, and the information the agency disclosed was
confined and responded only to the issues that had been publicly raised.
Similarly, I consider that the information disclosed by the Department in this current matter
was limited to the issues that had been publicly raised, and focused on clarifying potentially
misleading statements and correcting factual inaccuracies. I am therefore satisfied the first
limb of the reasonable expectation test has been met.
1 APP Guidelines, [6.22]
2 See
L v Commonwealth Agency [2010] PrivCmrA 14 (24 December 2010), Australasian Legal Information Institute website
<www.austlii.edu.au>
www.oaic.gov.au |
2
FOIREQ18/00066 000121
To form a view as to whether the second limb of the reasonable expectation test has been
met, I must consider the purpose for which the individual’s personal information was
collected, and the purpose for which it was disclosed. The purpose for which it was disclosed
must be related, by more than a tenuous link, to the purpose for which it had been collected.
It appears the primary purpose for the collection of the personal information was for the
administration of the individual’s social security entitlements and obligations.
The Department has advised that the secondary purpose for which the information was used
and disclosed was to correct, clarify and provide context to the information the individual
included in the article. Specifically, to respond to criticisms as to the Department’s
administration of the individual’s entitlements and obligations, and the factual assertions the
individual had made.
On consideration of all of the information available to me I am satisfied this secondary
purpose is related to the primary purpose. The Department collected the information in the
course of administering the individual’s entitlements and obligations. The individual then
publically criticised its administrative performance, and in doing so, made certain factual
assertions. The disclosure was related to and associated with those factual assertions. In my
view, the second limb of the reasonable expectation test is met and the Department was
permitted to disclose the individual’s personal information because the purposes were
sufficiently related to each other. I am therefore satisfied the disclosure is permitted by APP
6.2(a)(ii) in this instance.
My view on this was reached after very careful and close consideration of the precise
disclosures made by the Centrelink customer, and those made by the Department. Had the
Department released more information, or the customer published less, I may have reached a
contrary view. As such I caution the Department against using my conclusion in this case as a
general authority to release customer information in response to public criticism. The
Department must be careful to ensure that when responding to public criticism it releases the
minimum information necessary, and that it acts within the reasonable expectations of the
individual concerned.
APP 6.2(b) – authorised or required by or under law
The Department additionally relies on the exception under APP 6.2(b), claiming that the
disclosure of the protected information was a disclosure made for the purposes of family
assistance law and social security law, arising under the FAA and SSA Acts.
There is, however, no need to address the application of APP 6.2(b), having regard to my
conclusion that the disclosure was permitted under the APP 6.2(a)(ii) exception.
www.oaic.gov.au |
3
FOIREQ18/00066 000122
Decision
As I have decided the disclosure in this instance was authorised by APP 6.2(a)(ii), an
investigation is not required and I will cease inquiries into this matter.
If you wish to discuss this, please contact Mr Andrew Solomon, acting Deputy Commissioner,
on 02 9284 9708.
Yours sincerely
Angelene Falk
Acting Australian Information Commissioner
Acting Australian Privacy Commissioner
23 May 2018
www.oaic.gov.au |
4
FOIREQ18/00066 000123
Case note
Case Citation:
L v Commonwealth Agency [2010] PrivCmrA 14
Subject Heading:
Improper disclosure of personal information
Law:
Information Privacy Principle 11 in Part III Division 2 of the
Privacy Act 1988 (Cth).
The following case was decided by the Privacy Commissioner prior to 1 November 2010. On
1 November 2010 all the powers of the Privacy Commissioner under the Privacy Act were conferred
on the Australian Information Commissioner.
Facts:
The complainant made adverse comments in the media and on a blog about the way an Australian
government agency handled an application they had made. The agency received several enquiries
from the media about the issues and disclosed the complainant’s personal information in
responding to those enquiries. A journalist included that information in an article.
The complainant alleged that the agency improperly disclosed their personal information to the
journalist.
Issues:
IPP 11 prohibits agencies from disclosing personal information to anyone other than the individual
concerned, unless an exception applies.
The exception at IPP 11.1(a) permits disclosure where the individual concerned is reasonably likely
to have been aware, or made aware under Principle 2, that information of that kind is usually
passed to that person, body or agency.
Outcome:
The Commissioner investigated this matter under section 40(1) of the Privacy Act.
The Commissioner’s
Plain English Guidelines to Information Privacy Principles 8Ͳ11 provide
examples of when an individual may be considered to be reasonably likely to be aware that
information may be disclosed under IPP 11.1(a). The Guidelines state:
a person who complains publicly about an agency in relation to their circumstances (for
example, to the media) is considered to be reasonably likely to be aware that the agency
Office of the Australian Information Commissioner
1
FOIREQ18/00066 000124
may respond publicly – and in a way that reveals personal information relevant to the issues
they have raised.
The Commissioner took into account that the complainant had complained publicly about the
agency’s handling of their application. The information provided by the agency was confined to
responding to the issues raised publicly by the complainant. The Commissioner considered that the
complainant was reasonably likely to have been aware that the agency may respond, in the way it
did, to the issues raised. Therefore, the Commissioner took a preliminary view that IPP 11.1(a)
permitted that disclosure.
The complainant subsequently withdrew the complaint and the matter was closed.
Office of the Australian Information Commissioner
December 2010
Office of the Australian Information Commissioner
2
FOIREQ18/00066 000255
"UUBDINFOU D PG 0"*$ CSJFG
FOIREQ18/00066 000256
FOIREQ18/00066 000257
"UUBDINFOU E PG 0"*$ CSJFG
FOIREQ18/00066 000258
"UUBDINFOU F PG 0"*$
FOIREQ18/00066 000259 CSJFG
FOIREQ18/00066 000260
FOIREQ18/00066 000261
