International Law

The Australian Privacy Commissioner, Karen Curtis, has published three new case notes:

• V v Commonwealth Agency [2008] PrivCmrA 22 - the complainant alleged a government agency had improperly collected and disclosed personal information in interviewing the complainant about the complainant's partner and then interviewing the complainant a second time in relation to a claim the complainant had given false information. The complaint was dismissed.

• Own Motion Investigation v Direct Marketer [2008] PrivCmrA 23 - An individual notified the Privacy Commissioner that the direct marketer sent out a promotional email which displayed the email addresses of all recipients. While the Office did not receive any individual complaints, the Commissioner decided to conduct an investigation into the incident under section 40(2) of the Privacy Act. The direct marketer explained that as a result of human error,a third party organisation distributed to everyone who was on the email list an email showing those individuals' email addresses, rather than using the blind carbon copy or 'BCC' email function.The third party organisation counselled the individual responsible for the error and staff undertook refresher training in its quality control procedures.These procedures were also updated to prevent a similar incident in the future.The direct marketer acted quickly to contact all individuals who were on the promotional email list to apologise and explain what happened.  The direct marketer also committed to report to appropriate authorities any misuse of the email addresses including issuing spam emails. No further action was taken.
• W v Pathology Clinic [2008] PrivCmrA 24 - The complainant had medical tests at a pathology clinic and asked that the results be provided only to their treating medical specialist and solicitor.  The test results were to be part of a claim that the complainant was making to a federal government agency.The complainant later became aware that the clinic had provided the results directly to that government agency.The clinic contended that this was an isolated error. The Commissioner formed the view that the disclosure was an interference with the complainant's privacy.The Clinic apologised unreservedly to the complainant. It also contacted the government agency and asked that the complainant's information be securely destroyed, and sent a copy of the results to the complainant's treating specialist as originally requested.The Clinic also settled the costs incurred in processing the complainant's tests, costs that would otherwise have been incurred by the complainant, and it paid the complainant an undisclosed sum to compensate them for any hurt suffered as a result of the interference with their privacy.