OAIC statement regarding disclosure of Centrelink user personal information
(Ms A Fox, 29 May 2018)
Background – Centrelink disclosure of personal information
In February 2017, Ms Andie Fox wrote an article in which she was critical of Centrelink’s automated debt recovery system, and alleged that she was being wrongly pursued for a Centrelink debt.
Subsequently, a journalist wrote an article concerning Ms Fox which included certain details of her financial and personal affairs and her communications with Centrelink, which was based on information disclosed by the Commonwealth Department of Human Services (DHS) (operator of Centrelink).
On 28 February 2017, the Office of the Australian Information Commission (OAIC) commenced inquiries with the DHS concerning this disclosure of Ms Fox’s personal information by DHS.
The DHS submitted that the disclosure was authorised under Australian Privacy Principle (APP) 6.2(a)(ii) contained in the Privacy Act 1988 (Cth). APP 6.2(a)(ii) relevantly provides that if an entity holds personal information that was collected for a particular purpose (the primary purpose), it may use or disclose the information for a secondary purpose if the individual would reasonably expect it to do so, and the secondary purpose is related to the primary purpose. (Note that under APP 6.2(a)(i), if the personal information held was ‘sensitive information’, such as health information, the secondary purpose would need to be directly related to the primary purpose.)
Decision of the OAIC
On 29 May 2018, the OAIC (the acting Australian Information Commissioner and acting Privacy Commissioner) released a statement following the conclusion of its inquiries. The OAIC stated that it had ‘carefully considered the specific public statements’ made by Ms Fox, and the specific information disclosed in response, and concluded that the disclosure was permitted by APP 6.2(a)(ii) (as submitted by DHS).
The OAIC noted that it had regard to the matters outlined in the case of L v Commonwealth Agency  PrivCmrA 14 (24 December 2010) and in the OAIC’s APP Guidelines.
L v Commonwealth Agency  PrivCmrA 14 (24 December 2010)
In the case of L v Commonwealth Agency, a complainant had made adverse comments in the media and on a blog about the way a Commonwealth government agency had handled an application the complainant made. Subsequently, the agency received media enquiries about the matter and the agency disclosed the complainant’s personal information in responding to those enquiries. A journalist later included that information in an article.
Like in the case of Ms Fox, the complainant alleged that the Commonwealth agency improperly disclosed their personal information to the journalist.
The case considered the ‘Information Privacy Principles’ (IPPs) in the Privacy Act 1988 (Cth), which were replaced by the APPs in 2014.
IPP 11 provided a similar exception to disclosure as APP 6.2(a)(ii). IPP 11.1(a) relevantly permitted disclosure of an individual’s personal information where the individual was reasonably likely to have been aware, or made aware under IPP 2 (concerning the provision of information about the collection of the information), that information of that kind was usually passed to the recipient person, body or agency.
The then Privacy Commissioner referred to the IPP Guidelines applicable at the time, which provided examples of when an individual may be considered to be reasonably likely to be aware that information may be disclosed under IPP 11.1(a). The Guidelines stated that:
a person who complains publicly about an agency in relation to their circumstances (for example, to the media) is considered to be reasonably likely to be aware that the agency may respond publicly – and in a way that reveals personal information relevant to the issues they have raised.
The Privacy Commissioner considered that the complainant was reasonably likely to have been aware that the agency may respond, in the way it did, to the issues raised, and the Privacy Commissioner considered that IPP 11.1(a) permitted that disclosure.
The current APP Guidelines
The current OAIC APP Guidelines relevantly provide at paragraph 6.22:
Examples of where an individual may reasonably expect their personal information to be used or disclosed for a secondary purpose include where:
- the individual makes adverse comments in the media about the way an APP entity has treated them. In these circumstances, it may be reasonable to expect that the entity may respond publicly to these comments in a way that reveals personal information specifically relevant to the issues that the individual has raised …
To put it another way, paragraph 6.22 of the APP Guidelines supports a view that if a person criticises an organisation through the media (i.e. public criticism), that person may reasonably expect that the organisation would wish to respond to that criticism in a public manner too, and in a way which reveals the person’s personal information relevant to the issues they raised.
The OAIC decision in respect of the disclosure of Ms Fox’s personal information is consistent with the principles in the L v Commonwealth Agency decision, and the current APP Guidelines.
While the decision of the OAIC in this case suggests that an organisation may be able to disclose a person’s personal information in response to that person’s adverse public comments, paragraph 6.20 of the APP Guidelines states:
The ‘reasonably expects’ test is an objective one that has regard to what a reasonable person, who is properly informed, would expect in the circumstances. This is a question of fact in each individual case. It is the responsibility of the [organisation] to be able to justify its conduct.
This means that a decision concerning disclosure in such circumstances will need to be considered by an organisation on a case by case basis to determine if the ‘reasonably expects’ test is satisfied for the purposes of APP 6.2(a).
Even if the ‘reasonably expects’ test is satisfied for the purposes of APP 6.2(a), and an organisation wishes to disclose a person’s personal information to respond to the person’s public criticism, it should only disclose the minimum amount of personal information sufficient for that purpose (see paragraph 6.21 of the APP Guidelines).