M and Law Firm [2011] AICmrCN 7 (22 December 2011)

Subject heading

Disclosure of personal information

Law

National Privacy Principles 2 in Schedule 3 of the Privacy Act 1988 (Cth)

Facts

A law firm, acting on behalf of the complainant's former utility service provider, commenced debt recovery with the complainant. The complainant subsequently settled the debt and was advised by the utility service provider that debt recovery would cease.

Before the utility service provider advised the law firm of the settlement the law firm sent correspondence to the complainant's neighbour seeking information from the neighbour about the complainant's whereabouts. The branding of the law firm, including on the letter to the neighbour, identified that its legal expertise included debt collection.

The complainant complained that the law firm contacted the neighbour and revealed they had had an outstanding debt.

Issues

NPP 2.1 provides that an organisation must not use or disclose personal information about an individual for a purpose other than the primary purpose of collection, unless an exception in NPP 2.1(a)-(h) applies.

NPP 2.1(a) permits the use or disclosure of personal information for a secondary purpose where that purpose is related to the primary purpose of collection, and the individual would reasonably expect the disclosure.

Outcome

The Commissioner investigated the matter under section 40(1) of the Privacy Act.

The law firm stated that it collected the complainant's personal information from the utility service provider for the purpose of debt recovery. As part of recovering the debt, the law firm sought information from third parties that it believed could assist in their investigation and debt recovery activity.

The Commissioner formed the view that the correspondence sent by the law firm amounted to a disclosure of the complainant's personal information. The information disclosed was that the law firm wished to contact the complainant, not any specific information about the debt.

The Commissioner considered that the disclosure of the complainant's information to a third party for the purpose of assisting them with their investigation into the complainant's whereabouts was related to the primary purpose of debt collection.

Further, the Commissioner was of the view that the individual would reasonably expect that an organisation would disclose its name, and the complainant's name, to contact a third party in the circumstances, which included the organisation not being able to contact the complainant.

Consequently, the Commissioner was of the view that the personal information disclosed by the law firm was consistent with NPP 2.1(a).

The Commissioner referred the complainant to the Australian Competition and Consumer Commissioner to consider whether the debt collection practices were consistent with its debt collection guidelines.

The Commissioner closed the complaint under section 41(1)(a) of the Privacy Act  on the ground that the law firm had not interfered with the privacy of the individual.

Office of the Australian Information Commissioner

December 2011