Skip to main content
Skip to secondary navigation
Menu
Australian Government - Office of the Australian Information Commissioner - Home

Complaint Determination No 1 of 2004

Federal Privacy Commissioner April 2004 Complaint Determination No.1 of 2004 Parties to the complaint Complainants Respondent HistoryBackground, allegations and remedies soughtThe lawInvestigation processGeneral considerationsFindings Small business provisionsCharge for access to personal information via mail...

pdfComplaint Determination No 1 of 2004

Federal Privacy Commissioner

April 2004

Complaint Determination No.1 of 2004

    Parties to the complaint

    HistoryBackground, allegations and remedies soughtThe lawInvestigation processGeneral considerationsFindings

      Small business provisionsCharge for access to personal information via mail

      Charge for access to personal information via 190 number

      Correction of personal information via the 190 number

      Access via members

      Determination

      1. Made under the Privacy Act 1988 (Cth) (the Privacy Act) section 52.

      Parties to the Complaint

      Complainants

      2. The Tenants' Union of Queensland Inc, Tenants' Union of NSW Co-op Ltd, and complainants A and B.

      Respondent

      3. TICA Default Tenancy Control Pty Ltd.

      History

      4. This determination relates to a complaint lodged by the Tenants' Union of Queensland Inc (TU QLD) in February 2003 under section 36 of the Privacy Act.

      5. The respondent to the complaint is TICA Default Tenancy Control Pty Ltd (TICA). As set out below (see [10]) TICA's business activities involve the collection, use and disclosure of personal information. It is complained that certain acts and/or practices of TICA may be an interference with the privacy of individuals.

      6. The complaint is a representative complaint, lodged pursuant to section 38 of the Privacy Act. TU QLD has identified the class of member to the representative complaint as:

      • tenants or former tenants, who incur charges from TICA in order for them to access information about their listing on the database.

      7. I also received complaints made by the Tenants' Union of NSW Co-op Ltd (TU NSW), complainant A and Complainant B. The individuals the subject of those complaints fell within the class of members identified by TU QLD and, accordingly, those complaints were dealt with as a part of the representative complaint brought by TU QLD1 .

      8. I decided to investigate the relevant acts and practices of TICA pursuant to section 40 of the Privacy Act, being satisfied that there was an act or practice which may have been an interference with the privacy of an individual and that the complaints received were validly made under section 36 of the Privacy Act.

      9. I am also satisfied that the requirements for the making of a representative complaint, set out in section 38 of the Privacy Act, have been met.

      1.I note that section 38C of the Privacy Act gives me the power to amend a complaint so that it can be dealt with as a representative complaint. In the event that it is necessary to amend the complaints received from TU NSW and the individuals concerned so as to make them a part of the wider representative complaint, I would do so pursuant to section 38C of the Privacy Act.

      Background, allegations and remedies sought

      10. TICA is one of a number of organisations that operates what is known as a tenancy database. Its Tenancy History Database holds personal information about many thousands of Australians relating to alleged defaults on tenancy agreements, including failures to pay rent or damage to property. It also holds personal information about applicants for tenancies in what is known as the Enquiries Database. TICA collects personal information about tenants and tenancy applicants from property managers that are 'members' of TICA and makes the personal information it holds on its database available to its members for a fee.

      11. I understand that TICA has in place arrangements for individuals to access their personal information held by TICA in two ways:

      1. via mail for a charge of $11.00 which must be paid at the time of making a request for access by either bank cheque or money order. Personal cheques are not accepted. A written response is sent to individuals within 10 working days (or up to 14 days elapsed days as advised by TICA on its webpage 'Courtesy advice from TICA'.). The written response will either advise an individual that there is no personal information held in relation to them on the relevant database(s), or provide them with a copy of the personal information that is held in relation to them; or
      2. via a telephone call to 190 222 0346 (I will refer to this as 'the 190 number'). Calls to the 190 number are charged to the individual at a rate of $5.45 per minute inclusive of GST ($327 per hour). Higher rates apply from mobile or pay phones. The caller is advised of the charges at the beginning of the call and must elect to continue the call before the $5.45 per minute charge is imposed.

      12. When seeking access to their personal information, individuals must provide TICA with their full name, date of birth, driver's licence number, passport number if applicable and their current address and contact telephone number.

      13. Personal information obtained from individuals in the course of seeking access to their personal information is not added to the Enquiries or History Databases, nor is it disclosed to members.

      14. The complainants alleged that the amount TICA charges individuals for access to personal information is excessive. Further, the complainants argued that both the 190 number and the current mail system impose a charge for requesting access to personal information. Due to the number of issues canvassed in this complaint I have chosen to explain the nature of each allegation in detail whilst discussing my findings.

      15. Section 38(2) of the Privacy Act, requires amongst other things that a complaint identify the remedy sought. The remedy sought by the complainants is a declaration by the Federal Privacy Commissioner:

      • prohibiting any charges by TICA when tenants or former tenants contact the company by telephone during business hours; and
      • requiring TICA to provide information to a tenant or former tenant about their listing:
      1. electronically or by mail - for no cost; or
      2. by other means - only after approval by the Privacy Commissioner and on a marginal cost-recovery basis;
      • and requiring TICA to publicise on its website and in other appropriate materials the fact that access to information by a tenant can be provided free of charge electronically or on a cost recovery basis.

      The law

      16. The NPPs in Schedule 3 of the Privacy Act outline standards for handling personal information that legally bind organisations, as defined by section 6C(1) of the Privacy Act.

      17. Section 13A of the Privacy Act specifies that an act or practice of an organisation will be an interference with the privacy of an individual if, amongst other things, the act or practice breaches an NPP in relation to personal information that relates to that individual.2

      18. Most relevant to the present complaint are NPPs 3 and 6.

      19. NPP 3 provides:

      An organisation must take reasonable steps to make sure that the personal information it collects, uses or discloses is accurate, complete and up-to-date.

      2.TICA is not bound by an approved privacy code in terms of section 13A(b)(ii) of the Privacy Act.

      20. NPP 6 provides that:

        6.1 If an organisation holds personal information about an individual, it must provide the individual with access to the information on request by the individual, except to the extent that:

        1. in the case of personal information other than health information-providing access would pose a serious and imminent threat to the life or health of any individual; or
        2. in the case of health information-providing access would pose a serious threat to the life or health of any individual; or
        3. providing access would have an unreasonable impact upon the privacy of other individuals; or
        4. the request for access is frivolous or vexatious; or
        5. the information relates to existing or anticipated legal proceedings between the organisation and the individual, and the information would not be accessible by the process of discovery in those proceedings; or
        6. providing access would reveal the intentions of the organisation in relation to negotiations with the individual in such a way as to prejudice those negotiations; or
        7. providing access would be unlawful; or
        8. denying access is required or authorised by or under law; or
        9. providing access would be likely to prejudice an investigation of possible unlawful activity; or
        10. providing access would be likely to prejudice:
        1. the prevention, detection, investigation, prosecution or punishment of criminal offences, breaches of a law imposing a penalty or sanction or breaches of a prescribed law; or
        2. the enforcement of laws relating to the confiscation of the proceeds of crime; or
        3. the protection of the public revenue; or
        4. the prevention, detection, investigation or remedying of seriously improper conduct or prescribed conduct; or
        5. the preparation for, or conduct of, proceedings before any court or tribunal, or implementation of its orders; by or on behalf of an enforcement body; or
        • an enforcement body performing a lawful security function asks the organisation not to provide access to the information on the basis that providing access would be likely to cause damage to the security of Australia.

        6.2 However, where providing access would reveal evaluative information generated within the organisation in connection with a commercially sensitive decision-making process, the organisation may give the individual an explanation for the commercially sensitive decision rather than direct access to the information.

        Note: An organisation breaches subclause 6.1 if it relies on subclause 6.2 to give an individual an explanation for a commercially sensitive decision in circumstances where subclause 6.2 does not apply.

        6.3 If the organisation is not required to provide the individual with access to the information because of one or more of paragraphs 6.1(a) to (k) (inclusive), the organisation must, if reasonable, consider whether the use of mutually agreed intermediaries would allow sufficient access to meet the needs of both parties.

        6.4 If an organisation charges for providing access to personal information, those charges:

        1. must not be excessive; and
        2. must not apply to lodging a request for access.

        6.5 If an organisation holds personal information about an individual and the individual is able to establish that the information is not accurate, complete and up-to-date, the organisation must take reasonable steps to correct the information so that it is accurate, complete and up-to-date.

        6.6 If the individual and the organisation disagree about whether the information is accurate, complete and up-to-date, and the individual asks the organisation to associate with the information a statement claiming that the information is not accurate, complete or up-to-date, the organisation must take reasonable steps to do so.

        6.7 An organisation must provide reasons for denial of access or a refusal to correct personal information.

        21. Section 6D(1) of the Privacy Act defines a small business as one with an annual turnover of '$3,000,000 or less'. Section 6D(3) to 6D(9) of the Privacy Act provides for a small business to be classed as 'a small business operator' and therefore not subject to the Privacy Act except in specified circumstances, including where an organisation trades in personal information.

        22. The Privacy Act also provides that small businesses which are subject to the Privacy Act would not be subject to the provisions of the NPPs until 21 December 2002. Consequently, when investigating this complaint I have been restricted to examining evidence relating to the acts and practices of TICA which occurred after 21 December 2002 except where the Privacy Act provides otherwise.

        23. In this regard with respect to small businesses NPP 6 applies to personal information collected after 21 December 2002.3 With respect to providing individuals with access to personal information it is open to TICA to deny access to individuals on the basis that personal information was collected before 21 December 2002. However, I understand that in practice TICA does not make a distinction between personal information collected pre and post 21 December 2002 and is aiming to operate the whole database in compliance with the Privacy Act by providing access to all personal information held.

        3. Section 16D(4) of the Privacy Act.

        24. Section 52 of the Privacy Act provides that after I have investigated a complaint I may make a determination:

        • dismissing the complaint; or
        • finding the complaint substantiated and making a declaration that:
        • the respondent has engaged in conduct constituting an interference with the privacy of an individual and should not repeat or continue such conduct; and/or
        • the respondent should perform any reasonable act or course of conduct to redress any loss or damage suffered by the complainant; and/or
        • the complainant is entitled to compensation for any loss or damage - including injury to the complainant's feelings or humiliation suffered by the complainant.

        25. In my view it is also within my powers under section 27 of the Privacy Act to make recommendations which will promote compliance with the NPPs.

        26. Section 40(1A) of the Privacy Act provides that I must not investigate a complaint where the complainant has not first complained to the respondent, unless I consider that it was not appropriate for the complainant to have done so. In the present case, I am aware that TU QLD has had ongoing contact with TICA in relation to a number of privacy issues arising out of its activities and that this contact may be considered to be by way of 'complaint'. To the extent that the present complaint falls beyond those 'complaints' made to the respondent, which I note have not resulted in the resolution of these matters, I am satisfied that the complex nature of the issues raised and their significance for the rights of the people concerned makes it inappropriate for them to be the subject of direct complaint to the respondent.

        27. My Office's investigation of this complaint involved the following:

        • formally advising the parties that I was opening an investigation into the complaint under section 40(1) of the Privacy Act and inviting the parties to respond;
        • gathering evidence and considering information provided by TU QLD, TU NSW, the individual complainants and TICA in submissions or in response to matters raised by my staff or the complainants;
        • providing the respondent and the complainants with opportunities to comment on an initial preliminary view on the complaint in September 2003;
        • visiting TICA's premises to discuss the issues raised in the complaint, to observe its database in practice and gather additional information about the operation of the database;
        • providing the parties with the current Office position on the complaint in February 2004 following changes in some aspects of the views since September 2003 and extending an invitation to make oral and/or written submissions;
        • holding a hearing on 3 March 2004 affording the parties the opportunity to appear before me - TU QLD and TU NSW accepted the invitation to appear at the hearing;
        • considering written and oral submissions and gathering information to clarify claims made by the parties;
        • providing the primary representative complainant (TU QLD) and TICA with the opportunity to see information and submissions provided by the other party;
        • engaging an organisation specialising in 'mystery shopping' to make a number of requests for access via TICA's 190 number to test the time taken to provide a response;
        • pursuant to section 43(5) of the Privacy Act and the principles of procedural fairness, providing the parties with a revised preliminary view in March 2004 and a final opportunity to comment before I finalised the determination;
        • holding a further hearing on 8 April 2004 affording the parties the opportunity to appear before me - TICA accepted the invitation to appear at the hearing; and
        • providing TICA and TU QLD with copies of the submissions, excluding some material that involved personal information of third parties, made by the other party in response to my March preliminary view.

        28. Before setting out my findings in relation to this complaint I will make some general comments about the context in which this complaint is made.

        29. Housing is essential for all people and is one of the basic human rights set out in the Universal Declaration of Human Rights.4 The operation of tenancy databases is controversial because of their perceived impact on the ability of individuals listed on the databases to obtain housing. On the other hand tenancy databases, such as TICA, can be seen as a legitimate risk minimisation tool for property managers.

        30. A number of the NPPs relevant to this complaint require an assessment of 'reasonableness' (for example, the 'reasonable steps' required of an organisation under NPP 3). I take the view that in making an assessment of 'reasonableness', it is appropriate to take into account the purposes for which personal information is collected and the consequences for the individuals concerned. In this case I am satisfied that tenancy databases, such as the one operated by TICA, do have an impact on an individual's ability to obtain housing; my understanding is that this is part of the intention when establishing such databases.

        4. Article 25 of the Universal Declaration of Human Rights http://www.un.org/Overview/rights.html.

        31. However, this is only one factor I have taken into account. I have also considered the overall intention of the Privacy Act including that business needs to be able to operate efficiently and effectively and that the NPPs are general principles and are not prescriptive in how they apply.

        32. It is relevant to note that this complaint is against TICA, not its members. Accordingly, I will not consider how the NPPs apply to the acts and practices of its members. That would be the subject of separate investigation should such a complaint be made against a member I acknowledge TICA's request in its submission in response to my March preliminary view that it be advised about practices of its members that may be breaches of the Privacy Act so that it can assist to address these practices.

        Small business provisions

        33. I find that TICA is an 'organisation' as defined by section 6C(1) of the Privacy Act, and is accordingly bound by the NPPs.

        34. TICA does not appear to fall within the exemption to the Privacy Act which applies to 'small business operators'5. TICA is a 'small business' in terms of the Privacy Act, in that its annual turnover is '$3,000,000 or less'. However, as TICA trades in personal information, it does not appear to fall within the definition of 'small business operator' by virtue of section 6D(4)(c) of the Privacy Act.6

        5 I note that TICA has been offered the opportunity to make any submissions or provide any material to me in relation to this exemption. I have not received any submissions or material in relation to this issue.

        6 I note that section 6D(4)(c) of the Privacy Act does not prevent a body corporate from being a 'small business operator' only because it discloses personal information with the consent of the individual, or as required or authorised under legislation. I am not presently of the view that TICA has the consent of all of the individuals whose personal information appears on their database (in particular, those individuals whose personal information was collected before 21 December 2002) and is disclosed to TICA's members. I note that TICA has not claimed that it does have such consent, although it has been given the opportunity to do so.

        Charge for access to personal information via mail

        Complainants' allegations

        35. There are, in essence, two complaints in relation to the charge of $11.00 imposed by TICA for mail inquiries. The first is that the charge is a charge that applies to lodging a request for access to personal information, contrary to NPP 6.4(b). The second is that the charge is excessive, contrary to NPP 6.4(a).

        36.In support of the second aspect of this complaint, the complainants suggest that the cost acts as a disincentive to individuals to exercise their access right. They allege that the mail charge does not reflect the actual cost to TICA in providing mail access to personal information. They further argue that the cost of purchasing a money order (the cost of which is $2.50 Australia wide, except in Western Australia where stamp duty increases the cost to $2.60) or a bank cheque ($8.00) must be added to this charge, raising the actual costs to the individual to between $13.50 and $19.00.

        TICA's response

        37. TICA denies that it charges a fee for the lodgement of access requests via mail. Rather, they seek to characterise the charge as being one for the supply of information, based on the fact that the provision of any information (including the fact that no personal information is held in relation to an individual) requires the use of resources which amount to a cost to TICA.

        38. TICA argues that a request for access is made, not when the individual actively advises the organisation that they wish to access their personal information but when the individual seeks information about how they may obtain access to their personal information. For example TICA states that when an individual searches the TICA website for information about access methods 'the individual is seeking access via our website and as such is requesting access. The individual is advised via our website on how access can be obtained and therefore the request is made prior to the advice on how access is obtained. The request via the website is free of charge'. Another example provided by TICA is as follows: 'The individual obtains information from tenancy advocacy groups, government departments and so on about access. That information is obtained free of charge and the individual is advised how to access and the costs for access'.

        39. TICA further claims that the charge is not excessive as it reflects the costs incurred to provide the mail access service. TICA also claim that the cost is not priced in an attempt to, nor does it, discourage individuals from making access requests.

        Does the charge apply to lodging a request for access?

        40. The ability of individuals to gain access to personal information about themselves is critical to their ability to exercise the rights to privacy provided by the Privacy Act. NPP 6.4(b) requires that organisations which hold personal information about individuals allow requests for access to be made without applying a charge for 'lodging' such a request.

        41. There has been no judicial consideration of NPP 6.4(b), or the issue of what is a charge for 'lodging a request for access'. I am of the view that the proper approach is to consider the ordinary meaning of the expression. In my view, a charge which is payable upon making a request, without which no action will be taken in processing that request (including making a determination of whether or not any information is held in relation to that person) is a charge which '[applies] to lodging a request for access'.

        42. This does not prevent TICA from imposing a charge for access to personal information and requiring its payment 'up front'. Such a charge could be imposed at a stage at which it is determined that personal information is, in fact, held in relation to a person. While I do not encourage charges to be imposed for access to personal information, for the reasons set out below, it seems that such a charge is permissible under NPP 6.4 provided that it is not excessive.

        43. In my March preliminary view I suggested that one way to avoid the present problem may be for there to be a mechanism (by phone, email, internet, fax, or mail) by which individuals are able to find out, for no charge, whether or not their personal information is held by TICA, at which point they are either informed that no personal information is held by TICA or that personal information is held and that if they wish to have access to that information, a fee is payable. It is relevant to note that such personal information is stored electronically and this initial assessment is unlikely to be onerous (although I accept that it cannot be said to be without any cost to TICA). I note also that if such requests are received over the phone or by email, the process of notification that personal information is held and that a charge is payable for access is made particularly easy and efficient. In any event, it may be that there is a minimum level of service required to comply with NPP 6.4(b).

        44. TICA responded by arguing that such a mechanism would necessitate the introduction of an additional database, the 'Public Inquiry' database, which would 'need to be accessed each and every time an individual sought access' to ensure that individuals are not making access requests that are frivolous or vexatious. TICA submits that such a database would be necessary 'so that the free service the Commissioner would be inflicting upon TICA could not be abused'. TICA further argues that the implementation of such a database would increase the time taken to provide access and would be likely to increase the cost of access borne by individuals.

        45. I stress that the mechanism proposed in paragraph 44 is a suggested resolution based upon TICA's current operations and is not directive. I am not convinced, however, that there would be any need for an additional database to be created to prevent 'abuse' of the 'free service'.

        46. Although NPP 6.1(d) provides that organisations can deny access on the basis that a request is frivolous or vexatious, there is no obligation on organisations to create such a 'Public Inquiry' database nor do organisations have to screen each access request to determine if it is frivolous or vexatious. The decision to take this course of action would be TICA's. Organisations that are engaging in such a practice would need to be convinced that the collection of this personal information is necessary to their functions or activities and be careful to ensure that this personal information is used in accordance with NPP 2. In particular I would be carefully monitoring such organisations to ensure that this personal information was not used for unlawful secondary purposes.

        47. I find that the $11.00 charge in its current form is a charge which applies to lodging a request for access and is a breach of NPP 6.4(b).

        Is the charge for access excessive?

        48. As a consequence of finding that the $11.00 charge in its current form is a charge which applies to lodging a request for access and is a breach of NPP 6.4(b) it may therefore not be strictly necessary for me to consider whether or not the charge, in as far as it could also be said to be a charge for providing access to personal information, is excessive. However, the matter is the subject of specific complaint and I have received significant submissions from both the complainants and TICA on the issue. I will therefore provide my findings.

        49. A decision to charge for access to personal information is at the discretion of an organisation. In my view it is preferable that organisations do not charge an access fee, or only do so where the organisation would incur substantial costs in the provision of access. This view is consistent with the Explanatory Memorandum to the amendments to the Privacy Act that introduced NPP 6 which indicates that the intention of the section is to allow for organisations to charge for work done only where 'substantial costs' are incurred.7

        50. However, NPP 6.4 is unambiguous in saying that organisations may charge for access provided that charge is not excessive. The NPPs do not specifically state that access charges can only be imposed where substantial costs have been incurred. While the Explanatory Memorandum is relevant in understanding the terms of the Privacy Act, I am ultimately bound by the terms of the Privacy Act itself.

        7.Privacy Amendment (Private Sector) Bill 2000 Revised Explanatory Memorandum http://scaleplus.law.gov.au/html/ems/0/2000/0/0642454531.htm.

        51. TU QLD compare TICA's mail access charge to that of the consumer credit reporting databases which provide access within ten days for no cost. However, credit reporting databases are required to provide access on these terms by the Consumer Credit Code of Conduct issued by the Federal Privacy Commissioner under section 18A of the Privacy Act 8. There are no such specific requirements in the NPPs nor is there a provision for the Federal Privacy Commissioner to make this a blanket requirement for all organisations. The comparison drawn by the complainants does not, therefore, appear to be of much assistance.

        8. Credit Reporting Code of Conduct and Explanatory Notes, paragraphs 1.6 and 1.12, Privacy Commissioner March 1996.

        52. The complainants have also put to me that in making a finding about whether the cost of providing access is excessive I need to take into account the economic circumstances of the individuals who are seeking access. In my opinion this is a relevant consideration. I accept that people are more likely to be listed on a tenancy database if they are facing economic hardship as this will make them more likely to default on rental payments or have an outstanding debt.

        53. I have also taken into account the potential importance of access to the information on a tenancy database. An adverse listing may prevent an individual from obtaining housing. If such a listing is inaccurate, the ability to promptly access the information so as to be able to correct it may be vitally important.

        54. In addition the complainants have argued that the assessment as to whether the charge for access is excessive must also take into account the fact that TICA to date has not accepted personal cheques but rather has required payment by money order or bank cheque. I find that these additional costs (although they are not part of the 'charge' imposed by TICA) are relevant to determining whether or not the charge is excessive in all of the circumstances. Research by this Office indicates that the cost of a bank cheque can vary from $6.50 up to $15.00. The cost of a money order is $2.50, or $2.60 in WA.

        55. I have also taken into account the costs to TICA in providing mail access to personal information. In my view, the additional marginal cost of providing access is an important factor in determining whether or not a charge for access to personal information is excessive. There are, for example, the costs for postage, stationery, staff time in confirming the individual's identity, staff time in searching the databases and staff time in preparing the material. Nevertheless, it is relevant that TICA's database is intended to provide prompt and easy access to the information it contains. It is not a system which involves extensive documentary records - it is an electronic database.

        56. I have considered the charges that other organisations are making to provide access, including for example the charges made for providing access to health records. These charges vary considerably.

        57. I am also aware that some businesses offer a 'no charge' access service for individuals who are willing to wait for access to information (for example for a period of 10 days), and a 'premium' service for which a charge is incurred when access is sought immediately. In my opinion, this approach is a better practice and I would encourage TICA to consider providing a 'no charge' means of providing access. TICA may wish to consider, for example, providing access via secure email for no cost. The cost of providing this method of access is likely to be considerably less than providing a written copy as there are no costs for stationery or postage. However, it must be remembered that the charge for a premium service must not be excessive.

        58. In the course of my investigations I indicated a preliminary view that the charge of $11.00 was not excessive. Having received further submissions from the complainants on this issue, having further considered the matters I have set out above and based upon TICA's current operations, I find that, in all of the circumstances, a charge of $11 for access is excessive and a breach of NPP 6.4(a).

        59. In communications between my Office and TICA throughout the course of this investigation, TICA indicated that it may be possible reduce its mail access charge. A figure of $8.80 was suggested by TICA. Having assessed further information that TICA has provided at my request about its relevant marginal costs, it is my view that a charge of $8.80 more accurately reflects TICA's costs in providing mail access.

        60. In discussions with my Office, TICA has agreed to investigate the provisions of payment by credit card. Further, TICA indicated it would consider accepting requests for mail access via facsimile with payment by credit card. This facsimile number would be advertised on the TICA website and documentation. Such changes would, in my opinion, be reasonable and sensible.

        Charge for access to personal information via the 190 number

        Complainants' allegations

        61. As in the case of the complaint made in relation to the $11.00 charge for access to personal information via post, the complaint in relation to the charge for access to personal information via TICA's 190 number ($5.45 per minute) has basically two elements. The first is that the charge (or a component of it ) is a charge which applies to lodging a request for access, contrary to NPP 6.4(b). The second is that the charge is excessive, contrary to NPP 6.4(a).

        62. In support of its argument that the charge is excessive, the complainants claim that the charge does not reflect the actual cost to TICA in providing telephone access to personal information. They also note that the cost acts as a disincentive to individuals to exercise their access rights.

        TICA's response

        63. TICA acknowledges that the 190 number imposes a greater cost to the caller when the call exceeds two minutes than would be the case if the request was made by mail. However, it argues that the phone access service is faster and immediate, therefore the greater cost is justified. TICA does not consider the 190 number charge for access to be excessive or a disincentive to persons seeking access to their personal information.

        64. TICA states that the amount of gross income generated by the 190 service in the period December 2000 to December 2002 was not sufficient to cover the cost of providing the 190 service. TICA contends that the reason it has office space and non-directorial staff is so individuals can access the database. It claims that without the additional staff needed to provide the 190 access service the business could be run from a small home office. TICA has provided statistical information showing that in the period February 1999 to February 2003 the average 190 call time has decreased from 12.95 minutes to 3.76 minutes. TICA claim that the reduced call length is a result of IT upgrades. TICA itself does not receive the full $5.45 per minute from calls made to the 190 number; a substantial proportion of this cost is received by telecommunications companies.

        Does the charge apply to lodging a request for access?

        65. I note TICA's claim that the 190 number generates revenue but not profit. Nonetheless, in my opinion, NPP 6.4(b) prohibits an organisation from charging an individual for lodging a request for access to their personal information, irrespective of whether or not such a charge generates revenue or profit.

        66. The only way individuals can make a telephone request for access is by incurring a $5.45 per minute charge. It is therefore my finding that this is a charge which applies to lodging a request for access, contrary to NPP 6.4(b).

        67. While I am of the opinion that at present TICA does not provide any means of accessing personal information without the payment of a fee for lodging a request for access to personal information, I would note that I consider it is not a response to a breach of NPP 6.4(b) that a person could seek access in another way which does not attract a charge for lodging a request for access. The terms of NPP 6.4(b) would appear to be clear. If an organisation charges for providing access to personal information, those charges must not apply to lodging such a request. I find that any charge that is properly viewed as applying to lodging a request for access is impermissible under the terms of NPP 6.4(b).

        Is the charge excessive?

        68. As I noted above in the context of my findings in relation to the charge for mail access, it may be unnecessary for me to consider whether the charge for the use of the 190 is excessive in as far as it relates to access to personal information. However, for the same reasons, I believe that it is appropriate that I provide my findings on the issue.

        69. I accept the complainants' argument that the motive of the private sector amendment to the Privacy Act was to avoid discouraging individuals from seeking access to their personal information. I also acknowledge that individuals who contact the 190 number may be calling because they seek immediate access to their personal information and they have no idea how long the access process will take or how much the access charge will be. In my opinion, individuals wanting to access their personal information who may be on modest incomes may be discouraged from seeking access if there are charges for making a call and they have no way of knowing in advance how much the call might be.

        70. In considering this matter it is important to make a clear distinction between costs of access via the 190 number and call costs imposed as a result of 'non-access conversations'. My examination is restricted to the portion of the call that is relevant to access. I find that any portion of a call that deals with a discussion about tenancy laws is to be excluded from my deliberations. If a caller has obtained access and is subsequently discussing general tenancy matters, this portion of the conversation will not be relevant to the amount of the access charge.

        71. In considering if the access charge imposed by the 190 number is excessive I am of the opinion that I should give weight to both the per-minute cost of the call and the length of the telephone call. It is the combination of these factors that gives rise to the actual cost incurred by individuals.

        72. I am not in a position to make a finding as to how much each individual forming a part of this representative complaint has been charged by TICA to access their personal information via the 190 number. Neither TICA nor TU Qld suggested that I should attempt such an exercise. The amount will vary in every case depending upon the time taken.

        73. However, in the course of investigating the complaint there was significant discussion of average times taken to provide access and this is, in my view, a useful starting point in assessing whether or not the charge for access to personal information over the telephone is excessive.

        74. TU QLD claims that the average call time to obtain access is more than 4 minutes 40 seconds. The cost for such a call is approximately $25.45.

        75. TICA initially claimed that calls to the 190 number for information on listings last an average of two to three minutes. This represents a cost of $10.90 - $16.35.

        76. In order to establish an independent assessment of the average time it takes to obtain access via the 190 number I engaged a market research company to conduct an appropriate test. The result of that test was that the call times for access to personal information where the caller had their identification details at hand and did not discuss any matters except access took an average length of 6 minutes and 3 seconds. The cost for such a call is in excess of $32.

        77. TICA was provided with the opportunity to comment on the findings of the market research company. TICA did not dispute the times recorded by the market research company. However, it did seek to explain why such results may have been reached. TICA advised that the length of access calls to the 190 have increased since the commencement of this complaint. This is because TICA was initially providing individuals with access to their personal information contained in the Tenancy History database only. After advice from my Office, TICA began providing individuals with access to their personal information contained in both the Enquiries database and Tenancy History database. TICA explains that additional time arising from searches of the Enquiries database account for the discrepancy between the initial time advised (two to three minutes) and the average time found by the market research company. TICA concluded that the estimation of time provided by TU QLD was 'closer to being accurate' than that provided by the market research company because the latter estimation was arrived at after the practices of TICA were changed to comply with the Privacy Act.

        78. I accept that compliance with the requirements of the Privacy Act may have increased the time required to provide access to individuals' personal information. Nevertheless, the issue I am required to consider is whether, in all of the circumstances, the charges imposed by TICA for access are excessive. It is no answer to this question that access could be provided more cheaply if TICA was not required to comply with the Privacy Act. For the reasons set out above, I have found that TICA is required to comply with the Privacy Act.

        79. On the evidence before me, I am satisfied that the individuals who are members of the class of complainants to this complaint are presently charged, on average, $32 for access to their personal information via TICA's 190 number.

        80. In assessing whether or not this charge is excessive I have considered the factors set out above in the context of the charge for mail access, in particular:

        • people seeking access to information from a tenancy database are more likely to have a lower capacity to pay a charge;
        • the impact of imposing an excessive charge for access is potentially significant as it may make prompt access unaffordable for persons of limited means who are seeking to correct an incorrect record which may have the effect of denying them access to housing; and
        • the relevant marginal cost to the respondent of providing access will be an important factor.

        81. In the course of conducting this investigation, I raised with TICA my concerns about the impact that the 190 telephone access charge has on individuals and sought detailed information about the marginal cost to TICA in responding to a standard request for access. During the investigation of this complaint TICA offered to reduce the telephone access charge to $4.50 per minute based upon it current operations. This may indicate that there is room in TICA's cost structure to reduce the 190 access charges.

        82. In all of the circumstances I find that the current charge of $5.45 per minute for access via the telephone, resulting in an average cost of $32, is excessive.

        83. I therefore find that this aspect of the complaint is substantiated. Pursuant to section 52(1)(b)(i)(B) of the Privacy Act, I declare that the respondent, TICA, has engaged in conduct constituting an interference with the privacy of individuals within the class of complainants. I further declare that the respondent should not repeat or continue such conduct.

        84. I am not of the view that I am able to prescribe the manner in which TICA should act so as to avoid a repetition or continuation of the conduct which I have found to be a breach of the Privacy Act. It would appear, however, that TICA will be able to avoid continuing to charge an excessive amount for access to personal information on the telephone either by reducing the amount charged per minute for access, or finding ways to reduce the time taken to provide information to people making inquiries over the telephone, or both.

        85. One ongoing concern that I have with TICA's current method of charging for telephone access is that there is no maximum call cost. Setting a reasonable maximum call cost would appear to be an effective way to avoid the imposition of an excessive charge for access, particularly in cases where, for whatever reason, telephone access takes more than the average time.

        86. Under section 52(1)(b)(ii) of the Privacy Act I am able to make a declaration that the respondent should perform any reasonable act to redress any loss or damage suffered by class members. There is not sufficient evidence before me to determine the extent of the loss or damage suffered by class members, either in total or individually. In the circumstances I do not make any declaration for compensation under s 52(1)(b)(ii) of the Privacy Act.

        87. I note, however, that individuals have a means of redress through making an individual complaint to my Office if they believe that TICA has imposed an excessive access charge via the 190 number. Individuals would need to supply evidence that they sought access to their personal information via the 190 number and that the cost of the call was excessive.

        Correction of personal information via the 190 number

        Complainants' allegations

        88. The complainants alleged that the 190 number charges a fee for amending personal information.

        Findings

        89. I agree with the complainants that where TICA is receiving a request to amend information via the 190 number there is a charge to the individual. NPP 3 imposes an obligation on organisations to take 'reasonable steps' to make sure that the personal information it collects, uses and discloses is complete, accurate and up-to-date.

        90. In addition NPP 6 requires organisation to take reasonable steps to amend personal information that is proven to be inaccurate, incomplete or out-of-date.

        91. It is not in my view taking 'reasonable steps' to charge individuals for the time it takes to meet these obligations. A detailed discussion of NPP 3 is provided in Determination No. 2 of 2004.

        92. However, I find there is a mechanism whereby individuals can amend their personal information, namely by mail. Although I acknowledge that telephone amendment is, in most cases, a swifter means of amendment, and there is a cost incurred to the individual, in my opinion, this cost incurred via the 190 number is not specifically prohibited by the Privacy Act and there is a no-cost method of amendment available via mail. I do believe that this practice is contrary to standard industry practice and, I would urge TICA to provide a local call cost method of resolving disputes and amending personal information, or to telephone individuals to deal with such matters via the phone at no cost to the individual.

        Access via members

        Complainants' allegations

        93. TU NSW has complained that TICA does not allow its members (property managers) to give personal information on the database directly to individuals. Whilst this would be a way that individuals could get access to their personal information held by TICA (and at no cost to TICA) this is not access from TICA itself.

        TICA's response

        94. TICA claims that it has never prevented its members from providing information to individuals about listings but has prohibited members from providing printed copies of listings as the member's login information and password is printed at the bottom of the pages.

        Findings

        95. I find that there is no obligation for TICA to provide individuals with access to their personal information via property managers and this is not a breach of the Privacy Act. However, I would certainly encourage such an arrangement being set up, so long as individuals seeking access identify themselves (to ensure that inappropriate disclosure to third parties does not take place).

        Determination

        96. I find that TICA has breached NPP 6.4(b) by charging individuals an $11.00 fee to lodge a request for access to their personal information via mail. I therefore find this element of the complaint substantiated and declare that TICA has engaged in conduct constituting an interference with the privacy of individuals who are the members of the class identified in the complaint. I declare that this conduct should not be continued or repeated.

        97. I find that TICA has breached NPP 6.4(a) by charging individuals an excessive amount of $11.00 for access to their personal information via mail. I therefore find this element of the complaint substantiated and declare that TICA has engaged in conduct constituting an interference with the privacy of individuals who are the members of the class identified in the complaint. I declare that this conduct should not be continued or repeated.

        98. The complainants have asked me to make declarations requiring TICA to provide access via specific methods. In my opinion, I do not have the power to do so under section 52(1)(b)(i)(B) of the Privacy Act. Having found that TICA has engaged in conduct constituting an interference with the privacy of an individual I am able to declare that it should not repeat or continue that conduct, but it does not appear that I have the power to otherwise prescribe how TICA should act.

        99. However, based upon TICA's present practices, I would recommend that TICA charges no more than $8.80 for access to personal information via mail and:

        • implement an alternate charging option, namely credit card;
        • maintain this charge for three years from the date of this determination (subject to any legislative requirement to do otherwise);
        • provide access within working ten days (that is the individuals receive their personal information within ten days on average)9.

        9.I note that there is no requirement in the NPPs for access to be provided within a specified timeframe and that I have said, for example in my Guidelines to the National Privacy Principles, that it is generally reasonable for organisation to provide access within 30 days. In the present case, however, given the nature of the database, the information on it, the importance of access for individuals and the fact that access to housing may be at risk unless access (and correction) is achieved quickly I consider that 10 days is an appropriate time for providing access. It is also my opinion that the time taken may be considered relevant in determining whether or not a charge is 'excessive' in the circumstances.

        100. I find that TICA has breached NPP 6.4(b) by charging individuals a $5.45 per minute fee to lodge a request for access to their personal information via the 190 telephone number. I therefore find this element of the complaint substantiated and determine that TICA has engaged in conduct constituting an interference with the privacy of individuals who are the members of the class identified in the complaint. I declare that this conduct should not be continued or repeated.

        101. I find that TICA has breached NPP 6.4(a) by charging individuals an excessive amount of $5.45 per minute for access to their personal information via TICA's 190 number. I therefore find this element of the complaint substantiated and determine that TICA has engaged in conduct constituting an interference with the privacy of individuals who are the members of the class identified in the complaint. I declare that this conduct should not be continued or repeated.

        102. Based on TICA's present practices, I would recommend that the 190 number access charge be reduced, at least to $4.50 per minute for a period of three years. I further recommend that lhe length of access calls be kept to a minimum to ensure that the cost does not become excessive, or alternatively that a means by which call costs can be 'capped' be introduced. As noted earlier individuals have a means of redress through making an individual complaint to my Office if they believe that TICA has imposed an excessive access charge via the 190 number. Individuals would need to supply evidence that they sought access to their personal information via the 190 number and that the cost of the call was excessive.

        103. I find that the complaint in relation to TICA's practice of amending personal information via the 190 number is unsubstantiated and is therefore dismissed.

        104. I find that the complaint in relation to TICA's failure to provide access to personal information via its members is unsubstantiated and is therefore dismissed.

        Malcolm Crompton Federal Privacy Commissioner

        Dated 16 April 2004