Privacy determinations

Finding: Breach of APP 11.1 and 11.2

Remedies: Apology —Damages of $3,500 (non-economic loss)

Privacy — Privacy Act — Australian Privacy Principles — Privacy Act 1988 (Cth) — s 52 — APP 11 - Security of personal information — Breach of APP 11.1 — Destruction or de-identification of personal information — Breach of APP 11.2 — Compensation awarded — Non-economic loss — Aggravated damages not awarded

Finding: Breach of APP 11.1 and 11.2

Remedies: Apology — Damages of $3,500 (non-economic loss)

Privacy — Privacy Act — Australian Privacy Principles — Privacy Act 1988 (Cth) — s 52 — APP 11 - Security of personal information — Breach of APP 11.1 — Destruction or de-identification of personal information — Breach of APP 11.2 — Compensation awarded — Non-economic loss — Aggravated damages not awarded

Finding: Breach of APP 6.1 and 10.2

Remedies: Damages of $10,000 (non-economic loss)

Privacy — Privacy Act — Australian Privacy Principles — Privacy Act 1988 (Cth) — s 52 — APP 6 - Disclosure by medical practitioner of patient's medical information — Breach of APP 6.1 — APP 10 — Quality of personal information — Breach of APP 10.2 — Compensation awarded — Non-economic loss — Aggravated damages not awarded

Finding: Breach of APP 6.1 and 11.1

Remedies: Apology — Amendment of complainant's certificates of insurance — Damages of $3,000 (non-economic loss) — Revision of NRMA customer information guides — Review of NRMA disclosure practices in relation to certificates of insurance

Privacy — Privacy Act — Australian Privacy Principles — Privacy Act 1988 (Cth) — s 52 — APP 6 - Use or disclosure of personal information — Breach of APP 6.1 — APP 11 — Security of personal information — Breach of APP 11.1 — Compensation awarded — Non-economic loss — Aggravated damages not awarded

Finding: Breach of NPP 2.1

Remedies: Apology — Damages of $2,000 (non-economic loss)

Privacy — Privacy Act — National Privacy Principles — Privacy Act 1988 (Cth) — s 52 — NPP 2 - Use or disclosure of personal information — Breach of NPP 2.1 —NPP 4 — Security of personal information — No breach of NPP 4.1 — Compensation awarded — Non-economic loss — Aggravated damages not awarded

Set aside following review: [2017] AATA 2426

Finding: Breach of NPPs 1.3 and 2.1

Remedies: Apology — Staff training — General damages of $15,000 — Aggravated damages of $5,000

Privacy — Privacy Act — National Privacy Principles — Privacy Act 1988 (Cth) — s 52 — NPP 1.1 - Necessary collection — NPP 1.2 — Fair and lawful collection — NPP 1.3 — Notice of collection - Breach of NPP 1.3 — NPP 2.1 — Use and disclosure of customer's personal information online — Breach of NPP 2.1 — NPP 4.2 — Retaining of data — Compensation awarded — Non-economic loss — Aggravated damages awarded

Finding: Breach of NPPs 1.5 and 4.1, and TFN Guidelines 2, 5 and 6.

Remedies: Apology — Compensation of $10,000

Privacy — Privacy Act — Collection of complainant's personal information — National Privacy Principles (NPP) — NPP 1.5 — Collection of complainant's tax file number (TFN) — TFN Guidelines 1992 — TFN Guideline 5

Security of personal information — NPP 4.1 — Disclosure of TFN — TFN Guideline 2

Storage, security and destruction of TFN information — TFN Guideline 6

Compensation awarded — Privacy Act 1988 s 52

Set aside following review: [2015] AATA 991

Subsequent appeal dismissed: [2017] FCAFC 4

Finding: Breach of NPP 6.1

Remedies: Access to personal information free of charge

Privacy — Privacy Act — National Privacy Principles — (CTH) Privacy Act 1988 — s 52 — NPP6.1 — Access