Disputes between joint account holders always raise difficult issues for financial institutions.
In M v Financial Institution  PrivCmrA 16 a joint account holder complained to the Privacy Commissioner that the financial institution had improperly collected their personal information from a third party (a relative of the complainant's former partner) and used it in making a decision about the complainant's joint account, failing to ensure the personal information was accurate, complete and up-to-date.
After the contact, a staff member at the financial institution further modified the joint account to block all withdrawals not signed by both parties. The financial institution contacted the complainant about the modification days after it was made.
The financial institution argued that it did not collect information from the relative because it did not ask for the information. However, the Commissioner took the view that an organisation collects personal information if it gathers, acquires, or obtains information from any source and by any means (irrespective of whether the information was sought by the organisation). In addition, because the financial institution changed its accounts based on that information, the financial institution collected the information for inclusion in a record in accordance with section 16B of the Privacy Act.
Given the information was not provided by the account holders, was subject to change and had an effect on the complainant's finances, the Commissioner took the view that the financial institution had not taken reasonable steps to check the accuracy of the personal information it collected from the third party. Therefore, the financial institution had failed to comply with NPP 3.
The financial institution offered the complainant financial compensation. The complainant accepted the offer.