The Privacy Commissioner has published her reasons for two recent decisions awarding damages against Services Australia.

In ‘WZ’ and CEO of Services Australia (Privacy) [2021] AICmr 12 the Privacy Commissioner decided that Services Australia interfered with the complainant’s privacy as defined in the Privacy Act 1988 (Cth) (Privacy Act) by:

• disclosing the complainant’s personal information, namely, her new address to her former partner, for a purpose other than that for which it was collected, in breach of Australian Privacy Principle (APP) 6;
• failing to take reasonable steps to ensure that it used accurate and up-to-date personal information of the complainant in the form of her relationship status having regard to the purposes of its use, being to update her former partner’s address, in breach of APP 10.2;
• failing to take reasonable steps to ensure that it used accurate and up-to-date personal information of the complainant in the form of her address at which she could be contacted in breach of APP 10.2; and
• failing to take reasonable steps to protect the complainant’s personal information, being her updated address, from unauthorised disclosure to her former partner in breach of APP 11.1.

Services Australia was ordered to pay the complainant $19,980 for loss caused by the interference with the complainant’s privacy, and reasonably incurred expenses in connection with the complaint, comprised of $10,000 for non-economic loss, $8,000 for reasonably incurred legal expenses and $1,980 for reasonably incurred expenses in preparing a medical report.

The breach arose because the complainant and the former partner’s online records on their respective online accounts were linked and social security entitlements calculated with reference to their relationship. One effect of ‘linking’ records meant that if the complainant were to update her address using her online account, her partner’s address on his online account would also be updated to reflect the change, and vice versa. The Agency’s practice was to continue to keep such records linked unless and until it verified any claimed separation on the part of one of the linked individuals.

The Commissioner decided that on 13 October 2016 the complainant notified the Agency of her change of address and that on 5 January 2017 the complainant again notified the Agency of her change of address in person and that it was not updated to the new address, by the Agency’s customer service officer, until this time. The change in relationship status was not updated until later.

In ‘XA’ and CEO of Services Australia (Privacy) [2021] AICmr 13 the Privacy Commissioner found that Services Australia interfered with the complainant’s privacy as defined in the Privacy Act 1988 (Cth) (Privacy Act) by:

• disclosing the complainant’s address to an external debt collection agency, in circumstances where the relevant debt had been overturned, in breach of Australian Privacy Principle 6;
• failing to take reasonable steps to notify an external debt collection agency to correct the complainant’s personal information, namely that he owed a debt, in circumstances where the complainant requested such notification and where the Agency had itself corrected that personal information, in breach of Australian Privacy Principle 13.2.

Services Australia was ordered to pay the complainant $1,000 for loss caused by the interference with the complainant’s privacy.

No damages were awarded for any economic loss or aggravated damages.

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.