In brief – Changes to law and consumer attitudes lead to increased focus on privacy
Case notes published by the
Office of the Australian Information Commissioner provide a useful lesson for insurers about the nature of insurance-related privacy complaints and the Privacy Commissioner’s likely approach to future breaches of privacy obligations.
Increased powers of Privacy Commissioner
The reforms to the
Privacy Act 1988 came into effect in March 2014. Much has been written about the new Australian Privacy Principles and the expanded privacy obligations for organisations covered by the Act. However, the reforms also gave the Privacy Commissioner new enforcement powers and substantially increased the potential penalties for breach.
The Commissioner now has powers to investigate an alleged interference with privacy not only following a complaint, but also on its own initiative, to make a determination, to accept an enforceable undertaking and to bring proceedings to enforce such an undertaking and to apply to the court for civil penalty orders of up to $340,000 for individuals and up to $1.7 million for companies.
In addition, the Commissioner will be able to audit private sector organisations to determine whether they are handling personal information in accordance with the applicable legislation.
Increase in privacy-related consumer concerns and complaints
Privacy is important to consumers and they are increasingly prepared to take action to protect their personal information. Recently the Privacy Commissioner stated:
Privacy complaints to the OAIC are on the rise with the OAIC having received almost 3,000 complaints this financial year. That represents over a 50% increase on the previous year’s figure. We also know that a majority of Australians (60%) have chosen not to deal with organisations because they were concerned about how their personal information would be handled. The message is clear that people are prepared to exercise their rights to how their personal information is handled. Businesses must recognise and adopt the business case for privacy, and this means prioritising the privacy of their customers.
“…may disclose to anybody any information about you”
Examples of the sorts of complaints that have been made in the past against insurance companies can be found in case notes published by the Privacy Commissioner. In one matter, the insurer’s standard claim form asked the insured to agree that the insurance company “may disclose to anybody any information about you”. The insured did not sign the claim form and instead wrote to the Privacy Commissioner.
On investigation, and not surprisingly, the Privacy Commissioner agreed that the terms of the claim form were very broad. He did not take further action because the insurance company provided evidence that its practice was not to rely on the broad consent given in the standard claim form, but to rely on later more specific authority and because it also agreed to amend the claim form to remove the broad form of consent.
Disclosure amounts to breach of National Privacy Principles
In another example, the claimant completed a claim form which included a declaration allowing the insurance company to collect any records or information which may affect the claim and which authorised the insurance company to obtain information and documents from a number of specified parties, including a business. The insurance company telephoned the relevant business and spoke to an employee.
During the course of the conversation, the insurer’s representative disclosed that the claimant was claiming compensation and questioned the employee as to the nature of the relationship between the claimant and the former principal of the business (who was now deceased). The claimant complained to the Privacy Commissioner.
The Commissioner determined that there had been a breach of the then National Privacy Principles, because the consent on the claim form did not extend to collection of information about the de facto relationship and did not give any indication that the claimant’s personal information would be disclosed to the employee.
The Commissioner successfully conciliated the matter and closed the complaint. Although the case note does not give details of the agreed settlement, presumably it included some payment to the claimant.
Witness statements and commercially sensitive information
A further example does not involve an insurance company's disclosure of information, but rather its refusal to disclose certain information. The complainant made an insurance claim which was investigated and paid. The complainant then sought access to information collected about them during the course of the investigation. The insurance company supplied some documents but refused to provide access to others, in particular witness statements.
The Privacy Commissioner looked at the documents and decided that the complainant was not entitled to the witness statements as, in this case, the individuals who provided them would not have expected that their identity would be revealed and because masking their names would not prevent their identification which could be discerned from the content.
The complainant also could not have access to certain other documents that described the type of information that the insurer considered to be important when it assessed claims, as that information was commercially sensitive.
However, the complainant was granted access to the remaining documents on the basis that the third party or commercially sensitive information would be masked out.
Commissioner’s approach to breaches of privacy obligations
These examples are all examples of complaints dealt with before the recent reforms, and the Privacy Commissioner’s increased enforcement powers, but do give some indication of the Commissioner's likely approach to breaches of privacy obligations.
Further, in March 2014 the Commissioner issued a draft regulatory action policy which makes it clear that, while much of the media coverage at the time of the reforms focussed on the vastly increased financial penalties and while they will not hesitate to take action in the case of a serious breach of the law, such as a breach having an impact on a large number of individuals, the Commissioner’s preferred approach is to work with organisations subject to the Australian Privacy Principles to encourage compliance and best privacy practice.
In deciding whether to pursue regulatory action in a particular matter, the Commissioner will consider a range of factors such as:
- the seriousness of the breach, taking into account factors such as the number of people affected and whether the conduct was deliberate or reckless
- whether the breach is an isolated or a systemic issue
- whether the entity has any prior breaches
- what action has been taken or is being taken by the entity to remedy the breach
- whether the entity has cooperated with OAIC
- issues of proportionality, taking into account the cost and time of court proceedings
Prevention is better than cure
The message is clear – organisations cannot afford to ignore their privacy obligations. Further, the adverse effects on an organisation's reputation of a data or other privacy breach remain considerable. At the end of the day, it is always better to take steps to prevent a privacy breach than to have to deal with the consequences of one.
This is commentary published by Colin Biggers & Paisley for general information purposes only. This should not be relied on as specific advice. You should seek your own legal and other advice for any question, or for any specific situation or proposal, before making any final decision. The content also is subject to change. A person listed may not be admitted as a lawyer in all States and Territories. © Colin Biggers & Paisley, Australia 2024.