1 Feb 2002, 09:00

A woman applied for a position within a government department. She completed the Department's application form, supported by her curriculum vitae and a written reference from a former employer.

The application form asked the woman to nominate referees. It was the woman's understanding from the wording on the form that only those nominated referees would be contacted. In the event of a referee nominating another person to be contacted, she understood that the Department would advise her before speaking to that other person.

The woman was not short-listed for the position and her curriculum vitae and other papers were returned to her. From looking through the papers she discovered notes made by the person who had short-listed the candidates. The notes indicated that the former employer who had provided the written reference (but whom the woman had not nominated as a referee on the application form) had been contacted and had provided comments about her.

The woman considered that her failure to be short-listed for the position was directly related to the comments made by the person who gave the written reference. She believed that the comments, as recorded in the notes, were incorrect. The woman unsuccessfully attempted to resolve the matter directly with the Department and with the person who had provided the written reference. She complained to me.

The complaint raised issues under information privacy principles 3, 10 and 11. I formed the view that only principle 3 was breached.

Principle 10

This principle provides that an agency holding personal information that was obtained in connection with one purpose is not to use that information for any other purpose unless the agency believes, on reasonable grounds, that an exception applies.

The focus is on the agency's purpose in obtaining the information, rather than the supplier's purpose. In many cases these two purposes will be identical. However, in this case the woman's purpose and the Department's were different. Although the woman supplied the written reference with a particular purpose in mind (to show her suitability for the position) that did not control the use to which the Department could lawfully put it. Rather, it was the Department's purpose in obtaining that information which was relevant. The Department advised me that it obtained the information in the application in order to assess the woman's suitability for the position and this included checking all references supplied with the referee.

No breach of principle 10 will occur if an agency believes on reasonable grounds that the purpose for which the information is used is directly related to the purpose in connection with which the information was obtained (exception 10(e)). I took the view that the Department held the written reference as evidence of the woman's potential suitability for the position and that they had used it for that purpose. In my opinion exception 10(e) applied and there was no breach of privacy principle 10.

Principle 11

This principle provides that an agency that holds personal information must not disclose it unless it believes on reasonable grounds that an exception applies. The Department relied upon the exception provided in principle 11(a). Disclosing personal information will not breach principle 11 if the agency believes on reasonable grounds:

That the disclosure of the information is one of the purposes in connection with which the information was obtained or is directly related to the purposes in connection with which the information was obtained.

The Department obtained the written reference in order to use it to assess the woman's suitability for the position. In order to do so, it was necessary for the Department to tell the former employer that the woman had applied for a job, to receive confirmation that he had written the reference supplied and to receive his views on the woman's suitability for the position. Disclosing the fact of the woman's application was, in my opinion, directly related to the Department's purpose in obtaining the reference and therefore it fell within the exception 11(a).

Principle 3

Principle 3 provides that where an agency collects personal information directly from the individual concerned, it must take reasonable steps in the circumstances to ensure the individual is aware of, among other things, the fact of the collection, the purpose of the collection, who is collecting the information and who will receive it.

Applicants for the position were told to complete the Department's standard application form. That form asked applicants to nominate three referees. The form also stated that the Department might ask those referees to nominate other people who might be able to assist in assessing an applicant's suitability. The form stated that the Department would first advise the applicant.

The woman indicated on the form that she agreed to the Department asking those referees to nominate other people who might assist it in assessing her suitability for the position. The Department's advice was set out in the section headed 'Referees' which the woman would have seen.

h1.The Department's arguments
Unsolicited material

The Department submitted first, that the material was unsolicited information and therefore was not subject to the requirements of principle 3.

I was not persuaded of this. The woman did not speculatively submit the application form and her curriculum vitae. She supplied it in accordance with the advertisement, which indicated that applicants should use the Department's form. It did not advise applicants that they must only use that form, merely that the minimum method of application was completion of the form. It does not follow that any additional information supplied constituted 'unsolicited Material' the application form itself indicated in the 'Notes for Applicant' that a curriculum vitae containing additional information should be attached.

It seemed to me that an application submitted in response to the Department's advertisement would comprise the completed form plus curriculum vitae, which would include other material that the applicant considered relevant - in this case, written references. I formed the opinion that the Department should have complied with the obligations in principle 3 by advising applicants that any references supplied may be followed up and that by not doing so the Department had breached principle 3.

Implied authorisation

The Department's second submission was that in supplying the additional material the woman impliedly authorised the Department to contact the providers of references to seek their comments about her.

It appears that the Department had a policy of following up all references, whether or not the applicant had nominated those people as referees in the relevant section of the form. However, the application form was silent about the Department's policy and the steps it would take if those referees suggested other sources of information about the applicant.

As the Department had not advised applicants that they might use the form alone when applying for the position and in fact had instructed applicants to submit a curriculum vitae in addition to the form, I took the view that it was obliged to advise applicants how all the information included in their application would be dealt with, not merely how nominated referees and people they nominated would be handled. The fact that an applicant supplies additional references cannot constitute an implied authority for those referees to be contacted by the Department when the applicant had been given no indication that such an action would be taken. I could not accept the argument that merely by submitting extra written references the woman had in any way authorised the Department to contact those people.

The Department had previously employed the woman and claimed she would have been aware of the reference follow-up policy. The Department did not explain how the woman would have known this policy existed and it was not apparent that her previous role would have put her in a position to know of it. There was nothing to suggest that the woman knew of the Department's policy.

As a result I did not consider that the woman had authorised the contact. In order to meet its obligations under privacy principle 3, I considered that the Department was obliged to notify candidates of its policy in this area.

Harm

In my opinion the Department breached principle 3 through its failure to advise all applicants of its reference follow-up policy. I was also satisfied that this failure caused the woman harm of the kind specified in section 66(1)(b)(ii) and (iii) and that this constituted an interference with the woman's privacy. These provisions refer in part to rights or interests being adversely affected and to significant humiliation, loss of dignity or injury to feelings. By the Department's actions, the woman was precluded from making a decision about whether to supply additional written references, and if so, which ones.

Settlement

The woman and the Department were advised of my opinion and invited to attempt to settle the matter. The Department apologised to the woman and agreed to pay her $1,000. The Department undertook to revise the wording of its application forms and to brief managers and other staff involved in recruitment about the parameters for contacting authors of written references supplied by applicants. It also agreed to review its recruitment and retention policies and manuals.

The matter was settled to the satisfaction of both parties and I closed my file.

Indexing terms: Collection of personal information - Government department - Employment application - Application form required additional material - No indication of use to which additional material would be put - Whether supply of additional material implied authorisation for use - Privacy Act 1993, s 66(1)(b)(ii) and (iii) - Information privacy principle 3

Use of personal information - Government department - Application form required additional material - Use directly related to purpose for which information was obtained - Agency's purpose in obtaining information - Information privacy principle 10(e)

Disclosure of personal information - Government department - Employment application - Disclosure of application to former employer - Disclosure directly related to purpose for which information was obtained - Information privacy principle 11(a)

May 2002