1 Feb 2008, 09:00

A recruitment agency sent an email out to a number of its clients with each of the clients' email addresses visible. One of the clients complained to the agency about the disclosure of his email address, and received an apology. He did not consider that the apology was satisfactory in the circumstances.

The man complained to us about the disclosure of his email address.

Principle 11

Principle 11 of the Privacy Act states that an agency that holds personal information must not disclose that information unless one of the specified exceptions applies. In this case the recruitment agency acknowledged that they had mistakenly disclosed the man’s email address to a number of other people. The actions of the recruitment agency therefore constituted a breach of principle 11 of the Privacy Act.

The recruitment agency explained that the error had occurred as the ‘cc’ field had been used instead of the ‘bcc’ field and that it had been a one-off incident. They expressed their sincere apologies and stated that the mistake was unacceptable, given the nature of their business where confidentiality is important. They assured us and the man that they had implemented processes to ensure that the mistake did not occur again.

The man accepted this apology from the recruitment agency and the complaint was settled as a result.

We also wrote to the recruitment agency and stated that we would be concerned if the situation recurred.

We then closed the file.

August 2008

Principle 11 – disclosure of personal information – recruitment agency – email addresses sent to all recipients – settlement – Privacy Act 1993, principle 11