1 Feb 2008, 09:00

A man was a member of a club. He complained to us that the club supplied his personal details to a direct mailing company and as a result he received unsolicited direct mail from insurance companies.

The man stated that he did not know that his personal information would be used in this manner when the information was collected from him. He was unhappy about the way his information had been used and that his personal information had been disclosed to a third party.

His complaint raised issues under principles 3 and 11 of the Privacy Act and he raised concerns about principle 10.

Principle 3

Principle 3 of the Privacy Act concerns the collection of personal information from individuals. It requires an agency to notify individuals of the purpose for collecting the information, and the intended recipients of the information, among other things.

At its AGM in 1984, the club had resolved to release members’ contact information to an independent direct mailing company for the purpose of providing targeted advertising material to its members.

The club had advised its members of this change through the minutes of its Executive Committee, its newsletter and circulars distributed to its branches. They continued to provide this advice to their members in the intervening years.

Since the club had advised its members clearly that contact details would be disclosed, it was our opinion that there was no breach of principle 3 of the Privacy Act.

Principle 11

Principle 11 states that an agency that holds personal information shall not disclose that information unless that agency reasonably believes it can rely on one of the exceptions set out under principle 11.

We considered that principle 11(a) applied. This exception states that an agency can disclose personal information if it reasonably believes the disclosure is one of the purposes in connection with which the information was obtained, or directly related to the purposes in connection with which the information was obtained.

It was apparent that since the AGM in 1984, release of the information to the direct mailing company was one of the purposes for collecting the information.

This purpose also predated the Privacy Act by nine years, and had been notified to members on many occasions. This was not a situation where the purpose of collecting the information had been changed without notice to members.

Outcome

We concluded that there was no interference with the man’s privacy. However, we acknowledged that it was upsetting for him to receive advertising material in this way.

We suggested to the club that at the time a person’s membership comes up for renewal, there should be a standard statement that membership contact information is provided to the direct mailing company, so that it can offer services that may be of use to the club members. We also suggested that the club should at least allow members to opt out of this service, and that it is preferable to invite members to opt in.

We then closed our file.

August 2008

Collection of personal information – club – membership information provided to marketing agency - informing individual of purposes of collection and intended recipients of the information – standard statement at time of membership renewal – at least offer opt-out – opt-in preferable – Privacy Act 1993, principle 3

Disclosure of personal information – club – membership information provided to marketing agency – one of purposes of collection – Privacy Act, principle 11(a)