A subscriber to a telecommunications company requested a confidential listing. The telephone operator to whom she spoke did not correctly complete the service order relating to her request, so it was rejected by the computer system. The order was returned to the operator, who again filled it in incorrectly, and it was again rejected. It was finally completed in such a way that the subscriber's listing was included in the telephone directory. The subscriber was not contacted to clarify her preferred listing.

The subscriber wished to keep her whereabouts from a family member as her young child feared that person. The publication of the telephone number markedly affected the child's behaviour and health. The child blamed her mother for the disclosure, and this caused their relationship to deteriorate.

The subscriber complained to me.

Information privacy principle 5 requires agencies to have reasonable security safeguards to protect information from disclosures which are not authorised by the agency. The company explained that it trains new staff on privacy issues and has a procedure manual dealing with listing requirements for customers. The procedures were not followed in this case and it seemed that the operator did not understand the instructions or did not want to follow them.

I considered that principle 5 requires more than the existence of a procedure and a training programme, because they do not guarantee the procedure will be followed. To implement a procedure effectively, some steps need to be taken to ensure it is followed. Steps might include retraining on procedures following a particular problem and giving regular training and refresher courses. It might be appropriate to include a disciplinary provision so staff know there will be consequences for failing to follow the procedure. This is particularly important where a procedure has been developed to ensure that customers' needs are met in an area where there is a potential for them to suffer harm.

The complaint also raised an issue under principle 11, which limits the instances in which personal information may be disclosed. None of the exceptions contained in principle 11 seemed to apply in the circumstances.

Because a settlement was reached it was not necessary for me to form an opinion. The company acknowledged a need to reassess its listing procedures and staff training. As part of the settlement, a representative from the company visited the subscriber's child and explained that the company had made the mistake which led to the disclosure of the listing. The subscriber later advised that this had improved her relationship with the child. The company also took steps to improve the household security.

December 1997

Indexing terms: Disclosure of personal information - Telecommunications company - Disclosure of confidential listing - Security procedures not followed - Information privacy principles 5 and 11