1 Feb 2009, 09:00

A couple decided to separate. They each decided to stay with the telecommunications service provider they had used during their marriage. They informed the company of their new postal addresses.

A year after the couple's separation, the company mistakenly sent the husband's account to his estranged wife's postal address. The account included all the phone numbers that had been dialled from the husband's phone.

The husband discovered the company's error when his wife dialled some of the numbers listed on his account. Some of these numbers belonged to the husband's friends who told him that his wife had called. He complained to the company.

All telecommunications agencies must have internal procedures for handling privacy complaints, as required under Schedule 1 of the Telecommunications Information Privacy Code 2003. The company advised him that it would conduct an investigation and would contact him within three weeks. However, two months passed without any contact from the company.

As a result, the man complained to us. We investigated his complaint under rule 5 and rule 11 of the Code.

Telecommunications information

Telecommunications information is information about an 'identifiable individual that is subscriber information; traffic information; or the content of a telecommunication' (Telecommunication Information Privacy Code 2003, clause 4(1)).
Account details, such as the calls made from a telephone and the cost of those calls, is ‘telecommunications information' under the Code.

Storage and security of information

Rule 5(1)(a) provides that a telecommunications agency that holds telecommunications information must ensure that the information is protected, by such security safeguards as it is reasonable in the circumstances to take, against disclosure.

If an agency has reasonable safeguards in place but discloses information as a result of a one-off human error, this will not be a breach of rule 5 (though it may still be a breach of rule 11).

The company undertook an internal investigation into the incident. Unfortunately, it was unable to discover exactly what had happened.

The company assured us that it had robust processes in place to ensure that account information is not altered, accessed, or released to unauthorised people. Its staff are trained to ensure that only appropriate people have access to accounts. The man's address information was correctly listed and there was no information to suggest that there had been any changes to his account without first receiving his authorisation.

It therefore appeared that the company's systems were reasonable, but that there had been a human error, resulting in the information being sent to the wife. In these circumstances, we accepted that there had been no breach of rule 5.

Disclosure of information

Rule 11 of the Code states that a telecommunications agency must not disclose the telecommunications information it holds unless the agency believes, on reasonable grounds, that one of the exceptions in rule 11 applies.

Since the company was prepared to settle the matter, we did not need to form a final opinion that there had been a breach of rule 11. However, it was clear that there would have been no basis under rule 11 for sending the husband's information to his estranged wife.

Settlement

The man was understandably upset that the company had sent the account to his wife, who had then used that information. He sought an apology from the company. He did not seek financial compensation.

The company provided a letter of apology, though this did not go as far towards acknowledging the company's error as the man would have liked. However, the company also credited the man's account to the value of two months' free line rental.

The company also apologised for its delay in responding to the man's original complaint. The company assured us that it would review its internal policies to ensure complaints were dealt with in a timely fashion.

The man accepted the settlement and we discontinued the investigation.


May 2009


Security of personal information - telecommunications service provider - account information - sent to former partner in error - reasonable safeguards -- internal complaints process failed - settlement - apology - Telecommunications Information Privacy Code 2003 schedule 1: 'telecommunications information'; rule 5

Disclosure of personal information - telecommunications service provider - account information - sent to former partner in error - no basis for disclosure - internal complaints process failed - settlement - apology - Telecommunications Information Privacy Code 2003, rule 11