1 Feb 2009, 09:00

A woman made a request for a copy of a report prepared by a private investigator for her insurance company. The report related to an investigation being undertaken by the insurance company into alleged insurance fraud involving her insurance claim. The insurance company refused to provide the woman with a full copy of the report. The woman subsequently made a request to the insurance company for all of the personal information held by it about her and her husband.

Principle 6

Principle 6 of the Privacy Act provides that where an agency holds personal information in such a way that it can be readily retrieved, the individual concerned can ask the agency for access to that information.

The insurance company provided us with a copy of the report and advised that they wished to withhold parts of it on the basis that it was not the woman's personal information and that to release the whole report would involve the disclosure of other individuals' information. It became apparent that the insurance company were seeking to rely on section 29(1)(a) of the Privacy Act.

Section 29(1)(a) of the Privacy Act sets out that an agency may refuse to disclose any information requested under principle 6 if disclosure of the information would result in an unwarranted disclosure of the affairs of another individual.

We reviewed the information and advised the insurance company that we considered that some of the withheld information could be released to the woman. We also advised that some of the information could be withheld under section 29(1)(a) of the Privacy Act and some information could be withheld under section 27(1)(c) of the Privacy Act.

Section 27(1)(c) of the Privacy Act sets out that an agency may refuse to disclose any information requested under principle 6 if disclosure of the information would be likely to prejudice the maintenance of the law, including the prevention, investigation and detection of offences.

Section 27(1)(c) was an appropriate withholding ground as some of the information related to the fraud investigation, the techniques that it employed and the content of that investigation. If the insurance company released the information it might enable people to circumvent the law, or avoid detection.

Section 27(1)(c) only occasionally applies to private companies, usually where they act as a conduit of information from informants to the Police. The Police in turn rely on the informant's information to maintain the law by further investigating and prosecuting offences.

The insurance company could be characterised in a situation such as this as a law enforcement agency by proxy, as it was holding a class of information that could be described as necessary for maintenance of the law.

As a result of our comments the insurance company reviewed the information it was seeking to withhold and released a copy of the report to the woman with some information withheld either because it was not her personal information or because sections 27(1)(c) and 29(1)(a) of the Privacy Act applied. We were satisfied that the information released was all of the information the woman was entitled to.

The woman believed that there was further information that had not been provided to her. After we consulted the insurance company, it advised us that there was indeed further information.

This information included recorded phone conversations between the woman and the insurance company and between third parties and the insurance company. These recordings, together with some further documents, were released to the woman. One recorded phone call was withheld from the woman under sections 27(1)(c) and 29(1)(a) of the Privacy Act.

We reviewed the recorded phone call and concluded that the insurance company was entitled to withhold it under sections 27(1)(c) and 29(1)(a) of the Privacy Act. The release of the recorded phone call would have prejudiced the insurance company's investigation and also resulted in an unwarranted disclosure of information about other individuals.

The woman accepted the results of our review and advised that she was satisfied with the outcome of our investigation.

We closed our investigation on this basis.

October 2009

Access to personal information - insurance company - fraud investigation - maintenance of law - unwarranted disclosure of another's affairs - Privacy Act 1993, principle 6; section 27(1)(c), section 29(1)(a)