8 Sep 2022, 09:00

A man complained to his employer about the behaviour of a colleague, and the employer engaged an independent investigator to look into the complaint and make a report.

Both employees asked their trade union for support through the process, but the man felt things weren’t fair because the other employee received more financial support than he did.

The trade union delivered its own report into the levels of support the man and his colleague received during the employer investigation, but a problem arose when the trade union included a copy of the employer’s investigation with its findings into the man’s complaint.

The man complained to the Office of the Privacy Commissioner that the union should not have shared his employer’s report alongside its own because that information about their dispute was collected for a different purpose, and he had already resisted its release in other forms.

The privacy principles

This complaint raised issues under principle 10 of the Privacy Act.

Under privacy principle 10, agencies should only use the personal information they hold for the purpose they obtained it, unless they believe on reasonable grounds that one of the exceptions applies.

One exception allows you to use personal information where that use is directly related to the purpose for which you obtained the information. A further exception allows use of the information if the agency believes on reasonable grounds that the use of the information for another purpose is authorised by the individual.

The man was concerned the union’s internal review should not have included the employer’s report as this was not directly related to the purpose for which the report was obtained, and he had not authorised its use for this purpose. 

Final view

Our Office found that the trade union’s use of the employment dispute report was not directly related to the purpose for which details about the dispute were originally obtained.

The man did not authorise the use of his employer’s report for the purposes of the union’s internal review, and the terms of reference for the trade union’s review did not extend to considering the circumstances of the employment dispute.

Further, we found that the union did not have reasonable grounds for the belief that the man had authorised it, as the union was aware that he disputed the contents and the conclusions, and that he had resisted the report’s release in other forums. 

To make a finding there has been an interference with privacy, we also need to be satisfied the breach caused the complainant harm. We agreed the breach had caused the man emotional harm by including information about his personal dispute with his colleague, and that there had been an interference with his privacy.

We offered the parties the opportunity to participate in a conciliation conference to resolve the matter but the union chose not to accept our final view and said it did not intend to make an offer of settlement.

The man told us he was too upset to participate in any further conversations with the union when they would not accept they had breached the Privacy Act.

We told the man that he had the option of taking the matter to the Human Rights Review Tribunal if he wanted to further pursue his case and closed our file.

Comments

Principle 10 of the Privacy Act limits the ways in which information, obtained in connection with one purpose, may be used.  It’s also important to note that the Privacy Act is primarily concerned with purpose, rather than consent.

After considering submissions from both parties, in this case our Office found that the union had breached principle 10, in that it had used the employer’s report it obtained for one purpose (legal representation of the parties in their employment dispute) for another purpose (the internal review), and an exception to the privacy principle did not apply.

Under the Privacy Act, there is a general obligation not to use or disclose personal information, unless an exception applies.

This means that when you collect personal information, you need to tell  the individual concerned that you will be using or disclosing their personal information in a certain way, then you are entitled to go ahead and do so.

However, you will need to keep in mind how specific you were about what your purpose or purposes were when you collected the information.

A good test to keep in mind is the ‘no surprises’ test. In other words, would the way in which you’re planning to use or disclose personal information come as a surprise to the person you collected it from? If the answer is yes, that might be a sign that your intended use or disclosure is for a new purpose, in which case you’ll need to find another exception you can rely on to use or disclose the information.