1 Feb 2003, 09:00

A couple requested access to their bank file. The bank gave them some information but withheld a number of documents and made some deletions. After the couple asked the bank to review its decision, the bank released further information but continued to withhold material it regarded as a 'trade secret'.

The couple complained to me about the bank's actions. I investigated their complaint and formed the opinion the bank had breached information privacy principle 6.

Principle 6

Principle 6 provides individuals with the right to access personal information held about them by a public or private sector agency. There are certain exceptions.

The bank withheld three documents under section 28 of the Privacy Act. The first two documents were a diary note made by a bank employee about the bank's strategy regarding the couple and a facsimile between that employee and a senior manager. These documents outlined the course of action the bank proposed to take in respect of monies owed by the couple. The other document was a record of 'risk grades' relating to the bank's assessment of the couple's creditworthiness for loan purposes.

Section 28(1) permits an agency to withhold personal information if disclosure of the information:
(a) would disclose a trade secret, or
(b) would be likely unreasonably to prejudice the commercial position of the person who supplied or who is the subject of the information.

Trade secret

I first considered the bank's claim that the documents contained a trade secret. There is no definition of a 'trade secret' in the Privacy Act. In my review of the Privacy Act in 1998 I noted that some Canadian provincial statutes had adopted the following definition of trade secret:

Trade secret means information, including a formula, pattern, compilation, program, device, product, method, technique or process that:
(a) is used, or may be used, in business or for any commercial advantage;
(b) derives independent economic value, actual or potential, from not being generally known to the public or to other persons who can obtain economic value from its disclosure or use;
(c) is the subject of reasonable efforts to prevent it from becoming generally known; and
(d) the disclosure of which would result in harm or improper benefit.

There is little at common law defining a trade secret. Matters of public knowledge or of general knowledge in an industry cannot be considered to be true trade secrets (Ansell Rubber Pty Ltd v Allied Rubber Industries Pty Ltd ¹⁹⁶⁷ VR 37). The element of secrecy derives from the information only being known in the particular business in which it is used. However, mere assertion that something is a trade secret does not automatically make it so (Wright v Gasweld Pty Ltd (1991) NSWLR 317). Whether information is or is not a trade secret has to be determined objectively on the facts and circumstances of each case.

Bank's proposed strategy
I had difficulty in accepting the bank's submissions that its proposed strategy for addressing the couple's debt situation was a trade secret. The proposed strategy of mediation did not, to my mind, fall into any of the accepted examples of a trade secret, for example, a formula, pattern, device or compilation; it merely set out a fairly conventional course of action.

The bank argued that other debtors might organise their affairs to frustrate the bank's ability to recover monies owed to it, if they knew in advance the probable avenues the bank would pursue. However the type of strategy proposed for addressing the couple's debt seemed to me to be a matter of general knowledge within the finance industry. I therefore did not accept that this approach could be considered to be a true trade secret.

Risk grades
I did not agree with the bank's submission that disclosure of the 'risk grades' would reveal a trade secret. I noted that the bank had already released (albeit apparently accidentally) its internal formula for calculating customer credit ratings (the 'risk grades') to the couple. This may well have been a trade secret.

However, even if the internal formula could have been considered a trade secret, the question here was whether the information generated by it was a trade secret. The bank failed to show how the risk grades (as opposed to the formula by which they were calculated) constituted a trade secret. The information the bank gave me demonstrated only the uses to which the bank puts risk grades in obtaining, managing and securing accounts. It did not show how the risk grades themselves constituted a 'formula, pattern or other compilation' considered to be a trade secret.

In my opinion neither the documents nor the risk grades could be considered trade secrets, and so could not be withheld under section 28(1)(a).

Prejudice to commercial position

Section 28(1)(b) provides that an agency may refuse to disclose personal information if making the information available would be likely unreasonably to prejudice the commercial position of the person who supplied, or who is the subject of, the information.

An agency must satisfy four conditions:
1. the information in question must relate to the commercial position of the person who supplied, or who is the subject of, the information;
2. disclosure of the information would be likely to prejudice the commercial position of the person who supplied, or who is the subject of, the information;
3. prejudice would be unreasonable; and
4. the need to withhold the information must not be outweighed by other considerations rendering it desirable in the public interest to make the information available (section 28(2)).

The provision does not allow an agency to withhold personal information if the information simply relates to its own commercial position. I had to be satisfied that the disclosure of the information would have been likely to unreasonably prejudice the commercial position of the person who supplied, or who was the subject of, the information.

While the documents may have contained some information which related to the commercial interests of the bank, it seemed to me artificial to say that the bank was the 'subject' of the information. Rather, the subject of the information was the couple and their debt. Disclosure was not going to prejudice the couple's commercial position. Equally, to the extent that this information was 'supplied' to the bank, it had been supplied by the couple; an agency cannot sensibly be said to supply information to itself.

In my view, the bank did not have a proper basis for withholding the documents or the risk grades under section 28 of the Privacy Act. The bank's decision to refuse the couple's request for access to the documents and risk grades was an interference with their privacy.

After receiving my opinion, the bank released copies of the documents and a fresh copy of the couple's file, including the risk grades.

I exercised my discretion not to proceed further. I advised the parties of the couple's right to take the matter to the Human Rights Review Tribunal.

July 2003

Indexing terms: Access to personal information - Bank - Refusal - Whether documents reveal 'trade secret'- Privacy Act 1993, section 28(1)(a) - Information privacy principle 6

Access to personal information - Bank - Refusal - Whether disclosure would prejudice commercial position - Privacy Act 1993, section 28(1)(b) - Information privacy principle 6