1 Feb 2003, 09:00

Three police officers complained about Police review procedures following job appointments or promotions. Unsuccessful applicants could apply for a review of an appointment and, to enable them to make submissions, would be given a copy of the curriculum vitae (CV) of the successful appointee. The officers considered the disclosure of the appointee's CV to unsuccessful applicants was an interference with the appointee's privacy.

I reached the opinion that the Police procedure did result in an interference with the privacy of the officers and that they had suffered adverse consequences.

The Police appointment and appeal process is set out in the Police General Instructions issued under section 30 of the Police Act 1958. Because the appointment process was closely circumscribed by legislation, I considered whether I was precluded from investigating the Police's actions because the Police General Instructions authorise or require the disclosure (see Privacy Act 1993, section 7). I concluded that the General Instructions was not a 'regulation' authorising disclosure, so I proceeded to investigate the complaint under principles 3 and 11.

Principle 11

This principle places a general limit on the disclosure of personal information by an agency, subject to certain exceptions.

Principle 11(a) provides that an agency that holds personal information must not disclose that information unless it believes, on reasonable grounds, that the disclosure is one of the purposes in connection with which the information was obtained or is directly related to the purposes in connection with which the information was obtained.

I accepted that the Police purpose in disclosing an appointee's CV to those individuals involved in the review process was to indicate the reasons behind the selection panel's decision. I was persuaded that the disclosure of an appointee's CV to unsuccessful applicants was part of the process which was designed to ensure that the person best suited to the position was appointed.

I formed the opinion that the Police could rely on the exception in principle 11(a) to permit the disclosure of the appointee's CV to unsuccessful applicants.

Principle 3

This principle provides that where an agency collects personal information directly from an individual, it should take reasonable steps to ensure that the individual is aware of certain matters including the purpose of the collection, the fact of collection, and the intended recipients of the information collected.

If Police practice was to send out an appointee's entire CV to unsuccessful applicants upon receiving an application for review, then the Police clearly believed that internal review was a purpose for which they could routinely disclose information.

If that was so, these complaints illustrated that the practice of disclosing an appointee's CV to an unsuccessful applicant was not well understood by the affected Police officers. I was persuaded that the officers had not realised that the contents of their entire CVs would be disclosed. I considered that this was largely due to the absence of any specific instruction in either the General Instructions or in the letter that was sent to the appointees advising them that the Police would be forwarding 'relevant documentation' to unsuccessful applicants.

In my view the Police needed to ensure that all applicants were aware that some of the personal information contained in their CVs would be disclosed to an unsuccessful applicant if a review were to be requested. The most suitable time to be informing applicants of this seemed to be when they completed their application.

I concluded that the Police's actions amounted to a breach of principle 3.

Harm

Section 66 of the Privacy Act defines the circumstances in which an action is an interference with the privacy of an individual. An essential element in determining whether an action is an interference with privacy is the actual or possible adverse consequence of the action in question on the individual.

The CVs contained a large amount of sensitive information about officers. Some referred to incidents or operations and discussed an officer's performance in those events. I was satisfied that if information of this kind were disclosed to an unsuccessful applicant, particularly if an appointee did not realise that this would happen, then he or she might feel significantly humiliated knowing that a peer was privy to such information. In addition, I considered it important to ensure that all applicants were aware that their CVs might be disclosed so that they could make an informed decision about what to include in their CVs or even opt not to make the application at all.

For these reasons I was of the opinion that the adverse consequences suffered were sufficient to meet the requirements of section 66 and that the breach of principle 3 resulted in an interference with the privacy of the officer concerned.

Conclusion

The Police confirmed that the application form and the General Instructions would be amended to take account of the requirements of principle 3, and that they had discussed the proposed amendments with the officers who had complained.

In these circumstances I exercised my discretion under section 77 of the Act to take no further action, and closed the file.

February 2003

Indexing terms: Collecting personal information - Police - Applicants for positions required to submit CVs - Police practice to disclose appointee's CV to unsuccessful applicants in review process - Notice of practice not specific - Disclosure may cause humiliation - Privacy Act 1993, s 66(1)(b)(iii) - Information privacy principle 3

Disclosure of personal information - Police - Police practice to disclose appointee's CV to unsuccessful applicants in review process - Directly related purpose - Procedure for appointments and review set out in Police General Instructions - Instructions authorise disclosure - Instructions do not equate to regulations - Police Act 1957, s 30 - Privacy Act 1993, s 7 - Information privacy principle 11