1 Feb 2008, 09:00

A man applied for registration with his professional body (the Board). As he would be unable to be contacted for a short time, the man authorised a colleague to pay the necessary fees so that his registration was not delayed.

A few months later, without the man's knowledge, the colleague emailed the Board and expressed general dissatisfaction with the registration process and delays.

The Board replied by email. In the reply, the Board disclosed specific information about the man’s application. In particular, the Board gave details of steps taken during his application process and said that the man had not provided enough information to prove that he was competent in the profession. These details were embarrassing for the man.

We investigated this complaint under principle 11 of the Privacy Act. Principle 11 provides that an agency that holds personal information should not disclose it unless it believes, on reasonable grounds, that an exception applies.

The Board submitted that the man had authorised his colleague to act as his agent. It therefore believed it could rely on the exception at principle 11(d) that the disclosure was authorised by the individual concerned.

Actual authorisation is not required by the Act as long as the agency has reasonable grounds for believing that the disclosure was authorised.

However, here, the Board could not have reasonably believed that the man had appointed the colleague as his agent, or had authorised disclosure of this information. He had only asked his colleague to pay his fees. The Board had not dealt with the colleague in relation to any other aspect of the application. We therefore considered that the Board’s actions, in disclosing the man's personal information, had breached principle 11.

The man suggested that the Board could resolve the dispute by refunding his registration fee and providing a written apology. The Board agreed to this in full and final settlement of the man’s complaint. On that basis, we closed the file.

August 2008

Disclosure of personal information – professional body – whether disclosure was to agent – whether disclosure authorised –Privacy Act 1993, principle 11(d)