Proceedings: Complaint under s 36(1) of the Privacy Act 1988 (Cth) (Privacy Act).
Facts: The female complainant was receiving Centrelink payments administered by Services Australia (the respondent) while living with her former male partner. She obtained an Apprehended Violence Order (which her partner was imprisoned for breaching). The complainant notified the respondent of her separation from the partner, but the respondent considered the separation unverified. Their online records continued to be linked meaning that if the complainant updated her address online, her partner’s address would also be updated. Her former partner posted a screenshot of the complainant’s new address to social media and made threats against her and her current partner.
Issues: Whether Services Australia interfered with the complainant’s privacy as defined in the Privacy Act 1988 (Cth).
Decision and reasoning: The Commissioner found that the respondent interfered with the complainant’s privacy by:
In addition to ordering compensation for non-economic loss (including re-activation of psychological symptoms and distress) and expenditure incurred in association with the privacy complaint, and ordering an apology, the Agency was required to undertake an audit of policies, procedures, and systems to ensure the privacy breach was not repeated or continued. The Commissioner noted at -:
The effect of this privacy breach on the complainant has been significant. This is in large part due to the fact that she feared harm from the former partner… While the changes the respondent has made are encouraging, I remain concerned that individuals are at risk of their personal information being disclosed to former partners.
It is appropriate for the respondent to put in place more robust measures where the consequences for individuals are more significant. It is therefore appropriate to have special measures in place to protect individuals identified as being at risk of domestic violence. However, I remain concerned about the risks to individuals seeking to update their own address and not that of their former partner, where the respondent is not satisfied that the individual has in fact separated from their partner, regardless of whether they have a history of family or domestic violence. The ‘reasonable steps test’ is one that takes into account all relevant circumstances, including what is practical and what is required where the adverse consequences to particular individuals are significant.
I therefore see no reason to limit the audit to a particular cohort of individuals, including those at risk of family domestic violence. It is appropriate in order to address the grievance to target the situation where an individual makes unverified claims to have separated from, or to be no longer living with, their partner, and seeks to update their address, whether online or in person.”