case note 2008 VPrivCmr 2 Case note Complainant AJ v The Department  VPrivCmr 2 Data quality (IPP 3) – allegation that the Department failed to update its records and ensure that the personal information it collected, used and disclosed was accurate, complete and up to date. Data Security (IPP 4) – allegation that the Department failed to take reasonable steps to protect the personal information it held from unauthorised disclosure. The Complaint In 2006 the Complainant was contacted by the Department and asked to provide address details for a specific purpose. The Department also contacted the Complainant’s relative and asked for the relative’s address details for the same, specified purpose. The Complainant subsequently provided address to the Department. In 2007, a representative of the Department attended the Complainant’s relative’s residence and attempted to serve a subpoena on the Complainant at this address. The Complainant’s relative advised the Department’s representative that the Complainant did not reside at the address and had never resided at that address. The Complainant subsequently contacted the Department and enquired as to why the Department had attempted to serve the subpoena at the relative’s address. The Department informed the Complainant that the relative’s address was the address the Department had on record as the Complainant’s address. The Complainant again provided the correct address to the Department. Later in 2007, the Complainant wrote to the Department and provided a postal address as the address for return correspondence. In early 2008, the Department wrote a letter of response to the Complainant and sent it to the Complainant’s relative’s (now former) residential address. The letter contained the Complainant’s personal information. IPP 3 The Complainant believed that the Department’s failure to correctly record the Complainant’s postal address and to update the Complainant’s address details when informed of the mistake constituted a failure to take reasonable steps to ensure the personal information it collected, used and disclosed was accurate, complete and up to date. IPP 4 The Complainant also believed the Department – in attending the incorrect address to serve the subpoena and sending correspondence to the incorrect address – failed to take reasonable steps to protect the Complainant’s personal information from misuse, loss and unauthorised access and disclosure. Response to Complaint The Department stated that its records indicated that in 2006 the Complainant provided the relative’s address as the contact address for the specific purpose. The Department, however, acknowledged that the Complainant’s address could have been verified prior to sending a representative to serve the Complaint with a subpoena. The Department acknowledged that correspondence for the Complainant had been inadvertently sent to the Complainant’s relative’s former address in spite of being informed by the Complainant that this was not the correct address. On this basis, the Department submitted that it would like to engage the Complainant in a discussion to outline the steps taken by the Department to improve the quality and security of the personal information it collects, uses and discloses. Outcome The Privacy Commissioner considered that the Department’s failure to update the Complainant’s address information raised issues under IPP 3 and that the use of an incorrect address to send correspondence to the Complainant raised issues under IPP 4. On this basis, the Commissioner referred the complaint to conciliation. At conciliation, the Department agreed to provide the Complainant with a formal apology and to make a note on the Complainant’s file to verify the accuracy of the Complainant’s contact details prior to sending any future correspondence to the Complainant. In addition, the Department agreed to undertake a data cleansing exercise to ensure the accuracy of all the personal information contained within the Complainant’s file.