Docstoc

Complainant AJ v The Department

Document Sample
Complainant AJ v The Department Powered By Docstoc
					case note 2008 VPrivCmr 2




                                                                                                         Case note

                                             Complainant AJ v The Department
                                                   [2008] VPrivCmr 2

                            Data quality (IPP 3) – allegation that the Department failed to update its records and
                            ensure that the personal information it collected, used and disclosed was accurate,
                            complete and up to date. Data Security (IPP 4) – allegation that the Department failed
                            to take reasonable steps to protect the personal information it held from unauthorised
                            disclosure.

                            The Complaint

                            In 2006 the Complainant was contacted by the Department and asked to provide
                            address details for a specific purpose. The Department also contacted the
                            Complainant’s relative and asked for the relative’s address details for the same,
                            specified purpose. The Complainant subsequently provided address to the
                            Department.

                            In 2007, a representative of the Department attended the Complainant’s relative’s
                            residence and attempted to serve a subpoena on the Complainant at this address. The
                            Complainant’s relative advised the Department’s representative that the Complainant
                            did not reside at the address and had never resided at that address.

                            The Complainant subsequently contacted the Department and enquired as to why the
                            Department had attempted to serve the subpoena at the relative’s address. The
                            Department informed the Complainant that the relative’s address was the address the
                            Department had on record as the Complainant’s address. The Complainant again
                            provided the correct address to the Department.

                            Later in 2007, the Complainant wrote to the Department and provided a postal address
                            as the address for return correspondence. In early 2008, the Department wrote a letter
                            of response to the Complainant and sent it to the Complainant’s relative’s (now
                            former) residential address. The letter contained the Complainant’s personal
                            information.
IPP 3

The Complainant believed that the Department’s failure to correctly record the
Complainant’s postal address and to update the Complainant’s address details when
informed of the mistake constituted a failure to take reasonable steps to ensure the
personal information it collected, used and disclosed was accurate, complete and up to
date.

IPP 4

The Complainant also believed the Department – in attending the incorrect address to
serve the subpoena and sending correspondence to the incorrect address – failed to
take reasonable steps to protect the Complainant’s personal information from misuse,
loss and unauthorised access and disclosure.

Response to Complaint

The Department stated that its records indicated that in 2006 the Complainant
provided the relative’s address as the contact address for the specific purpose. The
Department, however, acknowledged that the Complainant’s address could have been
verified prior to sending a representative to serve the Complaint with a subpoena.

The Department acknowledged that correspondence for the Complainant had been
inadvertently sent to the Complainant’s relative’s former address in spite of being
informed by the Complainant that this was not the correct address. On this basis, the
Department submitted that it would like to engage the Complainant in a discussion to
outline the steps taken by the Department to improve the quality and security of the
personal information it collects, uses and discloses.

Outcome

The Privacy Commissioner considered that the Department’s failure to update the
Complainant’s address information raised issues under IPP 3 and that the use of an
incorrect address to send correspondence to the Complainant raised issues under IPP
4. On this basis, the Commissioner referred the complaint to conciliation.

At conciliation, the Department agreed to provide the Complainant with a formal
apology and to make a note on the Complainant’s file to verify the accuracy of the
Complainant’s contact details prior to sending any future correspondence to the
Complainant. In addition, the Department agreed to undertake a data cleansing
exercise to ensure the accuracy of all the personal information contained within the
Complainant’s file.

				
DOCUMENT INFO
Shared By:
Categories:
Stats:
views:6
posted:3/27/2010
language:English
pages:2
Description: Complainant AJ v The Department