Case Summary and Outcome

A company can be liable for violation of Australia’s Privacy Act if it publishes personal information concerning an individual without the individual’s knowledge or consent and it is not clear from the privacy policies of the company that the information will be published. This is especially true when an individual wishes to remain unlisted.

Facts

This case involves a lawsuit between Telstra Corporation Limited (“Telstra”) and a judge in the family law division. The judge contacted Telstra to set up a phone line at his home for the sole purpose of setting up an alarm system. After setting up the phone line, Telstra published the judge’s name, address, and phone number in the White Pages online directory.

The judge brought this action under Section 36 of the Privacy Act claiming that Telstra had unlawfully disclosed his personal information without his consent.

Decision Overview

Under the National Privacy Act, National Privacy Principal 1.3, an organization that collects personal information from an individual is required to disclose to the individual the purposes for which the information is collected and any other organizations that to which the information may be disclosed. The Privacy Commissioner found that Telstra violated this principle by failing to inform the Plaintiff that his personal information would be disclosed in the White Pages.

Further, under National Privacy Principle 2.1, an organization must not disclose personal information about an individual unless the individual would reasonably expect this information to be disclosed and the disclosure is related to the primary purpose of information collection. The Privacy Commissioner found nothing in Telstra’s privacy policies that informed customers that their personal information would be published in the online White Pages and therefore Telstra also violated this principle.

Last, Telstra argued that disclosure was allowed under National Privacy Principle 2.1(g), which permits disclosure when authorized by law. Telstra argued that it was required to disclose this information under 63(3) of the Telecommunications Act. That Act requires disclosure of some numbers, but the law also states that Telstra must ensure that it does not include details of an unlisted number. This Telstra failed to do.

The Privacy Commissioner then went on to discuss the proper amount of damages in such a case. The Privacy Commissioner ordered that Telstra apologize in writing to the Plaintiff, pay the Plaintiff $18,000 in damages for interference with privacy violations, to “review its processes so that its sales consultants are specifically required to notify each prospective customer that their phone line number will be listed in the White Pages and that they have the option of taking out a silent line,” and to “review its Privacy Statement to make specific reference to Telstra’s collection of personal information for the purpose of publication in the White Pages.”