Privacy, Data Protection and Retention
Google Spain SL v. Agencia Española de Protección de Datos
Nominations Are Now Open for the 2024 Columbia Global Freedom of Expression Prizes. Learn more and nominate here.
Closed Mixed Outcome
Global Freedom of Expression is an academic initiative and therefore, we encourage you to share and republish excerpts of our content so long as they are not used for commercial purposes and you respect the following policy:
Attribution, copyright, and license information for media used by Global Freedom of Expression is available on our Credits page.
A company can be liable for violation of Australia’s Privacy Act if it publishes personal information concerning an individual without the individual’s knowledge or consent and it is not clear from the privacy policies of the company that the information will be published. This is especially true when an individual wishes to remain unlisted.
This case involves a lawsuit between Telstra Corporation Limited (“Telstra”) and a judge in the family law division. The judge contacted Telstra to set up a phone line at his home for the sole purpose of setting up an alarm system. After setting up the phone line, Telstra published the judge’s name, address, and phone number in the White Pages online directory.
The judge brought this action under Section 36 of the Privacy Act claiming that Telstra had unlawfully disclosed his personal information without his consent.
Under the National Privacy Act, National Privacy Principal 1.3, an organization that collects personal information from an individual is required to disclose to the individual the purposes for which the information is collected and any other organizations that to which the information may be disclosed. The Privacy Commissioner found that Telstra violated this principle by failing to inform the Plaintiff that his personal information would be disclosed in the White Pages.
Further, under National Privacy Principle 2.1, an organization must not disclose personal information about an individual unless the individual would reasonably expect this information to be disclosed and the disclosure is related to the primary purpose of information collection. The Privacy Commissioner found nothing in Telstra’s privacy policies that informed customers that their personal information would be published in the online White Pages and therefore Telstra also violated this principle.
Last, Telstra argued that disclosure was allowed under National Privacy Principle 2.1(g), which permits disclosure when authorized by law. Telstra argued that it was required to disclose this information under 63(3) of the Telecommunications Act. That Act requires disclosure of some numbers, but the law also states that Telstra must ensure that it does not include details of an unlisted number. This Telstra failed to do.
The Privacy Commissioner then went on to discuss the proper amount of damages in such a case. The Privacy Commissioner ordered that Telstra apologize in writing to the Plaintiff, pay the Plaintiff $18,000 in damages for interference with privacy violations, to “review its processes so that its sales consultants are specifically required to notify each prospective customer that their phone line number will be listed in the White Pages and that they have the option of taking out a silent line,” and to “review its Privacy Statement to make specific reference to Telstra’s collection of personal information for the purpose of publication in the White Pages.”
Decision Direction indicates whether the decision expands or contracts expression based on an analysis of the case.
This case provides a mixed outcome. This case is about balancing the right to privacy with the right of the public to access information, and there is an important privacy interest in not having one’s personal information listed without one’s knowledge or consent especially when an individual explicitly requests to remain unlisted (here, for safety reasons).
Global Perspective demonstrates how the court’s decision was influenced by standards from one or many regions.
“At or before the time (or, if that is not practicable, as soon as practicable after) an organisation collects personal information about an individual from the individual, the organisation must take reasonable steps to ensure that the
individual is aware of: (c) the purposes for which the information is collected (d) the organisation (or the types of organisations) to which the organisation usually discloses information of that kind.”
“An organisation must not use or disclose personal information about an individual for a purpose (the secondary purpose) other than the primary purpose of collection unless: (a) both of the following apply: (i) the secondary purpose is related to the primary purpose of
collection and, if the personal information is sensitive information, directly related to the primary purpose of collection; (ii) the individual would reasonably expect the organisation to use
or disclose the information for the secondary purpose; or
(g) the use or disclosure is required or authorised by or under law.”
Case significance refers to how influential the case is and how its significance changes over time.
Australia is a common law country. Lower courts within the same jurisdiction of this court will be bound by the decision.
Let us know if you notice errors or if the case analysis needs revision.