Disclosure of personal information to third parties

In Flight Centre Travel Group (Privacy) [2020] AICmr 57 the Privacy Commissioner determined that Flight Centre interfered with the privacy of almost 7,000 customers by disclosing their personal information to third parties without consent.

The information, including individuals’ credit card and passport details, was released by Flight Centre Travel Group Ltd during a ‘design jam’ in 2017.

The Privacy Commissioner found the company breached three Australian Privacy Principles (APPs) by:

• not taking reasonable steps to implement practices to ensure compliance with the APPs
• disclosing individuals’ personal information without consent, and
• failing to take reasonable steps to appropriately secure the personal information.

The Flight Centre design jam brought together 16 teams to create technological solutions for travel agents. Participants were given access to a dataset that included customers’ personal information, despite preliminary checks to de-identify or remove personal information.

The error was only found after the information had been available for 36 hours.

Flight Centre’s privacy policy included some general statements about disclosing personal information to improve and develop their products.

However, the Commissioner found that this did not amount to valid consent from individuals to disclose their information to the design jam because it was not sufficiently specific and bundled together different uses and disclosures of personal information.

The Commissioner said:

“It is my view that the respondent ought to have taken at least the following reasonable steps to protect its customers’ personal information from unauthorised disclosure:

staff should have been made aware, through clear information in written policies and training, that personal information, such as a customer’s passport number, should only be entered directly into the appropriate system, in the field designated for that purpose, and kept secure.

additional steps should have been taken to operationalise information security policies, for example by requiring regular training of relevant staff and implementing regular compliance checks and assurance processes.

the respondent should have implemented technical controls that would detect whether staff had included credit card details and passport information in the free text field of its quoting, invoicing and receipting system.”

Spent conviction considered in employment termination

In ‘WC’ and Chief of Defence Force (Privacy) [2020] AICmr 60 the Privacy Commissioner found that the Australian Defence Force (ADF), breached section 85ZW(b)(ii) of the Crimes Act 1914 (Cth) in relation to the complainant by taking into account the fact of the complainant’s spent convictions in a decision to terminate his employment as an officer in the ADF.

The ADF was ordered to pay the complainant $6,000 for non-economic loss caused by the conduct as well as $4,850 for reasonably incurred expenses in connection with the privacy complaint.

On 20 December 2000 the complainant was convicted in the Brisbane Magistrates Court of a State criminal offence arising out of intoxication and received a fine. No conviction was recorded.

The complainant was not sentenced to imprisonment for the offence. As the complainant was not convicted as a minor, the relevant waiting period was 10 years beginning on the date of conviction.

There was another offence of drunken behaviour in 2008.

The complainant claims that the ADF considered his spent conviction in deciding to terminate his employment in 2016.

The respondent contends that it was the conduct underpinning the conviction, rather than the conviction itself, that was taken into consideration.

But the termination notice specifically refrred to the conviction.

The Commissioner was satisfied that the respondent took into account the spent conviction, not merely the conduct underlying it.

But the Commissioner did not order reinstatement.

The Commissioner said:

“While I am satisfied that the ADF’s consideration of the fact of the two spent convictions contributed to the termination decision to some extent, I am not satisfied that it was a major contributing factor. In particular, I consider that the ADF took into account the underlying conduct. I am not satisfied that had the ADF not considered the spent convictions, that the complainant’s employment would not have been terminated in any event, in reliance on the other circumstances, including the underlying conduct the subject of the convictions.”

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.

Author: David Jacobson
Principal, Bright Corporate Law
Email:
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.