Whilst cyber security receives constant publicity, the most obvious privacy breach risk is the disclosure of information in public areas, whether it is an office, a lift, a bus or an airport.

In ‘BO’ and AeroCare Pty Ltd [2014] AICmr 32 the Privacy Commissioner found that AeroCare interfered with the complainant’s privacy by collecting and disclosing the complainant’s sensitive personal medical information in the departure lounge of the Sunshine Coast Airport, in breach of the National Privacy Principles.

AeroCare was ordered to apologise in writing to the complainant, review its training of staff in the handling of sensitive personal information and pay the complainant $8500 for non-economic loss caused by the interference with the complainant’s privacy.

Whilst the Commissioner accepted that AeroCare was required to collect the information in order to determine the complainant’s fitness to fly, he considered that the manner in which the information was collected- in the departure lounge of the Sunshine Coast Airport, in the presence of the complainant’s Sighted Guide and in close proximity to a number of other passengers — was undertaken in an unreasonably intrusive manner.

The Commissioner concluded that:

“In approaching the complainant in the departure lounge of the Sunshine Coast Airport, revealing personal information about his medical condition and asking the complainant to provide additional information about the condition in the presence of third parties, AeroCare failed to take reasonable steps to protect the complainant’s information from unreasonable disclosure. …

when approaching the complainant, the AeroCare representative did not clearly identify who she was, the organisation she was representing or clearly explain the reason for the collection of the complainant’s personal information. …”

But the Commissioner did not award aggravated damages: “I do not consider AeroCare’s conduct to be high-handed, malicious, insulting or oppressive.”