 Australian Privacy Commissioner if they were unhappy with the steps the company had taken.
A person contacted an agency because they had received completed application forms that belonged to a number of other people. The person had originally completed an application for a service provider. The service provider had then mailed the form back to the client because not all the fields in the form had been filled in.
However, the employee at the agency who returned the incomplete form inadvertently included the completed forms from 17 other clients in the envelope that was sent out to the person.
In trying to do the right thing, the agency was over eager in attempting to notify the people whose forms had been accidentally sent to the wrong person. In doing so, it made assumptions about who the other people were, only to find out later that none of the people it had notified had been involved in the mix-up.
The agency then had to contact the 17 people whose information had been accidentally disclosed and also apologise to those other people who had first been mistakenly contacted about the breach.
Insights from agencies
“Develop a high degree of personal responsibility with BYOD (bring your own device). Personal phones and tablets are under a user’s control and do not come under organisational control. While managing personal phones is seen as intrusive, guidelines are necessary because many employees use them to access work information.”
“Accept collective responsibility. In many cases, it is often an organisation’s fault and not the individual employee because workers were not made aware of the risks.”
“Use the lessons learned as a teachable moment for workers throughout your agency.”
A man asked a company for access to his personal information. In response, the company sent a list of debtors' details which contained not only personal information about the man, but also about several other people. The employee who sent the information was inexperienced, and did not comply with the company’s usual procedures.
The company realised that a mistake had been made. It immediately contacted the Office of the Privacy Commissioner to say there had been a privacy breach. It also contacted all the people whose details had been inadvertently released, to let them know what had happened.
The man approached a newspaper which wrote a story about the company's mistake. One woman whose details had been included on the list was approached by a journalist. Although she was not featured in the story, she was embarrassed by the fact that details of her debt had ended up in the hands of the media.
She complained to Privacy Commissioner about the company's breach of her privacy. The company apologised to her and made a small payment in compensation for the embarrassment she had suffered. The woman accepted this as a settlement of her complaint.
The company provided specific training to the employee who made the mistake, and additional training for all staff responsible for handling requests for personal information. It also improved its internal documentation on handling requests for personal information.
A woman was being treated for a serious illness at her local hospital. Her doctor dictated a file note about the woman's illness and the proposed treatment. This was transcribed by a hospital employee.
The employee had been a close friend of the woman, and was able to identify her from the notes. The hospital employee then told a mutual friend about the woman’s illness. The friend made contact with the woman to express their concern.
The woman had not told anyone of her illness at that point, and was very upset that information about her had been disclosed.
Rule 11 of the Health Information Privacy Code 2004 prohibits a health agency from disclosing health information about an individual unless one of the specified exceptions applied.
The Office of the Privacy Commissioner did not consider that any of the exceptions applied and the hospital agreed. It accepted that its employee had breached rule 11, and caused emotional harm to the woman.
The wom