an and the hospital agreed to settle this complaint. The hospital provided an apology to the woman for the stress that had been caused to her, and also paid financial compensation.
Insights from agencies
“Do not treat the news media as an enemy. Adopt a cooperative and collegial approach. It works better than having an antagonistic stance, especially if your agency has stuffed up.”
“Change a blame culture if one exists. A better approach is to make people feel safe to come and admit what has happened, knowing there will be a fair and honest procedure to handle the error. Such a culture will allow more reporting of breaches and near-misses and lead to better management of organisational risk.”
An Australian government agency undertook a periodic audit of its records. The audit revealed an unusual pattern of client account enquiries in one branch of the agency over a 12 month period. The client records contained address information, financial information, and other details.
After some investigation, it was found that a staff member had been browsing the client accounts of his family and friends without any legitimate purpose or authorisation. There was no evidence that client information had been disclosed to a third party.
The agency recognised that some of the information was sensitive information that was not readily available. The agency considered there was a real risk of embarrassment or other harm from the release of that information. The staff member had a personal relationship with the affected people and could have combined the information with details about the people that he already knew.
The government agency decided to notify the individuals affected by the unauthorised access. It also took measures to prevent unauthorised access to client accounts by staff, and to ensure that all staff members were aware of their obligations to act appropriately.
The agency considered that, because of the sensitivity of the information and the context of the breach, the breach was sufficiently serious to warrant notification to the Australian privacy authority.
A man found himself in a financial dispute with his sister. The sister worked for IRD and during the financial dispute, it became apparent to the man that she was accessing his IRD files. The man told IRD of his concerns and IRD agreed to investigate them.
The man's concerns were confirmed and he again brought this to IRD's attention. The man made a complaint to the Office of the Privacy Commissioner about the fact that IRD had let his sister access his files even though he had warned them that this might be happening.
Principle 5 of the Privacy Act provides that agencies must protect personal information by safeguards that are reasonable in the circumstances.
However principle 5 is not primarily concerned with individual instances of unauthorised access. Rather it focuses upon the overall systems in place to prevent such occurrences.
IRD said it had a stringent code of conduct designed to ensure that staff are aware that they may not access personal information for non-work reasons. Any breach was considered by IRD to be serious misconduct.
IRD advised that it took action but found that at the time the man initially raised his concerns, there was no evidence of unauthorised access. IRD made the decision that it was not necessary to restrict access to the man's files at that time. It said with a staff of over 5,000, it must rely on the integrity of its employees.
After the man raised his concerns again at a later date, IRD conducted a further investigation, found that the sister had accessed his files and therefore breached the code of conduct, and took disciplinary action against her.
The Privacy Commissioner formed the opinion that the general security safeguards IRD had in place were reasonable. This was a case in which a staff member decided to breach her workplace obligations and IRD's code of conduct.
But the Privacy Commissioner felt that IRD could have handled the man's concerns in a better way and IRD agreed to fully restrict access to the man's files and to 