 could adversely affect her interests given the safety concerns.
The Trust apologised for the inadvertent disclosure of the girl's personal information and expressed genuine regret at what had happened. The Trust also put new procedures in place to prevent any recurrence of this situation.
The Trust offered the girl a 12-month gym membership to one of its facilities. But the mother did not find this acceptable and sought $500 in compensation.
Where there is an interference with privacy, the Privacy Commissioner encourages the parties to settle the matter. If they cannot do so, the matter can be referred to the Director of Human Rights Proceedings, who decides whether to bring proceedings to the Human Rights Review Tribunal.
While the mother's request for compensation was modest, the Trust was not in fact in a position to pay. It had made another offer of settlement, of equivalent value, in good faith.
Taking everything into consideration, the Privacy Commissioner exercised his discretion not to refer the complaint to the Director. But the mother was advised of her right to take the matter up with the Director of Human Rights Proceedings, if she wished.
Insights from agencies
“Banning social media is not a strategy. Many organisations bring in customers through networking. With guidance and training, employees can be encouraged to do this safely.”
“The term ‘data’ is not helpful and can invite complacency because it makes people forget that it is information about people.”
- New vulnerabilities are being found in computer operating systems and third party applications on a daily basis. Patches are regularly issued to address these vulnerabilities and they will protect you from hackers if you install them.
- Make sure all systems that contain or access sensitive information have all necessary operating system and third-party application security patches and updates.
- Carry out regular security checks and audits. Consider penetration testing as an option.
- Use strong passwords and don’t share or reveal passwords.
- If a computer is used by different people – for instance, a shared laptop for presentations – it should still have a strong password if it connects to your work network. If possible, don’t connect to the work network because that increases the risk.
- Use different passwords for accounts that provide access to restricted information than for less-sensitive accounts.
- Change passwords regularly.
- Install anti-virus, anti-malware and anti-spyware software and make sure it is always up-to-date.
- Don't click on unknown or unexpected links or attachments because these can infect your computer.
- Don’t open files sent via IM (instant messaging) or P2P (peer-to-peer) software on a machine that contains restricted data because these files can bypass anti-virus screening.
- Don't install unknown or suspicious programs on your computer because these can be computer viruses or open a “back door” giving others access to your computer without your knowledge. Consider restricting the ability to install software.
An online recruitment agency accepted CVs from jobseekers and made them available to employers on a password protected website.
Jane, a jobseeker whose CV was on the website, received an email which she suspected was a 'phishing' email. The email was personalised and contained information from her CV. It contained a number of spelling mistakes and offered her a job. The email claimed that all Jane had to do to secure the job was to provide her bank account details so she could be paid. Jane told the recruitment agency of her suspicions, and forwarded a copy of the email to the agency.
The recruitment agency then assigned a member from its IT team to investigate. The investigator discovered that the email was indeed a phishing email. It claimed to be from an employer and directed the jobseeker to a website that asked them to enter further information. It also installed spyware on the jobseeker's computer.
The recruitment agency then attempted to establish how phishers came to have the CV details of the jobseeker. T