You may not be aware that the Privacy Commissioner now has the ability to publish an “advisory opinion” and has done so for the first time on what does and doesn’t constitute “personal information” (information about an identifiable individual
An advisory opinion was sought by the Fire Service, which was considering publishing the addresses of fire incidents on its website with information about the dates and times of the calls and whether it was a false alarm or genuine emergency. Why, you might ask, did the Fire Service want to do that? The answer was because the information was frequently sought from insurers and they thought by publishing it on their website it would save time and resources answering those requests.
As a starting point, the Fire Service sought legal advice about whether their intended approach would comply with their obligations pursuant to the Privacy Act 1993. That is an important starting point as the Privacy Commissioner won’t publish an advisory opinion as a substitute for legal advice. That is, employers can’t go to the Privacy Commissioner to avoid the time and cost associated with instructing lawyers. (Phew!)
The legal advice given was that the addresses weren’t personal information, but that if that was incorrect and they were personal information, putting them on the website would amount to a breach of the Act as none of the disclosure exceptions would apply.
Considering also the general public interest in the answer and the fact that it has broader application than the Fire Service’s specific request, the Privacy Commissioner determined that it was appropriate to issue an advisory opinion.
The Commissioner’s view was that address information is personal information about the house owner or residents, other than where a property is owned by a company. Therefore, publishing it on the website would breach the Act. The reasons for the Commissioner’s view include:
- Personal information is information about identifiable human beings but the person doesn’t have to be named or otherwise identified in the information;
- The term “information” is very broad and includes anything that tells you something about an individual; and
- There is existing case law that address information can be personal information including geotechnical information, insurance information and meter information.
As technology develops and information becomes more readily available and accessible, and businesses look to streamline their processes and procedures, it is even more important to ensure that your business is complying with its privacy obligations. The risks of penalties and reputational damage are too significant to ignore.