H and Registered Club [2011] AICmrCN 2 (22 December 2011): Determination by CommissionerNPP 1.1, 1.3 and 4.2

March 20, 2012 |

In H and Registered Club [2011] AICmrCN 2 the Commissioner made a determination involving NPP 1.1, whereby an organisation must not collect an individual’s personal information, unless that information is necessary for one of more if its functions or activities, 1.3, at or before the time an organisation collects an individual’s personal information it must take reasonable steps to ensure an individual is aware of a number of factors, including the purposes for which the information is collected, and 4.2, an organisation must take reasonable steps to protect the personal information it holds from misuse and loss and from unauthorised access, modification or disclosure.

FACTS

The complainant alleged that a registered club interfered with his/her privacy by scanning his/her driver licence and, in doing so, recording unnecessary information.  While the complainant conceded that the club was required to collect their name, address and signature he/she considered the collection of the other information on the licence, including their date of birth, driver’s licence number, driver’s licence type and photograph to be unnecessary.

 

DECISION

As part of the conciliation process, the complainant accepted the registered club’s offer to delete their personal information from its database, on the condition that the complainant would provide it with a statutory declaration setting out their name, address, and the date they entered the registered club as a visitor.

The registered club  had obligations under section 31 of the Registered Clubs Act 1976 to retain certain personal information for five years and it had a procedure in place to delete the information after that time. Interestingly the Club would not agree to cease or alter its identity scanning practices but would offer its patrons the alternate option of manually completing and signing the register and if  if a patron changed his or her mind after having their identification scanned; it would endeavour to delete this information in a similar way to the complainant.

In terms of notice, the registered club advised that a privacy statement is displayed at the entrance to the club informing patrons about the collection and handling of their personal information and is also displayed to patrons on the terminal when their identification is scanned. This statement refers patrons to the registered club’s privacy policy.

The club also agreed to destroy any personal information it had collected from patrons for five years, rather than retaining it for seven years as it had done previously.

The Commissioner considered the registered club’s proposal to deal with the complaint, including the offer by the club to delete the complainant’s personal information from its identity card scanning machine. In particular, he took into account the registered club’s legal obligations to collect certain identifying information, and the fact that the registered club would continue to offer patrons the option of manually signing in as an alternative to having their identity cards scanned.

The Commissioner decided that the offer of deletion coupled with the alternative option of manual sign-in adequately dealt with the collection issues in the complaint. The Commissioner also considered the security procedures and notice at the entrance of the club adequately dealt with that aspect of the complainant’s complaint.

ISSUES

This is a deeply unsatisfactory response to a very serious privacy intrusion.  That a person’s licence should be scanned, as a mode of entrance, is very poor public policy.  That there was no sanction for this initial policy is a less than dynamic approach to privacy protection.  The breach was eggregious and the proposed solution does not remove a real ill, providing very private information well above that required by law.  That the club says it would delete some of that data is poor practice.

This is a very poor decision by the Commissioner. It is part explained by poor analysis.  It is also partly explained by the hybrid role the Commissioner adopts when considering complaints.  It is far from adjudicative and when it comes to resolving the balance is too far looking at a a solution for the future, here cobbled together roughly with much hope over realistic expectation, rather than dealing with the contravention.

 

Leave a Reply