Complaint Determination No. 2 of 2004
Federal Privacy Commissioner
April 2004
Complaint Determination No.2 of 2004
Table of Contents
COMPLAINT DETERMINATION NO. 2 2004........................................................................... 3
PARTIES TO THE COMPLAINT .............................................................................................. 3
Complainants................................................................................................................................................... 3
Respondent ..................................................................................................................................................... 3
HISTORY................................................................................................................................... 3
BACKGROUND, ALLEGATIONS AND REMEDIES SOUGHT ............................................... 3
THE LAW .................................................................................................................................. 5
INVESTIGATION PROCESS .................................................................................................... 7
GENERAL CONSIDERATIONS ............................................................................................... 8
FINDINGS.................................................................................................................................. 9
SMALL BUSINESS PROVISIONS .................................................................................................. 9
CURRENT STEPS TAKEN TO MAKE SURE PERSONAL INFORMATION IS ACCURATE, COMPLETE AND
UP-TO-DATE ............................................................................................................................ 9
Agreement with members.............................................................................................................................. 10
Random checking of listings.......................................................................................................................... 10
Listing process and requirements.................................................................................................................. 12
Notice in accordance with NPP 1.5 as reasonable step under NPP 3 .......................................................... 14
Findings in relation to TICA’s current data quality processes........................................................................ 15
TICA’S USE OF GENERIC LISTING CATEGORIES ........................................................................ 15
Findings in relation to TICA’s use of generic listing categories ..................................................................... 18
TICA’S USE OF THE TERM ‘TENANCY HISTORY ONLY’ FOR MULTIPLE PURPOSES ....................... 18
Findings in relation to the use of the ‘Tenancy History Only’ listing .............................................................. 19
DISPUTE RESOLUTION PROCESSES AND NPP 3 ....................................................................... 20
Findings in relation to Dispute Resolution and NPP 3................................................................................... 21
NPPS 6.5 AND 6.6................................................................................................................. 21
SUMMARY OF FINDINGS ON NPP 3 AND NPP 6.5 AND 6.6........................................................ 22
DETERMINATION................................................................................................................... 22
2004 2
Office of the Federal Privacy Commissioner
Complaint Determination No.2 of 2004
Complaint Determination No. 2 2004
1. Made under the Privacy Act 1988 (Cth) (the Privacy Act) section 52.
Parties to the Complaint
Complainants
2. The Tenants’ Union of Queensland Inc, Tenants’ Union of NSW Co-op Ltd and complainants C,
D, E, F and G.
Respondent
3. TICA Default Tenancy Control Pty Ltd.
History
4. This determination relates to a complaint lodged by the Tenants’ Union of Queensland Inc
(TU QLD) in February 2003 under section 36 of the Privacy Act.
5. The respondent to the complaint is TICA Default Tenancy Control Pty Ltd (TICA). As set out
below (see [10]) TICA’s business activities involve the collection, use and disclosure of personal
information. It is complained that certain acts and/or practices of TICA may be an interference
with the privacy of individuals.
6. The complaint is a representative complaint, lodged pursuant to section 38 of the Privacy Act.
TU QLD has identified the class of members to the representative complaint as ‘tenants or former
tenants whose listing on the TICA database is either inaccurate, incomplete or not up to date’.
7. I also received complaints made by the Tenants’ Union of NSW Co-op Ltd (TU NSW), and
complainants C, D, E, F and G. The individuals the subject of those complaints fell within the
class of members identified by TU QLD and, accordingly, those complaints were dealt with as a
part of the representative complaint brought by TU QLD.1
8. I decided to investigate the relevant acts and practices of TICA pursuant to section 40 of the
Privacy Act, being satisfied that there was an act or practice which may have been an
interference with the privacy of an individual and that the complaints received were validly made
under section 36 of the Privacy Act.
9. I am also satisfied that the requirements for the making of a representative complaint, set out in
section 38 of the Privacy Act, have been met.
Background, allegations and remedies sought
10. TICA is one of a number of organisations that operates what is known as a tenancy database. Its
Tenancy History Database holds personal information about many thousands of Australians
2004 3
Office of the Federal Privacy Commissioner
Complaint Determination No.2 of 2004
relating to alleged defaults on tenancy agreements, including failures to pay rent or damage to
property. It also holds personal information about applicants for tenancies in what is known as
the Enquiries Database. TICA collects personal information about tenants and applicants for
tenancies from property managers that are ‘members’ of TICA and makes the personal
information it holds on its database available to its members for a fee.
11. The complainants allege that the notices that TICA provides tenants and others about whom it
collects personal information under National Privacy Principle (NPP) 1.5 (set out below at [22])
are not sufficient to make individuals aware that they have been listed on the database and thus
allow them to challenge the accuracy, completeness and currency of the listing. They also allege
that the information held in the TICA database is not ‘accurate, complete or up-to-date’ to the
extent required by NPP 3 (set out below at [19])
12. The complainants argue that there are a number of related problems that contribute to the
allegation that the personal information on the database is not sufficiently accurate, complete or
up-to-date.
13. The issues that the complainants raise, in the original complaint or in submissions and oral
comments to me at the hearing I conducted on 3 March 2004, are that TICA:
•
allows listings that have not been verified by an independent third party such as a tenancy
tribunal – in the complainants’ view this means that listings can be made vexatiously and
inaccurately;
•
uses non-specific listing categories such as ‘Tenancy History Only’ that bring into question
the accuracy of the database;
•
allows landlords to list incidents that are not a breach of residential tenancy agreements,
thereby undermining tenancy legislation;
•
does not advise individuals that a listing has been made;
•
uses a dispute resolution system that is inadequate and does not resolve accuracy
disputes effectively; and
•
holds entries on its database that are incomplete or which are not accurate, for example
because all fields are not complete or because there are entries that duplicate, in most but
not all respects, another entry.
14. NPPs 6.5 (set out below at [24]) and 6.6 (set out below at [25]) are also relevant to this complaint
in that they require organisations to take reasonable steps to correct personal information that is
not accurate, complete and up-to-date or to allow an individual who does not agree that personal
information about them is accurate, complete and up-to-date to attach a statement to this effect to
1 I note that section 38C of the Privacy Act gives me the power to amend a complaint so that it can be dealt with as a
representative complaint. In the event that it is necessary to amend the complaints received from TU NSW and the individuals
concerned so as to make them a part of the wider representative complaint, I would do so pursuant to section 38C of the Act.
2004 4
Office of the Federal Privacy Commissioner
Complaint Determination No.2 of 2004
the record. As the complaint I am considering is about the accuracy of personal information, I
consider I also need to decide if TICA’s acts and practices comply with these NPPs.2
15. Section 38(2) of the Privacy Act requires amongst other things that a complainant identify the
remedy sought. The remedy sought by the complainants is a declaration by the Privacy
Commissioner that TICA:
•
only list a person if the person has breached an order of a state tenancy tribunal, or similar
body;
•
advise a person in writing if they have been listed on the TICA database;
•
require that its members keep records of these orders in order to support the listing and
will provide these to TICA within seven days in the case of a dispute;
•
immediately remove listings which are incomplete such as ‘refer to agent’ or ‘tenancy
history only’;
•
remove listings where an agent is no longer in business or no longer a member of TICA
and therefore the listing cannot be substantiated; and
•
amend and publish, on its website and in all material provided to tenants (such as
documentation provided under the Privacy Act) categories under which individuals may be
listed on the database and the criteria associated with the categories.
The law
16. The NPPs in Schedule 3 of the Privacy Act outline standards for handling personal information
that legally bind organisations, as defined by section 6C(1) of the Privacy Act.
17. Section 13A of the Privacy Act specifies that an act or practice of an organisation is an
interference with the privacy of an individual if the act or practice breaches an NPP in relation to
personal information that relates to that individual. 3
18. The issue in this complaint is whether TICA takes reasonable steps to make sure that the
personal information it handles is accurate, complete and up-to-date as required by NPP 3. NPP
3 sets out organisations obligations’ to maintain data quality.
19. NPP 3 states that:
An organisation must take reasonable steps to make sure that the personal information it
collects, uses or discloses is accurate, complete and up-to-date
20. The complainants also alleged that TICA does not meet its obligations under NPP 1.5 to take
reasonable steps to provide individuals with specified information.
2
I note here that the Privacy Act does not require complainants to specify which NPPs may be relevant to the complaint they
are making.
3 TICA is not bound by an approved privacy code in terms of section 13A(b)(ii) of the Privacy Act.
2004 5
Office of the Federal Privacy Commissioner
Complaint Determination No.2 of 2004
21. NPP 1.3 states that:
At or before the time (or, if that is not practicable, as soon as practicable after) an organisation
collects personal information about an individual from the individual, the organisation must take
reasonable steps to ensure that the individual is aware of:
(a) the identity of the organisation and how to contact it; and
(b) the fact that he or she is able to gain access to the information; and
(c) the purposes for which the information is collected; and
(d) the organisations (or the types of organisations) to which the organisation usually
discloses information of that kind; and
(e) any law that requires the particular information to be collected; and
(f)
the main consequences (if any) for the individual if all or part of the information is not
provided.
22. NPP 1.5 states that:
If an organisation collects personal information about an individual from someone else, it must
take reasonable steps to ensure that the individual is or has been made aware of the matters
listed in subclause 1.3 except to the extent that making the individual aware of the matters
would pose a serious threat to the life or health of any individual.
23. NPPs 6.5 and 6.6 are also relevant to the question of the accuracy, completeness and currency
of personal information. These principles are part of the range of measures set out in NPP 6
dealing with aspects of the right to access personal information. They complement organisations’
data quality obligations under NPP 3 by requiring them, where the individual independently
establishes that personal information is not accurate, complete and up-to-date, to take reasonable
steps to correct that information and by allowing individuals to have their view noted where there
is disagreement.
24. NPP 6.5 states that:
If an organisation holds personal information about an individual and the individual is able to
establish that the information is not accurate, complete and up-to-date, the organisation must
take reasonable steps to correct the information so that it is accurate, complete and up-to-date.
25. NPP 6.6 states that:
If the individual and the organisation disagree about whether the information is accurate,
complete and up-to-date, and the individual asks the organisation to associate with the
information a statement claiming that the information is not accurate, complete or up-to-date,
the organisation must take reasonable steps to do so.
26. Section 6D(1) of the Privacy Act defines a small business as one with an annual turnover of
‘$3,000,000 or less’. Section 6D(3) to 6D(9) of the Privacy Act provide for a small business to be
classed as ‘a small business operator’ and therefore not subject to the Privacy Act except in
specified circumstances, including where an organisation trades in personal information.
27. The Privacy Act also provides that small businesses which are subject to the Privacy Act would
not be subject to the provisions of the NPPs until 21 December 2002. Consequently, when
investigating this complaint I have been restricted to examining evidence relating to the acts and
practices of TICA which occurred after 21 December 2002 except where the Privacy Act provides
otherwise.
2004 6
Office of the Federal Privacy Commissioner
Complaint Determination No.2 of 2004
28. In this regard with respect to small businesses:
•
section 16D(2) of the Privacy Act provides that NPP 3, as far as it relates to collection of
personal information, only applies to personal information collected after 21 December
2002;
•
section 16D(3) of the Privacy Act provides that NPP 3, as far as it relates to use and
disclosure, applies to personal information regardless of when it was collected; and
•
Section 16D(4) of the Privacy Act provides that NPPs 2 and 6 apply to personal
information collected after 21 December 2002.
29. Section 52 of the Privacy Act provides that after I have investigated a complaint I may make a
determination:
•
dismissing the complaint; or
•
finding the complaint substantiated and making a declaration that:
the respondent has engaged in conduct constituting an interference with the privacy of
an individual and should not repeat or continue such conduct; and/or
the respondent should perform any reasonable act or course of conduct to redress
any loss or damage suffered by the complainant; and/or
the complainant is entitled to compensation for any loss or damage – including injury
to the complainant’s feelings or humiliation suffered by the complainant.
30. It is also within my powers under s 27 of the Privacy Act to make recommendations which will
promote compliance with the NPPs.
Investigation process
31. Section 40(1A) of the Privacy Act provides that I must not investigate a complaint where the
complainant has not first complained to the respondent, unless I consider that it was not
appropriate for the complainant to have done so. In the present case, I am aware that TU QLD
has had ongoing contact with TICA in relation to a number of privacy issues arising out of its
activities and that this contact may be considered to be by way of ‘complaint’. To the extent that
the present complaint falls beyond those ‘complaints’ made to the respondent, which I note have
not resulted in the resolution of these matters, I am satisfied that the complex nature of the issues
raised and their significance for the rights of the people concerned makes it inappropriate for
them to be the subject of direct complaint to the respondent.
32. My Office’s investigation of this complaint involved the following:
•
formally advising the parties that I was opening an investigation into the complaint under
section 40(1) of the Privacy Act and inviting the parties to respond;
•
gathering evidence and considering information provided by TU QLD, TU NSW, the individual
complainants and TICA in submissions or in response to matters raised by my staff or the
complainants;
•
providing the respondent and the complainants with opportunities to comment on an initial
preliminary view on the complaint in September 2003;
•
visiting TICA’s premises to discuss the issues raised in the complaint, to observe its database
in practice and gather additional information about the operation of the database;
2004 7
Office of the Federal Privacy Commissioner
Complaint Determination No.2 of 2004
•
providing the parties with the current Office position on the complaint in February 2004
following changes in some aspects of the views expressed by the Office since September
2003 and extending an invitation to make oral and/or written submissions;
•
holding a hearing on 3 March 2004 affording the parties the opportunity to appear before me –
TU QLD and TU NSW accepted the invitation to appear at the hearing;
•
considering written and oral submissions and gathering information to clarify claims made by
the parties;
•
providing the primary representative complainant (TU QLD) and TICA with the opportunity to
see information and submissions provided by the other party;
•
checking TICA listings relating to 50 individuals to assess if the personal information in the
listings was accurate, complete and up-to-date;
•
pursuant to section 43(5) of the Privacy Act and the principles of procedural fairness, providing
the parties with a revised preliminary view in March 2004 (the March preliminary view) and a
final opportunity to comment before I finalised the determination;
•
holding a further hearing on 8 April 2004 affording the parties the opportunity to appear before
me – TICA accepted the invitation appeared at the hearing; and
•
providing TICA and TU QLD with copies of the submissions, excluding some material that
involved personal information of third parties, made by the other party in response to my March
preliminary view.
General considerations
33. Before setting out my findings and reasons in relation to this complaint I will make some general
comments about the context in which this complaint is made.
34. Housing is essential for all people and is one of the basic human rights set out in the Universal
Declaration of Human Rights.4 The operation of tenancy databases is controversial because of
their perceived impact on the ability of individuals listed on the databases to obtain housing. On
the other hand tenancy databases, such as TICA, can be seen as a legitimate risk minimisation
tool for property managers.
35. A number of the NPPs relevant to this complaint require an assessment of ‘reasonableness’ (for
example, the ‘reasonable steps’ required of an organisation under NPP 1.3). I take the view that
in making an assessment of ‘reasonableness’, it is appropriate to take into account the purposes
for which personal information is collected and the consequences for the individuals concerned.
In this case I am satisfied that tenancy databases, such as the one operated by TICA, do have an
impact on an individual’s ability to obtain housing; my understanding is that this is part of the
intention when establishing such databases.
36. However, this is only one factor I have taken into account. I have also considered the overall
intention of the Privacy Act including that business needs to be able to operate efficiently and
effectively and that the NPPs are general high level principles and are not prescriptive in how they
apply.
4
Article 25 Universal Declaration of Human Rights available at http://www.un.org/Overview/rights.html.
2004 8
Office of the Federal Privacy Commissioner
Complaint Determination No.2 of 2004
37. I have set out below issues that this complaint raises together with information and evidence and
discussion about the application of the law that I consider relevant to the question of whether
TICA complies with its obligations under NPPs 3, 6.5 and 6.6.
38. It is relevant to note that this complaint is against TICA, not its members. Accordingly, I will not
consider how the NPPs apply to the acts and practices of its members. That would be the subject
of separate investigation should such a complaint be made against a member I acknowledge
TICA's request in its submission in response to my March preliminary view that it be advised
about practices of its members that may be breaches of the Privacy Act so that it can assist to
address these practices.
Findings
Small business provisions
39. I find that TICA is an ‘organisation’ as defined by section 6C(1) of the Privacy Act, and is
accordingly bound by the NPPs.
40. I find that TICA does not fall within the exemption to the Privacy Act which applies to ‘small
business operators’.5 TICA is a ‘small business’ in terms of the Privacy Act, in that its annual
turnover is ‘$3,000,000 or less’. However, as TICA trades in personal information, it does not fall
within the definition of ‘small business operator’ by virtue of section 6D(4)(c) of the Privacy Act.6
Current steps taken to make sure personal information is accurate,
complete and up-to-date
41. TICA argues that the information it holds is accurate, complete and up-to-date. TICA has put
forward the following points to support this view.
•
The ‘essential information is true and correct. Essential information is that a tenancy
existed, the agent was the agent or had the agency transferred to it. The contact number
for the agent is recorded’.
•
Whether or not a person is currently renting the property, the information on the database
reflects the conduct of the tenant.
•
It is TICA’s policy that its members must provide TICA with information that is ‘true and
correct’ and ‘all members guarantee the accuracy of the information at all times’.
•
It carries out 50 random checks on lodgements every week where members are required
to give a copy of the tenancy agreement, the tenancy application, the tenancy history
ledger, any notices issued to the tenant, any tribunal orders and any accounts for cleaning
or damages.
I note that TICA was offered the opportunity to make any submissions or provide any material to me in relation to this
exemption. I did not receive any submissions or material in relation to this issue.
6 I note that section 6D(4)(c) of the Privacy Act does not prevent a body corporate from being a ‘small business operator’ only
because it discloses personal information with the consent of the individual, or as required or authorised under legislation. I find
that TICA does not have the consent of all of the individuals whose personal information appears on their database (in
particular, those individuals whose personal information was collected before 21 December 2002) and is disclosed to TICA’s
members. I note that TICA has not claimed that it does have such consent, although it was given the opportunity to do so.
5
2004 9
Office of the Federal Privacy Commissioner
Complaint Determination No.2 of 2004
•
Its collection process uses specified fields and pick lists, rather than free text fields, to
ensure consistency and accuracy of listings and it publishes information about the
meaning of listings.
•
It refers disputes about listings to members.
42. While I acknowledge that TICA does take some steps to ensure that its information is accurate,
complete, and up-to-date, it is my view, for the reasons that follow, that the steps taken are not, in
all of the circumstances, sufficiently adequate to be considered ‘reasonable’.
43. As noted above, I consider the potential significance of the listing for an individual – namely,
difficulty in obtaining access to housing – as being relevant. In my view, this impacts upon what
steps are ‘reasonable’ in ensuring that information is accurate, complete and up-to-date.
Agreement with members
44. The Privacy Act places responsibility on organisations with respect to data quality that cannot be
passed onto others by contractual arrangements (although others may assist in meeting the
obligations). I consider that the fact that TICA’s agreement with members places obligations on
the members to make ‘true and correct’ listings is a positive step in meeting the obligations in
NPP 3.
45. However, I note that the agreement only requires that the listing be ‘true and correct’ and it does
not specify what is meant by ‘true and correct’. The obligations in NPP 3 go beyond requiring
organisations to take reasonable steps to make sure personal information is correct. They must
also take reasonable steps to make sure personal information is complete and up-to-date. In my
view, a listing might be ‘true and correct’ but be incomplete, for example because it notes that a
debt of X amount was owed but does not note that it has since been paid, or be out-of-date
because it relates to very old events.
46. I also note that the agreement with members does not currently specify what will happen if
members fail to provide listings that are ‘true and correct’. Although the NPPs do not require a
specific course of action, it would not be reasonable in my view for TICA to take no action in such
circumstances; the listings would need to made accurate, complete and up-to-date or be
removed. It is also my view that it would be unreasonable not to take some steps to prevent
incorrect listings in the future. TICA notes in its submission of April 2004 (responding to the
March 2004 preliminary view) that its web site states that members will be suspended for making
vexatious listings and that it would amend listing found to be false or misleading. I acknowledge
these measures and consider they are helpful. I would also expect similar action where a
member has a pattern of inaccurate, incomplete or out of date listings for reasons other than a
vexatious intent.
Random checking of listings
47. In my view, the 50 random checks that TICA states it undertakes weekly to test the accuracy,
completeness and currency of member listings would be a positive step in meeting the obligations
in NPP 3. TICA advises that its process is to seek copies of the documents mentioned above
from its member and to check these against the listing. However, TICA has advised that it does
not keep records of this process and that it shreds the documents it receives from its members
once the check is complete.
2004 10
Office of the Federal Privacy Commissioner
Complaint Determination No.2 of 2004
48. The Office asked TICA to provide it with the first 50 alphabetical listings from the Tenancy History
Database and attempted to check the accuracy of these listings. To confirm the accuracy of each
listing staff of the Office undertook the following:
•
examined the face of each listing to ensure that the record was complete and that there
were no obvious inaccuracies; and
•
telephoned the listing member using the telephone number provided in the record to:
•
ask if the individual was/is a tenant who had a tenancy relationship with the member; and
•
ask if the tenant’s name and suburb in which they rented was correct; and
•
ask if the member had a copy of the lease that applied to the tenancy; and
•
ask if the member, on TICA’s behalf, had obtained the individual’s consent for TICA to
collect the individual’s personal information and how this consent was obtained; and
•
ask the member if the remark in the field titled ‘comment’ (that is the listing category) was
correct; and
•
ask the member what evidence it had to support the listing, including what specific
evidence was held to substantiate that money was owed or that a tribunal/court order
existed and for a copy of that evidence to be provided to my Office.
49. In relation to the records that the Office checked it was found that:
•
Some records did not contain adequate identifying information, for example no driver’s
licence number was listed.
•
There were obvious inaccuracies on the face of some records. For example, some
records contained the listing ‘Tenancy History Only’ but also listed an amount of rent owed
and a date the rent debt was cleared.
•
The listing category was incorrect in some instances.
•
The record showed that one real estate franchisee had listed a debt when in fact the listing
was made by another franchisee.
•
The amount of rent owing was incorrect in some instances.
•
Rent had been ‘cleared’ but the record had not been updated to reflect this in some
instances.
•
The listing member had no knowledge of the tenant in some instances.
•
The member who initially listed the tenant had sold the real estate agency and the current
owner had no records relating to the tenancy in some instances.
50. In its April 2004 submission TICA accepted some of the error types listed above but argued that
others were based on the Office’s misunderstanding of its processes. In particular, TICA noted
that it did in fact have minimum listing requirements in place and had done so since 1998-99
when over 100,000 entries were removed from the database. I discuss this issue further below
(see [58]). TICA also queried the Office’s conclusion that some listing categories were incorrect.
2004 11
Office of the Federal Privacy Commissioner
Complaint Determination No.2 of 2004
This conclusion was based upon corrections made by listing members when the Office contacted
them to discuss their listing and I am satisfied that it is correct.
51. TICA did acknowledge that it is aware of cases where the listing agent may have been incorrect,
for example where a staff member moved to a new agency and made a listing with the previous
agent’s logon and password; it has taken steps to prevent this occurring in the future including
changing members' logon and password more frequently.
52. TICA also accepted that there may be instances where a listing in relation to an amount owing
was incorrect because of an ‘oversight’ by a member, or where the listing member had no
knowledge of the tenant or had ceased to trade. It considered that these matters would be dealt
with under TICA’s policy of deleting listings that cannot be validated or would be subject to
correction under NPP 6.5. However, these mechanisms rely on TICA or an individual being
aware that a listing is not accurate, complete or up-to-date and in my view this is inadequate.
53. In the context of ensuring that personal information is accurate, complete and up-to-date in the
present circumstances, I am of the view that the following elements in any system of quality
control are important:
•
implementation of a system for routine random checking of records;
•
deletion or amendment of records that are found to be inaccurate;
•
advice of deletion or amendment to the individual concerned and to any other members
that have accessed the record since it was listed;
•
provision of feedback to the member concerned; and
•
detailed records of the checking process including the member’s name, date of the check,
results of the check and action taken.
54. The March preliminary view indicated that TICA’s system of checking does not meet these
criteria. TICA states in its April 2004 submission that it takes all the steps other than the record
keeping element. TICA also advised that it would consider establishing a system to keep records
of its random check of members; the system would probably involve making file notes rather than
keeping copies of documents. However, on the basis of the evidence before me, including the
investigation conducted by the Office detailed above, I am satisfied that TICA has not taken
sufficient steps to comply with NPP 3.
Listing process and requirements
55. TICA’s method of collection is to receive listings from its members, either by the member entering
data directly into the database or by the member providing information to TICA for entry. TICA
advises that its system is designed to promote accuracy of the listings in that it uses a standard
format for data entry it provides a number of standard fields and it does not allow the member to
make free text entries.
56. The March preliminary view was based on the understanding that TICA did not require its
members to provide a minimum set of information before accepting a listing. TICA advised in its
April 2004 submission that it does require, in addition to name, at least one other form or
identification (date of birth, driver’s licence number or passport number) before accepting a listing.
2004 12
Office of the Federal Privacy Commissioner
Complaint Determination No.2 of 2004
It provided a copy of a listing screen, dated 25 March 2004, that stated this requirement. I also
note that the 50 records the Office examined all contained at least two identifiers.
57. The March 2004 preliminary view was that, in the context of ensuring that personal information is
accurate, complete and up-to-date in the present situation, the following elements are important
for a method of collection:
•
mandatory completion of fields that are significant in terms of ensuring the personal
information is accurate, complete and up-to-date; and
•
requiring a minimum set of identifying information, for example name, date of birth, and
address or driver’s licence number.
58. As noted above, TICA advises that it does require one piece of identifying information in addition
to name. It argued strongly against any requirement to include tenants’ addresses on its
database on the grounds of relevance to its members and privacy risks for the individuals
concerned. It also argued that the information currently submitted by members was limited to
what tenants provided or had available; it noted that there were many people who would have
neither a driver’s licence nor a passport. The complainants in their submission to me in response
to the March 2004 preliminary view agreed, with qualifications, with the proposal that a listing
should only be accepted with a minimum set of personal information. It considered that the
minimum set should be name, date of birth and an official identification number of some sort. It
did not seek to include address as an identifier.
59. I am aware of a wide range of anecdotal evidence to the effect that a listing with TICA can have a
negative impact on an individual’s ability to gain housing and that a property manager may decide
not to proceed with a tenancy application if it finds a listing it thinks relates to an applicant. While
I accept that not all or even most property managers will rely only on the fact that a person has a
listing with TICA¸ I consider that it would not be reasonable for TICA to accept listings that are
ambiguous as to the person to whom they relate.
60. In my view, name and one other identifying factor will not always be sufficient to establish identity
to this level. My experience is that, in general, database entries commonly contain a range of
errors introduced, for example because of operator error, the use by individuals (for whatever
reason) of different names or variations on their names, or the existence of a number of people
with the same or similar names. Increasing the number of identity-related data items to be
collected may improve the strength of evidence of identity. In the case of tenancy databases, I
take the view that the minimum requirement is three pieces of such information, including name
and date of birth.
61. TICA needs to be mindful that there are many government-issued (Commonwealth, State and
Territory), and other, numbers that could be used as the third data element in determining
evidence of an individual's identity. Use of Commonwealth government identifier-numbers (such
as passport numbers) by private sector organisations, however, can occur only in compliance
with NPP 7; this will require further consideration by TICA. TICA also needs to be mindful that the
collection of additional data elements such as date of birth or government-issued identifiers for
the primary purpose of establishing evidence of identity would mean, in accordance with NPP 2,
that these particular data items may only be used or disclosed for the purpose of establishing
evidence of identity (or in accordance with the exceptions under NPP 2).
2004 13
Office of the Federal Privacy Commissioner
Complaint Determination No.2 of 2004
Notice in accordance with NPP 1.5 as reasonable step under NPP 3
62. In my view, in the context of this complaint, proper notification of the collection of personal
information (required by NPP 1.5) can play an important role in ensuring accuracy as it allows an
individual to challenge a listing that they believe is (and may be) inaccurate.
63. The complainants argue that TICA’s current forms of notice are not sufficient to make people
aware that they have been listed on the database and as a consequence TICA is failing to allow
individuals the opportunity to check and challenge the accuracy, completeness and currency of
listings about them.
64. TICA advises that it informs individuals that it has collected their personal information from a third
party (the property manager) via the ‘Privacy Acknowledgement that tenants are required to sign
when they apply for a property’. TICA believes that this acknowledgment form makes ‘the
database membership and activities transparent and fully advises individuals what will occur with
their personal information’. It also advised in its April 2004 submission that the Privacy
Acknowledgement was not the only source of information available to tenants about TICA and its
operations or about the fact that they may or will be listed in certain circumstances. Other advice
includes arrears letter from members and various other TICA policy statements that it has
prepared for use by members or which describe its operations. On this basis, TICA believes that
it satisfies the requirements of NPP 1.5.
65. I note here that TICA collects personal information at two stages and holds that information in two
separate databases as follows:
•
information may be collected, about potential tenants and other people who will live in the
dwelling but not be included on the tenancy agreement as tenants (known as approved
occupants), when they apply for a tenancy and regardless of whether the tenancy
proceeds – this set of personal information is held on the Enquires Database;
•
information may be collected when a member considers there has been a problem with
the tenancy, or the tenancy ends, and it makes a listing about a tenant (but not about
approved occupants) – this set of information is held on the Tenancy History Database
66. The application of the Privacy Act to the Enquiries Database and to the steps TICA takes to meet
its obligations under NPP 1.5 is considered in relation to my Determination No. 4 of 2004. That
determination finds that in some respects the steps that TICA is currently taking are not
reasonable for the purposes of NPP 1.5 given the circumstances of the complaint.
67. In relation to this complaint I consider that the fact that TICA takes some steps to advise
individuals, in accordance with its obligations under NPP 1.5, is a positive step towards the
reasonable steps it needs to take under NPP 3.
68. However, I consider it is relevant here to note that:
•
TICA has only been obliged to comply with NPP 1.5 since 21 December 2002, and I
consider it is probable that there are many individuals who are currently listed in the
database who do not know they are listed; and
•
it would appear that individuals are not necessarily informed that an adverse listing has
been made with TICA and may only become aware that they have been listed, and
therefore have an opportunity to challenge the accuracy, completeness and currency of
2004 14
Office of the Federal Privacy Commissioner
Complaint Determination No.2 of 2004
the listing, if they are denied a tenancy and are told that this is on the basis of an adverse
TICA listing.
69. In regard to this last point, TICA in its April 2004 submission noted that tenants would be advised
in arrears letters of the possibility of listing if payments are not brought up to date. However, I
also understand from supporting material provided by TICA that a property manager may or may
not proceed with a listing in these circumstances. I also understand that listings may occur
without an arrears letter – for example because the listing was for a non- arrears matter.
Although an arrears letter may make some individuals aware of a listing or potential listing, I am
not satisfied that the practices of property managers are consistent. I also reiterate that
arrangements that TICA might make to get others to help meet its obligations does not relieve
TICA itself of these obligations, in this instance in regards to NPPs 1 and 3.
Findings in relation to TICA’s current data quality processes
70. I note that TICA in its April 2004 submission argues that is up to it, not the Privacy Commissioner,
to decide what steps are reasonable in the circumstances. I agree with this view but only up to a
point. The Privacy Act clearly puts an obligation on an organisation to make such judgements.
The Act also, however, provides that I can make those judgements should they be the subject of
a complaint and that I am then in a position in a determination such as this to reach a different
view on what is reasonable.
71. On balance, for the reasons I have set out above, I find that although TICA is taking some steps
to make sure the personal information it collects, uses and discloses is accurate, complete and
up-to-date these steps fall short of the ‘reasonable steps’ required by NPP 3. Consequently, I find
that TICA is in breach of NPP 3.
TICA’s use of generic listing categories
72. The information before me indicates that the listing categories used during May 2003 were:
•
Arrears of rent
•
Broke tenancy agreement
•
Absconded
•
Dishonoured Cheques
•
Tribunal orders (Against the Tenant in favour of the Agent or Lessor)
•
Court orders (Against the Tenant in favour of the Agent or Lessor)
•
Failed to comply with Residential Tenancy Act
•
Rental bond claims
•
Failing to provide adequate notice
•
Sublet without consent
2004 15
Office of the Federal Privacy Commissioner
Complaint Determination No.2 of 2004
•
Bankruptcy
•
Entered into Payment Arrangement
•
Damage to property
•
Taking possession without consent
•
Past tenant history no default recorded
•
Satisfactory payment history
•
Tenancy History
•
Current tenant
•
Recommended tenant
•
Breaches of body corporate bylaws
•
Poor periodic inspections
•
Unauthorised pets
•
Schemes of arrangement
•
Noise and Nuisance
73. TICA stated that members are only allowed to use existing categories and there is no free text
field that allows members ‘to type any information into listing categories’. However, members are
able to list amounts in relation to certain fields. When a member makes an enquiry about an
individual the information returned is listings against any category, any associated monetary
details, details about the listing agent and the date of listing.
74. In my view, given that members may only look at the category name when checking for listings
about an individual, the names of the categories should allow the tenant and listing member to
understand the meaning attached to the listing, and they should convey accurate information
about the tenant’s history to other persons using the TICA database. The March preliminary view
stated that the current categories do not meet this test, in part because a number of broad, ‘catchall’ categories are in use.
75. TICA responded in its April 2004 submission that is was considering changing its business model
to being a history only database; that is that the database would only contain individual details
including the property managers with whom they had rented. While I note this proposal, it does
not alter the situation in relation to the complaints currently before me. However I note that in
general the Privacy Act would not prevent this form of database provided its operation complied
with the NPPs.
76. Without well-defined listing criteria, tenants and users of the database are not able to determine
the meaning attached to listings. If there are multiple definitions for listing categories the precise
nature of the comment being made cannot be plain on the face of all categories. My view is that
this would render the database incomplete and inaccurate.
2004 16
Office of the Federal Privacy Commissioner
Complaint Determination No.2 of 2004
77. The categories noted in the March preliminary view as being currently too broad included
‘Breaking a tenancy agreement’ and ‘Failed to comply with Residential Tenancy Act’. It was
noted that the use of these terms may result in information being recorded that is incomplete in
terms of NPP 3, for example because it is possible that a term of the tenancy agreement or
legislation is broken by mutual agreement between the parties. These generic terms are
applicable when a tenant is in rental arrears, has absconded or failed to provide adequate notice,
has sublet without consent and taken possession without consent. Neither of the generic terms
‘Breaking a tenancy agreement’ and ‘Failed to comply with Residential Tenancy Act’ reveals the
precise nature of the comments being made and accordingly, appear to be incomplete.
78. TICA’s April 2004 submission advises that it ascribes a particular meaning to the term ‘broke
tenancy agreement’ namely the situation where the tenant advises the property manager of their
decision to vacate the premises while an agreement is in place; the term is therefore not a
catchall for other listings such as ‘absconded’ or ‘sublet without consent’. I accept this
clarification. However, I continue to hold the view that the category ‘Failed to comply with
Residential Tenancy Act’ is a broad, catch all category and results in information being recorded
which is incomplete.
79. TICA does provide definitions of the categories on its website and in information to members.
While TICA has published its listing criteria on its website, the listings are preceded by the
sentence ‘The following list provides a selection of the most common breaches for which tenants
can be listed on the database. It should be noted that members may list other breaches which
may not be listed below.’ From the material before me, I have concluded that the listing
categories are used intermittently and not adequately understood or followed by members. I find
this is likely to result in an incomplete and inaccurate database.
80. It would also appear that the listing definitions on the TICA website are not identical to the
definitions TICA provided to my Office. For example, the website defines ‘Arrears of rent’ as ‘a
tenant can be reported to TICA from the time of arrears’. The advice provided to my Office by
TICA defines ‘Arrears of rent’ to be ‘when a tenant is more than four days in arrears and not in
advance as required under the Residential Tenancy Agreement and the Residential Tenancy Act’.
This suggests that the listing criteria are not well defined. TICA has acknowledged that there
have been ambiguities in definitions. Its April 2004 submission argues that the examples
referred to above refer to different scenarios and are therefore technically accurate.
Nevertheless, it remains my view that it is critical that the categories are consistently described in
all the circumstances in which they are made available.
81. I find that TICA’s use of a ‘pick list’ method of reporting tenancy history, which relies on one
category that is broadly defined and on descriptions that are brief, not consistently defined and
are not mutually exclusive, means that in this regard it is not taking reasonable steps to make
sure that the personal information it holds is accurate, complete and up-to-date.
82. The complainants argue that, given the nature of the database and its impact upon an individual’s
ability to gain housing, listings should be supported by a high standard of proof and refer to the
objective decision of a third party. They also argue that as a general rule listings should only be
allowed when a tenant breaches an order of a relevant tenancy tribunal. They claim that without
this the accuracy of the listing cannot be determined and that without introducing any external
2004 17
Office of the Federal Privacy Commissioner
Complaint Determination No.2 of 2004
process, such as verification through tribunal orders, incorrect and subjective listings will
continue.
83. The Privacy Act does not, in my view, give me the power to determine what listing categories
should be used by TICA. The Privacy Act requires that all listings must be accurate, complete
and up-to-date and I may therefore be able to form a view that certain listing categories are not
acceptable. However, it does not follow that I can or should prescribe what categories must be
used.
84. Having said this, in my view listings which are restricted to categories defined by legislation, or
listings which relate to tribunal and court orders, will be clearly defined and are appropriate for
use in a database such as that maintained by TICA. While I acknowledge that tenancy regulation
is a state responsibility and the legislation differs in each state, which may limit the ability to
define national criteria for listing categories, where appropriate such an approach is to be
encouraged in the interests of accuracy and completeness.
85. I consider that it would be reasonable for the definition of each mutually exclusive listing to be
clearly communicated to database members and individuals, including the type of evidence the
agent will require before making a listing. I note that the use of mutually exclusive categories
does not prevent an agent from making multiple listings of multiple breaches of the tenancy
agreement. However, each breach of the agreement should be clearly defined by one category.
I suggest that TICA provide tenants and members with information advising exactly when one
listing would be used to the exclusion of another.
86. In my view it would also be beneficial for TICA to ask members to provide tenants with a copy of
the listing categories at the time the tenancy agreement is signed and the criterion that will lead to
listing in the database. The criteria should make clear exactly the circumstances under which a
person would be listed. Individuals would then understand that if they committed a particular act
that they would be listed on the TICA database. TICA advises, in its April 2004 submission,
which its members provide individuals with the definitions of the categories. I encourage TICA
and its members to continue this practice.
Findings in relation to TICA’s use of generic listing categories
87. I find that TICA’s use of a ‘pick list’ method of reporting tenancy history, which relies on one
category that is broadly defined and categories which are not consistently defined and are not
mutually exclusive, means that in this regard it is not taking reasonable steps to make sure that
the personal information it holds is accurate, complete and up-to-date. I therefore find that TICA
is in breach of NPP 3.
TICA’s use of the term ‘Tenancy History Only’ for multiple
purposes
88. My findings in relation to TICA’s listing categories apply also to the use of the listing ‘Tenancy
History Only’. However, this listing category raises particular issues that warrant separate
consideration.
89. TICA states that ‘Tenancy History Only’ is used when ‘a member may not need to report a default
but cannot justify recording a satisfactory tenancy history or recommended tenant’. TICA also
2004 18
Office of the Federal Privacy Commissioner
Complaint Determination No.2 of 2004
states that this listing is used when ‘a tenant rented a property and the member wishes not to
record ‘Past history no default recorded’ or ‘Satisfactory payment history’. In addition the TICA
website states that defaults which have been listed for either 3 or 5 years are amended to
‘Tenancy History Only’. Its April 2004 submission also states that it is possible for a rental arrears
listing to be made in conjunction with a Tenancy History Only listing.
90. TICA’s view is that this listing is accurate, complete and up-to-date: ‘a Tenancy history listing
provides no more information than would be provided by an honestly and accurately completed
tenancy application form. It acts as a verifier of an application form. Tenancy history only is what
it says, a tenancy history’.
91. From my investigation I understand that this listing may indicate that a tenant has had a default in
the past. However, it may also be chosen by agents to be used for tenants who did not have any
defaults or where the tenant did not conduct the tenancy in a satisfactory manner (although the
tenant did not have a default recorded against their name). As the ‘Tenancy History Only’ listing
may indicate that a default once existed, it appears inconsistent to allow this listing to be applied
to tenants who have had no default recorded.
92. The history of use of the ‘Tenancy History Only’ is such that it will continue to carry with it a
negative connotation and therefore the category appears to be, in effect, a continuing adverse
listing. The practical implication is that the individual is branded a bad risk even though the
specific default listing has been purged. I do not believe that this problem can be resolved by
TICA making efforts to clarify the nature of the listing with members. In my view, the listing may
be misleading and for this reason is inaccurate and incomplete because it does not explain the
nature of the rental problems, if any.
93. TICA’s April 2004 submission disputes this view on the grounds that the full meaning of the listing
will be apparent when a member contacts the property manager that made the listing. However, I
am not satisfied that this is the consistent practice of TICA’s members and in the absence of
evidence as to this practice, I am of the view that in at least some circumstances members will
impute a negative meaning from the term ‘Tenancy History Only’ and will decide on this basis not
to proceed with the application.
94. Further, if the tenant is advised that their application did not proceed because of a tenancy history
listing and wishes to establish the reason for the listing he or she can only do so by going back to
the member that made the listing.
Findings in relation to the use of the ‘Tenancy History Only’ listing
95. I find that the use of the term ‘Tenancy History Only’ results in the information being held by TICA
being inaccurate, incomplete and out-of-date. I therefore find that, in continuing to use this listing
category, TICA is not taking reasonable steps to make sure that the personal information it holds
is accurate, complete and up-to-date, in breach of NPP 3.
96. My Determination No. 3 of 2004 also deals with use of the ‘Tenancy History Only’ listing with
respect to the timeframes for retaining listings.
2004 19
Office of the Federal Privacy Commissioner
Complaint Determination No.2 of 2004
Dispute resolution processes and NPP 3
97. When describing the steps it takes when a tenant alleges that their personal information is
inaccurate, incomplete or out-of-date, TICA advises that the member is contacted and informed of
the dispute. The member must provide copies of the same evidence that is sought in random
checks. If the tenant continues to dispute the listing, the record is marked as ‘disputed by tenant’
for a period of 30 days whilst the tenant can have the matter heard by a court or tribunal. On
receipt of a tribunal or court order which proves that a listing is incorrect TICA will immediately
amend or delete a listing and advise the member of the inaccuracy.
98. To comply with its obligations to ensure information is accurate, TICA must, in conjunction with its
members, take responsibility for any dispute that arises about the accuracy of personal
information in its database and ensure that such disputes are resolved. Unless it does so, it
cannot be confident that the information it holds is accurate. TICA’s April 2004 submission states
that it does take appropriate responsibility for disputed listings.
99. It is relevant to consider the potential significance of a listing for an individual, particularly if it may
be inaccurate, incomplete or out-of-date. In this instance, as noted earlier, this could include
inability to gain any housing on the residential rental market. This will impact upon what is
reasonable for ensuring accuracy. In the present case I am of the view that for the steps in
relation to disputes about accuracy to be reasonable they would need to include some of the
following elements:
•
taking details of the individuals dispute and putting the concerns to the member;
•
requiring members to respond to the dispute within a reasonable timeframe, in most cases
this would be not more than seven days;
•
seeking sufficient evidence to establish if the criteria set in relation to a particular listing
has been met – for example if rental arrears can only be listed after a specified number of
days what evidence does the member have that this was the case;
•
removing listings where the member cannot provide the necessary evidence, including
because it is no longer in business;
•
providing detailed information to the individual concerned about the members’ response
and advising them of other avenues of redress including to this Office; and
•
keeping records of disputes and the resolution process, including what evidence was
provided by the member and how TICA was satisfied about the member’s claims – for
example did it sight the documentary evidence.
100. TICA states that if a member cannot provide the necessary evidence to validate a listing the
listing is removed. Its April 2004 submission states its dispute resolution practices do include the
elements listed above. In support of this view TICA provided the Office with documentary
evidence in relation to a number of disputed listings it had investigated. I acknowledge that the
documents provided do show that in these instances many of the steps above were included.
The documents provided do not include specified response times or evidence that notes are kept
on a tenant’s file. I also note that these documents relate to dispute investigations commenced
after I commenced my investigation.
101. TICA’s April 2004 submission confirmed that where relevant TICA will advise tenants that it will
mark files as disputed for 30 days to allow the tenant to apply to the relevant tenancy tribunal.
2004 20
Office of the Federal Privacy Commissioner
Complaint Determination No.2 of 2004
The submission puts the view that this is appropriate as the fact that a tenant disputes an amount
owing does not necessarily have implications for whether the listing is accurate, complete and upto-date but rather is a matter to be negotiated between the parties or arbitrated by a tenancy
tribunal.
102. However, in the circumstances of this complaint, TICA’s obligation is to take reasonable steps to
make sure the personal information it holds is accurate, complete and up-to-date. I do not expect
TICA to take on an arbitration role in relation to disputed amounts; however, I do not consider it is
reasonable for TICA to limit its action to marking the listing disputed for 30 days subject to a
tribunal ruling. There may be reasons why a person is unable to seek arbitration of their matter
by a tribunal – for example, because the subject of the dispute falls beyond the jurisdiction of the
tribunal, or because a person becomes aware of a listing after the time limit for making an
application to the relevant tribunal has passed. 7 As discussed below (see [107 - 107]) as a
minimum, I consider TICA should advise tenants of the option of seeking to have a statement to
the effect that the listing is disputed associated with the listing.
Findings in relation to Dispute Resolution and NPP 3
103. I find that with respect to amounts disputed TICA’s current practice of only marking listings
disputed for 30 days means that in this respect it is failing to take reasonable steps to make sure
that the personal information it holds is accurate, complete and up-to-date. I therefore conclude
that in this regard TICA has breached NPP 3.
NPPs 6.5 and 6.6
104. TICA is only obliged to comply with NPPs 6.5 and 6.6 in respect of personal information it
collected after 21 December 2002.
105. NPP 6.5 states that, if an individual can establish that personal information is not accurate,
complete and up-to-date, the organisation must take reasonable steps to correct the information.
TICA has advised that if an individual establishes that a listing is inaccurate it will remove the
listing regardless of when it was made. I accept this and find that TICA takes reasonable steps to
correct information where an individual establishes that it is inaccurate.
106. NPP 6.6 says that if an individual and an organisation are unable to agree about whether
information is accurate, up-to-date and complete, the organisation must, at the request of the
individual, take reasonable steps to associate with the information the individual’s claim to this
effect. I am satisfied that at present TICA does not take any steps in this regard other than, as
noted above, to mark disputed listing as ‘disputed by tenant’ for a period of 30 days.
107. The consequence of this approach is that in cases where the individual does not proceed to take
the matter to a court or tribunal or is unable to do so (for example because the matter falls beyond
jurisdiction or arises out of time for the commencement of proceedings), TICA will still remove the
7 I note, for example, that NSW tenancy legislation has time limits, which usually begin when individuals become aware of an
alleged tenancy agreement breach, after which the dispute can be brought to the Consumer Trader and Tenancy Tribunal
(CTTT). This could mean that if a TICA listing is about a disputed event that occurred, for instance 60 days before the listing,
the tribunal may not have the jurisdiction to hear the matter. In addition, the CTTT has no specific jurisdiction to hear matters
involving disputed TICA listings.
2004 21
Office of the Federal Privacy Commissioner
Complaint Determination No.2 of 2004
disputed marker ‘disputed by tenant’ after 30 days, thereby leaving in place the disputed
information without any indication to future users of the dispute.
108. I therefore find that TICA is not taking ‘reasonable steps’ to associate with an individual’s personal
information an individual’s claim as to the accuracy, completeness or currency of that information.
Consequently, I find that TICA is in breach of NPP 6.6.
109. TICA has advised the Office that it is willing to investigate options to enable individuals to note
they believe their personal information to be inaccurate, incomplete or out-of-date. I would
commend such an approach and suggest that in the case that a statement provided by a tenant is
unduly long, it would be reasonable for TICA to suggest a shortened version.
Summary of findings on NPP 3 and NPP 6.5 and 6.6
110. Whilst I am satisfied that TICA employs some steps to ensure that the information it holds is
accurate, complete and up-to-date, my preliminary view is that I do not consider its present
practices satisfy the obligation imposed by NPPs 3, 6.5 and 6.6. For this reason I find that TICA
has failed to take reasonable steps to make sure that the information it collects, uses and
discloses is accurate, complete and up-to-date and it has therefore breached NPPs 3, 6.5
and 6.6.
Determination
111. I find that TICA has breached NPPs 3, 6.5 and 6.6 by:
•
using an agreement with its members that does not sufficiently specify the data quality
standards required;
•
failing to take sufficient steps to check listings by property managers and not requiring
minimum identification requirement before listing;
•
failing to advise tenants contemporaneously that they have been listed;
•
using a ‘pick list’ method of reporting tenancy history, which relies on one category that is
broadly defined and on descriptions that are brief, not consistently defined and are not
mutually exclusive;
•
providing an inadequate dispute resolution process; and
•
failing to provide mechanisms to correct records where the individual concerned has
established they are not accurate, complete and up-to-date or to associate a statement to
this effect when there is a dispute about accuracy, completeness or currency
112. I therefore find this element of the complaint substantiated and declare that TICA has engaged in
conduct constituting an interference with the privacy of individuals who are members of the class
identified in the complaint. I declare that TICA should not repeat or continue such conduct.
113. The complainants have asked me to make a declaration requiring TICA to develop new forms to
meet its obligations under NPP 1.5. I am not satisfied that I should do so. While I have declared
that TICA should not repeat or continue conduct which constitutes an interference with the privacy
of an individual, I do not, in my view, have the power under section 52(1)(b)(i)(B) to otherwise
generally prescribe how TICA should act.
2004 22
Office of the Federal Privacy Commissioner
Complaint Determination No.2 of 2004
114. I am also of the opinion that section 52(1)(b)(ii) does not provide the basis for making a
declaration of the type sought by the complainants as to the future conduct of TICA. I am not, on
the information presently before me, satisfied that there has been any identifiable loss or damage
suffered by the complainants that would be redressed by a course of conduct required by such a
declaration.
115. However, I do consider the suggestion made by TU QLD to be helpful in assisting TICA to meet
its obligations under NPPs 3, 6.5 and 6.6, in promoting ‘best practice’ under the Privacy Act and
allowing the members of the class upon whose behalf this complaint has been brought to be
better assured that personal information that TICA holds about them will be accurate, complete
and up-to-date.
116. In my view the following steps, that include many of the suggestions made by TU QLD and also
that TICA has indicated it is willing to consider, would be a reasonable set of measures to ensure
that the personal information it currently holds on the database is accurate, complete and up-todate when used or disclosed; and that the personal information it collects in the future is accurate,
complete and up-to-date. I note that the set of measures below are reasonable steps in the
context of this complaint and at this time and taking account of TICA’s operational circumstances.
It is open to me to find that in another set of circumstances that these steps would not be all that
was required.
117. I recommend to TICA that it undertake the following action and that to the extent possible these
actions are completed by mid July 2004 unless I suggest otherwise below.
•
Develop, in consultation with my Office, a detailed description of all listing categories that
are mutually exclusive, include objective criteria for listing, are consistent with state and
territory tenancy legislation and do not include the terms ‘breaking tenancy agreement’ or
‘tenancy history only’. Provide the finalised listing categories to my Office, make them
available on TICA’s website and provide a copy to all of TICA’s members.
•
Specify to its members that the listing categories are to be made available to all individuals
at no charge when a tenancy agreement is signed and make the listing categories
available on TICA’s website and on request to individuals at no charge to the individual.
•
Develop in consultation with my Office, detailed guidelines for the categories, for example,
TICA will include the number of days overdue before a ‘late payment’ can be listed.
Provide the finalised guidelines to my Office and make the guidelines available with listing
categories wherever published or made available.
•
Allow members to only use the terms ‘objectionable behaviour’ and ‘repeated breaches’ if
there is a relevant tribunal order.
•
Provide tenants with the ability to add a statement to any listings which they dispute.
•
Develop, in consultation with my Office, criteria by which members may validate listing.
Remove listings that cannot be validated by members either in the course of TICA’s
random checks or where the individual concerned has disputed the listing.
•
Continue to conduct at least 50 random checks a week to validate listings and regular data
cleansing. In particular, delete or amend records that are found to be inaccurate, provide
advice of deletion or amendment to the individual concerned and to any other members
that have accessed the record since it was listed, provide feedback to the member
concerned and keep detailed records of the checking process including the member
name, date of the check, results of the check and action taken.
2004 23
Office of the Federal Privacy Commissioner
Complaint Determination No.2 of 2004
•
Ensure that individuals are advised, either by TICA or its members that a listing has been
made and that this will occur when individuals complete a tenancy application and when
the individual is listed.
•
Commission an independent audit of the Tenancy History and Enquiries database that will
test the accuracy, completeness and currency of 500 listings on the databases in terms of
NPP 3 and TICA’s stated operating procedures. Provide a de-identified copy of the audit
report to my Office within twelve months of the date of this Determination.
•
In the 12 months from the date of this Determination, delete all records that do not contain
adequate information to uniquely identify an individual. As a minimum requirement I would
expect this to be a name, date of birth and another official document number (subject to
the requirements of NPP 7).
•
Develop an audit trail for both the Tenancy History Database and Enquiries Database to
enable TICA to monitor modification of the databases.
•
Continue to provide members with training and information on the appropriate use of the
TICA system.
•
Alter the agreement with members to ensure that it reflects TICA’s obligations under the
NPPs.
Malcolm Crompton
Federal Privacy Commissioner
Dated 16 April 2004
2004 24
Office of the Federal Privacy Commissioner