Shree Parajuli
Determinations Support Officer
In a recent decision, the OAIC considered the appropriateness of intentionally exposing an individual’s personal information online without their consent when the service provider responded to a negative online review.
The OAIC determined there had been an interference with the privacy of the complainant, a tenant of a real estate agency, in the matter ‘AQE’ and Noonan Real Estate Agency Pty Ltd (Privacy) [2024] AICmr 237.
The privacy complaint
The complainant was a tenant of a property managed by a real estate agency. The tenant posted a negative review on the agency’s Google business page under a profile name similar to his own. In its response to the Google review, the agency disclosed his full name, occupation and financial circumstances.
After the agency refused to delete its response, the tenant made a privacy complaint to the OAIC.
The determination
The OAIC's decision scrutinised the agency’s compliance with the Australian Privacy Principle 6 (APP 6), which governs the use and disclosure of personal information.
Understanding APP 6
APP 6 states that an APP entity that holds personal information for a particular purpose cannot use or disclose that information for another purpose unless certain conditions are met. These conditions include obtaining the individual's consent or ensuring the individual would reasonably expect such use or disclosure.
In this case, the agency collected the tenant’s personal information, including his full name, date of birth, contact details and financial details, for property management purposes. However, the agency disclosed the tenant’s personal information in responding to the his Google review, which was unrelated to that purpose.
Key findings
- No consent: The tenant did not consent to the disclosure of his personal information for the secondary purpose of responding to his Google review.
- Reasonable expectation: While the tenant’s review might have warranted a response, he would not reasonably expect the agency to disclose his personal information in such a manner.
- Irrelevant information: The disclosure of the tenant’s full name and financial details was not pertinent to responding to the issues raised in his Google review. The agency admitted that it could have addressed the review without identifying him or revealing his personal information.
- Action: While no compensation was awarded to the tenant, the agency was ordered to issue a written apology within 30 days of the determination.
The takeaway
This decision highlights the importance of safeguarding personal information, even when responding to public feedback or criticism. From a privacy perspective, it isn’t right to expose someone’s personal information to pressure them into modifying or deleting an adverse online review. Service providers must navigate the fine line between addressing customer concerns and respecting privacy laws, ensuring that personal information is used strictly for its intended purpose. This decision serves as a reminder that the improper disclosure of personal information, especially in public forums, can lead to regulatory action.
