To begin, at the Commonwealth level the office with the responsibility for privacy regulation is the Office of the Australian Information Commissioner (OAIC).
Personal information refers to information or an opinion about a person that can reasonably make them identifiable based on that information, whether it is true or not. You should treat a debtor’s personal information with respect keeping in mind that the improper use of a debtor’s personal information may cause that person serious problems.
There are legal obligations under the Privacy Act 1988 (Cth) (the Privacy Act) to protect the privacy of a debtor’s personal information, which is done in the following ways;
If you acquire a debtor’s contact details from their employer, that counts as collecting their personal information. Telling a debtor’s neighbour the reason for trying to find the debtor will also disclose personal information about the debtor.
Collecting and disclosing the debtor’s personal information
Information handling by private sector organisations is regulated, in part, by the Australian Privacy Principles (the APPs). There are several key obligations around handling personal information:
Personal information (other than sensitive information which is discussed below) must not be collected about an individual unless the information is absolutely necessary for your organisation’s functions or activities. Therefore, only collect information that is reasonably necessary to recover the debt. For example, you should not write down extra information about the debtor from a document of identification just because it may prove to be useful in future.
Sensitive information must not be collected about an individual unless the individual has given their consent and the information is reasonably necessary. Some limited exceptions to this rule apply. Sensitive information includes information or an opinion about an individual’s race or religious beliefs, criminal record, health information, or membership of a professional or trade association.
During debt collection, personal information must be collected only by lawful, fair means and must be gained directly from the debtor, unless this is not reasonable or practicable. It is important that you take the possible steps to let the debtor know when and the fact that information concerning them is collected,
- the circumstances of that collection
- the identity of the organisation collecting the information and its contact details
- the purposes for which the information is collected
- the main consequences for the individual if the required information is not provided
- any law that requires the particular information to be collected
- the organisations (or types of organisations) to which the organisation usually discloses information of that kind
- whether the organisation is likely to divulge the information to overseas recipients
- the fact that the debtor may access the information collected
- the ways the individual can complain about a breach of the APPs
It is lastly important not utilise or release the information for a purpose other than that for which it was collected unless the debtor has consented to that use or disclosure or another exception applies.