Non-compliance of various data protection principles (DPPs) - E-mail is not necessarily personal data of the recipients - No question of compliance of DPPs for person who is not data user -DPP 3 and 4
The Complaint
The complainant, being a student, complained against the school for failing to maintain security of his personal data, i.e. his examination result, and violated various DPPs in passing the data to another student by means of e-mail in which his name appeared in the list of recipients.
Findings by Privacy Commissioner
The Privacy Commissioner refused to carry out investigation because he found the school was not the data user of the complainant's personal data. Thus, the allegation of non-compliance was not substantiated. He also found that the school was not the data user in respect of the e-mail in question and there was no evidence to show that the data was so passed to another student as alleged. The Privacy Commissioner also considered that the complaint was motivated by factors not related to concern for his privacy but out of a dispute with the school.
The Appeal
The complainant appealed against the Commissioner's decision by repeating that the school was a data user.
The Administrative Appeals Board held that the school was not the data user in relation to the personal data in question. It was also held that including the name of the complainant in the list of recipients of the e-mail without more did not make the e-mail the complainant's personal data and that there was no compilation of information about the complainant. The Privacy Commissioner was right not to carry out investigation.
The AAB decision
The Appeal was dismissed.