Responding to the financial abuse of older people - Loddon ...

More documents

Recommendations

Info

NPP 2.1 states that an organisation must not use or disclose personal information about an individual for a purpose (the secondary purpose) other than the primary purpose of collection, unless a relevant exception applies. The primary purpose for the collection of a natural person customer’s personal information by a financial institution is likely to be to facilitate the provision of financial services to that customer. We consider that a financial institution’s disclosure of a customer’s personal information to a third party (with the intention of protecting the customer from abuse) is not for the primary purpose of providing financial services to that customer. 50 As a result, the disclosure of the customer’s personal information to a third party in such circumstances would contravene NPP 2 unless one of the relevant exceptions applies. 6.6 National Privacy Principle 2: Exceptions NPP 2 provides a number of exceptions permitting use and disclosure of personal information for secondary purposes. The exceptions relevant to abuse are listed below. (a) Related purpose – NPP 2.1(a) A disclosure of personal information for a secondary purpose is permitted (in this case disclosure of customer information and suspected abuse to a third party) if the secondary purpose is related to the primary purpose and the customer would reasonably expect the financial institution to use or disclose the personal information for that secondary purpose. A related secondary purpose is something that arises in the context of the primary purpose. 51 A disclosure is reasonably expected in this context if the disclosure is expected by a customer with no special knowledge of the industry or activity involved. 52 (An example of where this exception may apply is the disclosure of a customer’s personal information to an external auditor of the financial institution for auditing purposes). At present in Australia, an elderly customer of a financial institution is unlikely to be aware of, or have any expectations relating to, a financial institution’s standard response to any suspected abuse. It is therefore unlikely that the reporting of abuse will be permitted under this exception, currently. A financial institution or the industry as a whole can, of course, inform its customers of the way it deals with suspected abuse, thus changing the reasonable expectations of customers over time and making this exception applicable in the future. (b) Consent – NPP 2.1(b) Prior consent from the customer, especially in written form, is perhaps the most effective method for financial institutions to remove any risk of breaching NPP 2 18
in reporting abuse to a third party. Such consent would normally be sought at the beginning of the financier-customer relationship or when any new applications, etc. are completed by the customer in taking up products from the financial institution from time to time. The Federal Privacy Commissioner has noted that an individual’s consent to a particular use or disclosure may be express or implied, and that implied consent could arise where consent may reasonably be inferred from the conduct of the individual and the organisation. For example, if a financial institution publicises the way it deals with suspected abuse (e.g. by reporting the suspicion to the OPA) it may be possible to infer the individual’s consent to such disclosures if the individual is given an opportunity to opt out which is clearly presented and easy to take up. The Federal Privacy Commissioner’s Guidelines suggest that where the disclosure of personal information has serious consequences for an individual, it would ordinarily be more appropriate for an organisation to seek express consent from the individual. 53 The reporting of abuse of a customer to a third party (e.g. the OPA) is likely to have serious consequences for the individual concerned (e.g. it could potentially affect their health and safety at the hands of the alleged abuser or at least their ongoing relationship with that person who may be their only relative or carer). It is therefore more appropriate for a financial institution to seek express consent from a customer to disclose their personal information to the relevant authorities if abuse is suspected. (c) Reporting suspected unlawful activity – NPP 2.1(f) A financial institution is permitted to disclose a customer’s personal information to a third party if it has reason to suspect that unlawful activity has been, is being or may be engaged in, and the use or disclosure of the customer’s personal information is a necessary part of its investigation of the matter or reporting its concerns to relevant persons or authorities. The exception is likely to afford financial institutions protection from NPP 2 requirements as its operation only requires a financial institution to have a ‘reason to suspect’. However, this exception requires a factual basis for suspecting unlawful activity, 54 i.e. that some identifiable act or omission that is expressly prohibited by Commonwealth, State or Territory law has occurred, is occurring or may occur. This suggests a need to clearly identify the nature of the suspected ‘unlawful activity’. For example, a person may accompany an elderly customer to a bank teller to transfer a large sum of money from the customer to that person in circumstances where the customer appears not to be allowed to decide or speak for themselves. In this situation, criminal activity may be in progress (e.g. obtaining financial advantage by deception, if the customer was deceived into believing the other person was acting for the customer’s benefit), and we consider the bank’s disclosure of personal information to a third party such as the police would be permitted under this exception. 19
Page 1 and 2: Responding to the financial abuse o
Page 3 and 4: Responding to the fi nancial abuse
Page 5 and 6: Contents Preface ..................
Page 7 and 8: Preface In a paper given in Novembe
Page 9 and 10: 1. Introduction and Scope This repo
Page 11 and 12: 2. Glossary In this report: • ‘
Page 13 and 14: impose an obligation to protect a c
Page 15 and 16: 4. Code of Banking Practice 4.1 Sum
Page 17 and 18: 5. Office of the Public Advocate 5.
Page 19 and 20: 5.4 Administration orders (a) If th
Page 21 and 22: nevertheless be able to guess the s
Page 23 and 24: ‘general duty of confidentiality
Page 25: capacity’. 48 As a result, any fi
Page 29 and 30: y or on behalf of an enforcement bo
Page 31 and 32: Reporting requirements are in two c
Page 33 and 34: to assist bank employees in identif
Page 35 and 36: 7. Confidentiality 7.1 Summary (a)
Page 37 and 38: Additionally, the following particu
Page 39 and 40: 7.6 BFSO scheme (a) The BFSO scheme
Page 41 and 42: (e) Where a representative of a cus
Page 43 and 44: (c) The fiduciary relationship aros
Page 45 and 46: Indeed, the duty to honour a custom
Page 47 and 48: suspicious transaction. These terms
Page 49 and 50: The common law has formulated the t
Page 51 and 52: 9.6 Contextual truth A defence of c
Page 53 and 54: (d) whether the opinion was honestl
Page 55 and 56: equires that the duty and interest
Page 57 and 58: 10. Recommendations On the basis of
Page 59 and 60: Notes 1. Julian Gardner, Uncovering
Page 61 and 62: 34. Instruments Act 1958 (Vic) s 12
Page 63 and 64: 69. Mandatory reporting may give re
Page 65 and 66: 96. Cheques Act 1986 (Cth) s 33(2)(
Page 67 and 68: Schedule 1: Office of the Public Ad
Page 69 and 70: Schedule 1: Office of the Public Ad

Responding to the financial abuse of older people - Loddon ...

Create successful ePaper yourself

Delete template?

Save as template?