Responding to the financial abuse of older people - Loddon ...

in reporting abuse to a third party. Such consent would normally be sought at the
beginning of the financier-customer relationship or when any new applications, etc.
are completed by the customer in taking up products from the financial institution
from time to time.
The Federal Privacy Commissioner has noted that an individual’s consent to a
particular use or disclosure may be express or implied, and that implied consent
could arise where consent may reasonably be inferred from the conduct of the
individual and the organisation. For example, if a financial institution publicises the
way it deals with suspected abuse (e.g. by reporting the suspicion to the OPA) it may
be possible to infer the individual’s consent to such disclosures if the individual is
given an opportunity to opt out which is clearly presented and easy to take up.
The Federal Privacy Commissioner’s Guidelines suggest that where the disclosure
of personal information has serious consequences for an individual, it would
ordinarily be more appropriate for an organisation to seek express consent from
the individual. 53 The reporting of abuse of a customer to a third party (e.g. the OPA)
is likely to have serious consequences for the individual concerned (e.g. it could
potentially affect their health and safety at the hands of the alleged abuser or at least
their ongoing relationship with that person who may be their only relative or carer).
It is therefore more appropriate for a financial institution to seek express consent
from a customer to disclose their personal information to the relevant authorities
if abuse is suspected.
(c) Reporting suspected unlawful activity – NPP 2.1(f)
A financial institution is permitted to disclose a customer’s personal information to a
third party if it has reason to suspect that unlawful activity has been, is being or may
be engaged in, and the use or disclosure of the customer’s personal information is a
necessary part of its investigation of the matter or reporting its concerns to relevant
persons or authorities.
The exception is likely to afford financial institutions protection from NPP 2
requirements as its operation only requires a financial institution to have a ‘reason
to suspect’. However, this exception requires a factual basis for suspecting unlawful
activity, 54 i.e. that some identifiable act or omission that is expressly prohibited by
Commonwealth, State or Territory law has occurred, is occurring or may occur.
This suggests a need to clearly identify the nature of the suspected ‘unlawful activity’.
For example, a person may accompany an elderly customer to a bank teller to
transfer a large sum of money from the customer to that person in circumstances
where the customer appears not to be allowed to decide or speak for themselves.
In this situation, criminal activity may be in progress (e.g. obtaining financial
advantage by deception, if the customer was deceived into believing the other
person was acting for the customer’s benefit), and we consider the bank’s disclosure
of personal information to a third party such as the police would be permitted
under this exception.
19