Can my bank be held responsible for how they shared my private details?

The situation

I am writing to seek some guidance regarding a situation that occurred here in New South Wales. About three weeks ago, on the 14th of October, I noticed some very strange activity on my savings account. I had transferred a total of $2,500 into my account for a new car deposit, but shortly after, I received an email from a company I have never heard of, asking for my personal details to confirm a transaction. When I called my bank to report this potential breach, the customer service representative told me that because the data leak might have happened through an automated system used for interstate transactions, they might not be directly liable for the privacy mishap. I have already lodged a formal complaint with their internal grievance department, but they sent me a letter yesterday stating they aren't responsible for how information is handled during certain types of commercial exchanges between different states. I am incredibly frustrated because I have been a loyal customer for over ten years and I have always trusted them with my sensitive information. I am unsure if the privacy rules actually apply to a major bank when they are moving data around between different parts of Australia or if they can just use these technicalities to avoid taking any responsibility for my lost privacy.

Detailed Analysis

Based on the information you provided, your bank's claim that they are not responsible because the leak happened during an interstate transaction appears to be incorrect under the Privacy Act 1988.

The law specifically ensures that privacy protections extend to banking activities. Under Section 26XF, the privacy rules have effect regarding "a collection, use or disclosure that occurs in the course of, or in relation to, the carrying on of the business of banking"^[1]. This means that if your personal details were mishandled while the bank was performing its regular banking duties, the bank is subject to these privacy regulations.

Furthermore, the bank cannot use the fact that the transaction was 'interstate' to escape these rules. Section 26XF also states that the division has effect regarding a disclosure that occurs "among the States"^[1]. This confirms that moving data between different parts of Australia, such as from New South Wales to another state, does not remove the bank's obligation to protect your information.

Additionally, the law treats actions taken by people working for the bank as actions taken by the bank itself. Section 8(1)(a) states that an "act done or practice engaged in by... a person employed by... an organisation in the performance of the duties of the person's employment shall be treated as having been done or engaged in by... the organisation"^[2]. This means if an automated system or a staff member's error caused the leak during their work, the bank is legally responsible for that error.

It is currently uncertain whether the specific 'automated system' used for your transaction was a third-party service or an internal bank tool, which could affect the specific technicalities of the breach, but the bank's primary responsibility to you remains.

Please note that state, provincial, or local laws may add further rules regarding consumer protection or data privacy in New South Wales.

Statutory Citations

Related Questions

• Can the privacy ombudsman give my private details to the police?
• Can a private debt collection agency legally get my bank details from my lender?