Use and privacy of Owners Corporation information

1. Owners Corporations (OC’s), like any other organisations that collect, store and use personal information, are subject to the Privacy Act, which provides, at section 16, that “An agency shall not do an act, or engage in a practice, that breaches an Information Privacy Principle”.

2. The Privacy Principles include requirements that:

a. Personal information shall not be collected or included in a record unless the information is collected and is necessary for a lawful function or activity of the collector;
b. Personal information shall be protected, by such security safeguards as it is reasonable in the circumstances to take, against loss, unauthorised access, use, modification or disclosure, or other misuse;
c. Personal information that was obtained for a particular purpose shall not be used for any other purpose unless the individual concerned has consented to that other use;
d. Personal information shall not be disclosed to a person, body or agency (other than the individual concerned) unless the disclosure is required or authorised by or under law; and
e. An organisation must take reasonable steps to make sure that the personal information it collects, uses or discloses is accurate, complete and up-to-date.

3. The operation of OC’s is primarily governed by The Unit Titles (Management) Act (The Act). The Act, as it applies to dealing with personal information, is generally consistent with the Privacy Act. It defines the range and extent of the personal information that corporations collect and enter into their corporate registers and accounting systems, the various functions that they may use that information for, e.g. to serve notice on owners or to pursue monies owning to the corporation, and the procedures for and limits on disclosure of the registered information.

4. The Act prescribes penalties for not disclosing information held in the register in accordance with its provisions, but it does not specifically require the OC to ensure that the information in its register is up to date, and nor does it specifically proscribe use or disclosure over and above that mentioned in The Act. That does not excuse corporations from the strictures of the Privacy Act, and a prudent corporation would ensure that its procedures are consistent with that Act's requirements as outlined in paragraph 2 above. Any person employed to assist manage the corporate register would properly be required to follow those same procedures.

Management of OC’s records

5. There is no reason, apart possibly from consideration of the attendant workload, why the member of the EC elected to the office of Secretary could not maintain the corporate register and do all the other things listed related to the register and usage of the information it contains, and similarly, the EC member elected as treasurer could maintain the financial records. That is the case where OC’s self-manage, but generally, OC’s employ managers, and include the keeping of the register and financial records, and associated functions among those the manager is to exercise.


6. Cases have been recorded where managers form the view that since they are in physical charge of the corporate register and financial records and use information drawn from them to perform their contracted functions, the Privacy Act applies to them in respect of access to the records, and prevents their disclosing the contents to members of, or even to the EC of, the owners corporation by which they are employed. Cases have been reported where managers have allegedly granted access to OC’s records over and above that allowed by the relevant sections of The Act. These activities and the interpretations that underlie them are quite wrong, and should be given short shrift.

7. Under The Act, the establishment and maintenance of the corporate register and the use and disclosure of the information in the corporate register are functions of the OC. The functions of the owners corporation are exercised by the EC and specifically by the members of the EC elected to the offices of Secretary and Treasurer. Where the owners corporation so determines, a manager may be employed to assist exercise those functions, but it should not be forgotten that the functions of the EC include supervising the secretary, treasurer, and manager, and that failure to manage the corporation’s records in accordance with Part 7 of the Act makes the committee liable to severe penalties (see section 121).

8. Section 8 of the Privacy Act addresses the application of that Act to “Acts and practices of, and disclosure of information to, staff of agency, organisation etc”. It provides that for the purposes of that Act, “an act done or practice engaged in by, or information disclosed to, a person employed by, or in the service of, an agency or organisation in the performance of the duties of the person’s employment shall be treated as having been done or engaged in by, or disclosed to, the agency or organisation”.

9. Quite clearly an employee of the owners corporation can have no independent authority over information he or she receives or records in the corporate register or financial records of the owners corporation in the course of that employment. Regardless of how or where or by whom the record keeping function is performed, the EC supervises the process and remains at all times responsible for its correct performance. The committee is entitled to such access as might be necessary for it to be satisfied that the records comply with the Privacy Principles as they apply to the records. And the committee is also responsible for ensuring that the information is used as envisaged by the Act, and that members of the corporation are given access to the records in accordance with their entitlements as provided for in The Act.

Example 1: The name of the person who represent each unit might be revealed to other owners so they can get in touch to discuss issues of common concern, but the fact of a unit being subject to a mortgage would needlessly
reveal the personal affairs of the owner.

Example 2: The fact that a given amount of money is owed to the corporation by a given number of debtors would allow members to assure themselves that proper recovery measures are being taken by the EC, but revealing the names of individual owners who might be experiencing temporary financial embarrassment would be an unnecessary invasion of their privacy.

10. This paper may be helpful to members in cases where doubt arises as to the status of records held by an owners corporation, or where an owners corporation manager seeks to deny the owners corporation access to its corporate register or financial records on “privacy” grounds. In cases where a written response seems appropriate, members may wish to consider a letter along the lines of this model text.