Privacy Case Note - ALZ v WorkCover NSW [2015] NSWCATAP 138
View the full decision here ALZ v WorkCover NSW [2015] NSWCATAP 138
What you need to know
The case concerned a bullying complaint and its investigation by Workcover NSW. Workcover NSW obtained a medical report about the complainant from the complainant’s employer, without notice to the complainant.
The complainant said that the collection and subsequent use (and other action) by Workcover NSW was a breach of the Health Privacy Principles (HPP).
The Appeal Panel found a breach of HPP 6 (rights of access) and dismissed the remainder of the appeal. The Appeal Panel stated that HPP 6 places a broad obligation on agencies to take reasonable steps to ensure that individuals know what kinds of health information are held by an agency, and for what purposes and how to exercise their right to access that information.
The Tribunal found that WorkCover NSW had not met HPP 6 as WorkCover NSW require interested individuals to undertake a website navigation exercise directed to a host of documents and tucked-away paragraphs within documents. In the Tribunal’s view, the organisation should ideally point to a single statement that covers the points required by HPP 6.
Legislative background
The Health Privacy Principles are listed in Schedule 1 of the Health Records and Information Privacy Act 2002 (HRIP Act).
HPP 6: An agency or organisation must provide a person with details regarding the health information they are storing, why they are storing it and what rights a person has to access it.
HPP 9: An agency or organisation cannot use health information without taking reasonable steps, having regard to the proposed purpose of its use, to ensure the information is relevant accurate up to date and complete.
Factual background
The appellant had made allegations of bullying in the workplace - which was a local council, and also had made a worker’s compensation claim for psychological injury as a result of the alleged bullying. In the course of the worker’s compensation claim, the appellant had obtained a medical report from a psychiatrist. The respondent, in the course of its investigation, obtained that report from the local council and used it for the purpose of the investigation into the complaint. The appellant claimed this conduct breached the HPPs.
The appellant had a decision by the Tribunal where findings were made that the agency had breached the HPP 3 (direct collection); HPP 4 (aware about collection). A supplementary decision found that the agency also breached HPP 5(1)(c) (security safeguards).
The appellant appealed that decision of the Tribunal on a question of law in relation to HPP 1 (lawful collection), HPP 6 (rights of access), HPP 9 (accuracy), HPP 10 (use) and HPP 11(disclosure).The appellant also sought for leave to appeal on grounds other than a question of law, to extend the merits and re-determine the matter.
The Appeal Panel did not re-determine the matter, but did consider the alleged breaches of HPP 1, HPP 6, HPP 9, HPP 10 and HPP 11. The Appeal Panel did not reconsider those findings of the Tribunal that were favourable to the complainant, that is the findings that the agency had breached HPP3, HPP4 and HPP5(1)(c).
The Appeal Panel considered HPP 1 and noted that the investigator had the power, under the applicable legislation, to compel the production of the report. If the holder of the information gives it to the requesting party without being compelled to provide it, this fact alone does not mean the information was unlawfully obtained.
In relation to HPP 6, the Appeal Panel stated that, ideally, an organisation ought to be able to point to a single statement, accessible to members of the public, providing instructions as to the manner of determining whether health information is held etc. It commented that the burden imposed by HPP 6 is not a burden on individuals, requiring them to undertake complex investigations, but on health organisations, such that the steps taken by an organisation should not require an individual to be “endowed with special skills in chasing down information of this kind”. Having regard to the steps required to be taken by the appellant in this case, the Appeal Panel held that the respondent had breached HPP 6.
In considering HPP 9, the Appeal Panel emphasised the investigative context in which the information was used; its analysis of the principles involved includes a useful acknowledgement that the HPPs have to be read in such a way that accommodates to a reasonable degree the practicalities of investigation including that they take place and are finalised quickly. The making of a complaint does not give the complainant the procedural right to be involved in the investigation processes.
The Appeal Panel rejected the appeal in relation to HPP 1, HPP 9, HPP 10 and HPP 11. The Appeal Panel found a breach of HPP 6 and remitted to the Tribunal for making orders in relation to the contraventions found at first instance as well as the additional contravention found (HPP 6).
