Back to Top
Crown Solicitor's Office

Privacy update

​Distinction between personal information and opinion based on information

John McDonnell, CSO Assistant Crown Solicitor

At least two cases in the last year have highlighted the distinction inherent in the Health Records and Information Privacy Act 2002 ("HRIP Act") between information and opinion.

In ARC v Northern NSW Local Health District [2014] NSWCATAD 109 (read decision on NSW Caselaw), Principal Member Higgins considered a case involving a communication between a third party psychologist, Mr Grace, and the Mental Health Access Line ("MHAL"). The applicant had had an appointment with Mr Grace prior to the telephone call. The applicant contended that the information communicated by Mr Grace to the MHAL in relation to that appointment contained inaccurate information and that any diagnosis or other medical opinion formed as a result of such information was also inaccurate and should be corrected/deleted (HPP8). In support of that contention, the applicant "relied on a number of reports concerning her mental health at the time of her appointment with Mr Grace".

Higgins PM was satisfied that the record of Mr Grace's telephone call to the MHAL accurately reflected the content of his communications in respect of the applicant.  She noted that, although Crewdson's case ([2002] NSWCA 345) was concerned with a provision of the old Freedom of Information Act 1989 ("FOI Act"), the relevant provision was in similar terms to s. 15 of the Privacy & Personal Information Protection Act 1998 ("PPIP Act") and HPP8, and the case was of relevance. In Crewdson, the Court of Appeal held that the FOI Act was "concerned with the accuracy of official records, not with the merits or legality of the official action recorded in them." Even where an opinion is subsequently changed or revised, the proper course is not to remove it from the records, but to add a notation to the effect that it had been changed. Although another mental health professional made a different assessment of the applicant later that day, "the fact that a subsequent assessment differs … does not mean that Mr Grace's assessment … is inaccurate in the relevant sense" (at [31]-[35]).  Accordingly, no further action was taken by the Tribunal.

In ALL v Sydney Local Health District [2014] NSWCATAD 4 (read decision on NSW Caselaw), the applicant was a person taken by police to the Missenden Psychiatric Unit ("MPU"), a part of the Royal Prince Alfred Hospital, pursuant to former s. 24 of the now-repealed Mental Health Act 1990. In doing so, the police officers were required to complete a form which was provided to the MPU. The applicant contended that some of the information contained in that form was inaccurate.

Higgins PM held that HPP9 required the respondent to take reasonable steps to determine whether the information provided by police in the s. 24 form was accurate (though it was also under an obligation, pursuant to the Mental Health Act, to act on the information contained in the form).  The obligation to ensure accuracy was discharged when the respondent's staff member interviewed the applicant and attempted to obtain the relevant information from him. However, she noted that "while the applicant may be able to establish that some of the factual matters recorded in the [forms] are either factually incorrect, or misleading, this does not necessarily mean that the recorded provisional diagnosis of Dr Allan is inaccurate" (at [91]). This was because the provisional diagnosis was also (and primarily) based upon the observations made in respect of the applicant at [85]).

(I note that ALL was also complicated by the fact that some records apparently disappeared, and the basis upon which the discharge diagnosis was recorded was questionable.)

Decisions relating to the scope of certain investigations

Two recent decisions have come to different conclusions regarding the appropriateness of limiting the scope of investigations carried out under a statutory scheme for the purpose of determining whether the collection of personal information was permissible.

In ALZ v WorkCover [2014] NSWCATAD 49 ("ALZ") (read decision on NSW Caselaw), Senior Member Montgomery considered HPP3, which requires that information be collected directly from the person concerned, with some exceptions. In this case, the applicant did not, in fact, have possession of the information sought. However, Montgomery SM held that the respondent breached HPP3 by not requesting the information from the applicant first, notwithstanding that she couldn't have provided it.

A later decision in respect of the same applicant, [2014] NSWCATAD 93 (read decision on NSW Caselaw), concerned a complaint made when a WorkCover inspector obtained the applicant's medical records from her employer, a local council. The internal review into the complaint incorrectly took the view that the records had been obtained from StateCover, and instigated an investigation in respect of that transfer of information. In the course of the internal review, further personal information about the applicant was obtained.

Montgomery SM ultimately held that the respondent was not lawfully authorised to collect the personal information which was obtained for the purpose of the internal review, since the matter being investigated was clearly not within the scope of the complaint. In substance, in this case, the outcome achieved is probably a just one. However, it might be problematic for the Tribunal to take upon itself the task of determining what investigations are open to an agency conducting an internal review under the HRIP Act.

This decision in ALZ can be contrasted with that in AOZ v RailCorp [2013] NSWADT 279 ("AOZ") (read decision on NSW Caselaw). There, the applicant was an employee who submitted an application for worker's compensation. RailCorp is/was self-insured and it became necessary to investigate the application. For that purpose, RailCorp wrote to medical practitioners who had seen the applicant and requested copies of their records. The nature of the applicant's complaint was that the request for medical records was not limited to those relating to the relevant injury (back pain) but was for all records.

Senior Member Isenberg held that the respondent was entitled, for the purpose of assessing the application, to review the applicant's complete history, in order to determine "if the 2011 back pain was due to the [previous] 2004 injury or some other condition" (at [22]). It would be unduly narrow to hold that the respondent could only collect medical records relating to back pain, since some other medical condition could have a symptom of back pain that would account for the injury. In contrast to ALZ, the Tribunal refused to confine the scope of the matters it was open to the agency to investigate although it should be noted that the context was different.  The Tribunal also held that the consent on the WorkCover form was sufficient to obtain records generally, and that there was no obligation on the respondent to inform the applicant specifically about its intention to collect those records.

AOZ's case has been appealed to the Appeal Panel of the NSW Civil & Administrative Tribunal ("NCAT") and has been heard, though a decision has not yet been given.  AOZ contended on appeal that WorkCover medical certificates did not constitute notices for the purpose of HPP4, and that the "consent" exception did not apply to her entire medical file because the consent to collection given for the purpose of the claim extended only as far as was reasonably necessary for the purpose of assessing her claim. RailCorp relied upon the fact that, under the Workers Compensation Act 1987, matters such as the worker's general state of health and any hereditary risk factors could be taken into account in assessing a claim for compensation (s. 9A(2)) and that the wording of the consent at the relevant time included "any other condition which restricts or inhibits my returning to normal classified duties" (at [25]) have added this citation. On appeal, a number of comments were made as to the sufficiency of the consent given by AOZ and the obligations placed upon RailCorp as a self-insurer under the Workers Compensation scheme. It should be noted that WorkCover was not a party to the proceedings at any stage.

Decisions involving APV and APW

Two decisions with potentially far-reaching consequences were made in the cases of APV & APW v Department of Family and Community Services [2014] NSWCATAD 9 (read decision on NSW Caselaw) and APV & APW v Department of Finance and Services [2014] NSWCATAD 10 (read decision on NSW Caselaw).

In the first, the issue was that an internal review was carried out under the PPIP Act by the Department of Family and Community Services ("FACS"), which later contended that the proper respondent was the Department of Finance and Services ("DFS").  Senior Member Isenberg stated that an agency acts through its officers, which is relatively uncontroversial; however, the conclusion, that the staff member in this case was employed to assist FACS in the exercise of its functions, is problematic. The Tribunal stated:

"The Respondent submitted that the effect of [s. 4J of the Public Sector Employment and Management Act 2002] is that Mr Hale, as a member of staff of FACS employed to enable the LHC to exercise its functions, is taken to be part of the LHC [that is, the Land and Housing Corporation] for the purposes of the PPIP Act and consequently it is the LHC (now DFS) that was required to perform the internal review under s. 53(3) as the 'public sector agency concerned'. I do not agree with this interpretation. To adopt this approach would have the result that every government lawyer acting for a government agency would, for the purposes of the PPIP Act, be regarded as employed to enable the agency to exercise its functions." (at [13])

Obviously, the Public Sector Employment and Management Act 2002 has now been repealed. However, query whether the Tribunal was correct in extending the very specific case of Mr Hale, who was employed for the purpose of assisting a statutory corporation which could not employ staff, to encompass all other government solicitors whose employment conditions may be very different.  Curiously, the Tribunal concluded that, even if it was incorrect in determining the proper agency to conduct an internal review, an incorrect choice of agency would not affect the Tribunal's jurisdiction to review the conduct in question.

The decision may leave agencies in a difficult position in determining the proper agency to which an application for internal review should be sent. Clearly, the statutory powers being exercised were not the responsibility of the agency conducting the internal review; as such, it would not have any power to implement recommendations of the internal review. Potentially, it may also lack requisite special knowledge of the practical aspects of the administration of the proper agency, which may lead to incorrect or inaccurate assumptions of fact.

The second case involving these applicants is more problematic and is currently under appeal to the Appeal Panel. The respondent had disclosed information regarding a property subject to a 99 year lease in favour of the applicants; their names were not attached to the information, but their address was. An issue arose as to whether the information was "personal information". The applicants led evidence to the effect that:

"an internet search in relation to the address of the Applicants' property readily lead to the web page for 'NSW Tendering', which contains the Applicants' names as the successful tenderers for the property at that address. Therefore, the identity of the applicants could be reasonably ascertained from the address of their property." (at [15])

On this basis, Isenberg SM concluded that the information was "personal information".

This is a problematic broadening of the conclusions reached by the former Tribunal in WL v Randwick City Council (No. 2) [2010] NSWADT 84 (read decision on NSW Caselaw).  There, the Tribunal held that the "context" in which information was held could have the result that the identity of the applicant would be "reasonably ascertainable" for the purpose of the definition of "personal information" in s. 4(1) of the PPIP Act. By extension, this case has the result that the entire content of the internet could be the "context" of information for the purpose of the definition of "personal information". Some of the difficulties arising from such a situation should be self-evident. From the point of view of government, one such difficulty is that it potentially requires agencies to conduct Google searches on all de-identified information in or coming into their possession, in order to determine whether or not it might be "personal information".

Applications for information held in compound record-keeping system

Finally, it is worth noting the decision in AYT v Sydney Local Health District [2014] NSWCATAD 29 (read decision on NSW Caselaw). That case concerned two separate applications for information by the applicant; one in the form of an application apparently under the Government Information (Public Access) Act 2009 ("the GIPA Act") and a subsequent subpoena issued in civil proceedings. The applicant had been treated at the Camperdown Aged Chronic Care and Rehabilitation Service ("AC&R Clinic"), whose medical records were merged with those of the Royal Prince Alfred Hospital ("RPAH"). In response to a GIPA Act application made to the RPAH by her solicitor for all the applicant's medical records, the solicitor was provided with copies of documents not including those of the AC&R Clinic, with a covering letter stating that other documents may exist.  When an "all documents" subpoena was subsequently issued at the request of the applicant, the respondent produced documents which included those of the AC&R Clinic.

The Tribunal accepted, on the evidence, that records of the AC&R Clinic were held by the respondent and that it was under an obligation to produce them in response to the subpoena (together with records from RPAH proper). This was notwithstanding an initial view taken by the respondent that the AC&R documents produced under subpoena were produced in error. Since a subpoena is an order of the issuing court, failure to comply with which may be a contempt of court, the respondent was bound to produce the documents. (It is worth noting that the applicant had a right of first access in order to raise any objections, which it did not take, presumably in reliance on her solicitor's earlier GIPA application.)

Although it was not in issue in the proceedings and no findings were made, Higgins PM was critical of the respondent's practice of treating applications for information under the GIPA Act differently from subpoenas: in the former, the searches made captured only documents relating to the applicant held as part of RPAH "proper" records, and hence did not capture those created by the AC&R clinic. Higgins PM recommended that the respondent review its procedures in that regard, since there was no proper reason for treating the requests differently.