ALQ June 2023 - Privacy

Decision summaries

Departure from the orthodox meaning of ‘disclosure’ under NSW privacy legislation

FMM v Nominal Insurer [2023] NSWCATAD 114

The applicant sought administrative review of the respondent’s conduct in relation to the respondent’s agent emailing a Costs of Claims report to the incorrect workers compensation claims manager by mistake under the Privacy and Personal Information Protection Act 1998 (PPIP Act) and the Health Records and Information Privacy Act 2002 (HRIP Act).

The applicant submitted that the respondent had seriously breached her privacy by sending her personal and health information to an unintended recipient, which exacerbated her existing psychological injury.

The respondent submitted that it had reasonable security safeguards to protect the information in the Costs of Claims report and that there had not been a disclosure of the applicant’s information as the unintended recipient of the Costs of Claims report did not open it and therefore did not become aware of the applicant’s information.

The Tribunal found that the respondent had unlawfully disclosed the applicant’s information and therefore contravened s. 18 of the PPIP Act and cl. 11 of Sch. 1 to the HRIP Act. The Tribunal also found that the respondent’s security safeguards were wholly inadequate to protect against unlawful disclosures of information and therefore breached s. 12(c) of the PPIP Act and cl. 5(1)(c) of Sch. 1 to the HRIP Act. In addition to requiring the respondent to implement administrative measures, the Tribunal ordered the respondent to pay the applicant $20,000 for exacerbating her pre-existing injury.

Emailing a Word version of a party’s written submissions to the Tribunal at its request (without copying the other party) did not amount to an ex parte communication giving rise to a reasonable apprehension of bias

BVV v Commissioner of Police, NSW Police Force [2023] NSWCATAD 134

The Tribunal found that the NSW Police Force (NSWPF) had not breached the Privacy and Personal Information Protection Act 1998 in providing a deed of release executed by the applicant and the NSWPF to its insurer to pay the applicant the settlement monies specified therein. The NSWPF then applied for its costs and the applicant applied for Senior Member Dinnen to disqualify herself from hearing that application.

The applicant contended that a reasonable apprehension of bias arose from the Tribunal engaging in ex parte communications with the NSWPF by the NSWPF acceding to the Tribunal’s request at the hearing to email a Word version of its submissions to the registry and the Tribunal not providing written reasons for its refusal of the applicant’s first disqualification application and the applicant’s request to have his third disqualification application determined before the NSWPF’s costs application within the statutory time limit required.

The Tribunal held that emailing a Word version of a party’s written submissions to the registry at the Tribunal’s request (without copying the other party) did not amount to an ex parte communication giving rise to a reasonable apprehension of bias as the applicant had not articulated a logical or reasoned basis upon which the relied upon conduct could result in the Tribunal member not deciding the case on its legal and factual merits.

The Commissioner contended that there were ‘special circumstances’ warranting an award of costs as the applicant had unnecessarily disadvantaged the NSWPF, unduly prolonged the proceedings and the applicant’s case was weak and lacking in substance. The Tribunal accepted that the Commissioner had established that there were special circumstances warranting an order for costs and that a costs order should be made. However, the Tribunal was not satisfied that a lump sum order should be made having regard to the scale of costs incurred and the complexity of the proceedings.

No review of privacy internal review applications lodged out of time

EJE v Department of Education [2023] NSWCATAD 132

The applicant and respondent resolved prior privacy proceedings by agreement. The respondent agreed to attach statements provided by the applicant to its records pursuant to s. 15(2) of the the Privacy and Personal Information Protection Act 1998, in lieu of altering its records pursuant to s. 15(1) of that Act. The applicant later took issue with what had been agreed and pressed for the respondent to amend its records (rather than attaching statements to them).

After making a series of complaints and complaints about the handling of complaints, the applicant lodged an application for internal review of the respondent’s conduct under s. 53 of the Act. The respondent decided that the conduct of which review was sought occurred in 2020 and 2021, and the application for internal review was therefore made outside the six-month time limit. The respondent declined to accept the application out of time.

The applicant applied to the Tribunal for external review. The respondent applied for the proceedings to be summarily dismissed.

The applicant’s central submission was that the date from which the six-month period should be calculated was the date of her last complaint before requesting the internal review. The respondent argued that the proper approach was to focus on the privacy ‘conduct’, which was much earlier. The respondent relied on the settled authorities deciding that the Tribunal has no jurisdiction to review a decision to decline to accept an application out of time.

The respondent’s submissions were accepted, and the applicant’s approach to reckoning time was described as ‘plainly misconceived’. The proceedings were summarily dismissed. 

Back to top