2007 - Complaint Case Note 14

View printable version of this page

Case Citation: 

L v Contractor to Australian Government Agency [2007] PrivCmrA 14

Subject Heading:

Improper disclosure of medical information

Law:

Information Privacy Principle 11 in Part III Division 2 of the Privacy Act 1988 (Cth)

Facts:

The complainant alleged that a health care provider contracted to provide services to the complainant's employer, a government agency, had improperly disclosed their personal information to their employer without their consent.

The complainant wrote to the Privacy Commissioner to complain about the disclosure of their personal information.

Issues:

The relevant provisions in this complaint were the Information Privacy Principles.  In particular, Information Privacy Principle 11 prohibits the disclosure of personal information to third parties unless certain circumstances exist, such as where an individual has consented to the disclosure or where the disclosure is required or authorised under law.

Outcome:

The Privacy Commissioner investigated the matter under section 40(1) of the Privacy Act 1988 (Cth).

The health care provider accepted that a breach of the Information Privacy Principles had taken place due to its disclosure of correspondence, sent between it and the complainant, to the complainant's employer.  The health care provider conceded that there were no lawful grounds for the complainant's personal information to be disclosed to their employer. 

In an attempt to resolve the matter the health care provider offered to make a payment of compensation to a charity chosen by the complainant, to provide a written apology to the complainant, to conduct a review of its confidentiality policy and make the policy accessible to all staff. It confirmed in writing that no other personal information was provided to the complainant's employer.

The complainant accepted the respondent's offer as settlement of the complaint.

Satisfied that the complaint had been adequately dealt with, the Commissioner closed the matter under section 41(2)(a) of the Privacy Act.

OFFICE OF THE PRIVACY COMMISSIONER

June 2007