Case Citation: 

M v Health Service Provider [2006] PrivCmrA 12

Subject Heading:  

Improper disclosure of personal information by a health service provider.

Law:  

National Privacy Principle 2 in Schedule 3, and section 41(2)(a), of thePrivacy Act 1988(Cth).

Facts:

The complainant underwent a number of medical tests for sexually transmitted diseases at a health service provider. The complainant alleged that the health service provider disclosed the types of tests undertaken to the complainant''s partner.

When contacted by the complainant, the health service provider stated that the disclosure was inappropriate and was made by a new employee who understood that the results of tests should not be disclosed, but did not realise that the types of tests undertaken should also not be disclosed. The Health Service Provider acknowledged the disclosure of the complaint''s personal information and apologised.

The complainant claimed to have suffered serious hurt and embarrassment resulting from the disclosure of his health information and was not happy with the outcome. The complainant then wrote to this the Privacy Commissioner.

Issues:

The Commissioner investigated the complainant''s allegations under section 40(1) of the Privacy Act.

National Privacy Principle 2.1 provides that personal information collected for a primary purpose may only be used or disclosed for a secondary purpose if one of a number of exceptions in National Privacy Principle 2.1(a)-(h) applies.  For example, information may be used or disclosed for a secondary purpose where the individual has consented to the use or disclosure (National Privacy Principle 2.1(b)), or, where the information is health information, where the use or disclosure is directly related to the primary purpose of collection and within the individual''s reasonable expectations (National Privacy Principle 2.1(a)).

In this case it did not appear that any of the exceptions under National Privacy Principle 2 applied.  The health service provider acknowledged that its disclosure of the complainant''s personal information to the complainant''s partner was not permitted by National Privacy Principle 2.

Outcome:

Because the disclosure caused disruption to the complainant''s family life the complainant did not consider an apology from the health service provider provided an adequate resolution to the complaint. In this regard the complainant sought compensation for loss and emotional distress and embarrassment.

The health service provider did not dispute that the complainant''s personal information had been improperly disclosed to the complainant''s partner, and agreed to the Commissioner conciliating a settlement.

Section 27(1)(a) of the Privacy Act provides for the Commissioner, where he or she considers it appropriate, ''to endeavour, by conciliation, to effect a settlement of the matters that gave rise to the investigation''. If the matter can be settled by conciliation and the Commissioner is satisfied that the matter has been adequately dealt with he or she may decline to investigate the matter further under section 41(2)(a) of the Privacy Act. 

During the conciliation process, the complainant was unable to demonstrate that the amount of compensation they were seeking was commensurate with the loss or damage they had suffered. A different amount was agreed to by the parties recognising the emotional distress and embarrassment suffered by the complainant.

Accordingly, the Commissioner closed the investigation of the complaint under section 41(2)(a) of the Privacy Act, on the grounds that the health service provider had adequately dealt with the matter. 

OFFICE OF THE PRIVACY COMMISSIONER June 2006