Case Citation: 

M v Health Service Provider [2007] PrivCmrA 15

Subject Heading:

Collection of sensitive information

Law:

National Privacy Principles 1 and 10 in Schedule 3 of the Privacy Act 1988 (Cth)

Facts:

The complainant went to a medical practitioner, who took a digital photograph of the complainant for the complainant's medical file.  The complainant viewed this as an unnecessary collection of their personal information.

The complainant raised the issue directly with the medical practitioner but the matter was not resolved. The complainant subsequently wrote to the Privacy Commissioner to complain about the collection of their personal information.

Issues:

National Privacy Principle 1.1 provides that an organisation must not collect personal information unless the information is necessary for one or more of its functions or activities.

National Privacy Principle 10.1 provides that an organisation must not collect sensitive information about an individual unless certain circumstances exist, such as where the individual has provided consent.

Outcome:

The Privacy Commissioner investigated under section 40(1) of the Privacy Act 1988 (Cth).

In considering National Privacy Principle 1.1 the medical practitioner conceded that it was not necessary to record a digital photograph of the complainant to provide a health service.  As such, the Commissioner took the view that the medical practitioner breached NPP 1.1 by unnecessarily collecting the complainant's digital photograph for inclusion in the patient database.

In the course of the investigation the medical practitioner and the complainant disagreed on whether consent had been given for the photograph to be taken, so it was difficult to determine whether National Privacy Principle 10.1(a) could be relied upon. 

As a result of the complaint the medical practitioner removed the complainant's digital photograph from the medical practice's records and has discontinued the practice of taking photographs for patient files.

Satisfied that the medical practitioner had adequately dealt with the complaint, the Commissioner closed the matter under section 41(2)(a) of the Privacy Act.

OFFICE OF THE PRIVACY COMMISSIONER

June 2007