Case Citation: D v Private Health Service Provider [2003] PrivCmrA 2

Subject Heading: Access to personal information collected before 21 December 2001

Law: National Privacy Principle 6 - Access and Correction; section 16C(3) Privacy Act 1988

Facts

The complainant suffered an injury and in the course of treatment was referred to a medical specialist. In February 2002, the complainant approached the specialist and asked for a copy of his entire medical record in relation to the injury and treatment.

In the first instance the specialist denied the request for access to the information on the basis that it was not accessible under the provisions of the Privacy Act as it was collected before 21 December 2001.

The complainant returned to the specialist and argued that although the information had been collected before 21 December 2001 it was still in use since it related to a condition which was currently being treated. The complainant did not provide detail about the treatment he received nor did he state that he was currently being treated by the specialist.

The specialist responded to the complainant stating she remained certain that she had not collected, used or disclosed the complainant's personal information since 21 December 2001.

Issues

National Privacy Principle 6 facilitates open communication between an individual and their health service provider. The principle provides individuals with a general right to access health information held about them, and provides for them to have the information corrected if it is not accurate, complete and up-to-date.

The private sector amendments to the Privacy Act, which came into force on 21 December 2001, provided that not all of the National Privacy Principles (NPPs) applied to information collected by private sector organisations before that date. Section 16C of the Privacy Act sets out which NPPs apply regardless of when the information was collected, and which NPPs apply only to information collected after 21 December 2001.

Generally, section 16C(3) provides that NPP 6 applies to personal information collected after 21 December 2001. However, NPP 6 does apply to information collected before that date, if the information has been used or disclosed by the organisation after 21 December 2001 and if providing access to the information would not place an unreasonable administrative burden on the organisation or cause the organisation unreasonable expense.

The Commissioner had to decide whether, on the facts and information available, the complainant's personal information was subject to the requirements of the Privacy Act by establishing when the information was collected and if it had been used or disclosed since 21 December 2001.

Outcome

As a result of preliminary enquiries it was established that the personal information to which the complainant sought access was collected by the specialist before 21 December 2001 and had not been used or disclosed by the specialist after that date. The treatment related to surgery carried out in 1984. The Commissioner was also satisfied that the specialist had not collected any further personal information about the complainant after 21 December 2001.

Although he continued to receive treatment for his injury from other health service providers, the complainant could not verify that he had attended the specialist for treatment after 21 December 2001. The complainant's legally appointed guardian confirmed that it had no record of the complainant attending the specialist after 21 December 2001. Further, the complainant had no cause to believe that the specialist had used or disclosed his personal information since 21 December 2001.

It was confirmed that the specialist had no record of providing the complainant with medical attention after 21 December 2001. In addition, there was no indication that the specialist had used or disclosed the complainant?s personal information after that date.

Accordingly, the Commissioner was satisfied that NPP 6 did not apply to the personal information held by the specialist, so that the Privacy Act did not oblige the specialist to comply with the complainant's request to gain access to his personal information.

The complaint was closed under s.41(1)(a) of the Privacy Act on the basis that the circumstances described by the complainant did not constitute a breach of the Act.

OFFICE OF THE PRIVACY COMMISSIONER JANUARY 2003