Case Citation: 

W v Pathology Clinic [2008]PrivCmrA 24 

Subject Heading:

Disclosure of sensitive personal information

Law:

National Privacy Principle 2.1 in Schedule 3 of the Privacy Act 1988 (Cth)

Facts:

The complainant had medical tests at a pathology clinic and asked that the results be provided only to their treating medical specialist and solicitor.  The test results were to be part of a claim that the complainant was making to a federal government agency.  The complainant later became aware that the clinic had provided the results directly to that government agency.     

Issues:

NPP 2.1 provides that an organisation must not use or disclose personal information about an individual for a purpose other than the primary purpose of the collection unless an exception in NPP 2.1(a)-(h) applies.  

Outcome:

The Privacy Commissioner investigated the matter under section 40(1) of the Privacy Act. 

The clinic conceded that it had disclosed the complainant's test results to the government agency. 

It advised the Commissioner that at the time of conducting the tests, its staff had incorrectly assumed that the results from these specific kinds of tests were usually requested by, and the results sent to, the government agency in question.  Clinic staff marked the complainant's paperwork with the name of that government agency and when the results were complete, they were sent directly to the agency noted on the complainant's form.  The clinic contended that this was an isolated error. 

As this information was disclosed for a purpose other than the primary purpose for which it was collected, and the disclosure was not permitted by any of the exceptions listed in NPP 2.1, the Commissioner formed the view that the disclosure was an interference with the complainant's privacy. 

The Commissioner considered it appropriate to attempt, through conciliation, to effect a settlement of the matters that gave rise to the investigation.

The Clinic apologised unreservedly to the complainant.  It also contacted the government agency and asked that the complainant's information be securely destroyed, and sent a copy of the results to the complainant's treating specialist as originally requested. 

The Clinic also settled the costs incurred in processing the complainant's tests, costs that would otherwise have been incurred by the complainant, and it paid the complainant an undisclosed sum to compensate them for any hurt suffered as a result of the interference with their privacy.

The Commissioner then closed the complaint under section 41(2)(a) of the Privacy Act on the grounds that the Clinic had dealt adequately with the matter.

OFFICE OF THE PRIVACY COMMISSIONER

November 2008