FMM v Insurance and Care NSW [2023] NSWCATAD 114

Civil and Administrative Tribunal New South Wales Medium Neutral Citation: FMM v Insurance and Care NSW [2023] NSWCATAD 114 Hearing dates: 12 December 2022 Date of orders: 23 May 2023 Decision date: 23 May 2023 Jurisdiction: Administrative and Equal Opportunity Division Before: P French, Senior Member Decision: (1) A further oral hearing in relation to the description of iCare NSW and the proper respondent to the application is dispensed with in accordance with s 55(1)(c) of the Civil and Administrative Tribunal Act 2013 (NSW). (2) The name "iCare NSW" is amended to "Insurance and Care NSW t/a iCare NSW". (3) Insurance and Care NSW t/a iCare NSW is removed as the respondent to the application. (4) The name of the respondent is amended to Workers Compensation Nominal Insurer. (5) The decision under review is varied. (6) In variation of that decision the Tribunal determines that the conduct of the agency constituted a contravention of Information Privacy Principles 5 and 11 (ss 12(c) and 18 of the Privacy and Personal Information Protection Act 1998) and HPP 5 and 11 (clauses 5(1)(c) and 11 of Schedule 1 of the Health Records and Information Privacy Act 2002). (7) The Nominal Insurer must pay FMM $20,000.00 immediately. (8) By 30 June 2024 the Nominal Insurer must ensure that its agent Insurance and Care NSW t/a iCare designs and implements a secure on-line portal for the making available of Cost of Claims reports pursuant to s 147 of the Workers Compensation Regulation 2016 (NSW). Access to Costs of Claims reports via the portal must only be available to persons who authenticate their identity and entitlement to access the report by a unique electronic password or key. (9) By 30 September 2023 the Nominal Insurer must ensure that its agent Insurance and Care NSW t/a iCare institutes the following security safeguards in relation to the present broadcast method of distribution of Cost of Claims reports: - Distribution lists must be cross-checked against Costs of Claims reports by two senior officers with this designated responsibility each of whom must certify in writing the accuracy of the distribution before any email containing Costs of Claims reports is released, - Emails containing Cost of Claims reports must be encrypted such that they are only capable of being opened and read by the person for whom they are intended upon submission of a unique electronic password or key, - Each Cost of Claims data file must also be password protected such that it is only capable of being opened by the person for whom it is intended upon submission of a unique electronic password or key. (10) The application is otherwise dismissed. (11) The publication or broadcast of the name of the applicant is prohibited pursuant to s 64(1)(a) of the Civil and Administrative Tribunal Act 2013 (NSW). (12) The publication or broadcast of the names of the persons other than the applicant listed in column G under the heading "Worker Name" of the spreadsheet contained in the confidential supplementary bundle of documents filed by the agency pursuant to s 58 of the Administrative Decisions Review Act 1997 (NSW) on 25 November 2022 is prohibited pursuant to s 64(1)(a) of the Civil and Administrative Review Act 2013 (NSW). Note: A reference to the name of a person includes a reference to any information, picture or other material that identifies the person or is likely to lead to the identification of the person. (13) The publication of the spreadsheet contained in the confidential supplementary bundle of documents filed by the agency pursuant to s 58 of the Administrative Decisions Review Act 1997 (NSW) on 25 November is prohibited pursuant to s 64(1)(c) of the Civil and Administrative Tribunal Act 2013 (NSW). (14) Disclosure to the applicant of the spreadsheet contained in the confidential supplementary bundle of documents filed by the agency pursuant to s 58 of the Administrative Decisions Review Act 1997 (NSW) on 25 November 2022 is prohibited pursuant to s 64(1)(d) of the Civil and Administrative Review Act 2013 (NSW). Catchwords: ADMINISTRATIVE LAW – Privacy and Personal Information Protection Act 1998 – administrative review of a reviewable decision – administrative review of conduct of the agency – disclosure of personal and health information – security safeguards Legislation Cited: Administrative Decisions Review Act 1997 (NSW) – ss 55, 58 Business Names Act 2002 (NSW) Civil and Administrative Tribunal Act 2013 (NSW) – ss 50, 64, 60 Criminal Records Act 1991 (NSW) – s 13 Government Information (Public Access) Act 2009 (NSW) Health Records Information Privacy Act 2002 (NSW) – ss 3, Schedule 1 Privacy and Personal Information Protection Act 1998 (NSW) – ss 3, 18, 20, 21, 53, 55 State Insurance and Care Governance Act 2015 (NSW) – s 4, 17 Workers Compensation Act 1987 (NSW) – ss 154A, 154B, 154C, 185A Workers Compensation Regulation 2016 (NSW) – s 147 Workplace Injury Management and Workers Compensation Act 1998 (NSW) – ss 183A, 243 Cases Cited: AOZ v Rail Corporation NSW (No. 2) [2015] NSWCATAP 179 CHY v Family and Community Services [2018] NSWCATAD 84 CLT v Department of Education and Communities [2016] NSWCATAD 98 CPJ v The University of Newcastle [2017] NSWCATAD 350 DED v Randwick City Council [2017] NSWCATAD 327 Department of Education and Training v GA (No. 3) [2004] NSWADTAP 50 EPT v The Sydney Children's Hospital Network [2022] NSWCATAD 137 GA v Commissioner of Police, NSW Police [2004] NSWADT 254 JD v NSW Department of Health [2007] NSWADT 210 JD v New South Wales Medical Board [2008] NSWADT 67 KO v Commissioner of Police, NSW Police Force (GD) [2005] NSWADTAP 56 March v Stramare (E and MH) Pty Ltd [1991] HCA 12; (1991) 171 CLR 506 Nakhl Nasr v State of New South Wales; George Nasr v State of New South Wales [2007] NSW 101 OD v Department of Education and Training (GD) [2005] NSWADTAP 74 NS v Commissioner, Department of Corrective Services [2004] NSWADT 263 Shi v Migration Agents Regulatory Authority (2008) 235 CLR 286 State of NSW (Justice Health) v Dezfouli [2008] NSWADTAP 69 XW v Department of Education and Training [2009] NSWADT ZR v NSW Department of Education and Training [2009] NSWADT 84. Texts Cited: Nil Category: Principal judgment Parties: FMM (Applicant) Nominal Insurer (Respondent) Representation: FMM (Self-represented)