ALZ v WorkCover NSW (No 2) [2014] NSWCATAD 122

Civil and Administrative Tribunal New South Wales Medium Neutral Citation: ALZ v WorkCover NSW (No 2) [2014] NSWCATAD 122 Hearing dates: On the papers Decision date: 29 August 2014 Jurisdiction: Administrative and Equal Opportunity Division Before: S Montgomery, Senior Member Decision: The matters are to be listed for a planning meeting at 3.00 pm on 14 October 2014 Catchwords: Privacy - information protection principle - personal information -Health information - Health Privacy Principle - retention and security safeguards - reasonable steps to prevent unauthorised access Legislation Cited: Administrative Decisions Tribunal Act 1997 Civil and Administrative Tribunal Act 2013 Health Records and Information Privacy Act 2002 Privacy and Personal Information Protection Act 1998 Cases Cited: ALZ v WorkCover NSW [2014] NSWCATAD49 FH v Commissioner, NSW Department of Corrective Services [2003] NSWADT 72 MH v NSW Maritime [2011] NSWADT 248 MT v Director General, NSW Department of Education & Training [2004] NSWADT 194 NS v Commissioner, Department of Corrective Services [2004] NSWADT 263 ZR v NSW Department of Education and Training [2008] NSWADT 199 Category: Principal judgment Parties: ALZ (Applicant) WorkCover NSW (Respondent) Representation: ALZ (Applicant in person) Crown Solicitor's Office (Respondent) File Number(s): 123291, 133003

reasons for decision 1The Applicant alleges that the Respondent's conduct contravened several of the Health Privacy Principles ("HPP"s) of the Health Records and Information Privacy Act 2002 ("HRIP Act") and also several of the Information Protection Principles ("IPP"s) of the Privacy and Personal Information Protection Act 1998 ("PPIP Act"). 2In these reasons the names of private individuals have been anonymised so as to preserve the privacy of their personal affairs. The Applicant is referred to as ALZ. At relevant times ALZ was employed by a local council ("the Council"). 3The background is set out in my decision reported as ALZ v WorkCover NSW [2014] NSWCATAD 49 ("ALZ v WorkCover No.1"). 4The conduct concerns a medical report dated 10 November 2011 ("the medical report") by a psychiatrist, Dr Prabal Kar. The medical report was prepared in relation to a workers compensation claim brought by ALZ against the Council. The workers compensation insurer which covered the Council for workers compensation claims was StateCover Mutual Limited ("StateCover"). StateCover and the Council were responsible for processing and managing ALZ's workers compensation claim. The Respondent obtained a copy of the medical report from the Council. 5At paragraphs [114] - [116] of ALZ v WorkCover No.1 I stated: 114 I agree with the Applicant that if the Respondent is uncertain about how many copies of the report are held, it cannot be said that it had taken reasonable security safeguards to ensure that the information was protected against loss. 115 I am satisfied that the security safeguards are reasonable in the circumstances insofar as they concern the copies of the medical report held in the Respondent's investigations database and in the Respondent's archives. I find no contravention of HPP 5 in regard to the security of this information. 116 However, further evidence is needed in regard to what other copies of the medical report are held by the Respondent and in regard to the security of this information for the purposes of HPP 5. 6The decision in ALZ v WorkCover No.1 is under appeal. On 27 June 2014 the Appeal Panel remitted the matter for a decision in relation to the issues that are unresolved and to which I referred at paragraph [116]. 7HPP 5 requires that personal health be securely housed and protected against loss or misuse. 8The parties have made submissions in relation to that issue. The Respondent has also filed a statement of Ms Susan Kelly, the Principal Lawyer in the Respondent's Safety, Return to Work and Support Advisings Branch.