AFU v Sydney Local Health District

The Australian Information Commissioner initiated proceedings against the Sydney Local Health District, alleging that it had failed to adequately search for personal information in response to an access request. The dispute was heard by the Information Commissioner’s Tribunal. The primary issue for determination was whether the respondent's search for the requested personal information was adequate and whether the delay in responding to the access request was excessive. This required consideration of the standard of care expected in the search for personal information and the legal framework governing access requests under the Privacy and Personal Information Protection Act 1998.

The Tribunal found that the Sydney Local Health District had not conducted an adequate search for the personal information requested, which included various documents and records. The search was described as superficial and not sufficiently thorough. Additionally, the Tribunal concluded that the delay in responding to the access request was excessive, as it took significantly longer than the statutory time frame provided for such responses. The Tribunal emphasised the importance of timely and comprehensive searches in upholding the privacy rights of individuals under the Act.

In light of these findings, the Tribunal decided not to take any action on the matter. This decision was based on the Tribunal's authority under section 55(2) of the Privacy and Personal Information Protection Act 1998, which allows it to forgo taking action if it believes it would be in the public interest to do so. The Tribunal considered that taking action might not be necessary as the respondent had already taken steps to address the issues identified. This decision serves as a reminder to organisations of the critical importance of conducting adequate searches and responding to access requests within the prescribed time limits to avoid potential regulatory consequences.