ALZ v WorkCover NSW (No 2)

The case of ALZ versus WorkCover NSW (No 2) was heard in the Civil and Administrative Tribunal of New South Wales. The dispute involves allegations concerning the retention and security of personal health information, specifically whether the respondent, WorkCover NSW, had taken reasonable steps to prevent unauthorised access to the personal health information of the applicant, ALZ. The applicant sought a declaration that the respondent breached the Health Privacy Principle and the Information Protection Principle by failing to take reasonable steps to protect the applicant's personal health information from unauthorised access.

The primary legal issues before the tribunal were whether the respondent's handling of the applicant's personal health information complied with the Health Privacy Principle and the Information Protection Principle under the Privacy and Personal Information Protection Act 1998 (NSW). Specifically, the tribunal had to determine if WorkCover NSW took reasonable steps to prevent unauthorised access to the applicant's personal health information and whether this was sufficient to meet the statutory obligations under the Act.

In examining the evidence presented, the tribunal considered the measures WorkCover NSW had in place to protect personal health information. The tribunal found that while the respondent had implemented various security measures, there were instances where the applicant's personal health information was accessible without proper authorisation. The tribunal concluded that these lapses constituted a breach of both the Health Privacy Principle and the Information Protection Principle, as the steps taken by the respondent were not sufficient to prevent unauthorised access. The tribunal ordered the parties to attend a planning meeting to discuss the next steps in the proceedings.