AW v Vice Chancellor, University of Newcastle

The matter before the Australian Information Commissioner involved a complaint by an individual against the Vice Chancellor of the University of Newcastle. The complainant alleged that the university had breached their privacy by disclosing their personal health information without consent. The dispute was heard and determined by the Australian Information Commissioner under the Privacy and Personal Information Protection Act 1998. The central legal issue before the Commissioner was whether the university had violated the complainant's privacy by using and disclosing their personal health information without proper authority or consent. Specifically, the Commissioner needed to determine if the use of the information complied with the health privacy principle outlined in the Act.

The Commissioner found that the university had indeed used the complainant's personal health information without appropriate consent or legal basis. The university had disclosed the information to third parties without the complainant's knowledge or agreement, which was a breach of the privacy principles. The Commissioner noted that while the university argued the disclosure was necessary for the administration of the university, it did not sufficiently demonstrate that the disclosure complied with the requirements of the privacy principles. The Commissioner concluded that the use and disclosure of the personal health information were not authorised by the Act, leading to a violation of the complainant's privacy rights.

As a result, the Commissioner determined not to take any further action on the matter, as the university had taken steps to address the breach and the complainant had received an apology. The Commissioner also made no order regarding costs, as the university had already acknowledged the breach and taken corrective actions. This decision underscores the importance of adhering to privacy principles when handling personal health information and highlights the potential consequences for non-compliance.