CJU v HealthShare NSW

The case of CJU v HealthShare NSW involved an application for review of a decision by HealthShare NSW, a statutory corporation, regarding the handling of personal information. The applicant, CJU, sought review of the respondent's handling of their personal information, specifically concerning its disclosure to another agency. The case was heard and determined in the Civil and Administrative Tribunal of New South Wales.

The primary legal issues before the Tribunal were whether the respondent breached sections 10 and 18 of the Privacy and Personal Information Protection Act 1998 by failing to notify the applicant of certain matters and by disclosing the applicant's personal information to another agency without a valid exception or exemption. The applicant argued that the respondent's actions constituted a breach of their privacy rights under the Act.

In its decision, the Tribunal found that the respondent did not comply with section 10 of the Privacy and Personal Information Protection Act by failing to notify the applicant of specific matters relating to the collection of their personal information. The Tribunal also found that the disclosure of the applicant's personal information to another agency was a breach of section 18 of the Act, as neither the exception in section 18(1)(a) nor the exemption in section 27A applied. The Tribunal concluded that the respondent's actions were unlawful and constituted a breach of the applicant's privacy rights.

The Tribunal ordered that the respondent file and serve submissions as to remedy by a specified date, with the applicant then having the opportunity to respond. The matter was to be relisted for directions as to remedies before a Senior Member of the Tribunal. The orders made by the Tribunal addressed the breaches found and set out a process for determining appropriate remedies for the applicant.