EPT v The Sydney Children's Hospital Network

The Sydney Children's Hospital Network was the respondent in a case brought by EPT. The applicant sought compensation for a breach of privacy, specifically under section 12(c) of the Privacy and Personal Information Protection Act 1998 (NSW), alleging that the hospital failed to secure personal information between February 2017 and May 2018. The dispute was heard and determined by the Civil and Administrative Tribunal of New South Wales.

The key legal issues before the Tribunal were whether the hospital had indeed breached the statutory duty to secure personal information and, if so, whether the applicant was entitled to compensation for the distress and harm caused by the breach. The Tribunal needed to establish if the hospital's failure to secure the applicant's personal information amounted to a breach of section 12(c) of the Privacy and Personal Information Protection Act 1998 and, if so, the extent of the applicant's damages.

The Tribunal found that the hospital had indeed breached section 12(c) of the Privacy and Personal Information Protection Act 1998. The hospital had failed to take reasonable steps to ensure that personal information was protected from misuse, interference, loss, unauthorised access, modification or disclosure. The Tribunal determined that this failure directly resulted in the applicant's personal information being accessible to unauthorised parties, leading to distress and harm. Consequently, the Tribunal set aside the decision made by the hospital on 5 March 2021, replacing it with a finding that the hospital had breached the statutory duty. The Tribunal also ordered the hospital to provide an unreserved written apology to the applicant and to pay the applicant $10,000 in compensation.

In summary, the Tribunal held that the hospital had breached the statutory duty to secure personal information and ordered the hospital to provide compensation to the applicant. The Tribunal further mandated that the hospital must issue a formal apology to the applicant within 28 days.