FMH v Cumberland Council

In the case of FMH v Cumberland Council, the applicant, FMH, sought relief under the Privacy and Personal Information Protection Act 1998 and the Health Records Information Protection Act 2002, alleging breaches of various Information Privacy Principles (IPPs) and Health Privacy Principles (HPPs) by Cumberland Council. The applicant claimed that the council had improperly handled her personal, health, and restricted information, leading to significant psychological distress and financial loss. The Civil and Administrative Tribunal (CAT) of New South Wales was tasked with reviewing the council's internal review decision and determining whether the alleged breaches occurred and if they warranted compensation and other remedies.

The primary legal issues before the tribunal were whether Cumberland Council had indeed breached the relevant IPPs and HPPs, and if so, what level of compensation was appropriate for the harm caused to FMH. The tribunal needed to assess the council's handling of FMH's personal, health, and restricted information, particularly whether the council had improperly disclosed this information to witnesses involved in administrative reviews and proceedings. Additionally, the tribunal considered whether the council had failed to adequately protect the applicant's information from unauthorised access, use, modification, or disclosure.

After reviewing the evidence and submissions, the tribunal found that the Cumberland Council had breached several IPPs and HPPs. The council had improperly disclosed FMH's personal, health, and restricted information to witnesses, and failed to implement adequate security measures to protect this information. The tribunal concluded that these breaches had caused significant psychological distress and financial loss to FMH. Consequently, the tribunal set aside the council's internal review decision and ordered the council to compensate FMH with $12,500, provide a formal written apology, and implement various administrative measures to protect FMH's information in future proceedings. The tribunal also ordered specific actions to be taken to redact and secure the personal and health information provided to witnesses and to implement safeguards to protect FMH's restricted information.