FMM v Insurance and Care NSW

The case of FMM v Insurance and Care NSW t/a iCare NSW involves an application for judicial review by the applicant, FMM, of decisions made by Insurance and Care NSW, an agency responsible for workers' compensation claims in New South Wales. The primary issue in this case concerns the alleged improper disclosure of personal and health information by the agency, which FMM claims contravened the Information Privacy Principles under the Privacy and Personal Information Protection Act 1998 (NSW) and the Health Records and Information Privacy Act 2002 (NSW).

The court was tasked with determining whether the agency's actions constituted a breach of the privacy principles and health privacy provisions. It also needed to assess the adequacy of the agency's security measures in handling sensitive information and the appropriate remedies if a breach was found. The court had to consider the specific provisions of the legislation regarding the handling and disclosure of personal and health information and whether the agency's conduct fell short of the required standards.

In its decision, the court found that the agency had indeed contravened the privacy principles and health privacy provisions by failing to adequately protect personal and health information. The court was critical of the agency's security measures, noting that they were insufficient to prevent the unauthorised disclosure of sensitive information. As a result, the court ordered the agency to implement more stringent security safeguards and to pay compensation to FMM. The court also prohibited the publication or broadcast of certain personal information to protect the privacy of the individuals involved.

The court issued several orders to address the issues raised in the case. It varied the decision under review to recognise the breach of privacy principles and health privacy provisions. The court ordered the agency to pay FMM $20,000 and mandated the implementation of enhanced security measures, including the design and implementation of a secure online portal for the distribution of Cost of Claims reports. Additionally, the court prohibited the publication of certain personal information and documents to safeguard privacy. The application was otherwise dismissed, and the court prohibited the publication or broadcast of the names of the individuals involved in the case.