JD v NSW Department of Health

[2007] NSWADT 219

CITATION:	JD v NSW Department of Health [2007] NSWADT 219
DIVISION:	General Division
PARTIES:	APPLICANT JD RESPONDENT New South Wales Department of Health
FILE NUMBER:	063438
HEARING DATES:	14 September 2007
SUBMISSIONS CLOSED:	14 September 2007
DATE OF DECISION:	25 September 2007
BEFORE:	Handley R - Acting Deputy President
CATCHWORDS:	Privacy - health privacy principle - disclosure to third party - Privacy - information protection principle - disclosure to third party
MATTER FOR DECISION:	Principal matter
LEGISLATION CITED:	Administrative Decisions Tribunal Act 1997 Health Records and Information Privacy Act 2002 Privacy Act 1988 (Cth) Privacy and Personal Information Protection Act 1998 Sex Discrimination Act 1984 (Cth) State Records Act 1998
CASES CITED:	Director General, Department of Education & Training v MT (GD) [2005] NSWADTAP 77 Director General, Department of Education & Training v MT [2006] NSWCA 270 GR v Director-General, Department of Housing [2004] NSWADTAP 26 Hall v A & A Sheiban Pty Ltd (1989) 20 FCR 217 JD v Department of Health (No 2) [2004] NSWADT 227 JD v Department of Health [2005] NSWADTAP 44 JD v NSW Medical Board (No 2) [2006] NSWADT 345 Macquarie University v FM [2005] NSWCA 192 NZ v Director General, Department of Housing [2006] NSWADT 173 Re Rummery and Federal Privacy Commissioner & anor [2004] AATA 1221
REPRESENTATION:	APPLICANT In person RESPONDENT M Dalla-Pozza, Solicitor
ORDERS:	(1) Pursuant to s 55(2)(a) of the Privacy and Personal Information Protection Act 1997 and s 54(1)(a) of the Health Records and Information Privacy Act 2002, the Respondent, the NSW Department of Health, is to pay the Applicant, JD, compensation totalling $4,500 in respect of breaches of both Acts; and; (2) Pursuant to s 55(2)(g) of the Privacy and Personal Information Protection Act 1997 and s 54(1)(f) of the Health Records and Information Privacy Act 2002, the Respondent: ; (a) is to make a written apology to the Applicant for the breaches of the two Acts, and ; (b) is to delete all references to personal information concerning JD that is irrelevant, inaccurate, out of date or misleading contained in copies of the report of Ken Thomson to the Pharmaceutical Services Branch dated 27 November 2002 in the possession or under the control of the Respondent, and the Respondent is to approach the NSW Medical Board requesting that the Medical Board also delete such material from copies of Mr Thomson’s report in its possession or under its control.

1 This matter involves an application by JD for the review of a decision concluding that there had been no breach of the Privacy and Personal Information Protection Act 2002 (‘the PPIP Act’) in relation to the disclosure of personal information.

Background

2 JD is a medical practitioner. In April 2006, in the course of preparing for a Tribunal hearing in other proceedings involving JD, a solicitor employed by the NSW Department of Health (‘the Department’), Ms K Thomas, faxed information to Mr A Tadros, an officer of the NSW Medical Board. The Department claims Ms Thomas’ object in faxing this information to Mr Tadros was to check whether the full 19 page report prepared by the Pharmaceutical Services Branch (‘PSB’) concerning JD, which included reference to personal information, the accuracy of which had not been checked by the PSB, had been referred to the Medical Board, or whether a shorter version of the same report comprising 16 pages, omitting this personal information, had been referred to the Board. The information faxed to Mr Tadros comprised the personal information contained in the 19 page report but omitted from the 16 page report. The Department claims Ms Thomas sought this clarification for the purpose of preparing a draft affidavit to be sworn by Mr Tadros in those proceedings.

3 JD claims that Ms Thomas’ action in faxing this information, which he states is “highly defamatory”, to Mr Tadros was in breach of provisions of both the PPIP Act and the Health Records and Information Privacy Act 2002 (‘the HRIP Act’). It appears that JD complained to the Department about Ms Thomas’ conduct but the Department denied there had been any breach of privacy principles. No copy of the complaint made by JD or of original decision made by the Department in relation to this complaint has been supplied to the Tribunal and I am not, therefore, clear as to the exact terms of the complaint or original decision.

4 On 3 October 2006, JD sought a review of the original decision. On 30 November 2006, the Department notified JD that the internal review had concluded that there had been no breach of the Information Privacy Principles in the PPIP Act relating to the collection, accuracy, use and disclosure of personal information. On 18 December 2006, JD applied to the Tribunal for a review of the internal review decision.

The Relevant Law

Privacy and Personal Information Protection Act 2002

5 Part 5 of the PPIP Act provides for the review of certain conduct. The conduct to which Part 5 applies is set out in s 52 and includes relevantly:

(1)(a) the contravention by a public sector agency of an information privacy principle that applies to the agency

6 Section 53(1) states that a person who is aggrieved by the conduct of a public sector agency can apply to the agency for a review of that conduct. The Tribunal’s role, pursuant to s 55(1) of the PPIP Act, is to undertake a review of the conduct that was the subject of JD’s complaint to the Department. Pursuant to s 55(2), the Tribunal may then decide not to take any action on the matter or to make any one or more of a series of orders:

(2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders:
(a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct,

(b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice,

(c) an order requiring the performance of an information protection principle or a privacy code of practice,

(d) an order requiring personal information that has been disclosed to be corrected by the public sector agency,

(e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant,

(f) an order requiring the public sector agency not to disclose personal information contained in a public register,

(g) such ancillary orders as the Tribunal thinks appropriate.

7 The PPIP Act provides for the protection of personal information and the privacy of individuals. The Act contains a series of Information Protection Principles (‘IPPs’) which agencies are required to observe in their handling of personal information. In JD’s case, the relevant IPPs appear to be those set out in ss 16, 17 and 18, set out below.

16 Agency must check accuracy of personal information before use

A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading.

17 Limits on use of personal information

A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless:

(a) the individual to whom the information relates has consented to the use of the information for that other purpose, or

(b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or

(c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person.

18 Limits on disclosure of personal information
(1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless:
(a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or

(b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or

(c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person.

(2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it.

8 ‘Personal information’ is broadly defined in s 4 as meaning information or an opinion about an individual, including that forming part of a database. Section 4(4) provides that personal information is held by a public sector agency if, relevantly, the agency, or an employee of the agency in the course of their employment, is “in possession or control of the information” (see the discussion in Macquarie University v FM [2005] NSWCA 192).

Health Records and Information Privacy Act 2002

9 In these proceedings, JD also complains of breaches of the HRIP Act. Section 11 of the HRIP Act requires every organisation that is a health service provider or that collects, holds or uses ‘health information’ to comply with the Health Privacy Principles (‘HPPs’), and not to do any thing, or engage in any practice, that contravenes a HPP. ‘Health information’ is defined in s 6 as including “(a) personal information that is information or an opinion about: (i) the physical or mental health or a disability (at any time) of an individual”. ‘Personal information’ is defined in s 5 as meaning “information or an opinion ... about an individual”. Section 9 provides that health information is ‘held’ by an organisation if the organisation is in possession or control of the information, or is in the possession or control of a person employed or engaged by the organisation in the course of such employment or engagement, or in the case of a public sector agency, the information is contained in a State record for which the agency is responsible.

10 In s 4(1), ‘Health Privacy Principle’ or ‘HPP’ is defined as meaning, “a clause of Schedule 1. A reference in this Act to a Health Privacy Principle by number is a reference to the clause of Schedule 1 with that number”. Section 21 provides that the contravention by a public sector agency of an HPP is conduct to which Part V of the PPIP Act applies.

11 The relevant HPPs set out in Sch 1 of the HRIP Act are cls 9, 10 and 11, which are framed in terms similar to IPPs 16, 17 and 18, quoted above.

Preliminary Issue

12 At a preliminary hearing on 28 June 2007, the Department submitted that because JD has claimed psychological injury, “it should be permitted to have the opportunity to have the applicant assessed by a medical expert of its choosing”. The Department relied on the decision in GR v Director-General, Department of Housing [2004] NSWADTAP 26 (‘GR’) where, at par 42, the Appeal Panel said:

“Clearly a significant onus lies on the applicant at this point to satisfy the Tribunal that the causal connection required by s 55(4)(b) is made out. Equally the agency should have an opportunity to test any expert evidence that the applicant seeks to rely on, including by having the applicant examined by its expert.”

13 The Department contended that if JD were unwilling for this to occur, then it sought an order from the Tribunal compelling JD to submit to a medical examination by a medical expert of the Department’s choosing. The Department submitted the Tribunal has jurisdiction to make such an order as a necessary incident of the jurisdiction conferred on it by s 55 of the PPIP Act and s 73(2) of the Administrative Decisions Tribunal Act 1997 (‘the ADT Act’). Section 73(2) provides that the Tribunal is to “enquire into and inform itself on any matter in such manner as it thinks fit, subject to the rules of natural justice”. The Department submitted that this impliedly allows the Tribunal to make an order that an applicant submit to cross-examination.

14 The Department submitted that failure to afford it an opportunity to have JD medically examined would mean that it had not been afforded procedural fairness.

15 JD opposed the Department’s application, which I refused. In my view, while the Tribunal must, pursuant to s 55 of the PPIP Act, be satisfied that the loss or harm has been caused by the conduct of the public sector agency, and s 73(2) of the ADT Act permits the Tribunal “to inquire into and inform itself on any matter in such manner as it thinks fit”, it is not a necessary incident of these provisions that the Tribunal is empowered to make an order of the kind sought by the Department. Other powers conferred on the Tribunal by the ADT Act do not appear to be of this species, and, in my opinion, the Tribunal could only make such an order pursuant to a specific statutory power.

16 In the course of these preliminary proceedings I did, however, emphasise to JD, pursuant to the Tribunal’s obligation under s 73(4) of the ADT Act, that it was his responsibility as the applicant in these proceedings to place material before the Tribunal in support of his application for orders under s 55 of the PPIP Act (GR, at par 38). I noted this would be of particular significance in relation to his claim for damages, in respect of which the Tribunal must be satisfied that the loss or harm suffered by JD was caused by the conduct of the Department (per s 55(2)(a) and s 55(4)(b)).

JD’s submissions on the substantive issues

17 In his written submissions, JD notes that the Department has already conceded a breach of the IPP set out in s 18 of the PPIP Act and has offered him the sum of $500 in compensation, together with an apology. JD states that the personal information in question was of “an extremely salacious, prurient and obscene nature”, and that Ms Thomas must have known that the information transfer in April 2006 was unlawful. JD submits that, as a result, a prima facie case of misfeasance in public office lies against Ms Thomas, whom, he claims, was motivated by bad faith towards himself, and deliberately disclosed the highly defamatory documents to the NSW Medical Board to impugn his good character and damage his standing with the registration authority.

18 JD referred to the Tribunal decision in JD v NSW Medical Board (No 2) [2006] NSWADT 345 (‘JD (No 2)’), where Montgomery JM awarded him $7,500 damages. JD contends that case is not distinguishable from the present matter, since both concern the unlawful disclosure of personal information pertaining to his mental health to a third party.

19 JD submits that information disclosed by the Department was personal health information “of a psychiatric species” “about” an individual. JD refers to definitions of ‘about’ stating its meaning as ‘concerning, relating to, connected with’. JD contends the information in question was clearly related to his mental health and therefore ‘health information’, so that the HRIP Act is applicable. He submits that a number of HPPs have been breached by the Department, including HPPs 9, 10 and 11.

20 JD seeks “nominal damages” of at least $7,500 for breaches of each of the PPIP Act and the HRIP Act, following the decision in JD (No 2) where, JD submits, Montgomery JM expressly awarded “nominal damages” of that quantum. JD also seeks exemplary damages of $4,000 for each statutory breach and for the blatantly malfeasant conduct by Ms Thomas, together with exaggerated damages of $2,000 for psychological harm in respect of each statutory breach and for psychological harm in the future. Further, JD seeks a written apology and that all copies of the relevant documents be destroyed.

21 JD provided a letter from his psychiatrist, Dr Larry Brash, dated 27 March 2007, in support of his claims. Dr Brash diagnosed JD as suffering from bipolar disorder and stated that JD “has suffered from additional psychiatric harm due the disclosure” of the information in question to the NSW Medical Board.

22 In oral submissions at the hearing, JD said that the information about his mental health, which he contends is “health information”, was contained in a report by Ken Thomson, Pharmaceutical Adviser (whom, JD said, is a registered pharmacist), dated 27 November 2002, prepared for the PSB at the request of the NSW Medical Board. This report included reference to a conversation between Mr Thomson and Ms Lorraine Craig, who is a registered or enrolled nurse of some 20 years standing. According to Mr Thomson’s report, Ms Craig stated in this conversation that she found JD to be “eccentric, possible hyperactive [sic] and prone to mood swings”. The report also contains other references to JD suffering from depression, to what medication he might be taking, and other personal information. It was this report that was faxed by Ms Thomas to Mr Tadros at the Medical Board.

23 JD submitted that ss 16, 17 and 18 of the PPIP Act are intimately linked and should be considered together. He submitted that the information was “used” by Ms Thomas (s 16) without checking its accuracy, and was unlawfully collected (s 17). With regard to the decision in Director General, Department of Education & Training v MT [2006] NSWCA 270 (‘MT’), JD submitted that the facts of that case can be distinguished from those in this matter, and Spigelman CJ’s comments on ‘use’ and ‘disclosure’ are, in any event, obiter.

24 With regard to causation, JD noted that in JD (No 2), Montgomery JM agreed with the view expressed by the Administrative Appeals Tribunal (‘AAT’) in Re Rummery and Federal Privacy Commissioner & anor [2004] AATA 1221 (‘Rummery’), that the errant agency must take the individual harmed as he or she presents, as with the ‘egg shell skull’ principle in tort law. JD said the fact that he has a predisposition to psychiatric harm is of no consequence in terms of remedies. Dr Brash’s evidence establishes that he suffered harm as a result of Ms Thomas’ actions.

The Department’s submissions on the substantive issues

25 Section 16. In its written submissions, the Department submits that while the actions of Ms Thomas in faxing information concerning JD to the Medical Board amounted to a ‘disclosure’, they did not amount to a ‘use’ of the information for the purposes of s 16 of the PPIP Act. The Department refers to the Tribunal decision in Director General, Department of Education & Training v MT (GD) [2005] NSWADTAP 77 (‘MT (GD)’), where, at par 39, the Appeal Panel said:

“We see the relationship between ss 16, 17 and 18 as follows. Section 16 applies a data quality standard to all uses of personal information by an agency including conduct involving disclosure of personal information by the agency. Then s 17 and s 18 operate in separate spheres. Section 17 deals with internal use of the personal information by the agency, while s 18 deals with external disclosure of the personal information by the agency.”

26 While this decision was successfully appealed to the NSW Court of Appeal in MT, the Department notes that Spigelman CJ, (with whom Ipp and Hunt JJA agreed) commented, at par 47:

“In a case such as the present, where there is a breach of s 12 by the agency of a kind which permitted unauthorised use or disclosure, I can see no purpose of the Act which will be served by imposing additional liability upon an agency under any of ss 16, 17 or 18.”

27 The Department submits that His Honour’s remarks could apply equally to the relationship between s 16 and s 18, and that there is no useful purpose in making the agency liable under s 16 as well as s 18.

28 Alternatively, the Department submits that a ‘use’ will only also amount to a ‘disclosure’ where information is used by the agency for its own purposes. The decision in JD v Department of Health (No 2) [2004] NSWADT 227 on this issue (see Higgins JM at par 61 – par 62) was upheld by the Appeal Panel in JD v Department of Health [2005] NSWADTAP 44, at par 42:

“In our view, if an agency merely retrieves information in its possession and discloses that to an external person or body, there is no ‘use’ involved. The action is governed by the standards relating to the ‘disclosure’ of information. Similarly, there may be situations in which the agency ‘uses’ information and then ‘discloses’ the information. In such a situation, we agree with the Tribunal (at [62]) that both s 16 and s 18 (limitations on disclosure and any related exemptions) would apply.”

29 The Department states that if one were to assume that the present ‘disclosure’ could also be characterised as a ‘use’, then it submits the use was to prepare its case for upcoming Tribunal hearing; it was seeking clarification of which version of the PSB report had been disclosed to the Medical Board and was not attempting to rely on the accuracy of the information itself. Thus, there was no duty on the Department to ensure the information was accurate.

30 Section 17. The Department repeats its submissions in relation to s 16 and submits that pursuant to the decision in MT (GD), at par 39, quoted above, where the Appeal Panel found that s 17 applies to the internal use of information by the agency, s 17 does not apply in the current matter. Moreover, the Department submits there is no overlap between ss 17 and 18.

31 Section 18. The Department concedes Ms Thomas’ actions were in breach of s 18, although notes the disclosure was made in the course of legal proceedings in order to clarify the facts of the situation. There is no indication that Ms Thomas acted otherwise than in good faith.

32 Misfeasance in public office. The Department submits the Tribunal has no jurisdiction in relation to JD’s allegation that Ms Thomas’ conduct amounted misfeasance in public office or a breach of s 68 of the PPIP Act.

33 Remedies. The Department submits that JD must establish a causal connection between the conduct of the agency and the loss or harm suffered (s 55(2)(a) and s 55(4)(b) of the PPIP Act). As the Appeal Panel noted in GR, at par 42, this places a significant onus of the applicant to satisfy the Tribunal that an order should be made. Mr Dalla-Pozza, for the Department, noted that I drew the onus borne by the applicant in such proceedings to JD’s attention at the preliminary hearing on 28 June 2007, and that the Tribunal had allowed sufficient procedural fairness to JD in this regard.

34 Mr Dalla-Pozza noted that the only evidence provided by JD in support of his claim is Dr Brash’s letter dated 27 March 2007. He submitted that the letter fails to establish a sufficient causal nexus to warrant damages: the letter provides no evidence of what “additional psychiatric harm” has been suffered by JD as a result of the disclosure. Dr Brash’s clinical notes, tendered by the Department and admitted in evidence, give no indication of additional harm being suffered by JD at the relevant time. Indeed, the disclosure in April 2006 is not even mentioned in Dr Brash’s notes. The offer of $500 in compensation for JD was made at the outset of these proceedings in the hope of settlement and is no longer ‘on the table’.

35 The Department states that it is prepared to provide JD with a written apology. Mr Dalla-Pozza said that an apology had not yet been forthcoming because the parties are still engaged in litigation. With regard to the destruction of the information in question, the Department submits that it would be inappropriate for the Tribunal to order the destruction of the report containing the information pursuant to s 55(2)(e) of the PPIP Act because of the obligations placed on the Department under the State Records Act1998. If the Tribunal is so inclined, it could make an order that the Department contact the Medical Board (a separate agency from the Department) to effect a correction of the information pursuant to the Tribunal’s power under s 55(2)(d), or to request the return of the information. However, the Department has no power to direct the Board to do so.

36 HRIP Act. Mr Dalla-Pozza submitted that there is only one paragraph of Mr Thomson’s report to the PSB which could conceivably be considered ‘health information’ – that in which Ms Craig is recorded as saying that she found JD “eccentric, hyperactive and prone to mood swings”. The remainder of the information in this report is personal information to which the PPIP Act applies. However, Ms Craig was not asked to provide the information in her professional capacity – it was an opinion stated as an ordinary person. Mr Dalla-Pozza submitted that if the Tribunal finds the relevant information to be health information, then, as with the IPPs, the only breach of the HPPs is that of cl 11, the equivalent of s 18 of the PPIP Act.

Discussion

Was there a breach of the PPIP Act?

37 First, in relation to the PPIP Act, JD has alleged breaches of the IPPs set out in ss 16, 17 and 18, quoted above. Section 16 applies in respect of the ‘use’ of personal information. In the current matter, I am satisfied in the absence of evidence to the contrary, that the personal information concerning JD contained in the report, dated 27 November 2002, prepared by Mr Thomson for the PSB, faxed by Ms Thomas to Mr Tadros at the NSW Medical Board, was faxed for the purpose of clarifying whether the PSB had supplied the Board with the full, 19 page report, rather than the shorter 16 page report prepared by the PSB. The question I must determine is whether this was a ‘use’ of personal information for the purposes of s 16.

38 In MT (GD), at par 39, quoted above, the Appeal Panel said that s 16 applies to all uses of personal information, including disclosure by the agency. The Appeal Panel also said, at par 33:

“In the first discussion of the need to regulate disclosure in its final report, the ALRC states at [803]: ‘[d]isclosure is a particular form of ‘use’’. In our view, this is correct though it is a common characteristic of information privacy laws to deal separately with ‘disclosure’ and ‘use’. The actions that an agency may take on personal information range from relatively minor internal ones, such as verification of data against other records held by the agency, to the much more grave step of making a considered decision to disclose the information to an external body. There is, in our view, no clinical distinction between conduct which amounts to ‘use’ and that which involves ‘disclosure’.”

39 The word ‘use’ is not defined in the legislation and should be given its ordinary meaning. In my view, the Department was ‘using’ the information in question – in the sense of employing it - for the purpose of clarifying, in relation to upcoming legal proceedings, what had been disclosed to the NSW Medical Board. As discussed in JD v Department of Health (GD) [2005] NSWADTAP 44, at par 42, there was both a ‘use’ and a ‘disclosure’ of the information. The information was used in a way that was clearly adverse to the interests of JD, without regard to the accuracy of the information. I accept that there was no attempt by the Department to rely on the accuracy of the information and that, as I have said, the purpose was purely that of clarifying what had been disclosed to the Medical Board. However, there were other ways in which clarification could have been sought without faxing the full report prepared by Mr Thomson, the content of which Ms Thomas knew to include contested personal information. Thus, there was a breach of s 16.

40 With regard to s 17, the decision in MT (GD) indicates that s 17 applies in relation to the internal use of the information by the agency – where the information is used for a purpose other than that for which it was collected. In my view, there was no internal use of the information – rather there was an external use, in that the information was disclosed to another agency, the Medical Board, with a consequent breach of s 18, as the Department acknowledges.

Was there a breach of the HRIP Act?

41 Turning to the HRIP Act, the first issue is whether there has been a use or disclosure of ‘health information’. As stated above, ‘health information’ is defined in s 6 as including “(a) personal information that is information or an opinion about: (i) the physical or mental health or a disability (at any time) of an individual”. ‘Personal information’ is defined in s 5 as meaning “information or an opinion ... about an individual”.

42 The report, dated 27 November 2002, prepared by Mr Thomson for the PSB, faxed by Ms Thomas to the NSW Medical Board, included reference to a conversation between Mr Thomson and Ms Lorraine Craig, who is a registered or enrolled nurse of some 20 years standing. According to Mr Thomson’s report, Ms Craig stated in this conversation that she found JD to be “eccentric, possible hyperactive [sic] and prone to mood swings”. The report also contains other references to JD suffering from depression, and to what medication he might be taking. In my view, in the context of this being a report to the PSB, prepared by a registered pharmacist, and quoting the opinion of a registered or enrolled nurse, this was clearly ‘health information’, being personal information about JD’s mental health.

43 As stated above, the relevant HPPs set out in Sch 1 of the HRIP Act are cls 9, 10 and 11 which are framed in terms similar to IPPs 16, 17 and 18, discussed above. Clause 9 states:

9 Accuracy

An organisation that holds health information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading.

44 Clause 10 states relevantly that, subject to various exceptions, “[a]n organisation that holds health information must not use the information for a purpose ... other than the purpose ... for which it was collected”.

45 Clause 11 states relevantly that, subject to various exceptions, “[a]n organisation that holds health information must not disclose the information for a purpose ... other than the purpose ... for which it was collected”.

46 For the reasons stated above in relation to IPPs 16, 17 and 18, in my view there was a breach of HPPs 9 and 11, but not of HPP 10.

Misfeasance in public office

47 In my view, because the Tribunal’s jurisdiction and powers are those with which it is endowed by statute, it has no jurisdiction in relation to JD’s complaint that Ms Thomas’ conduct amounted to the common law tort of misfeasance in public office. The Tribunal also has no jurisdiction in relation to the offences set out in s 68 of the PPIP Act relating to dealings with the Privacy Commissioner.

Remedies

48 Pursuant to s 55(2) of the PPIP Act, the Tribunal may decide not to take any action on the matter, or may make one or more of the orders set out in that subsection. These include an order for the payment of damages not exceeding $40,000 “by way of compensation for any loss or damage suffered because of the conduct” subject, relevantly, to s 55(4)(b), which requires that the Tribunal must be “satisfied that the applicant has suffered financial loss, or psychological or physical harm, because of the conduct of the public sector agency”. As noted by the Department, in GR, at par 42, the Appeal Panel emphasised that the applicant bears a significant onus to satisfy the Tribunal of the causal connection.

49 The Tribunal has similar powers pursuant to s 54(1)(a) of the HRIP Act, including a power to award an order for the payment of damages not exceeding $40,000, but once again subject to a requirement, set out in s 54(2)(b), that the Tribunal must be “satisfied that the applicant has suffered financial loss, or psychological or physical harm, because of the conduct of the respondent”.

50 I have found the Department breached IPPs 16 and 18, and HPPs 9 and 11. JD claims that he suffered psychological harm because of the breaches. He relies on his own evidence as to the harm suffered and that of Dr Brash, namely Dr Brash’s letter dated 27 March 2007. JD states that he has been “psychologically demonised, stigmatised and vilified by the respondent’s deliberate and reckless release of this unlawfully collected and unlawfully disclosed ... personal information to the NSW Medical Board”, and that his professional reputation has been damaged as a result. He claims the psychological harm caused is fully supported by Dr Brash’s evidence. However, he also submits that “I do not have to prove any harm or damage whatsoever to be awarded nominal damages”, referring to the decision by Montgomery JM in JD (No 2). JD claims nominal damages of at least $7,500 in respect of breaches of each of the PPIP Act and HRIP Act, together with exemplary damages of $2,000, and exaggerated damages of $2,000 for each breach.

51 The Department submits that Dr Brash’s letter provides no evidence of what “additional psychiatric harm” has been suffered by JD, and notes that Dr Brash’s clinical notes give no indication of any additional harm being suffered at the relevant time.

52 I note that Dr Brash’s letter of 27 March 2007, which is of only three paragraphs, refers to JD having “suffered from additional psychiatric harm due to the disclosure of the above information to NSW Medical Board”. No further information is provided. Dr Brash’s clinical notes, which were tendered and admitted into evidence at the request of the Department, make no specific reference to additional harm as a result of the disclosure which took place in April 2006. JD has also not provided any specific evidence as to the psychological harm he suffered as a result of the disclosure of the information contained in Mr Thomson’s report to the Medical Board, other than describing it in the general terms to which I have referred above.

53 However, part way through the hearing on 14 September 2007, without prior notice, JD requested an adjournment to enable him to obtain further information from Dr Brash. In view of the fact that on 28 June 2007, I specifically drew to JD’s attention his responsibility in these proceedings to place material before the Tribunal in support of his application for orders under s 55 of the PPIP Act (as to which see par 16, above), and having regard to the need to allow procedural fairness to the Department, which opposed JD’s application, I denied JD’s request.

54 I have had regard to the character of some of the personal information contained in Mr Thomson’s report, which I accept, as JD contends, is potentially highly defamatory and could have a significant effect on JD’s personal and professional reputation. However, JD has not sought to establish any harm suffered other than psychological harm. Given the character of the some of the information disclosed, I am prepared to accept JD’s claim that the disclosure caused him psychological harm on the basis of the corroborative evidence of Dr Brash, despite the lack of detail provided as to the nature of the additional harm caused. Thus, I am satisfied that in accordance with section 55(4)(b) of the PPIP Act and s 54(2)(b) of the HRIP Act, there is a sufficient causal link between the disclosure and the psychological harm suffered by JD to permit the exercise of the discretion for an award of compensation.

55 I am aware that JD suffers from a mental illness and that his condition has already been exacerbated as a result of other conduct. In JD (No 2), Montgomery JM awarded JD damages of $7,500 for breaches of ss 18 and 19 of the PPIP Act by the NSW Medical Board. Contrary to JD’s contention, Montgomery JM did not make an award of ‘nominal’ damages. At par 72, after taking into account the factors raised by the parties and having “had regard to the various considerations canvassed in Rummery”, he determined that “an appropriate award for the financial loss and psychological harm caused to JD by the conduct of the Board is $7,500”.

56 The award of compensation under the PPIP Act was also recently discussed by the President of the Tribunal, O’Connor DCJ, in NZ v Director General, Department of Housing [2006] NSWADT 173 (‘NZ’). The President said, at par 46:

“I accept, in general, the view expressed in Rummery that the errant agency must take the individual harmed as he or she presents, and it is the impact on the victim that is to be assessed (similar to the ‘egg shell skull’ theory of tort law: see Bourhill v Young [1943] AC 92 at 109-110 per Lord Wright; Beavis v Apthorpe (1962) 80 WN (NSW) 852 at 857 per Herron CJ; Havenaar v Havenaar [1982] 1 NSWLR 626 at 631 per Glass JA). Some people will have a more severe reaction to an event than others.”

57 Thus, the fact that JD may be susceptible to mental illness does not affect any entitlement to compensation he may have. In Rummery, a decision under the Privacy Act 1988 (Cth), the AAT, including the President of the Tribunal, Justice Downes, relied on the decision of the Federal Court in Hall v A & A Sheiban Pty Ltd (1989) 20 FCR 217, a decision involving the assessment of damages under the Sex Discrimination Act 1984 (Cth). The Federal Court considered that where a complaint is substantiated and loss or damage has been suffered, some form of redress is contemplated. Relevantly, awards should be restrained but not minimal, compensation should be assessed having regard to the complainant’s reaction (including injury to feelings, distress and humiliation) and not to the perceived reaction of the majority of the community or of a reasonable person in similar circumstances, and in an appropriate case aggravated damages may be awarded. In Rummery, the AAT found a serious breach of the Privacy Act had occurred and awarded compensation of $8,000.

58 In NZ, at par 47, the President, O’Connor DCJ, accepted that the reaction of NZ to the disclosure was “a heightened or severe one”. Having had regard to the various considerations canvassed in Rummery, he awarded NZ compensation of $4,000. He declined to award aggravated damages. The President said, at par 52:

“The applicant also seeks an award for ‘aggravated damages’ that involves a form of reproof or chastisement of the Department going beyond that which is effected by the making of an award of damages of the usual kind. This type of award is more usually referred to in tort law as an award of ‘exemplary’ or ‘punitive’ damages. Rummery is a good illustration of a case where the conduct of the agency in defence of the claim was so egregious that such an award might well have been made. But the award ultimately made was global, and there was no express reference by the AAT to the inclusion within it of a ‘punitive’ or ‘exemplary’ element. I should add that I do not see any difficulty in awarding aggravated or exemplary damages if the case justifies it.”

59 Turning to what would constitute an appropriate award in JD’s case, I am satisfied that JD did suffer psychological harm as a result of the disclosure, although there is a lack of evidence as the exact nature of that harm, and the extent of the additional harm over and above that for which JD was compensated in JD (No 2). However, I accept that JD felt “psychologically demonised, stigmatised and vilified” by the disclosure of the information to the Medical Board. Taking into account the considerations identified in Rummery and NZ, discussed above, and noting the lack of any detailed evidence as to the psychological harm suffered by JD as a result of the disclosure, in my view an appropriate award of compensation is $4,500. This encompasses the breaches under both the PPIP Act and the HRIP Act, since all the breaches relate to the same act – the disclosure of personal information to the NSW Medical Board.

60 There is no evidence before me to suggest that the disclosure was malicious as JD contends. I note that at the commencement of these proceedings, the Department conceded the breach of s 18 of the PPIP Act and offered JD an apology and compensation of $500. While such an amount of compensation is in my view inadequate, nevertheless, the Department’s conduct in these proceedings has been conciliatory and I can see no justification for an award of aggravated damages.

61 JD also seeks a written apology and the Department has offered to provide this. Accordingly, pursuant to the power of the Tribunal to make ancillary orders under s 55(2)(g) of the PPIP Act and s 54(1)(f) of the HRIP Act, I order the Department to make a written apology to JD for the breaches of the two Acts.

62 Finally, with regard to JD’s contention that all copies of the relevant documents containing the offending information be destroyed, utilising the same power under s 55(2)(g) of the PPIP Act and s 54(1)(f) of the HRIP Act, I order that all references to personal information concerning JD that is irrelevant, inaccurate, out of date or misleading contained in copies of the report of Ken Thomson to the PSB dated 27 November 2002 in the possession or under the control of the Department be deleted, and that the Department approach the NSW Medical Board requesting that the Medical Board also delete such material from copies of Mr Thomson’s report in their possession or under its control.

Decision

(1) Pursuant to s 55(2)(a) of the Privacy and Personal Information Protection Act 1997 and s 54(1)(a) of the Health Records and Information Privacy Act 2002, the Respondent, the NSW Department of Health, is to pay the Applicant, JD, compensation totalling $4,500 in respect of breaches of both Acts; and

(2) Pursuant to s 55(2)(g) of the Privacy and Personal Information Protection Act 1997 and s 54(1)(f) of the Health Records and Information Privacy Act 2002, the Respondent:

(a) is to make a written apology to the Applicant for the breaches of the two Acts, and

(b) is to delete all references to personal information concerning JD that is irrelevant, inaccurate, out of date or misleading contained in copies of the report of Ken Thomson to the Pharmaceutical Services Branch dated 27 November 2002 in the possession or under the control of the Respondent, and the Respondent is to approach the NSW Medical Board requesting that the Medical Board also delete such material from copies of Mr Thomson’s report in its possession or under its control.