MH v NSW Maritime

The case of MH v NSW Maritime was heard in the Civil and Administrative Tribunal of New South Wales. The applicant, MH, brought a complaint against NSW Maritime regarding alleged breaches of the Privacy and Personal Information Protection Act 1998 (NSW). The dispute centred around the misuse, disclosure, and failure to secure personal information, with MH asserting that NSW Maritime had not properly protected their personal data, leading to unauthorised use and disclosure.

The primary legal issues the Tribunal had to address were whether NSW Maritime's conduct constituted a breach of the Information Privacy Principles (IPP) under sections 12(c) and 18 of the Act, and if so, whether these breaches warranted an order for redress. The Tribunal needed to determine whether the actions of NSW Maritime amounted to a failure to secure personal information, as well as the unauthorised use and disclosure of that information. Additionally, the Tribunal had to consider the appropriate remedies for the breaches, including an apology and specific conduct orders.

In reaching its decision, the Tribunal examined the evidence presented and the relevant provisions of the Act. It found that NSW Maritime had indeed failed to secure MH's personal information, leading to its unauthorised use and disclosure. The Tribunal held that these actions constituted breaches of the IPPs in sections 12(c) and 18 of the Act. Consequently, the Tribunal ordered NSW Maritime to cease any further breaches of the IPPs and to apologise to MH for the breaches. Regarding costs, the Tribunal mandated that MH file submissions on costs within 28 days, followed by a response from NSW Maritime within a further 28 days.

The Tribunal's final orders required NSW Maritime to refrain from any further breaches of the specified IPPs, to apologise to MH for the breaches, and to allow for the submission and consideration of costs. The orders underscore the importance of compliance with privacy laws and the Tribunal's role in ensuring that entities handle personal information responsibly.