NZ v Health Care Complaints Commission

The case before the court was between the New Zealand Privacy Commissioner and the Health Care Complaints Commission. The dispute centred around the disclosure of personal information from New Zealand to the Health Care Complaints Commission in Australia. The Privacy Commissioner alleged that the disclosure was in breach of the information protection principle under the Privacy Act 1993. The matter was heard in the Federal Court of Australia, with the Privacy Commissioner seeking to have the disclosure ruled unlawful.

The central legal issue was whether the disclosure of personal information from New Zealand to the Health Care Complaints Commission in Australia contravened the information protection principle. This principle generally prohibits the disclosure of personal information to a third party unless certain conditions are met. The court had to determine whether the Health Care Complaints Commission met the necessary conditions to lawfully receive and use the personal information disclosed.

The court examined the relevant provisions of the Privacy Act 1993 and found that the information protection principle was indeed breached. The disclosure was not made in accordance with the Act, as the Health Care Complaints Commission did not meet the conditions required for such a disclosure. Despite the Health Care Complaints Commission's argument that the disclosure was necessary for their statutory functions, the court held that this did not exempt them from compliance with the Privacy Act. Consequently, the application was dismissed, and the disclosure was ruled unlawful.

The court's final order was that the application brought by the Privacy Commissioner was dismissed. This ruling underscored the importance of adhering to privacy laws when disclosing personal information, even across international borders. The decision serves as a reminder to organisations that compliance with privacy legislation is mandatory and cannot be overlooked on the basis of statutory functions or operational needs.