Redimed Pty Ltd and Australian Information Commissioner (Freedom of information)

Redimed Pty Ltd sought review of a determination made by the Australian Information Commissioner (the Commissioner) that Redimed had breached Australian Privacy Principle (APP) 12 of the *Privacy Act 1988* (Cth) by failing to provide an individual, Mr AAQ, with full access to his personal information contained in a pre-employment medical report. The Commissioner had found that Redimed had interfered with Mr AAQ's privacy by declining to provide access to certain redacted information, failing to take reasonable steps to provide access in an appropriate manner, and failing to provide the required written notice regarding complaint mechanisms.

The primary legal issue before the Administrative Appeals Tribunal was whether Redimed had lawfully redacted information from Mr AAQ's medical report, specifically whether the exemptions under APP 12.3(b) (unreasonable impact on the privacy of other individuals) and APP 12.3(j) (evaluative information generated within the entity in connection with a commercially sensitive decision-making process) applied. The Tribunal was also required to consider whether Redimed had taken reasonable steps to provide access and had complied with the notification requirements of APP 12.9.

The Tribunal affirmed the Commissioner's decision, finding that Redimed had breached APP 12.1. It was not satisfied that the exemption under APP 12.3(b) applied. Regarding APP 12.3(j), while the information was considered evaluative, the Tribunal agreed with the Commissioner that the commercially sensitive decision-making process belonged to the referring employer, not Redimed, and therefore the exemption did not apply. The Tribunal also found that Redimed's subsequent provision of the unredacted report did not remedy the initial failure to provide access, nor did it rectify the breach of APP 12.5 concerning reasonable steps to provide access. Furthermore, Redimed had failed to comply with APP 12.9 by not providing the required written notice of complaint mechanisms.

The Tribunal affirmed the Commissioner's reviewable decision and ordered Redimed to undertake specific remedial actions, including engaging an independent reviewer to assess its APP 12 compliance procedures, providing the reviewer's report to the Commissioner, and conducting a further assessment of its practices to determine the effectiveness of implemented recommendations.