CJU v HealthShare NSW [2021] NSWCATAD 372

CJU v HealthShare NSW [2021] NSWCATAD 372

The Respondent collected the Applicant's personal information when it solicited or, at least, accepted and actioned the Applicant's inquiry, and it failed to take reasonable steps to notify the Applicant of the matters required by s 10 PPIP Act/IPP 3. The Respondent disclosed the Applicant's personal information to SESLHD for the first time in relation to Conduct of Concern 2, and although the disclosure was directly related to the purpose of responding to the inquiry, the 'Confidential PID' subject line and contents of the email gave the Respondent reason to believe that the Applicant would object. The s 18(1)(a) exception was therefore not made out, and the Respondent did not establish...

Jurisdiction
Australia
Judgment Date
15 December 2021
Procedural Posture
Administrative Review of Alleged Breaches of the Privacy and Personal Information Protection Act 1998 / Liability Determination; Remedies Reserved for Further Proceedings
Outcome
The Tribunal found breaches of s 10 PPIP Act/IPP 3 and s 18(1) PPIP Act/IPP 11 in relation to Conduct of Concern 2, with remedies to be determined later.
Legal Topics
['personal Information' 'information Privacy Principles' 'collection Notice Requirements' 'disclosure of Personal Information' 'inter Agency Disclosure Exemption' 'internal Review and External Review Under the Privacy and Personal Information Protection Act 1998']
['administrative Law' 'privacy Law'] ['personal Information' 'information Privacy Principles' 'collection Notice Requirements' 'disclosure of Personal Information' 'inter Agency Disclosure Exemption' 'internal Review and External Review Under the Privacy and Personal Information Protection Act 1998']

Case Brief

Summary, issues, holding and outcome

More case intelligence is available

Unlock the full research layer for this judgment.

Full judgment text Downloadable case file Legal principles 1 Authorities cited 2 Party arguments 2 Amounts and remedies 1
Sign in to unlock

Procedural Posture

Administrative Review of Alleged Breaches of the Privacy and Personal Information Protection Act 1998 / Liability Determination; Remedies Reserved for Further Proceedings

Legal Issues

  1. 1 ['Whether Conduct of Concern 3 was within the scope of the administrative review and could be determined on the evidence' 'What personal information of the Applicant was the subject of the proceedings' 'Whether the Respondent was required to take reasonable steps under s 10 PPIP Act/IPP 3 to notify the Applicant of matters relating to collection of personal information' "Whether the Respondent breached s 18 PPIP Act/IPP 11 by disclosing the Applicant's personal information to SESLHD in relation to Conduct of Concern 2" 'Whether the exception in s 18(1)(a) PPIP Act applied to the disclosure to SESLHD' 'Whether the exemption in s 27A PPIP Act applied to the disclosure to SESLHD']

Ratio Decidendi

The Respondent collected the Applicant's personal information when it solicited or, at least, accepted and actioned the Applicant's inquiry, and it failed to take reasonable steps to notify the Applicant of the matters required by s 10 PPIP Act/IPP 3. The Respondent disclosed the Applicant's personal information to SESLHD for the first time in relation to Conduct of Concern 2, and although the disclosure was directly related to the purpose of responding to the inquiry, the 'Confidential PID' subject line and contents of the email gave the Respondent reason to believe that the Applicant would object. The s 18(1)(a) exception was therefore not made out, and the Respondent did not establish...

Court Disposition

The Tribunal found breaches of s 10 PPIP Act/IPP 3 and s 18(1) PPIP Act/IPP 11 in relation to Conduct of Concern 2, with remedies to be determined later.

Orders

  • ["The Respondent failed to comply with s 10 PPIP Act/IPP 3 by not taking reasonable steps, either before or as soon as practicable after the collection of the Applicant's personal information, to notify the Applicant of the matters in ss 10 (a) to (f) PPIP Act." "The Respondent disclosed the Applicant's personal...