EJX v University of Newcastle [2023] NSWCATAD 53

EJX v University of Newcastle [2023] NSWCATAD 53

The Tribunal found the Respondent contravened IPPs 3, 5, 6, 9, and 10 and HPPs 4, 5, 6, 9, and 10 by failing to give adequate notice of information collection, provide information access, safeguard information, check information accuracy before use, and using information for purposes not reasonably connected to the collection purpose. There were no breaches established regarding access (IPP 7/HPP 7) or disclosure to external third parties (IPP 11/HPP 11). The Tribunal ordered the cessation of use of the dedicated email, provision of a written apology, compliance with certain IPPs and HPPs, and payment of $22,500, including aggravated damages, as compensation for harm caused to the Applicant.

Jurisdiction
Australia
Judgment Date
13 March 2023
Procedural Posture
Administrative Review / Decision After Full Hearing
Outcome
Application allowed in part; internal review decision set aside and replaced with new orders.
Legal Topics
['privacy and Personal Information Protection Act' 'health Records and Information Privacy Act' 'administrative Review of Privacy Decisions' 'aggravated Damages for Privacy Breaches' 'information Protection and Health Privacy Principles']
['administrative Law' 'privacy Law' 'equal Opportunity Law'] ['privacy and Personal Information Protection Act' 'health Records and Information Privacy Act' 'administrative Review of Privacy Decisions' 'aggravated Damages for Privacy Breaches' 'information Protection and Health Privacy Principles']

Case Brief

Summary, issues, holding and outcome

More case intelligence is available

Unlock the full research layer for this judgment.

Full judgment text Downloadable case file Legal principles 1 Authorities cited 2 Party arguments 2 Amounts and remedies 1
Sign in to unlock

Procedural Posture

Administrative Review / Decision After Full Hearing

Legal Issues

  1. 1 ["Whether the Respondent contravened IPPs 3, 5, 6, 7, 9, 10 and 11 and/or HPPs 4, 5, 6, 7, 9, 10 and 11 in the collection, use, security, disclosure, and transparency of the Applicant's personal and health information in relation to the establishment and operation of a dedicated email address."]

Ratio Decidendi

The Tribunal found the Respondent contravened IPPs 3, 5, 6, 9, and 10 and HPPs 4, 5, 6, 9, and 10 by failing to give adequate notice of information collection, provide information access, safeguard information, check information accuracy before use, and using information for purposes not reasonably connected to the collection purpose. There were no breaches established regarding access (IPP 7/HPP 7) or disclosure to external third parties (IPP 11/HPP 11). The Tribunal ordered the cessation of use of the dedicated email, provision of a written apology, compliance with certain IPPs and HPPs, and payment of $22,500, including aggravated damages, as compensation for harm caused to the Applicant.

Court Disposition

Application allowed in part; internal review decision set aside and replaced with new orders.

Orders

  • ['Respondent must cease use of the dedicated email and associated email address immediately.' 'Within 14 days, Respondent to provide Applicant with a formal written apology signed by the Chancellor addressing and apologising for identified contraventions and harm caused.' 'Within 14 days of the Applicant providing...