FMH v Cumberland Council [2022] NSWCATAD 293

FMH v Cumberland Council [2022] NSWCATAD 293

Cumberland Council breached IPPs 5, 10, 11, and 12 and HPPs 4, 5, 10, and 11 by disclosing and failing to secure personal, health and restricted information beyond what was reasonably necessary for the preparation of witness evidence, contrary to statutory requirements. The conduct was not excused under litigation exemptions or natural justice. Compensation, apology, performance of privacy principles and further administrative measures were appropriate remedies.

Parties
Applicant: FMH; Respondent: Cumberland Council
Jurisdiction
Australia
Judgment Date
30 August 2022
Procedural Posture
Administrative Review / Final Determination and Orders
Outcome
Application allowed in part; Respondent's internal review set aside; compensation and non-monetary orders made.
Legal Topics
Information Privacy Principles, Health Privacy Principles, Disclosure of Personal Information, Use of Personal Information, Security of Information, Compensation for Privacy Breaches
Administrative Law Privacy Law Information Privacy Principles Health Privacy Principles Disclosure of Personal Information Use of Personal Information Security of Information Compensation for Privacy Breaches

Case Brief

Summary, issues, holding and outcome

More case intelligence is available

Unlock the full research layer for this judgment.

Full judgment text Downloadable case file Legal principles 5 Authorities cited 39 Party arguments 2 Amounts and remedies 1
Sign in to unlock

Parties

FMH

Applicant

Cumberland Council

Respondent

Procedural Posture

Administrative Review / Final Determination and Orders

Legal Issues

  1. 1 Whether Cumberland Council's use and disclosure of FMH's personal and health information to employee and non-employee witnesses breached IPPs 5, 10, 11, and 12 and HPPs 4, 5, 10, and 11 under the Privacy and Personal Information Protection Act 1998 and the Health Records and Information Privacy Act 2002;
  2. 2 Whether the conduct was exempted under s 25(b) PPIP Act and equivalent provisions for HPPs;
  3. 3 Whether reasonable security safeguards were implemented;

Ratio Decidendi

Cumberland Council breached IPPs 5, 10, 11, and 12 and HPPs 4, 5, 10, and 11 by disclosing and failing to secure personal, health and restricted information beyond what was reasonably necessary for the preparation of witness evidence, contrary to statutory requirements. The conduct was not excused under litigation exemptions or natural justice. Compensation, apology, performance of privacy principles and further administrative measures were appropriate remedies.

Court Disposition

Application allowed in part; Respondent's internal review set aside; compensation and non-monetary orders made.

Orders

  • Publication of the applicant’s and witnesses’ names or identifying details is prohibited under s 64 CAT Act.
  • Publication (by other than the Applicant) of evidence and submissions filed or served in the proceedings is prohibited under s 64(1)(c) CAT Act.