Australia: When can a disclosure in relation to a healthcare practitioners registration be a breach of privacy? What is a lawful collection?

The hazards of incorrectly redacting a document. What does providing access to personal information "without excess delay or expense" mean? - AIN v Medical Council of New South Wales [2017] NSWCATAP 21, AIN v Medical Council of New South Wales [2017] NSWCATAP 22, and AIN v Medical Council of New South Wales [2017] NSWCATAP 23

In AIN v Medical Council of New South Wales [2017] NSWCATAP 21, AIN v Medical Council of New South Wales [2017] NSWCATAP 22, and AIN v Medical Council of New South Wales [2017] NSWCATAP 23, the registered medical practitioner appealed several decisions made by the New South Wales Civil and Administrative Tribunal (Tribunal) relating to the collection, use and disclosure of her personal information by the predecessor of the Medical Council of NSW, Medical Board of NSW (Medical Council).24 This article examines the interpretation of the Protection of Personal Information Act 1988 (NSW) (Act) by the Appeal Panel of the Tribunal (Appeal Panel). There are similarities between the Act and the Privacy Act 1988 (Cth).

Background

The facts may be brie?y summarised as follows:

  • AIN (a pseudonym) was a registered medical practitioner with general registration. AIN applied for full general registration but her application was refused. There had never been a complaint about AIN's conduct to any medical authority.
  • AIN provided the Medical Council with her personal information to determine whether she was suitable for general registration as a medical practitioner.
  • The Medical Council granted AIN general registration subject to conditions.
  • AIN appealed the Medical Council's decision to the Medical Tribunal. The parties settled the matter by agreeing to orders imposing revised conditions on AIN's general registration. The Medical Tribunal granted a non-publication order which prohibited, amongst other things, the publication of AIN's name.
  • The Medical Council notified the conditions on AIN's general registration to the Australian Health Practitioner Regulation Agency (AHPRA).
  • The Medical Council published the decision on its website (Contravening Publication), however, used the Adobe software to redact references to the name. With some versions of the Adobe Acrobat Reader, AIN's name was displayed whenever the mouse hovered over the redacted lines. Any person with a PDF editing tool was able to remove the blanking in each of the lines so that AIN's name was displayed. The Contravening Publication contained "Re A Practitioner" and the parties were stated to be "A Practitioner" and "Office of the Healthcare Complaints Commission" (the HCCC). The latter party was incorrect. The catchwords referred to the duty of the Medical Council to protect public health and safety. There was no reference in the catchwords section to returning to practice after an extended absence.
  • On googling AIN's name, the Medical Council's decision came up.
  • AIN was concerned that the Contravening Publication gave an incorrect disclosure that conditions were imposed upon her registration due to a HCCC Complaint.

Grounds of Appeal

AIN appealed the Tribunal's decisions regarding various matters including:

  1. the collection of AIN's personal information by the Medical Council;
  2. the use of AIN's personal information by the Medical Council;
  3. the disclosure of the conditions on AIN's general registration by the Medical Council to AHPRA against a non-publication order;
  4. AIN's access to personal information held by the Medical Council, including access "without excessive delay or expense";
  5. the Medical Council's failure to check the accuracy of AIN's personal information before use; and
  6. the Contravening Publication.

Collection of Personal Information

AIN provided the Medical Council with her personal information to determine whether she was suitable for general registration as a medical practitioner. The Medical Council subsequently (after the matter was settled at the Medical Tribunal) acknowledged that AIN had always had the status of general registration and therefore she was not required to make an application for general registration. On this basis, AIN alleged that the Medical Council had contravened section 8(1) of the Act because the Medical Council collected her personal information for an unlawful purpose.

Section 8(1) of the Act states:

A public sector agency must not collect personal information unless:

  1. the information is collected for a lawful purpose that is directly related to a function or activity of the agency, and
  2. the collection of the information is reasonably necessary for that purpose.

The Tribunal adopted the description of "lawful purpose" set out by the Administrative Decisions Tribunal in PN v Department of Education and Training [2009] NSWADT 287 at paragraph 153 and endorsed on appeal in PN v Department of Education and Training [2010] NSWADTAP 59 at paragraph 23:

"Lawful purpose" has been stated to generally mean, a purpose that is not forbidden, rather than positively authorised, by law: NX v Officer of the Director of Public Prosecutions [2015] NSWADT 74 at paragraph 22.

The Tribunal found in favour of the Medical Council and said, whilst the collection of AIN's personal information by the Medical Council was due to a mistaken belief by the Medical Council, it did not detract from its lawfulness.25

The Appeal Panel held that the Tribunal failed to respond to substantial evidence and submissions by AIN that the Medical Board knew that she did not need to re-apply for general registration and that error was a breach of procedural fairness to exercise jurisdiction.26

In addition, the Appeal Panel did not agree with the Tribunal because it failed to consider whether "the collection of the information is reasonably necessary for that purpose". The Appeal Panel said whether the collection of information was reasonably necessary would depend on the evidence of any witnesses on the state of mind of the Medical Council.27 If it was established that the Medical Council knew that AIN did not need to re-apply for general registration but nonetheless collected her information, then the collection by the Medical Council would not be reasonably necessary.

Disclosure of Personal Information

AIN alleged that the Medical Council's disclosure to AHPRA contravened section 18 of the Act because there was a nonpublication order in place. The Tribunal held that the Medical Council did not contravene section 18 of the Act because an exception in section 18 of the Act applied. Section 18 of the Act relevantly provides a public sector agency that holds personal information must not disclose the information to a person unless:

  1. the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure; or
  2. the individual concerned is reasonably likely to have been aware that information of that kind is usually disclosed to that other person.

The Appeal Panel agreed with the Tribunal's decision. The Appeal Panel examined the Medical Practice Act 1992 (now repealed) which allowed the Medical Tribunal to make the non-publication order. It relevantly allowed the Medical Tribunal to direct that:

  1. the name of any witness is not to be disclosed in the proceedings;
  2. the name and address of a registered medical practitioner not to be published.

The Medical Tribunal only had a power to direct that the name of a registered medical practitioner not to be published. It did not have a power to direct that the name of a registered medical not to be disclosed.

The Appeal Panel noted the definition of "publish" in the Macquarie Dictionary referred to "issue to the public" and "to make publicly or generally known.28

Accordingly, the non-publication order did not prohibit the Medical Council's disclosure to AHPRA. The Appeal Panel noting AIN's reason for applying a non-publication order was to prevent the "world at large" being informed of the conditions on her general registration said AIN was aware that the conditions on her general registration would be disclosed to AHPRA.29

Access by AIN

AIN sought access to her personal information held by the Medical Council. The Medical Council initially provided some documents to AIN and informed AIN that it had provided her with all the requested information. AIN challenged the Medical Council's response and later received documents that the Medical Council initially said it did not hold. AIN applied for internal review by the Tribunal complaining the Medical Council's conduct in dealing with her right to access to personal information under section 14 of the Act.

Section 14 of the Act states:

A public sector agency that holds personal information must, at the request of the individual to whom the information relates and without excessive delay or expense, provide the individual with access to the information.

The Tribunal accepted the Medical Council's submission that the complaint should be dismissed because AIN had been provided with the requested information and that any issue relating to delay or expenses in providing AIN with access would go to remedy.

The Appeal Panel did not agree with the Tribunal. The Appeal Panel held that a public sector agency who complies with a request for personal information but failed to do so without excessive delay or expense contravenes section 14 of the Act.30

Accordingly, section 14 of the Act has two limbs:

  1. Whether the request for access to personal information has been complied with; and
  2. Whether the request for access to personal information was provided without excessive delay or expense.

The failure of the Tribunal to determine whether or not access was provided without excessive delay or expense resulted in a failure by the Tribunal to consider a significant part of AIN's case.31

The Contravening Publication - Disclosure

The Medical Council published the decision regarding AIN's application for full registration on its website (Contravening Publication), however, used the Adobe software. With some versions of the Adobe Acrobat Reader, AIN's name was displayed whenever the mouse hovered over the redacted lines. Any person with a PDF editing tool was able to remove the blanking in each of the lines so that AIN's name was displayed. Apparently what you are supposed to do is print out the document as amended by Adobe and scan the redacted version, thereby removing the meta data/data trace.

There was no dispute that the Medical Council had contravened section 18 of the Act.

Section 18 of the Act states:

18 Limits on disclosure of personal information

(1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless:

  1. the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or
  2. the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or
  3. the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person.

(2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it.

Section 16 of the Act states:

A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading. AIN contended that the Contravening Publication did not accurately set out what was agreed.

The grounds of appeal included the duration of the breach of section 18 of the Act, the nature and scope of publication and hence the nature of the breach of section 18, and section 16 and remedies.

The Appeal Panel found, amongst other matters that the Tribunal at first instance had erred in finding that AIN's personal information was "masked from the human eye" based on an error of fact which was unreasonably arrived at and clearly mistaken.

In addition, the Appeal Panel found that the Contravening Publication falsely conveyed that AIN had been the subject of a complaint about her conduct and this was a breach that impacted very adversely on her reputation and caused her significant distress and anxiety.32

The Contravening Publication - Use

AIN alleged that the Medical Council had contravened section 16 of the Act by using her personal information in the Medical Council's creation of the Contravening Publication.

The Appeal Panel acknowledge that there can be an overlap between use and disclosure, however, the Act reveals a legislative intention to identify district stages of the information handling process, ranging from collection, to holding, to access, to use, and to disclosure, with varying agency obligations at each stage.33

The Tribunal found that the Medical Council did not contravene section 16 of the Act on this point because that particular section does not apply to "external disclosure" and there was no "identifiable internal use" of AIN's personal information.34

The Appeal Panel agreed with the Tribunal and referred to AFC v The Sydney Children's Hospital Speciality Network (Randwick and Westmead) [2012] NSWADT 189. In that case, it was held that "writing and dispatching [a] letter should be viewed as one course of conduct that falls to be considered as a disclosure."35

Accordingly, the Medical Council in compiling and disclosing the Medical Tribunal's decision did not contravene section 16 of the Act. The question of the duration of the breach of section 18, relief and costs were remitted for redetermination.

Footnotes

24 AIN v Medical Council of New South Wales [2017] NSWCATAP 21; AIN v Medical Council of New South Wales [2017] NSWCATAP
22; AIN v Medical Council of New South Wales [2017] NSW CATAP 23; and AIN v Medical Council of New South Wales [2017] NSWCATAP 36.

25 AIN v Medical Council of New South Wales [2017] NSWCATAP 22, paragraph 33

26 AIN v Medical Council of New South Wales [2017] NSWCATAP 22, paragraph 38

27 AIN v Medical Council of New South Wales [2017] NSWCATAP 22, paragraphs 39 and 40

28 AIN v Medical Council of New South Wales [2017] NSWCATAP 22, paragraph 79

29 The Appeal Panel also found the exceptions in sections 18(1)(a) and 25(b) applied. The former applied because APHRA had the functions of maintaining the national register of health practitioners and the Medical Council had no reason to believe that AIN would object to the disclosure. The latter applied because section 221 of the Health Practitioner Regulation National Law lawfully authorised the Medical Council not to comply with section 18 of the Act.

30 AIN v Medical Council of New South Wales [2017] NSWCATAP 21, paragraph 24

31 AIN v Medical Council of New South Wales [2017] NSWSCATAP 21, paragraph 44

32 AIN v Medical Council of New South Wales [2017] NSWCATAP 23, paragraph 65.

33 AIN v Medical Council of New South Wales [2017] NSWCATAP 23, paragraph 75

34 AIN v Medical Council of New South Wales [2017] NSWCATAP 23 paragraph 69, In PK v Department of Education and Training [2010] NSWADTAP 59, it was found that section 16 of the Act did not apply to a disclosure of personal information outside the public sector agency ("external disclosure"). In Department of Education and Communities v VK [2011] NSWADTAP 61, it was found that there might be both a use for the purpose of section 16 of the Act (see above) and a disclosure for section 18 in the one sequence of events, but only where there were separate "identifiable internal use" and "identifiable external disclosure" transactions or actions.

35 AIN v Medical Council of New South Wales [2017] NSWCATAP 23, paragraph 81

To print this article, all you need is to be registered on Mondaq.com.

Click to Login as an existing user or Register so you can print this article.

Authors
 
Some comments from our readers…
“The articles are extremely timely and highly applicable”
“I often find critical information not available elsewhere”
“As in-house counsel, Mondaq’s service is of great value”

Related Topics
 
Related Articles
 
Related Video
Up-coming Events Search
Tools
Print
Font Size:
Translation
Channels
Mondaq on Twitter
 
Register for Access and our Free Biweekly Alert for
This service is completely free. Access 250,000 archived articles from 100+ countries and get a personalised email twice a week covering developments (and yes, our lawyers like to think you’ve read our Disclaimer).
 
Email Address
Company Name
Password
Confirm Password
Position
Mondaq Topics -- Select your Interests
 Accounting
 Anti-trust
 Commercial
 Compliance
 Consumer
 Criminal
 Employment
 Energy
 Environment
 Family
 Finance
 Government
 Healthcare
 Immigration
 Insolvency
 Insurance
 International
 IP
 Law Performance
 Law Practice
 Litigation
 Media & IT
 Privacy
 Real Estate
 Strategy
 Tax
 Technology
 Transport
 Wealth Mgt
Regions
Africa
Asia
Asia Pacific
Australasia
Canada
Caribbean
Europe
European Union
Latin America
Middle East
U.K.
United States
Worldwide Updates
Registration (you must scroll down to set your data preferences)

Mondaq Ltd requires you to register and provide information that personally identifies you, including your content preferences, for three primary purposes (full details of Mondaq’s use of your personal data can be found in our Privacy and Cookies Notice):

  • To allow you to personalize the Mondaq websites you are visiting to show content ("Content") relevant to your interests.
  • To enable features such as password reminder, news alerts, email a colleague, and linking from Mondaq (and its affiliate sites) to your website.
  • To produce demographic feedback for our content providers ("Contributors") who contribute Content for free for your use.

Mondaq hopes that our registered users will support us in maintaining our free to view business model by consenting to our use of your personal data as described below.

Mondaq has a "free to view" business model. Our services are paid for by Contributors in exchange for Mondaq providing them with access to information about who accesses their content. Once personal data is transferred to our Contributors they become a data controller of this personal data. They use it to measure the response that their articles are receiving, as a form of market research. They may also use it to provide Mondaq users with information about their products and services.

Details of each Contributor to which your personal data will be transferred is clearly stated within the Content that you access. For full details of how this Contributor will use your personal data, you should review the Contributor’s own Privacy Notice.

Please indicate your preference below:

Yes, I am happy to support Mondaq in maintaining its free to view business model by agreeing to allow Mondaq to share my personal data with Contributors whose Content I access
No, I do not want Mondaq to share my personal data with Contributors

Also please let us know whether you are happy to receive communications promoting products and services offered by Mondaq:

Yes, I am happy to received promotional communications from Mondaq
No, please do not send me promotional communications from Mondaq
Terms & Conditions

Mondaq.com (the Website) is owned and managed by Mondaq Ltd (Mondaq). Mondaq grants you a non-exclusive, revocable licence to access the Website and associated services, such as the Mondaq News Alerts (Services), subject to and in consideration of your compliance with the following terms and conditions of use (Terms). Your use of the Website and/or Services constitutes your agreement to the Terms. Mondaq may terminate your use of the Website and Services if you are in breach of these Terms or if Mondaq decides to terminate the licence granted hereunder for any reason whatsoever.

Use of www.mondaq.com

To Use Mondaq.com you must be: eighteen (18) years old or over; legally capable of entering into binding contracts; and not in any way prohibited by the applicable law to enter into these Terms in the jurisdiction which you are currently located.

You may use the Website as an unregistered user, however, you are required to register as a user if you wish to read the full text of the Content or to receive the Services.

You may not modify, publish, transmit, transfer or sell, reproduce, create derivative works from, distribute, perform, link, display, or in any way exploit any of the Content, in whole or in part, except as expressly permitted in these Terms or with the prior written consent of Mondaq. You may not use electronic or other means to extract details or information from the Content. Nor shall you extract information about users or Contributors in order to offer them any services or products.

In your use of the Website and/or Services you shall: comply with all applicable laws, regulations, directives and legislations which apply to your Use of the Website and/or Services in whatever country you are physically located including without limitation any and all consumer law, export control laws and regulations; provide to us true, correct and accurate information and promptly inform us in the event that any information that you have provided to us changes or becomes inaccurate; notify Mondaq immediately of any circumstances where you have reason to believe that any Intellectual Property Rights or any other rights of any third party may have been infringed; co-operate with reasonable security or other checks or requests for information made by Mondaq from time to time; and at all times be fully liable for the breach of any of these Terms by a third party using your login details to access the Website and/or Services

however, you shall not: do anything likely to impair, interfere with or damage or cause harm or distress to any persons, or the network; do anything that will infringe any Intellectual Property Rights or other rights of Mondaq or any third party; or use the Website, Services and/or Content otherwise than in accordance with these Terms; use any trade marks or service marks of Mondaq or the Contributors, or do anything which may be seen to take unfair advantage of the reputation and goodwill of Mondaq or the Contributors, or the Website, Services and/or Content.

Mondaq reserves the right, in its sole discretion, to take any action that it deems necessary and appropriate in the event it considers that there is a breach or threatened breach of the Terms.

Mondaq’s Rights and Obligations

Unless otherwise expressly set out to the contrary, nothing in these Terms shall serve to transfer from Mondaq to you, any Intellectual Property Rights owned by and/or licensed to Mondaq and all rights, title and interest in and to such Intellectual Property Rights will remain exclusively with Mondaq and/or its licensors.

Mondaq shall use its reasonable endeavours to make the Website and Services available to you at all times, but we cannot guarantee an uninterrupted and fault free service.

Mondaq reserves the right to make changes to the services and/or the Website or part thereof, from time to time, and we may add, remove, modify and/or vary any elements of features and functionalities of the Website or the services.

Mondaq also reserves the right from time to time to monitor your Use of the Website and/or services.

Disclaimer

The Content is general information only. It is not intended to constitute legal advice or seek to be the complete and comprehensive statement of the law, nor is it intended to address your specific requirements or provide advice on which reliance should be placed. Mondaq and/or its Contributors and other suppliers make no representations about the suitability of the information contained in the Content for any purpose. All Content provided "as is" without warranty of any kind. Mondaq and/or its Contributors and other suppliers hereby exclude and disclaim all representations, warranties or guarantees with regard to the Content, including all implied warranties and conditions of merchantability, fitness for a particular purpose, title and non-infringement. To the maximum extent permitted by law, Mondaq expressly excludes all representations, warranties, obligations, and liabilities arising out of or in connection with all Content. In no event shall Mondaq and/or its respective suppliers be liable for any special, indirect or consequential damages or any damages whatsoever resulting from loss of use, data or profits, whether in an action of contract, negligence or other tortious action, arising out of or in connection with the use of the Content or performance of Mondaq’s Services.

General

Mondaq may alter or amend these Terms by amending them on the Website. By continuing to Use the Services and/or the Website after such amendment, you will be deemed to have accepted any amendment to these Terms.

These Terms shall be governed by and construed in accordance with the laws of England and Wales and you irrevocably submit to the exclusive jurisdiction of the courts of England and Wales to settle any dispute which may arise out of or in connection with these Terms. If you live outside the United Kingdom, English law shall apply only to the extent that English law shall not deprive you of any legal protection accorded in accordance with the law of the place where you are habitually resident ("Local Law"). In the event English law deprives you of any legal protection which is accorded to you under Local Law, then these terms shall be governed by Local Law and any dispute or claim arising out of or in connection with these Terms shall be subject to the non-exclusive jurisdiction of the courts where you are habitually resident.

You may print and keep a copy of these Terms, which form the entire agreement between you and Mondaq and supersede any other communications or advertising in respect of the Service and/or the Website.

No delay in exercising or non-exercise by you and/or Mondaq of any of its rights under or in connection with these Terms shall operate as a waiver or release of each of your or Mondaq’s right. Rather, any such waiver or release must be specifically granted in writing signed by the party granting it.

If any part of these Terms is held unenforceable, that part shall be enforced to the maximum extent permissible so as to give effect to the intent of the parties, and the Terms shall continue in full force and effect.

Mondaq shall not incur any liability to you on account of any loss or damage resulting from any delay or failure to perform all or any part of these Terms if such delay or failure is caused, in whole or in part, by events, occurrences, or causes beyond the control of Mondaq. Such events, occurrences or causes will include, without limitation, acts of God, strikes, lockouts, server and network failure, riots, acts of war, earthquakes, fire and explosions.

By clicking Register you state you have read and agree to our Terms and Conditions