About the blog

This blog is about New South Wales’ privacy laws: the Privacy and Personal Information Protection Act 1998 (NSW) (the PPIP Act) and the Health Records and Information Privacy Act 2002 (NSW) (the HRIP Act).

It contains the opinions of a citizen of NSW (me): whose privacy was violated, who asserted her statutory privacy rights, who remains interested in privacy law, and who does not have a law qualification but can read, write and understand plain English and recognise unfairness when she sees or experiences it.

Interest in privacy law sparked

I was a public sector official (as defined in the PPIP and HRIP Acts) for ten years; I worked in a child care centre that was owned and operated by Lismore City Council (the Council). In my role I handled the most sensitive personal and health information of young children and their families. I did not, however, know that I had obligations or rights under the PPIP and HRIP Acts (because I had never heard of either Act) until the Council and WorkCover (who later became SafeWork) grossly violated my health privacy, which gave me the incentive to find out about privacy law and exercise my rights.

Privacy rights asserted

I made written complaints to the Council and to WorkCover, was dissatisfied with their responses, and lodged review applications with the Administrative Decisions Tribunal (which later became the NSW Civil and Administrative Tribunal) where I represented myself.

Both WorkCover and the Council mishandled my personal and health information when they responded to my privacy complaints/review applications, which complicated matters greatly and caused me to make further complaints and review applications.

I appealed Tribunal Decisions that I considered were wrong to the Tribunal’s Appeal Panel but, due to a lack of resources, did not appeal the Appeal Panel decisions that I considered were wrong to the Court of Appeal.  The Tribunal and Appeal Panel published 13 decisions in my matters.  Some of my rights were vindicated, many were not.

If I sound like a person who can’t accept what the higher ups — the public agencies, solicitors, barristers and judges are saying, well, that’s because I am. I can’t, for example, accept that privacy law permits public agencies to use an individual’s health information against the individual’s interests without the individual’s knowledge or consent, in circumstances where the agency collected the health information in contravention of the Health Privacy Principles which obliged the agency to obtain the individual’s consent, because that conduct is surely the mischief that the HRIP Act was developed to prevent.

And I can’t accept that a person’s express right to a review of the conduct that aggrieved them, and an agencies positive obligation to review its conduct, are abrogated by the person’s failure to do something that the law (section 53 of the PPIP Act) did not require the person to do.

Resolution of privacy complaints

After four and a half years in the Tribunal I agreed to settle my privacy matters.

SafeWork

The SafeWork matters were settled after SafeWork’s upper limit and my bottom line aligned at mediation in April 2017.

Lismore City Council settlement

The first Council privacy matter settled in 2014 with an unfair contract proceeding that I had commenced in the Industrial Court of NSW. The settlement included compensation and a letter of regret from the Council’s General Manager which acknowledged that work place bullying had occurred, regretted the upset the bullying had caused, and wished me well.

I did not settle the remaining privacy matter at this time because the Council was refusing to correct wrong personal information and refusing to dispose of unlawfully retained health information.

The wrong personal information, which strongly implied that I had dishonestly completed my timesheets, was used in a statement that the Council filed in the Tribunal, served on the Privacy Commissioner, and pressed when I asked the Council to correct it.  I believe the dishonesty implication influenced, consciously or subconsciously, the Tribunal’s decision making in the WorkCover matter(s) which were being heard by the same Tribunal member.

The second matter settled in April 2017. I settled under duress because the Tribunal’s unfair processes and its implied condonation of the Council’s despicable conduct made the proceedings oppressive.

The settlement included compensation in excess of the $15 000 open offer that the Council made  in the course of a three day hearing in Lismore in February 2017, the correction of the wrong information that implied I was a dishonest employee, and a letter of regret from the General Manager of the Council. But it did not include the disposal of the unlawfully retained health information.