QCAT awards financial compensation for breach of privacy
The Queensland Civil and Administrative Tribunal (QCAT) recently published a decision about a privacy complaint that concerned the collection and disclosure of an individual’s medical records by WorkCover in relation to a workers’ compensation claim.
In PB v WorkCover Pty Ltd (2018] QCAT 138, WorkCover conceded that it breached Information Privacy Principles (IPPs)1, 3 and 11. QCAT added that there had also been breaches of IPPs 2 and 4 and ordered that:
- WorkCover pay the complainant compensation of $5,000; and
- in the event that WorkCover has any of the original medical records, that it return them to the respective medical practices.
This is the second case in the Queensland privacy jurisdiction with an award of financial compensation by QCAT. In RM v Queensland Police Service, QCAT described the Service’s breach as having been ‘careless rather than malicious’ and ordered compensation in the sum of $5,000. In awarding a similar amount of $5,000 in this case, QCAT also characterised WorkCover’s breaches as ‘careless rather than malicious’.
This QCAT decision serves as a timely reminder for agencies to ensure that their privacy collection notices are correct and up to date. Our guideline on collection notices (or, for health agencies – advising individuals when collecting personal information) explains when a collection notice is necessary, what a collection notice needs to contain and how a collection notice may be communicated.
For further advice or assistance, please contact our Enquiries Service on email@example.com or 07 3234 7373.