Privacy Case Note 02-2017 (Communication)

Case note number:  02-17

Privacy principles:  National Privacy Principle 2

The complaint

The complainant’s parent was receiving commercial services from a health agency. The arrangement was relatively long-standing and involved regular communication between the complainant and the health agency.

Due to personal circumstances, the communication between the complainant and the health agency became intermittent and then ceased for a period. As a consequence of this lack of communication, the health agency then approached another family member to discuss the delivery of the services.

At this point, the complainant resumed communication with the health agency but was not happy about the alternative approach that had occurred in their absence. The complainant made a privacy complaint to the health agency on behalf of their parent claiming that its discussion of their parent’s affairs with the other family member constituted a breach of the parent’s privacy.

As this matter involved a health agency, the alleged breach was of National Privacy Principle 2 – secondary use and secondary disclosure.

The complainant lodged the privacy complaint with the health agency and received a short acknowledgement but thereafter heard nothing from the agency. Over 10 weeks later, with still no contact from the health agency, the complainant lodged the privacy complaint with this Office.

Once we contacted the health agency it would be another 3 months before it provided us with any significant information about this matter. This is despite, repeated and numerous attempts made by this Office to obtain information.

The health agency provided us with information which explained their actions. The inability to communicate with the complainant was having a significant impact on its delivery of services to the parent and at that time, there was no indication as to if or when the complainant would resume communication with the health agency.

Given that the primary reason for the health agency’s approach to the other relative was ensuring the well-being of the parent, we decided not to accept the privacy complainant on the basis that the circumstances fell within a number of exemptions in NPP 2.

We relayed the health agency’s explanation to the complainant but it was a case of ‘too little, too late’; the health agency’s delay in responding to the complaint damaged the working relationship between it and the complainant, to the point where the complainant arranged to have the services to their parent provided by a different agency.

In this case we determined that there had been no privacy breach. It is often the case that a perception of privacy breach arises from a vacuum. The health agency’s explanation in this matter could have been provided six months earlier – at the time that the complainant resumed contact. Instead it took two complaints – one internal and one to our Office before the explanation was provided and then seemingly reluctantly.

It is regrettable that in a matter that commenced with a ‘breakdown’ of communication from the complainant, that the health agency’s own failure to communicate became the source of grievance.