Privacy Case Note 04-2012 (Information Privacy Principle 1)

Case note number: 04/2012

Privacy principles: Information Privacy Principle 1 – Collection of personal information (lawful and fair)

The complaint

The Complainant made a workers compensation claim to WorkCover against their employer. The respondent Agency was the legal representative of WorkCover in the workers compensation claim.

The Agency wrote to the Complainant’s treating doctor and requested information which was relevant to the Complainant’s claim. The Agency obtained the Complainant’s authority for the request.  When the Agency sent the request to the doctor, it enclosed a copy of the authority purportedly from the Complainant. However, the agency had mistakenly sent the authority of another person with the same surname as the Complainant.

Notwithstanding the request being accompanied by the wrong authority, the treating doctor sent the Complainant’s information to the Agency. In the intervening period, a settlement in the WorkCover claim was reached and an agreement was signed in finalisation of the matter. 

The alleged breach of the privacy principles

The Complainant was concerned that their medical records were being unnecessarily held by government.

The Complainant considered that the Agency’s request of the treating doctor was in breach of IPP 1(2) which states that an agency must not collect personal information in a way that is unfair or unlawful. The Complainant alleged that because the request was not accompanied by the proper authority, the collection of personal information was not lawful and therefore a breach of IPP 1.

Jurisdiction

The complaint satisfied all the criteria in section 166 of the Information Privacy Act 2009 (IP Act) for making a privacy complaint to the Office of the Information Commissioner. The Acting Privacy Commissioner accepted the complaint and advised the Complainant and the Agency.

The Complainant raised an additional issue during the course of complaint. At the time the Agency requested the medical records the claim was still open and the records were relevant to its administration.  But because of the timing involved, when the Complainant’s medical records were received by the Agency, the WorkCover claim had been settled and the medical records no longer had any relevance.

The Complainant argued, that the act of receipt was the point of collection and that at the time the Agency ‘collected’ their personal information it no longer served a lawful purpose directly related to a function of the Agency. The Complainant considered that accordingly, the Agency was also in breach of IPP 1(1)(a).

As this issue was only raised once the complaint had reached the Office of the Information Commissioner and the agency had not had an opportunity to respond to it, this issue was not able to be considered during the course of the complaint.

The mediation process

To settle the matter, the Complainant sought that the medical records be returned to the treating doctor, and no copies of the documents be retained by the Agency.

The Agency did not agree that a breach of IPP 1 had occurred because irrespective that the wrong person’s authority was sent to the doctor, the Agency did have the Complainant’s authority to request the records.  Nonetheless, the Agency was prepared to enter into mediation discussions with the Complainant.

In regards to the Complainant’s settlement request, the Agency was of the view that the documents could not be returned because they were required to be retained in accordance with the Public Records Act 2002 (Qld). However, the Agency was prepared to return the documents to the treating doctor provided the Queensland State Archivist approved the return.  Following consultation, the Queensland State Archivist approved the return of the records to the doctor and the complaint was resolved on this basis.