Privacy Case Note 05-2017 (Accuracy of personal information)
Case note number: 05-17
Privacy principles: Information Privacy Principle 8
The complaint
The complainant was a shift worker employed by a local government (Council). The complainant has a medical condition which is readily managed through the regular taking of medication. This requirement aside, the medical condition does not impact on the complainant’s ability to perform their work for the Council.
In 2015, Council received an allegation about another employee (thethird party), which amongst other claims, stated that the third party had knowingly rostered the complainant on shifts that breached the complainant’s ‘medical restrictions’. The allegation was substantiated and Council subsequently terminated the third party’s employment in early 2016.
In a later visit to their medical practitioner, the complainant learned that Council contacted the medical practitioner in March 2016 to discuss their medical condition.
Preliminary inquiries
The complainant’s initial focus was that Council obtained their medical information without obtaining their consent first. The complainant had also asked Council for a copy of its record of the telephone conversation with the medical practitioner, which Council denied, stating that it did not have authorisation from the medical practitioner to release this information.
We explained that none of the Information Privacy Principles (IPPs) dealing with collection require an agency to obtain an individual’s consent to collect that individual’s personal information. The medical practitioner may have breached the complainant’s privacy by disclosing their medical information to Council without agreement, but an action for this lay against the medical practitioner under the Commonwealth privacy law. We also advised the complainant on the informal and formal options for seeking access to personal information about them held by an agency.
We then looked at the issue of the accuracy of Council’s information about the medical condition and its perceived impact on the complainant’s capacity to perform the required work. The complainant alleged that Council did not have a full understanding of the medical condition and further, some significant misconception on the ‘medical restrictions’ which were not borne out by the complainant’s work history and experience.
It was not in dispute that at no point did Council approach the complainant to affirm or obtain clarification of its perception of the medical condition and its implications for the work. The complainant noted that even when their medical practitioner was contacted, this was well after Council had made decisions and taken actions in reliance of its erroneous view of their medical condition and that the information sought of the practitioner were designed to confirm Council’s view of the ‘medical restrictions’ rather than to get a full view of the condition.
IPP 8
IPP 8 requires that Council must take all reasonable steps to ensure that, having regard to the purpose for which the information is proposed to be used, the information is accurate, complete and up-to-date.
It was not in dispute that Council spoke with the complainant’s medical practitioner in March 2016 in order to understand the complainant’s medical condition and determine whether Council needed to consider any workplace restrictions.
There was a suggestion that Council obtained written information about the complainant’s medical condition in 2014, however those records were no longer able to be found.
IPP 8 does not impose an absolute obligation on an agency to definitively test personal information before use. It does however strongly require an agency to ‘turn its mind’ to whether the information is ‘correct’ before use. The reasonable steps that an agency should take will depend upon circumstances such as the possible adverse consequences for an individual if the accuracy of the personal information is not ensured. More rigorous steps may be required as the risk of adversity increases.
In this case, the view held by Council on the complainant’s capacity to perform the work was at odds with a relatively long history of the complainant successfully performing that work without issue.
The complainant’s position was that this could have been easily addressed by Council approaching them and obtaining information about their medical condition and its actual (limited) impact on work. The complainant also argued that even Council’s eventual telephone call with the medical practitioner occurred well after Council has significantly used the (incorrect) information.
On this basis, we decided that the complaint showed an arguable breach of IPP8 and accepted the complaint for mediation.
Mediation
Council took a consistent position through our administration of this complaint that it had not breached the complainant’s privacy and went to inordinate lengths to argue that its view of the complainant’s medical condition and consequent restrictions were justified. This was despite the fact that there was no medical information supporting its view and that had medical information been sought of either the complainant or their medical practitioner, an opposite view would have prevailed.
Indeed, there was an argument that Council took no steps, reasonable or otherwise to ensure that its view was accurate, complete or up-to-date. The complainant considered that Council’s strenuous defence of its position merely compounded the damage arising from its breach of their privacy.
These positions carried throughout mediation of the complaint and the consequent gaps between the parties’ positions were both wide and unbridgeable. We declared the complaint not amendable to mediation. The complainant subsequently sought referral of the complaint to the Queensland Civil and Administrative Tribunal and is awaiting outcome.