Freedom of Information Act 1982(Cth)

Privacy Act 1988 (Cth)

Australian Railway Group Pty Ltd v Rowan [2004] WASC 165

B v B [1979] 1 All ER 801

In the Marriage of Barro (1983) 47 ALR 338

Lonrho Ltd v Shell Petroleum Co Ltd (No 2) (1980) 1 WLR 627

Midalco Pty Ltd v Simpson, unreported; FCt SCt of WA; Library No 6747

R v Peters (1886) 16 QBD 636

Royal v Alcoa of Australia Limited [2005] WADC 170

Taylor v Santos Ltd (1998) 71 SASR 434

Theodore v Australian Postal Commission [1998] VR 272

Mulley v Manifold [1959] HCA 23; (1959) 103 CLR 341

1 PRINCIPAL REGISTRAR GETHING: By application filed on 25 October 2005 the defendant seeks an order that the plaintiff file and serve an affidavit within seven days stating whether certain medical records are or have been in her possession, custody or power. The specific records sought are:

(b) Accounts and/or receipts for treatment provided by Dr Will;

(c) Letters from Dr Will concerning the plaintiff's treatment on 23 October 2003;

(d) Reports of diagnostic imaging/testing and/or accounts relating to such imaging/testing; and

(e) Any medical reports, clinical notes, diagnostic imaging/testing and/or accounts relating to the plaintiff's:

(i) longstanding and pre-existing problems in the lumbar spine which required the plaintiff to undergo disk surgery in 1997 and 1980;

(ii) longstanding and pre-existing problems in which the plaintiff fractured both wrists.

(iii) longstanding and pre-existing impingement syndrome in the left shoulder;

(iv) longstanding, pre-existing and symptomatic degenerative disease in the cervical and lumbar spine; and

(v) longstanding and pre-existing patellofemoral disease and midtarsal osteoarthritis.

2 The relevance of the documents is conceded.

3 The plaintiff asserts that the documents sought are in the possession, custody and power of Dr Wills and not her. The plaintiff relies on the decision of the High Court in Breen v Williams (1996) 186 CLR 71 as authority for the proposition that a patient has no legal right, whether based in contract, property, fiduciary duty or equity generally, to access, inspect and/or copy the file maintained by his or her medical practitioner. In particular, the property in the records as chattels is with the medical practitioner (Brennan CJ at 80, Dawson and Toohey JJ at 88, Gaudron and McHugh JJ at 101).

4 The defendant, rightly, concedes that the decision in Breen is authority for the propositions set out above. However, the defendant contends that the plaintiff has "possession, custody or power" over the contents of her medical file pursuant to her rights under the National Privacy Principles ("NPP") contained in the Privacy Act 1988 (Cth). Counsel for the defendant noted that the relevant sections of the Privacy Act relating to the private sector came into operation after the decision in Breen was handed down (being 6 September 1999). The private sector amendments to the Privacy Act became operative from 21 December 2001 (Privacy Amendment (Private Sector) Act 2000 (Cth). In the decision in Breen, Dawson and Toohey JJ (at 99) and Gaudron and McHugh JJ (at 114-115) said that the issue of whether a patient should have a right to access and copy medical records is one for Parliament to address. Counsel for the defendant in this case submitted that Parliament had so addressed the issue in the amendments to Privacy Act.

5 The defendant also relies on the decision of Registrar Wallace in Royal v Alcoa of Australia Limited [2005] WADC 170. In Royal, Registrar Wallace dealt with an application similar to the one made by the defendant in this action. Specific discovery was sought of the plaintiff's medical records held by the medical centre at Alcoa's Kwinana Refinery, where the plaintiff in that case, Mr Royal, was treated, and St John of God Hospital where Mr Royal was admitted on the date of the accident. Registrar Wallace concluded that in light of Mr Royal's rights under the Privacy Act, he had a presently enforceable legal right to obtain inspection of the documents in question. That being so, the learned Registrar concluded that the documents were within Mr Royal's "power" for the purposes of Rules of the Supreme Court ("RSC") O 26 r 1(1), and ordered they be discovered.

6 The plaintiff invites me to decline to follow the decision in Royal.

7 In dealing with this application, two main issues arise. The first is what "rights" in relation to a document are sufficient to say that the document is in the "power" of a party for the purposes of RSC O 26 r 1(1). The second is whether the plaintiff has rights of this character under the Privacy Act, at least as regards Dr Will.

8 Before doing so, one preliminary issue needs to be addressed. The documents set out above appear to fall into two categories:

(a) Documents brought into existence by Dr Will, which, on the authority of Breen, he would own as chattels (for example his clinical notes); and

(b) Documents that were brought into existence by other people, and which as chattels, may well be owned by the plaintiff (for example a report of diagnostic imaging obtained by the plaintiff, paid for by the plaintiff and given by the plaintiff to Dr Will).

9 On the materials I am provided with, I am not able to say anything higher than that there may be some documents in Dr Will's files that, as chattels, are owned by the plaintiff. In this regard, in Breen, Dawson and Toohey JJ comment (at p 88):

"The appellant did not claim ownership of the actual documents comprising her medical records. It is understandable that she did not do so, because they do not include any documents obtained on her behalf and paid for by her, such as x-ray photographs or pathology reports, the ownership of which she may well be able to claim."

10 The consideration of what documents are discoverable begins with RSC O 26 r 1(1). There is an obligation on a party to give discovery "of all documents which are or have been in his possession, custody or power relating to any matter in question" in the action. The words "possession", "custody" and "power" were defined by Dunn J, in B v B [1979] 1 All ER 801, at 805 in the following terms:

"For this purpose 'possession' means, the right to the possession of a document. 'Custody' means the actual, physical or corporeal holding of a document regardless of the right to its possession, for example, a holding of a document by a party as servant or agent of the true owner. 'Power' means, an enforceable right to inspect the document or to obtain possession or control of the document from the person who ordinarily has it in fact. The requirements of the rules are disjunctive in their operation, so far as possession, custody and power are concerned."

11 This formulation was adopted by the Full Court of the Family Court in In the Marriage of Barro (1983) 47 ALR 338, at 345-346.

12 The concept of "power" over a document was considered by the House of Lords in Lonrho Ltd v Shell Petroleum Co Ltd (No 2) (1980) 1 WLR 627 at 635 in the judgment of Lord Diplock (with whom the other members of the House of Lords agreed). Lord Diplock said the following:

"The phrase, as the Court of Appeal pointed out, looks to the present and the past, not to the future. As a first stage in discovery, which is the stage with which the subsidiaries appeal is concerned, it requires a party to provide a list, identifying documents relating to any matter in question in the cause of matter in which discovery is ordered. Identification of documents requires that they must be or have at one time been available to be looked at by the person upon whom the duty lies to provide the list. Such is the case when they are or have been in the possession or custody of that person; and in the context of the phrase 'possession, custody or power' the expression 'power' must, in my view, mean a presently enforceable legal right to obtain from whoever actually holds the document inspection of it without the need to obtain the consent of anyone else. Provided that the right is presently enforceable, the fact that for physical reasons it may not be possible for the person entitled to it to obtain immediate inspection would not prevent the document from being within his power; but in the absence of a presently enforceable right there is, in my view, nothing in Order 24 to compel a party to a cause or matter to take steps that could enable him to acquire one in the future."

13 Lord Diplock's definition was cited with approval by Le Miere J in Australian Railway Group Pty Ltd v Rowan [2004] WASC 165 at par 30 and by Burt CJ and Pidgeon J in Midalco Pty Ltd v Simpson, unreported; FCt SCt of WA; Library No 6747; 5 June 1987. In Midalco, Wallace J dissented, distinguishing the decision in Lonrho. Wallace J would have made an order that the respondent in that case, the plaintiff in an asbestosis claim, provide discovery of certain medical reports which were in the physical custody of Sir Charles Gairdner Hospital.

14 The issue of what constitutes "power" over a document was also considered by the Full Court of the Supreme Court of South Australia in Taylor v Santos Ltd (1998) 71 SASR 434. In that case, the Full Court unanimously held that the defendant did not have "power" over certain documents in the possession and custody of a company that was a wholly owned subsidiary of another company that was itself a wholly owned subsidiary of the defendant. The Court accepted the comments referred to above from Lord Diplock in Lonrho as the starting point in the analysis of the authorities. Doyle CJ (at 437-438) made the following comments that are relevant for present purposes:

"In my opinion the court should be cautious in extending the concept of power beyond the concept of presently enforceable legal right, even though it may be appropriate to do so. Reading r 58 as a whole, my view is that the obligation to discover a document is limited to a document that the person in question has the legal power or (I can think of no better expression) actual and immediate ability to inspect, even though the document is the property of or is held by another person. That power or ability might exist in relation to a document that a person is not able to produce for inspection to a third person, for example a document in which a person has joint property with another person. But, in my opinion, the obligation to discover hinges upon having a right or actual and immediate ability to examine the document. A person does not have that right or actual immediate ability if the person is able to inspect the document only if a third person, who has control of the document, agrees to permit inspection, or agrees to refrain from so exercising that person's control as to prevent inspection. I add, at the risk of speaking too generally, that in considering these issues the court is not concerned with issues of practicality. For example, a document might be in the power of a person in the sense just explained, but be thousands of kilometres away and difficult to get to, or it might be close at hand but stored in a warehouse and very difficult to locate.

The point I wish to emphasise is that to the extent that the concept of power extends beyond a presently enforceable legal right, it should be held to so extend only when the court can say that the person in question does have the actual immediate ability to inspect the document. Otherwise, I consider, the law would place an impossible obligation upon a party."

15 A helpful analogy for present purposes is the question of whether the rights of access to documents provided by Freedom of Information legislation creates sufficient rights in relation to documents to bring the documents into the "power" of a party. This issue was considered by Murphy J in Theodore v Australian Postal Commission [1998] VR 272 in the context of the Freedom of Information Act 1982 (Cth) ("FOI Act"). His Honour held that the rights of the plaintiff in that case did not place documents that may be obtained pursuant to the FOI Act, in the "power" of the plaintiff (at 279). Murphy J commented (at 279):

"Every request for access to documents under the Act is subject to a decision in respect thereof by the responsible Minister or the principal officer of the agency or by some officer appropriately delegated (see s. 23). There is no evidence in the present case as to what the decision might be, and the Act is so circumscribed that I do not think it possible to say that the files referred to would automatically be made available or be copied or that the plaintiff has a presently enforceable right to them."

16 The concept of "power" over a document in RSC O 26 r 1(1) must take its content from the context of O 26 generally. In particular, once a party serves a list of discoverable documents, the party is then obliged by O 26 r 8(1) to allow other parties to inspect the document, ordinarily at the Perth office of the party's solicitor (O 26 r 8(4)). The inspection is to take place within seven days (O 26 r 8(1)). The party making the inspection is entitled to make copies of the documents produced for inspection (O 26 r 8(5)). Thus, the power required over a document seems to necessarily include a power that is sufficient to allow other parties to conveniently and quickly inspect and copy the documents.

17 The question then becomes what power does the plaintiff have over the documents under the Privacy Act. It is to that issue I now turn.

The plaintiff's rights under the Privacy Act

18 I am not provided with precise information about Dr Will's practice as a business. For present purposes, I have made some assumptions. If on the assumptions I have made, it transpires that the plaintiff has sufficient rights in relation to the documents comprising her medical file for those documents to be discoverable, I propose to defer making orders until the assumptions in this decision are tested.

19 For present purposes the starting point in relation to the Privacy Act, is Privacy Act s 13A. That section creates a general rule that an act of an organisation is an interference with the privacy of an individual if, among other things, the act or practice breaches a National Privacy Principle ("NPP") in relation to personal information that relates to a particular individual. By Privacy Act s 6C(1), an "organisation" is defined in the following terms:

that is not a small business operator, a registered political party, an agency, a State or Territory authority or a prescribed instrumentality of a State or Territory."

20 I have assumed that Dr Will's practice falls within one of the types of entity set out in pars (a) to (e) of Privacy Act s 6C(1). However, Privacy Act s 6C(1) immediately raises the issue as to whether or not Dr Will's practice is that of a "small business operator". The concept of a "small business operator" is defined in Privacy Act s 6D in the following terms:

"(1) A business is a small business at a time (the test time) in a financial year (the current year) if its annual turnover for the previous financial year is $3,000,000 or less.

(2) However, if there was no time in the previous financial year when the business was carried on, the business is a small business at the test time only if its annual turnover for the current year is $3,000,000 or less.

(3) A small business operator is an individual, body corporate, partnership, unincorporated association or trust that:

(b) does not carry on a business that is not a small business.

(4) However, an individual body corporate, partnership, unincorporated association or trust is not a small business operator if he, she or it:

(b) provides a health service to another individual and holds any health information except in an employee record; ..."

21 For present purposes, I will assume that Dr Will is involved in a small business. However, it also clearly appears that, if he is, he is providing a "health service to another individual and holds ... health information" other than in an employee record. Health information is defined in Privacy Act s 6 as follows:

(i) the health or a disability (at any time) of an individual; or

(ii) an individual's expressed wishes about the future provision of health services to him or her; or

(iii) a health service provided, or to be provided, to an individual; that is also personal information; or

(b) other personal information collected to provide, or in providing, a health service; or

(c) other personal information about an individual collected in connection with the donation, or intended donation, by the individual of his or her body parts, organs or body substances."

22 Health service means (Privacy Act s 6):

(a) an activity performed in relation to an individual that is intended or claimed (expressly or otherwise) by the individual or the person performing it:

(i) to assess, record, maintain or improve the individual's health; or

(ii) to diagnose the individual's illness or disability; or

(iii) to treat the individual's illness or disability or suspected illness or disability; or

(b) the dispensing on prescription of a drug or medicinal preparation by a pharmacist."

23 It thus appears that Dr Will is subject to the Privacy Act. The question then becomes whether the plaintiff acquires any rights under the NPP that give her sufficient rights over a document on her medical file that she has "power" over the document for the purposes of the RSC O 26. I note that by Privacy Act s 98, the plaintiff would have the right to seek an injunction in the Federal Court or the Federal Magistrates' Court to enforce her rights under the Privacy Act. Thus any rights that she has under the NPP would be enforceable.

24 The NPP are set out in Schedule 3 to the Privacy Act. For present purposes, the relevant NPP is Principle 6 dealing with access to documents. Principle 6 is in the following terms:

"6.1 If an organisation holds personal information about an individual, it must provide the individual with access to the information on request by the individual, except to the extent that:

(a) in the case of personal information other than health information - providing access would pose a serious and imminent threat to the life or health of any individual; or

(b) in the case of health information - providing access would pose a serious threat to the life or health of any individual; or

(c) providing access would have an unreasonable impact upon the privacy of other individuals; or

(d) the request for access is frivolous or vexatious; or

(e) the information relates to existing or anticipated legal proceedings between the organisation and the individual, and the information would not be accessible by the process of discovery in those proceedings; or

(f) providing access would reveal the intentions of the organisation in relation to negotiations with the individual in such a way as to prejudice those negotiations; or

(h) denying access is required or authorised by or under law; or

(i) providing access would be likely to prejudice an investigation of possible unlawful activity; or

(i) the prevention, detection, investigation, prosecution or punishment of criminal offences, breaches of a law imposing a penalty or sanction or breaches of a prescribed law; or

(ii) the enforcement of laws relating to the confiscation of the proceeds of crime; or

(iv) the prevention, detection, investigation or remedying of seriously improper conduct or prescribed conduct; or

(v) the preparation for, or conduct of, proceedings before any court or tribunal, or implementation of its orders;

(k) an enforcement body performing a lawful security function asks the organisation not to provide access to the information on the basis that providing access would be likely to cause damage to the security of Australia.

6.2 However, where providing access would reveal evaluative information generated within the organisation in connection with a commercially sensitive decision-making process, the organisation may give the individual an explanation for the commercially sensitive decision rather than direct access to the information.

Note: An organisation breaches subclause 6.1 if it relies on subclause 6.2 to give an individual an explanation for a commercially sensitive decision in circumstances where subclause 6.2 does not apply.

6.3 If the organisation is not required to provide the individual with access to the information because of one or more of paragraphs 6.1(a) to (k) (inclusive), the organisation must, if reasonable, consider whether the use of mutually agreed intermediaries would allow sufficient access to meet the needs of both parties.

6.4 If an organisation charges for providing access to personal information, those charges:

(b) must not apply to lodging a request for access.

6.5 If an organisation holds personal information about an individual and the individual is able to establish that the information is not accurate, complete and up-to-date, the organisation must take reasonable steps to correct the information so that it is accurate, complete and up-to-date.

6.6 If the individual and the organisation disagree about whether the information is accurate, complete and up-to-date, and the individual asks the organisation to associate with the information a statement claiming that the information is not accurate, complete or up-to-date, the organisation must take reasonable steps to do so.

6.7 An organisation must provide reasons for denial of access or a refusal to correct personal information."

25 It follows that the plaintiff has a presently legally enforceable right of "access" to information held by Dr Will, subject to the exceptions in NPP 6. In particular, the exceptions in NPP 6.1(a) and (b) relate to medical information.

26 The next question is what is meant by the term "access". "Access" is not defined in the Privacy Act. The Court must then look to its meaning in ordinary usage. The court may have regard to a dictionary to ascertain the meaning of a word that is not defined in a particular Act: R v Peters (1886) 16 QBD 636 at 641 per Lord Coleridge; Pearce & Geddes, Statutory Interpretation in Australia, par 3.27 (5th ed, 2001). The Macquarie Dictionary relevantly defines "access" to mean: the act or privilege of coming (fol. by to); admittance; approach: to gain access to a person ...way, means, or opportunity of approach". "Access" in its ordinary meaning does not appear to include the ability to copy or remove that which is accessed.

27 The Office of the Federal Privacy Commissioner has issued a document entitled "Guidelines to the National Privacy Principles", the most recent version being dated September 2001. Under the heading "Key Concepts" on p 21, the following is stated about the concept of "access":

"This involves an organisation giving an individual information about themselves held by the organisation. Giving access may include allowing an individual to inspect personal information or giving a copy of it to them."

28 The following commentary is also included (p 49):

"NPP 6 gives an individual a right of access to all the personal information that an organisation holds about them, although there are some exceptions.

Ways an organisation could give access to an individual would include allowing them to inspect records, take notes or giving them a photocopy or printout.

There are a limited number of situations where an organisation may deny an individual access to the personal information an organisation holds about them. Where such an exception applies to a request for access, an organisation would ordinarily need to give the individual access to the parts of the record that are not exempt."

29 The Privacy Commissioner has also issued a document entitled "Guidelines on Privacy in the Private Health Sector", dated 8 November 2001. Under the heading "A 6 Key Concepts" access is referred to as follows:

"This involves a health service provider giving an individual information about themselves. Access may include inspecting personal information or having a copy of it."

30 The Privacy Commissioner has also issued a document entitled "INFORMATION SHEET 4 - 2001 Access and Correction". Information Sheet 4 contains the following commentary on factors affecting access and ways of giving an individual access to information:

"Factors affecting access

Various factors could affect the way an organisation provides an individual with access. These factors could include:

• the technology available to the individual making the request;

• the respective locations of the organisation and the individual;

• any exceptions that apply to the information requested.

Ways of giving an individual access to information

Examples of the way an organisation could give access include:

• letting the individual inspect all the information the organisation holds about him or her;

• providing a photocopy of the information asked for;

• letting the individual take notes on the content of the record;

• giving the individual a printout of the information if it is in electronic form;

• letting the individual view the information and have a suitably qualified person explain the content;

• giving the individual an accurate summary of the information;

• using any other appropriate method to give the individual access to the data; and

• letting the individual take away copies of this information."

31 The position that is apparent under the interpretive material issued by the Privacy Commissioner is that it is possible for an organisation to comply with NPP 6 by giving an individual access to a document in a form that does not involve the individual actually seeing the document - for example if the individual is given an accurate summary of the information - and in particular in a manner that does not involve the individual being able to copy the document. This interpretive position is of course not binding on the court, though it is instructive in setting the context in which the Privacy Act is to be construed. In any event, the interpretive guidance set out by the Privacy Commissioner is entirely consistent with the ordinary meaning of the word "access" discussed above. As I have already indicated, on its ordinary meaning, it is entirely possible for an individual to have "access" to a document, without the individual having the right to copy the document.

32 As noted above, the power over the document which a party must have in order for it to comply with the obligations flowing from the inclusion of the document in a discovery list include the power to allow other parties to conveniently and quickly inspect the document, and the power to allow another to copy the document. On the analysis that I have set out above, the rights of the plaintiff do not extend this far. There is no right to take copies of the document. Neither does there appear to be a right to allow a third party, namely an opposing party to litigation, to inspect the documents in the hands of the organisation holding them. In the words of Doyle CJ in Taylor, an applicant under the Privacy Act does not have an "actual and immediate ability to inspect" any documents. In this regard, the position under the Privacy Act seems analogous to the position under the FOI Act as considered by Murphy J in Theodore.

33 At the conclusion of the hearing, I raised with counsel the fact that it would be of assistance to have an understanding of the practical implications of an order that a party provide discovery of documents only obtainable through exercise of rights under the Privacy Act. I gave the parties liberty to file and serve affidavit evidence on the position of the Australian Medical Association (AMA) and other like organisations on access to patient records in the light of the NPP. The defendant responded to that information with an affidavit of one Rodney John Carey, a law clerk in the employ of the defendant's solicitors. Mr Carey annexes the AMA Position Statement setting out guidelines for doctors on providing patient access to medical records, as revised in 2002. The relevant parts of the AMA's guidelines are as follows:

"1. Patients have a right to be informed about all personal information held about them by an organisation that provides health services, and they generally have a right to access that information.

2. Where a patient requests a copy of their medical record doctors may suggest that the patient be provided with a copy of a health summary of the factual medical information contained in the medical record. If the patient wishes to access the full medical record (such as opinions contained in reports by specialists), doctors should ensure that such access is not likely to cause serious harm to the patient or any other person before acceding to that request.

3. If the patient persists with a request for access, it is suggested that other appropriate ways of providing the information to the patient are considered and discussed with the patient, such as, for example, the provision of a summary of the information. Doctors should document in the medical record any refusal of, or restriction on access and the reasons for that refusal or restriction.

4. It is recommended that, if in providing access, doctors permit a patient to view and/or copy a medical record concerning themselves, this should take place in the presence of the doctor so that the doctor is able to explain the record to the patient. The doctor may also wish to record any explanations and interpretations and make a copy of these available to the patient. This should avoid any misinterpretation which might occur with unsupervised access."

34 The salient point here is that the AMA itself does not interpret the Privacy Act regime as requiring a doctor to provide a patient with a copy of medical reports concerning him or her in every case.

35 In the light of the analysis set out above, I am of the view that the rights which the plaintiff acquires under the Privacy Act are not sufficient for her to have "power" over the documents in her medical file maintained by Dr Will. Crucially, the nature of her rights under the Privacy Act do not extend to allowing the plaintiff a "right" to take copies of documents. Neither does the regime in the Privacy Act extend to allowing another party in the action to inspect medical reports from her medical file and make copies of documents on that file.

36 The practical effect of this position is likely to be that where a plaintiff is able to obtain copies of her documents either by consent of the medical practitioner or through the patient's rights under the Privacy Act, the copies then become discoverable documents, assuming they are relevant. If the plaintiff is not able to secure copies of the documents on her medical file, or sufficient consensual access by the medical practitioner to allow the documents to be discovered, then the opposing party will need to utilise its right of non-party discovery and subpoenas in order to gain access to the documents.

37 I am conscious that this decision is at odds with that of Registrar Wallace in Royal. However, on the foregoing analysis, I feel bound to come to a different conclusion.

38 I will hear counsel on the question of final orders and costs.