In these Reasons for Decision the name of the Applicant has been anonymised so as to preserve the privacy of their personal affairs. The Applicant is referred to as ENY. I have also used the term "executor" in these Reasons for Decision in relation to the Applicant as a gender-neutral term instead of executor or executrix or executor/executrix to avoid identifying the gender of the Applicant.
These proceedings concern the preliminary issue of whether one (i.e. the Applicant in this case) is able, in principle, to apply for the amendment or correction of the personal information and/or health information about a deceased person if they are the executor of that deceased person.
On the evidence and materials before me I have determined that the Applicant, if they are a valid executor of their father's will/estate, is able to apply under the Health Records and Information Privacy Act 2002 (HRIP Act) and/or the Privacy and Personal Information Protection Act 1998 (PPIP Act) to amend or correct the health information and/or personal information, respectively, about their late father held by the Respondent.
[2]
Background
On 21 May 2021 the Applicant filed an application for administrative review by the Tribunal (AR Application). Filing was based on the Respondent's failure within 60 days to undertake an internal review in response to the Applicant's request for an internal review submitted to the Respondent by email dated 8 March 2021 (IR Request), receipt of which was acknowledged by the Respondent by email dated 10 March 2021.
In a letter dated 25 May 2021 the Respondent informed the Applicant that, among other things, the IR Request mentions matters that are not reviewable conduct and that it has declined to accept the IR Request.
On 22 October 2021 the Tribunal issued, in summary and most relevantly, the following Amended Orders (Amended Orders):
2 The Nepean Blue Mountains Local Health District is to file a summary dismissal application by 26 October 2021.
3 The issue of whether the Applicant is able to apply for the amendment, correction (and related issues) of another person's personal and health information to be determined before all other issues raised in the summary dismissal application.
4 The [Respondent] is to file supporting material on the issue referred to in Order 3 … by 5 November 2021.
5 The applicant to file any material in response by 26 November 2021.
6 The issue referred to in Order 3 is to be determined on the papers.
The Respondent filed both the summary dismissal application required by Order 2 and the supporting material on the issue referred to in Order 3 of and as required by Order 4 of the Amended Orders on 8 November 2021 (Respondent Submissions), both of which were filed after the dates set out in the Amended Orders 2 and 4 for filing with the Tribunal.
On 24 November 2021 the Applicant filed its material in response to the Respondent Submissions in accordance with Order 5 of the Amended Orders (Applicant Submissions).
On 1 December 2021 the Respondent requested that the expired timetable for the filing of supporting materials on the issue in Order 3 of the Amended Orders be further amended to allow the Respondent time to file further materials in respect of the issue in Order 3 and for the Applicant to then have time to provide materials in reply to the Respondent's additional materials filed.
On 17 December 2021 the Tribunal denied the Respondent's application and ordered, most relevantly, that:
"(2) After determining the issue raised in Order 3 of the Tribunal's 22 October 2021 Amended Orders the Tribunal will, if required, set a directions hearing to require the next steps as regards submissions and evidence required to address the other issues raised in summary dismissal application and, at that time, make any relevant orders and/or directions."
[3]
Materials before the Tribunal
The Respondent (the applicant in respect of the dismissal application) filed the following material with the Tribunal in relation to the issue in Order 3 of the Amended Orders:
1. application for miscellaneous matters (i.e. summary dismissal application); and
2. the Respondent Submissions, including the Investigation Report under Section 50 of the Privacy Commissioner of the Information & Privacy Commission dated 14 July 2020 (IPC Investigation Report).
The Applicant (the respondent in the dismissal application) filed with the Tribunal the Applicant Submissions.
[4]
The issue before the Tribunal at this time
Pursuant to the Amended Orders the issue before the Tribunal to be considered in these proceedings is whether a person (i.e. the Applicant in this case), if they are a valid executor of a deceased person, is able to exercise the rights relating to personal information and/or health information about that deceased person (i.e. the Applicant's father in this case) under the PPIP Act and/or HRIP Act respectively. That is, in this case, to apply for the amendment or correction of personal information and/or health information about that deceased person held by the Respondent.
Given this is a preliminary matter and the focus of the submissions of the parties was on the issue referred to in Order 3 of the Amended Orders as noted in [13] above, I am only considering that issue at an 'in principle' level in these Reasons for Decision. That is, this decision addresses only whether, in principle, an executor of a deceased person is able to exercise the rights granted under the PPIP Act and/or the HRIP Act in respect of the correction or amendment of the personal information and/or health information about the deceased held by the Respondent. Even if I find in the positive, it will remain for the parties to address and the Tribunal to determine whether the Applicant is a valid executor and to consider and determine the other matters/grounds raised in the Respondent's summary dismissal application, none of which are addressed in these Reasons for Decision.
[5]
Applicable legislation
The definitions of "personal information" in s 4 PPIP Act and s 5 HRIP are identical and are as follows:
(1) …
"personal information" means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. …
(3) Personal information does not include any of the following--
(a) information about an individual who has been dead for more than 30 years, …
The definition of "health information" in s 6 HRIP Act is:
"health information" means--
(a) personal information that is information or an opinion about--
(i) the physical or mental health or a disability (at any time) of an individual, or
(ii) an individual's express wishes about the future provision of health services to him or her, or
(iii) a health services provided, or to be provided, to an individual, or
(b) other personal information collected to provide, or in providing, a health service, or
(c) other personal information about an individual collected in connection with the donation, or intended donation, of an individual's body parts, organs or body substances, or
(d) other personal information that is genetic information about an individual arising from a health service provided to the individual in a form that is or could be predictive of the health (at any time) of the individual or of a genetic relative of the individual, or
(e) healthcare identifiers, …
The HRIP Act sets out 15 Health Privacy Principles (HPPs) in Schedule 1. Amendment of health information is a distinct health privacy principle (HPP 8), most relevantly as set out below:
8 Amendment of health information
(1) An organisation that holds health information must, at the request of the individual to whom the information relates, make appropriate amendments (whether by way of corrections, deletions or additions) to ensure that the health information -
(a) is accurate, and
(b) having regard to the purpose for which the information was collected (or is to be used) and to any purpose that is directly related to that purpose, is relevant, up to date, complete and not misleading.
(2) If an organisation is not prepared to amend health information under subclause (1) in accordance with a request by the individual to whom the information relates, the organisation must, if so requested by the individual concerned, take such steps as are reasonable to attach to the information, in such a manner as is capable of being read with the information, any statement provided by that individual of the amendment sought.
(3) If health information is amended in accordance with this clause, the individual to whom the information relates is entitled, if it is reasonably practicable, to have recipients of that information notified of the amendments made by the organisation.
Section 7 HRIP Act relevantly provides:
7 Capacity
(1) An individual is incapable of doing an act authorised, permitted or required by this Act if the individual is incapable (despite the provision of reasonable assistance by another person) by reason of age, injury, illness, physical or mental impairment of:
(a) understanding the general nature and effect of the act, or
(b) communicating the individual's intentions with respect to the act.
(2) An authorised representative of an individual may do such an act on behalf of an individual who is incapable of doing that act. …
Section 8 HRIP Act relevantly provides:
8 Definition of "authorised representative"
(1) In this Act, authorised representative, in relation to an individual, means:
(a) an attorney for the individual under an enduring power of attorney, or
(b) a guardian within the meaning of the Guardianship Act 1987, or a person responsible within the meaning of Part 5 of that Act, or
(c) a person having parental responsibility for the individual, if the individual is a child, or
(d) a person who is otherwise empowered under law to exercise any functions as an agent of or in the best interests of the individual. …
The equivalent of HPP 8 id Information Privacy Principle (IPP) 8/s 15 PPIP Act is most relevantly as follows
15 Alteration of personal information
(1) A public sector agency that holds personal information must, at the request of the individual to whom the information relates, make appropriate amendments (whether by way of corrections, deletions or additions) to ensure that the personal information -
(a) is accurate, and
(b) having regard to the purpose for which the information was collected (or is to be used) and to any purpose that is directly related to that purpose, is relevant, up to date, complete and not misleading.
(2) If a public sector agency is not prepared to amend personal information in accordance with a request by the individual to whom the information relates, the agency must, if so requested by the individual concerned, take such steps as are reasonable to attach to the information, in such a manner as is capable of being read with the information, any statement provided by that individual of the amendment sought.
(3) If personal information is amended in accordance with this section, the individual to whom the information relates is entitled, if it is reasonably practicable, to have recipients of that information notified of the amendments made by the public sector agency. …
[6]
Respondent Submissions
In the summary dismissal application the Respondent states the grounds for dismissal, in summary and most relevantly to the issue in Order 3, as:
"1 The applicant has no right to review the obligation to amend personal information or health information because [the Applicant] is not "the individual to whom the information relates."
In respect of what personal information and health information is relevant to these proceedings, in summary and most relevantly, the Respondent submitted in the Respondent Submissions that:
1. The personal information and health information in question is that of the Applicant's father, not the Applicant.
2. The IR Request is, on its face, clear that it concerns the personal information and health information of the Applicant's late father only. Also, the document prepared and submitted by the Applicant at the case conference makes it plain that these proceedings only concern the personal information and health information of the Applicant's late father.
In respect of the request for correction of health information under the HRIP Act by the Applicant the Respondent submitted, in summary and most relevantly, in the Respondent Submissions that:
1. The Applicant relies on clause 8 of Schedule 1 to the HRIP Act (i.e. HPP 8 "Amendment of Health Information") but the express qualification "at the request of the individual to whom the information relates" makes it clear that the clause only applies where a living person applies for the amendment of their own health information. As noted, the Applicant is applying to amend another person's health information (i.e. that of their late father).
2. Section 7 HRIP Act does deal expressly with capacity and the ability of others to be appointed as the "authorised representative" to act on behalf of a person where an individual is "incapable of doing an act" but only because of one of a finite list of reasons "age, injury, illness, physical or mental impairment". However, the list does not include death.
3. Section 7 HRIP Act does not apply in the present case and thus the AR Application must be dismissed for that reason where it relates to the health information (and/or personal information) of the Applicant's late father.
4. Even if the analysis in [23(1), (2) and (3)] is incorrect, s 8 HRIP Act provides a definition of an "authorised representative" and, on the information available to the Respondent, the Applicant is not an authorised representative under s 8 HRIP Act.
5. It is not sufficient that the Applicant self-nominate as the "next of kin", s 7 HRIP Act requires that there be a legal authorisation under the specific categories identified in the HRIP Act. The HRIP Act deliberately deals with "immediate family members" differently to those legally authorised to act as a representative of a person.
6. In the IPC Investigation Report the Privacy Commissioner explained, in relation to a similar 'privacy complaint' against the Respondent, that:
"In my view, the HRIP Act does not create a right for an individual to request amendment of a deceased's person's personal or health information. Accordingly, any entitlement to have recipients of information notified of amendments made to information under subclause 3 of HPP 8 would belong to the individual to whom the information relates."
1. The position as regards the HRIP Act is that health information is personal to a particular person and it is not for third parties to have that information amended without that particular person's knowledge or consent.
As regards the Applicant's request to correct personal information under the PPIP Act the Respondent submitted, in summary and most relevantly, in the Respondent Submissions that:
1. The PPIP Act creates an obligation to make amendments to or correct personal information in certain circumstances only "at the request of the individual to whom the information relates" (s 15(1) PPIP Act).
2. There is no mechanism under the PPIP Act by which a third party can apply to correct/amend another person's personal information.
3. The position as regards the PPIP Act is that personal information is personal to a particular person and it is not for third parties to have that information corrected/amended without their knowledge or consent. A common definition of privacy is "the claim of individuals, groups or institutions to determine for themselves when, how and to what extent information about them is communicated to others" (Laws of Australia at [21.11.10]). Further, "information privacy is not concerned with secrecy but rather the ability to control information about oneself and to maintain a zone free from scrutiny by others" (Laws of Australia at [21.11.10]). Thus, it is not for third parties to amend another's personal information.
The Respondent submitted in conclusion, in summary and most relevantly, in the Respondent Submissions that:
1. For the reasons noted in [22], [23] and [24] above, the jurisdiction of the Tribunal is circumscribed. That is, as there is no privacy right for which the Applicant may seek review in the Tribunal the AR Application is misconceived within the meaning of s 55(1)(b) of the Civil & Administrative Tribunal Act 2013 (CAT Act) and should be dismissed under that section.
2. If the Tribunal does not dismiss the application (i.e. the AR Application in this case) on the basis sought in the Respondent's summary dismissal application which is the subject of these proceedings as noted in [16] above, the matter should be re-listed to determine the other bases raised by the Respondent in its summary dismissal application.
[7]
Applicant Submissions
The Applicant generally submitted, in summary and most relevantly, in the Applicant Submissions that:
1. The Respondent did not submit its application for summary dismissal by 26 October 2021 as ordered by the Tribunal. The Respondent Submissions made on 5 November 2021 (also late), as well as the application for summary dismissal, are therefore invalid.
The Respondent claims that "on the information available" to it the Applicant has no authorisation to act on behalf of their deceased father. However, the Respondent was provided by the Applicant with proof of authorisation to act on their father's behalf in 2012. The Applicant informed the Respondent that their mother, who had been executrix, had died and that the Applicant was now executor of both their mother and father and certified copies of both Wills were provided to the Respondent.
1. Both Wills make the Applicant the father's executor and therefore the 'authorised representative' of their father allowing the Applicant to act on behalf of their late father as regards any rights under the HRIP Act and PPIP Act. As such, the Applicant submits that they are therefore entitled to request, as their father's authorised representative, the correction/amendment of certain personal information and/or health information about their late father held by the Respondent.
2. The Respondent has accepted, both in writing and by its actions, that the Applicant has the appropriate authorisation to act on behalf of their late father in relation to his personal/health information by already undertaking to make amendments to and put notifications on such and has corrected some of the 'false material' included in the Respondent's records relating to their father's health information.
3. The Respondent had a chance to undertake an internal review in March 2021 in response to the Applicant's IR Request but failed to do so.
As regards the Respondent's specific submissions, the Applicant submitted, in summary and most relevantly, in the Applicant Submissions that:
1. While the Respondent submitted that a third party cannot make alterations; amendments, or corrections to another person's personal and/or health information (see [18(7)] above), it seems that the Respondent and the relevant hospital can do so with complete impunity as they have made changes to the health information of the Applicant's late father up to 192 times.
2. At every step of the way the Applicant has complied with the Respondent's requests to establish and prove that they are an 'authorised representative' (i.e. executor) of their late father.
3. Section 5.6.1 of the Privacy Manual for Health Information, NSW Ministry of Health 2015, which the Respondent has quoted to the Applicant on several occasions, defines an "authorised representative" as follows, with the final item being relevant in this case:
someone with a power of attorney;
a guardian or enduring guardian;
a person who has parental responsibility for a child;
a person responsible under the Guardianship Act 1987, OR
any other person who is authorised by law to act for or represent the person.
1. The last item in [27(3)] above also comes under s 8(1)(d) HRIP Act as:
● a person who is otherwise empowered under law to exercise any functions as an agent of or in the best interests of the individual;
1. The Applicant is authorised, by law, as the executor of their late father to act for and/or represent their late father and has provided all proof required of that authorisation to the Respondent.
2. The Respondent and its representatives have continually failed to recognise that the IR Request and all subsequent submissions of the Applicant are that the information in question in these proceedings also includes the Applicant's personal information (see [22] above), in addition to the health information about their late father. The Applicant was not asked to provide for the case conference a concise statement of their "privacy complaints" but to provide a concise statement of the allegedly false statements in relation to their deceased father's health information for which the Applicant was seeking correction. The Applicant's personal information is also unequivocally contained in the relevant notes and information detailed by the Applicant.
3. The Applicant has the right to act as agent on behalf of their late father given their role as executor. The Respondent's claims that the Applicant has no right to correct their father's health information is in direct opposition to everything that the Respondent has said, including in writing, and their actions up until this time whereby they have actually made numerous corrections and annotations on the health information of their late father.
4. Of course, the Applicant's late father is not capable of acting on his own behalf (see [23(7)] above) but the Applicant is legally authorised to take charge of his affairs as the executor under the terms of his will.
5. The Respondent's submissions as to "incapable of doing an act" not including death (see [23(2)] above) would lead to the very strange result that a health service provider would be liable for corrections to the health information of a living incapacitated person by an authorised representative but not in respect of a deceased person whose health information nonetheless remains 'health information' under the HRIP Act for up to 30 years after they have died.
In relation to any personal information about their deceased father and the PPIP Act the Applicant submitted, in summary and most relevantly, in the Applicant Submissions that:
1. The Respondent's submission in respect of s 15(1) of the PPIP Act (see [24(1)] above) includes the word "only" as regards the request of the individual to whom the information relates and is not accurate as presented by the Respondent as s 15(1) of the PPIP Act does not use the word "only".
2. As regards the Respondent's submission that the PPIP Act does not create an authorisation exemption like that contained in ss 7 and 8 HRIP Act and thus the conclusion of the Respondent that "there is no mechanism by which a third party can apply to amend another person's personal information under the PPIP Act" (see [24(2)] above), the Applicant submits that they also have requested to correct their own personal information and that they have the appropriate authorisation to act in the place of their late father under the terms of the PPIP Act in respect of personal information about him.
[8]
Consideration and findings
The definitions of 'personal information' in the PPIP Act and HRIP Act and 'health information' in the HRIP Act (i.e. which each have specific rights attaching to them and are subject to specific obligations under the PPIP Act and HRIP Act) include relevant information "about an individual who has been dead" for less than 30 years.
From the wording of s 4(3)(a) PPIP Act and ss 5(3)(a) and 6(a) HRIP Act it is clear that "individual" as used in these definitions and therefore in the PPIP Act and HRIP Act also refers to a 'deceased individual'. The personal information and/or health information about an 'individual' who has been deceased for less than 30 years remains subject to the obligations and retains the rights attaching to that personal information and health information under each of the PPIP Act and HRIP Act respectively.
Therefore s 15 PPIP Act/Information Protection Principle (IPP) 8 (Alteration of personal information) which is triggered by the "request of the individual to whom the information relates" must, in order to be consistent with and not make the definition of personal information redundant, be read as including a request by the legal representative (i.e. executor) of the deceased individual whom the information is about. Otherwise the personal information of an individual deceased for up to 30 years would have rights attached to it and obligations imposed on agencies in respect of it under the PPIP Act with no way of exercising (and no one able to exercise) those rights or enforcing (and no one able to enforce) the obligations.
On the same basis as set out in [31] above, HPP 8 (Amendment of health information) must also be read as including a request of the legal representative of the individual deceased for up to 30 years which the health information is about.
Based on the analysis in [29], [30] and [31] above, in s 7 HRIP Act the phrase "an individual is incapable of doing an act authorised, permitted or required by this Act" must therefore include a deceased individual the health information is about. Thus s 7(2) HRIP Act expressly permits the 'authorised representative' (i.e. executor) of that deceased individual to do such acts (i.e. exercise the rights under the HRIP Act) on behalf of that deceased individual who is incapable of doing that act.
Section 8 HRIP Act defines an "authorised representative" in relation to an individual (i.e. based on the analysis above, including a deceased individual) to include, most relevantly, "a person who is otherwise empowered under law to exercise any functions as an agent" of that deceased individual.
A valid executor of a deceased individual is clearly a person "otherwise empowered under law" to act as an agent of or act on behalf of the deceased individual.
While I believe that the interpretation and analysis of the PPIP Act and HRIP Act noted above is clear, the Respondent specifically cited in its submissions (and below I address each of) both (a) Basten JA's interpretation of 'incapacity' in Hunter Quarries Pty Ltd v Alexandra Maxon as Administrator for the Estate of the Late Ryan Messenger [2018] NSWCA 178 (Hunter Quarries); and (b) principles from The Laws of Australia (Chapter on privacy), in support of its position that an individual under the PIPA Act and HRIP Act must be alive and an authorised representative can only act on behalf of a living incapacitated individual and not a dead individual, even if they are a duly appointed legal representative of that deceased individual.
The issue of whether 'incapacity' included the period before the 'death' of someone who died shortly after a workplace accident in Hunter Quarries was in relation to a workers compensation claim and under a compensation regime that provided separate compensation for (and clear definitions within the relevant Act of) 'incapacity' and 'death' resulting from a workplace accident. This is a very different circumstance to interpreting the rights of the legal representative of a deceased individual (whose information about them remains personal information and/or health information, as relevant, for 30 years after their death) to exercise the rights granted in respect of that personal information and health information about the deceased individual under the PPIP Act and HRIP Act respectively. As noted in [29] and [30] above, the definitions of personal information and health information under the PIPA Act and HRIP Act are clear and contemplate that 'deceased individuals' (through their legal representative) have rights in the personal information and health information about them continuing for up to 30 years after their death.
The definition and words quoted by the Respondent from The Laws of Australia (see [24(3)] above) are not inconsistent with the interpretation and analysis above as regards the application of the PPIP Act and HRIP Act in these proceedings.
In coming to my decision I have also considered DSC v United Protestant Association [2020] NSWCATAD 315 (DSC) in which the Tribunal raised, but did not have to decide, in relation to HPP 7 (Access to health information) whether the HRIP Act covers requests for access to health information about deceased individuals (see paragraph [26] of DSC). In particular, at paragraph [83] DSC:
Despite the absence of a reference to an executor in the definition of 'authorised representative' in s 8(1) of the HRIP Act, the respondent apparently placed reliance on the appointment of executors under the Will in seeking to satisfy itself about DSC's authority to have access. In the circumstances, this was not an unreasonable consideration on the part of the respondent.
And at paragraph [90] DSC:
In circumstances where, although s 8 of the HRIP Act does not include 'executor' in the definition of 'authorised representative', the respondent's decision to rely upon the appointment of an executor under the Will of the deceased as being indicative of authority to access records of the deceased, was a reasonable course of action.
Based on the material before me and the analysis above, I am satisfied that if the Applicant is a valid executor of their father then, as an authorised representative, they are entitled/able to apply to the Respondent for the amendment and/or correction of the personal information and/or health information about their deceased father under the PIPA Act and HRIP Act respectively for up to 30 years after the death of their father.
I find that, in principle, if an applicant is a valid executor/executrix of a deceased individual who has been dead for less than 30 years they are able to apply to an agency under the PPIP Act and/or HRIP Act for the amendment or correction of the personal information and/or health information about that deceased individual.
[9]
Orders
1. Pursuant to s64 of the Civil and Administrative Tribunal Act 2013 the publication of the name of the applicant in these proceedings or reference to any information, picture or other material that identifies that person or is likely to lead to the identification of the person is prohibited.
2. If the applicant is a duly appointed executor or executrix of their late father's Will and the father has been dead for less that 30 years they are, in principle, able to apply to amend personal information and health information about their late father held by the respondent.
3. The parties should seek a date for a directions hearing before the Tribunal in relation to the summary dismissal application proceedings to establish the specific issues (or any limits on the issues) to be addressed by the parties in any written submissions and in any hearing before the Tribunal on whether the applicant is a valid executor/executrix of their father's Will and the rest of the issues raised in the summary dismissal application.
[10]
I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.
Registrar
[11]
Amendments
23 December 2021 - General spelling and grammatical errors corrected pursuant to s63 Civil and Administrative Tribunal Act
DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated.
Decision last updated: 23 December 2021