GSY v Western Sydney Local Health District [2025] NSWCATAD 219;

(1) An organisation that holds health information must ensure that -

(a) the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and

(b) the information is disposed of securely and in accordance with any requirements for the retention and disposal of health information, and

(c) the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and

(d) if it is necessary for the information to be given to a person in connection with the provision of a service to the organisation, everything reasonably within the power of the organisation is done to prevent unauthorised use or disclosure of the information.

1. The internal review concluded that there was no breach of HPP 5.
2. There is no evidence before the Tribunal of the handling of the Applicant's health information in a manner that contravenes HPP 5, subject to one matter.
3. An A5 document containing certain dental records of the Applicant had gone missing. The Respondent had not been able to find it and had determined that it did not, at the time of searches, "exist".
4. The absence of a missing document without any explanation as to why it could not be found in circumstances where it once existed, leaves some unanswered questions. However, the inference I draw is that at some point, it was mislaid or lost.
5. The standard at which documents must be protected under HPP 5 is not one of perfection. A single mislaid or lost document, in circumstances where a large number of folios were found and provided to the Applicant, is not of itself sufficient to allow for a conclusion that the A5 document was handled in a way that resulted in a breach of HPP 5.
6. The Applicant questioned how secure documents kept in paper form were. He said that documents could be kept more securely if they were in digital form. The Applicant specifically objected to the provision of documents to him by post and what he understood as a request from the Respondent to send his identification documents by mail.
7. I do not think that the keeping of documents in paper form, in the circumstances of the case, or the means of sending those documents are matters that compromise the security of the documents or in any other way amount to a breach of HPP 5. There was no evidence before the Tribunal of any actual use, disclosure or other circumstance resulting from the keeping of information in paper form or the means of sending paper documents that resulted in a breach of HPP 5 or any other HPP.
8. The Applicant also alleged breaches of HPP 10 and HPP 11. These HPPs place certain limits on the use and disclosure of information respectively.
9. HPP 10 says that an organisation that holds health information must not use the information for a purpose (a secondary purpose) other than the purpose (the primary purpose) for which it was collected, unless certain exceptions apply.
10. HPP 11 says that an organisation that holds health information must not disclose the information for a purpose (a secondary purpose) other than the purpose (the primary purpose) for which it was collected unless certain exceptions apply.
11. There was nothing in evidence to indicate either any "use" or "disclosure" for an impermissible purpose in breach of HPP 10 or HPP 11. Accordingly, I agree with the Respondent's decision that no such breaches have occurred.

1. The consequences of breaches of HPPs are set out in s 55(2)(a) and (4)(b) of the PPIP Act in the following terms:

(2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders -

(a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct,

(b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice,

(c) an order requiring the performance of an information protection principle or a privacy code of practice,

(d) an order requiring personal information that has been disclosed to be corrected by the public sector agency,

(e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant,

(f) an order requiring the public sector agency not to disclose personal information contained in a public register,

(g) such ancillary orders as the Tribunal thinks appropriate.

......

(4) The Tribunal may make an order under subsection (2) (a) only if -

(a) the application relates to conduct that occurs after the end of the 12 month period following the date on which Division 1 of Part 2 commences, and

(b) the Tribunal is satisfied that the applicant has suffered financial loss, or psychological or physical harm, because of the conduct of the public sector agency.

1. The Applicant claims the maximum amount of damages available under s 55.
2. Before awarding damages under s 55(2)(a), the Tribunal must relevantly be satisfied that the relevant conduct of the Respondent caused the damage or loss claimed by the Applicant. In CPJ v The University of Newcastle [2017] NSWCATAD 350, Hennessy LCM, Deputy President said, at [24]-[25]:

When interpreting the words "by reason of" in EQ and Office of the Australian Information Commissioner (Freedom of information) [2016] AATA 785 at [47] the AAT adopted the following principles relying, to some extent, on the common law principles in March v Stramare (E and MH) Pty Ltd [1991] HCA 12; (1991) 171 CLR 506:

(a) causation is ultimately a question of common sense and experience, determined on the facts of each case;

(b) in law, causation is a question identifying where legal responsibility should lie, rather than examine the cause of event from a scientific or philosophical viewpoint, policy issues and value judgements have a role to play in determining whether, for legal purposes, a circumstance we found to be causative of loss;

(c) a 'but for' analysis is not a sufficient test for causation, although it may be a guide; and

(d) where there are multiple elements, each one sufficient on its own to have caused the loss, the causation test may be considered satisfied by each one of them.

The words "by reason of" in the Commonwealth privacy legislation convey the same meaning as the words "because of" in the NSW statute. Despite my conclusion in FM v Vice Chancellor, Macquarie University [2003] NSWADT 78 at [103], I agree with the AAT summary of the relevant principles and acknowledge that a 'but for' analysis is not a sufficient test for causation.

1. The above observations of the Tribunal on causation are relevant to determination of whether any alleged loss or damage was suffered "because of" the relevant conduct (see CPJ, at [25]). They are also relevant to the determination of whether he has suffered "financial loss, or psychological or physical harm, because of the conduct of the public sector agency" within the meaning of s 55(4)(b).
2. The Applicant said that he had a depressive condition. He said that the Respondent's conduct caused him to suffer exacerbated treatment resistant depression, stress and anxiety. He said that he also experienced frustration. The Respondent, however, said that the Applicant had not shown that the delay in issue caused damage, loss or harm.
3. The consequences of a psychological condition in the context of a compensation claim were set out in the following terms in JD v NSW Department of Health [2007] NSWADT 219, at [57]:

"Thus, the fact that JD may be susceptible to mental illness does not affect any entitlement to compensation he may have. In Rummery, a decision under the Privacy Act 1988 (Cth), the AAT, including the President of the Tribunal, Justice Downes, relied on the decision of the Federal Court in Hall v A & A Sheiban Pty Ltd [1989] FCA 72; (1989) 20 FCR 217, a decision involving the assessment of damages under the Sex Discrimination Act 1984 (Cth). The Federal Court considered that where a complaint is substantiated and loss or damage has been suffered, some form of redress is contemplated. Relevantly, awards should be restrained but not minimal, compensation should be assessed having regard to the complainant's reaction (including injury to feelings, distress and humiliation) and not to the perceived reaction of the majority of the community or of a reasonable person in similar circumstances, and in an appropriate case aggravated damages may be awarded".

1. A pre-existing psychological condition, in other words, should not prevent a claim for compensation where the conduct in issue is found to aggravate that condition.
2. However, the evidence before the Tribunal did not include any medical evidence such as a report from a medical practitioner to support the Applicant's claim for the psychological harm or aggravation of the psychological condition he said he suffered as a result of the Respondent's conduct. The Respondent submitted that the Tribunal should not be satisfied that the Applicant suffered from any such condition or aggravation of a pre-existing condition from the Applicant's assertions alone. The Respondent's submissions have some force.
3. The Applicant, in support of his claim, said that the Respondent's conduct caused him to experience excessive delays in being able to have certain surgery and major dental treatment he needed. If it can be shown that delays in provision of medical information delayed medical treatment, these are circumstances that would carry relevance in establishing that a breach of HPP 7 caused relevant damage, loss or harm to the Applicant.
4. The evidence, however, does not support the proposition that the delays in provision to the Applicant of his medical records were the cause of delays in receiving treatment. The Applicant in his own evidence refers to the postponement of certain surgery following a year on a "waiting list". If the delays in treatment were the result of the time it took to move up a waiting list, these cannot be said to be delays occurring because of the late receipt of health information. Additionally, there was no evidence that the specific information received late had a bearing on delays in the Applicant's medical treatment.
5. The Applicant described other matters that caused him distress and harm, including the events in the Middle East occurring during the last two years and the impact on him of media coverage of these events. I accept the Applicant's evidence. However, this is not distress or harm that can be said to be the result of late receipt of health information.
6. Nevertheless, even if the Applicant did not submit any medical evidence from a medical practitioner to support his assertions and the other matters he relies upon do not show that delays in receiving medical information caused damage, loss or harm to the Applicant, I accept his evidence that he suffered distress from the delay in providing information to him.
7. The Applicant complained about the form in which the information the Applicant sought had been provided. He said that the records were "arranged haphazardly" and thought this was "intentional". He also said that he sought access to the information he wanted in digital form pursuant to s 26 of the HRIP Act.
8. The evidence was that he was granted access to certain information in digital form under the remitted decision. The Respondent however submitted that questions as to the form in which documents were provided was not raised in or subject to the internal review decision and therefore fall outside the scope of these proceedings.
9. To the extent that there are remaining documents provided to the Applicant in digital form and not in paper form (if any), I accept the submission of the Respondent that they are not a matter for determination in these proceedings.

1. I am of the opinion that the distress suffered by the Applicant as a result of the delays in provision of information to him warrants a remedy under s 55(2).
2. What that remedy ought to be must have regard to the circumstances of the matter that are in evidence. Those circumstances include the intentions underlying the Respondent's conduct. I do not find anything in the evidence to indicate that the breach of HPP 7 was the result of intentional wrongdoing. The absence of medical evidence from a medical practitioner establishing a causal link between the breach of HPP 7 and claimed damage, loss or harm suffered by the Applicant is also a relevant circumstance.
3. These are not circumstances, that in my opinion, warrant an award of damages. I accept that damages may, in some cases, be awarded for emotional distress, even if there is no medical evidence in support of the applicant's claim. In CJU v SafeWork NSW [2018] NSWCATAD 300, the Tribunal awarded damages of $1,000 as a result of disclosure of personal information. In AOZ v Rail Corporation NSW (No 2) [2015] NSWCATAP 179, the Tribunal found a breach of HPP 4 dealing with the collection of information. It awarded damages of $4,000 for that breach.
4. I do not think that late provision of some of the health information that the Applicant wanted, where most of that information was provided within a reasonable timeframe, gives rise to a breach of the same order as would the wrongful disclosure of personal information of the kind found in CJU or the collection of health information in a non-compliant way addressed in AOZ. These were breaches that carried a greater degree of fault. A case that involves delays that breached HPP 7 in the provision of some of the information sought by the Applicant that did not involve intentional wrong-doing is not one that, in my opinion, calls for an award of damages.
5. The Respondent had provided an apology to the Applicant for delay after the internal review decision, in its letter of 18 October 2024 providing a copy of the internal review decision. The Respondent offered "sincere apologies if during your dealings with the ROI Team, you felt that you were not treated with respect or dignity". The Respondent also offered its "sincere apologies" for the breach of HPP 7 determined to have occurred by the internal review decision.
6. However, the later information was provided after the apology of 18 October 2024. The Respondent should make a further apology for its breach of HPP 7 because of the delay in providing the later information. An order requiring that apology under s 55(2)(e) of the PPIP Act should be made.

(1) That the Respondent render a formal apology in writing to the Applicant for the distress caused to him by its breach of HPP 7.

(2) Pursuant to s 64(1)(a) and (c) of the Civil and Administrative Tribunal Act 2013 (NSW), the disclosure of the names the Applicant or reference to any information, picture or other material that identifies the Applicant or is likely to lead to the identification of the Applicant is prohibited.

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.