Administrative Decisions Tribunal New South Wales

• Medium Neutral Citation: NK v Northern Sydney Central Coast Area Health Service (No.2) [2011] NSWADT 81
• Hearing dates: On the papers
• Decision date: 20 April 2011
• Before: Montgomery S - Judicial Member

Decision

1.Pursuant to s 55(2)(a) of the Privacy and Personal Information Protection Act 1997 and s 54(1)(a) of the Health Records and Information Privacy Act 2002, the Respondent is to pay the Applicant compensation totalling $40,000 in respect of breaches of both Acts.

2.The Respondent is to take all necessary steps to ensure that outcomes referred to in paragraphs 12 and 26 of these reasons are achieved.

• Catchwords: Privacy - information protection principle - personal information -Health information - health privacy principle - collection - security - access - accuracy - disclosure - damages
• Legislation Cited: Health Records and Information Privacy Act 2002; Privacy and Personal Information Protection Act 1998; Administrative Decisions Tribunal Act 1997
• Cases Cited: Crewdson v Central Sydney Area Health Service [2000] NSWADT 184; Dell v Dalton (1991) 23 NSWLR 528; GR v Department of Housing [2005] NSWADT 301; Hall v A & A Sheiban Pty Ltd (1989) 20 FCR 217; Hall v Sheiban (1985) ALR 503; HP v Hunter New England Area Health Services [2009] NSWADT 186; Hunter Area Health Service v Marchlewski (2000) 51 NSWLR 268; In Hehir v Smith [2002] QSC 92; JD v NSW Dept of Health [2007] NSWADT 219; JD v NSW Medical Board (No.2) [2006] NSWADT 345; New South Wales v Ibbett [2005] NSWCA 445; NK v Northern Sydney Central Coast Area Health Service [2010] NSWADT 258; NZ v Department of Housing [2006] NSWADT 173; Re: Rummery and Federal Privacy Commissioner [2004] AATA 1221; Spencer v Dowling [1997] 2 VR 127; Sydney Area Health Service v Crewdson (GD) [2001] NSWADTAP 44.; WT v Auburn Council [2007] NSWADT 253; WT v Auburn Council [2008] NSWADTAP 16
• Category: Principal judgment
• Parties: NK (Applicant); Northern Sydney Central Coast Area Health Service (Respondent)
• Representation: Counsel : N Rooney (Respondent); NK (Applicant in person); General Insurance Law Department (Respondent)
• File Number(s): 093130
• Publication restriction: Section 75(2)(b) of the Administrative Decisions Tribunal Act 1997 applies in relation to the identity of the applicant.

REAsons for decision

1 In NK v Northern Sydney Central Coast Area Health Service [2010] NSWADT 258 ("the 2010 NK decision"), I upheld NK's claim that the Northern Sydney Central Coast Area Health Service ("the Respondent") breached NK's privacy by failing to comply with various privacy principles in the Health Records and Information Privacy Act 2002 (" Health Privacy Act ") and the Privacy and Personal Information Protection Act 1998 (" Privacy Act "). The background to this matter are set out in the 2010 NK decision. NK was both an employee and a patient at a hospital ("the Hospital") operated by the Respondent. NK suffers from bi-polar disorder. In August 2008, NK presented at the Hospital seeking medical help in relation to anxiety and stress. At the time he was distressed by thoughts and feelings he was experiencing at that time in relation to his workplace. NK's presenting problem is listed in the Inpatient Admission Form as "forced mania", "patient states due to work situation took self off medications to have deliberate mania at work.. O/E clear thinking man wanting help HX bi polar disorder".

2 The hospital later disclosed his personal and health information contrary to various requirements of the Health Privacy Act and the Privacy Act . Various officers of the Hospital failed to check the accuracy of NK's personal information before using it in various ways that had extremely serious consequences for NK's health and employment. NK was locked out from his workplace on the basis of information that was inaccurate or incomplete. The Human Resources Manager of the Hospital arranged to have NK's electronic ID card blocked so that he could not access the department and also advised that NK should only be on site for medical reasons or to attend matters relating to any investigations. As a result NK felt unable to seek further medical help from the Hospital (which was also his local hospital) for reasons including fear that his personal information would be again used against him. This led to an attempted suicide by NK.

3 The Respondent has emphasised that the actions of its officers were taken in good faith and without malice. It maintains that the actions that it took against NK were taken in a belief that he was a risk to other employees. I do not doubt that the actions of the particular officers were taken in the mistaken belief that NK had threatened a co-worker at the Hospital and that it had some form of duty to take action to prevent the threat. However, had the Hospital complied with its privacy obligations towards NK, as both a patient and an employee, it would not have taken the actions that it did take. Even if its actions were taken in the belief that it was under a duty to take action to prevent a perceived threat of injury to another employee, it should have had regard to the punitive consequences for NK. It should have checked the accuracy of the information it was given by its employees. It should have carefully considered its legal obligations under the Privacy Act and the Health Privacy Act. Clearly, it failed to do so.

4 The Respondent's former Human Resources Manager ("the Human Resources Manager") gave evidence that:

In relation to [NK], I have had cause to indicate to him that he would be unable to return to work until assessed by specialist psychiatric assessment and until receiving appropriate clearance. Such matters are not taken lightly. Whilst I am no longer employed by the Hospital (having retired) my view remains that such requirements were necessary in terms of the Hospital's duty of care to [NK], staff and patients of the Hospital and the public. To the extent that I have provided any information to any persons (including persons connected with the investigation of any of the above issues or related issues) I have always done so within the context of my role and the duty of care owed as described above.

5 While I accept that the Human Resources Manager believed the Hospital acted responsibly, by taking the action that it did it failed to consider its obligations to NK who was also its patient and employee. The Human Resources Manager failed to check the accuracy of the information he was given by a registered nurse of the Hospital ("Nurse W"). Some of that information from the Nurse has been showed to be incorrect. Reasonable checks would have revealed that it was incorrect. NK's health information was inappropriately interfered with, disclosed and used against him, preventing him from working for several years and causing a great deal of stress and uncertainty. No steps were taken to consider the Hospital's obligations in relation to NK's privacy. The Respondent took serious adverse action against NK in reliance on inaccurate information, in breach of the privacy legislation. No steps were taken to check the accuracy of that information.

6 The Respondent maintained that it had acted lawfully, in compliance with the privacy legislation. Alternatively, it also asserted that any breach caused no damage to NK because of NK's existing condition.

7 In its submissions in relation to the issue of damages the Respondent has continued to assert that its officers acted in good faith and that NK has failed to show any damage. In relation to remedies it has relied upon the relatively modest awards of damages made by the Tribunal for breaches of privacy laws in its submissions regarding damages.

8 The evidence does not reveal any demonstration of good faith towards NK. In fact, the manner in which these proceedings have been conducted invites the opposite conclusion: see my comments at paragraph 190 of the 2010 NK decision. I repeat those comments here and note that the manner in which these proceedings have been conducted it has continued to fall short of the Respondent's obligations to act as a model litigant.

9 In the 2010 NK decision I found that the Respondent :

(1) breached Health Privacy Principle ("HPP") 5 (retention and security) by failing to keep NK's health information secure because Nurse W inappropriately accessed his health information and inserted inaccurate information;

(2) breached HPP 3 (collection to be from individual concerned) because Nurse W inappropriately collected NK's health information from a different hospital ("the other Hospital");

(3) breached HPP 4 (individual to be made aware of certain matters) because Nurse W collected NK's health information from the other hospital without informing NK of that fact;

(4) breached HPP 10 (limits on use of health information) because Nurse W inappropriately used NK's health information by disclosing it to the Human Resources Manager without NK's consent, seven days after she saw NK in a distressed state and six days after viewing the most recent medical opinion about NK's mental health ("co-operative, helpful about the future") in the absence of a serious imminent threat to health or welfare;

(5) breached HPP 9 (accuracy) because Nurse W disclosed NK's health information to the Human Resources Manager without taking reasonable steps to check the accuracy of the information she was disclosing and disclosing information that was not relevant, accurate, up to date, complete or misleading;

(6) breached section 17 of the Privacy Act (by using information for a purpose other than that for which it was collected) because NK's supervisor, Ms A, showed NK's letter of resignation (which included complaints of bullying and harassment in the workplace) to those same members of staff NK claimed had engaged in that behaviour;

(7) breached HPP 9 (accuracy) and HPP 10 (limits on use of health information) because the Human Resources Manager did not take any steps to ensure that a memo provided to the Director of Business Units for the Respondent, Ms S, contained information that was relevant, up to date, complete and not misleading by ignoring the most recent medical opinion from a doctor treating NK which contradicted Nurse W's opinions;

(8) breached HPP 10 (limits on use of health information) because the Human Resources used NK's health information for a purpose other than the purpose for which it was collected;

(9) breached section 16 of the Privacy Act (accuracy) because the Human Resources Manager sent an email to Ms S, with copies to four other people in which he reported information received from Ms A or Nurse W without checking its accuracy in a manner that had serious adverse consequences for NK;

(10) breached section 16 of the Privacy Act (accuracy) and HPP 9 (accuracy) by the Human Resources Manager's use of information of unknown origin in a Confidential Report, a Risk Assessment, a Fact-Finding Report and a letter without checking the accuracy of the information;

(11) breached HPP 5 (security) by failing to keep NK's health information secure.

10 NK seeks the following orders from the Tribunal:

(1) An order requiring the Respondent to pay damages for the harm suffered as a result of these contraventions, in the amount of $40,000;

(2) An order requiring the removal of any information which was the subject of the complaint from NK's personnel record and that such information is to be destroyed (including, but not limited to the Risk Assessment, a Memorandum dated 2 September 2008 and information contained in the Fact Finding Report);

(3) An order requiring the Hospital and Respondent to remove any documentation in their possession which contain the information subject to this complaint and that such information be destroyed;

(4) An order requiring the removal of the notes that Nurse W placed on NK's medical file, or in the alternative, an order directing that the letter provided to the Hospital's Medical Records by the other Hospital stating the duration of NK's stay at the other Hospital to be placed on NK's medical file (a letter dated 16 October 2009 was provided to the Hospital Records).

(5) An order directing Nurse W to provide the Tribunal or NK with a list of persons with whom she discussed NK's medical information and the Respondent be required to issue a Letter of Retraction to such persons.

(6) An order directing the removal of NK's other Hospital Medical Records from NK's medical file at the Hospital.

(7) An order directing the removal of NK's other Hospital Medical Records from the Hospital Community Health file.

(8) An order directing the Respondent to provide a written confirmation of the findings of the Tribunal to all those people internal and external to the organisation who were provided with information regarding NK.

(9) An order directing the Respondent to commence investigation into the contravention of Organizational Policies related to the actions of Ms A, Nurse W and Ms S and the Human Resources department of the Hospital for their disregard of policies.

(10) An order directing the Respondent to provide NK with a complete and comprehensive access log history of his Medical File from the date of commencement.

(11) An order directing the Respondent to submit a detailed apology to NK on behalf of its officers, detailing the steps it will be taking to ensure such conduct is not repeated.

(12) An order requiring the Respondent to pay exemplary damages.

11 The Respondent has conceded that some of these orders should be made and agrees to the following orders:

(1) That the letter provided by the other Hospital indicating the duration of NK's stay in that hospital be placed on NK's Hospital medical file.

(2) That Nurse W identify any person(s) not already identified in these proceedings, with whom she discussed the duration of NK's admission to the other Hospital.

(3) That the Respondent notify, in writing, persons involved in these proceedings with written confirmation of the Tribunal's findings.

(4) That NK's medical notes from the other Hospital relating to NK's admission on 26 August 2008 be removed from his Hospital medical file and also from his Hospital Community Health file pursuant to section 21(2)(d) of the State Records Act 1998.

(5) That the Respondent submit a detailed apology to NK detailing steps that it has taken and will take to ensure that such conduct is not repeated.

12 In light of this concession, each of these orders are made.

Orders the Respondent contests

13 The Respondent has submitted that the Tribunal should not make the following orders:

• An order requiring the Hospital to remove any information which was the subject of this complaint from NK's Personnel Record and such information is to be destroyed including (but not limited to - the Risk Assessment, the Memo dated 2 September 2008, any information contained in the Fact Finding Report); and
• An order requiring the Hospital and the Respondent to remove any such documentation (hard and soft copies) in their possession, which contain information the subject of this complaint and such information is to be destroyed.

14 The Respondent submitted that it is prevented from removing such documentation by section 21(1) of the State Records Act 1998. The Respondent is able to remove such records pursuant to section 21(2)(d) if required by a court order. However, the Respondent submits that such removal is not appropriate, because the records form a documentary record of the Respondent's actions. In the alternative, the Respondent submitted that it is prepared to remove the material subject to the complaint from NK's personnel file and create a separate file which could only be accessed by the Area Director of Workforce Services.

15 The Respondent also submitted that the Tribunal should not make the following order:

• An order directing the Respondent to commence investigation into the contravention of organisational policies related to the actions of Ms A, Nurse W and Ms Seeto and the Human Resources Department of the Hospital for disregarding organisational policies, which includes the subject of this complaint.

16 The Respondent submitted that such an order is not appropriate because the Respondent is in the process of undertaking investigations and providing further counselling and education to those involved in the subject matter of these proceedings.

17 In response to the Respondent's submission that it cannot remove the information from NK's personnel file by virtue of section 21(1) of the State Records Act , NK referred to section 15 of the Privacy Act. Section 15 provides:

15 Alteration of personal information

(1) A public sector agency that holds personal information must, at the request of the individual to whom the information relates, make appropriate amendments (whether by way of corrections, deletions or additions) to ensure that the personal information:

(a) is accurate, and

(b) having regard to the purpose for which the information was collected (or is to be used) and to any purpose that is directly related to that purpose, is relevant, up to date, complete and not misleading.

(2) If a public sector agency is not prepared to amend personal information in accordance with a request by the individual to whom the information relates, the agency must, if so requested by the individual concerned, take such steps as are reasonable to attach to the information, in such a manner as is capable of being read with the information, any statement provided by that individual of the amendment sought.

(3) If personal information is amended in accordance with this section, the individual to whom the information relates is entitled, if it is reasonably practicable, to have recipients of that information notified of the amendments made by the public sector agency.

(4) This section, and any provision of a privacy code of practice that relates to the requirements set out in this section, apply to public sector agencies despite section 25 of this Act and section 21 of the State Records Act 1998.

(5) The Privacy Commissioner's guidelines under section 36 may make provision for or with respect to requests under this section, including the way in which such a request should be made and the time within which such a request should be dealt with.

(6) In this section (and in any other provision of this Act in connection with the operation of this section), public sector agency includes a Minister and a Minister's personal staff.

18 Section 25 of the Privacy Act provides:

25 Exemptions where non-compliance is lawfully authorised or required

A public sector agency is not required to comply with section 9, 10, 13, 14, 15, 17, 18 or 19 if:

(a) the agency is lawfully authorised or required not to comply with the principle concerned, or

(b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998).

19 I note that section 21 of the State Records Act provides:

21 Protection measures

(1) A person must not:

(a) abandon or dispose of a State record, or

(b) transfer or offer to transfer, or be a party to arrangements for the transfer of, the possession or ownership of a State record, or

(c) take or send a State record out of New South Wales, or

(d) damage or alter a State record, or

(e) neglect a State record in a way that causes or is likely to cause damage to the State record.

Maximum penalty: 50 penalty units.

(2) None of the following is a contravention of this section:

(a) anything done in accordance with normal administrative practice in a public office (as provided by section 22),

(b) anything that is authorised or required to be done by or under this Act, or by or under a provision of any other Act that is prescribed by the regulations as being an exception to this Part,

(c) anything done by or with the permission of the Aut hority or in accordance with any practice or procedure approved by the Authority either generally or in a particular case or class of cases (including any practice or procedure approved of under any standards and codes of best practice for records managem e nt formulated by the Authority),

(d) anything done pursuant to an order or determination of a court or tribunal,

(e) the disposal, in accordance with a resolution of a House of Parliament, of a State record for which the House is the responsible public o ffice,

(f) anything done for the purpose of placing a record under the control of a public office.

(3) The Authority must not do, or give permission or approval for or with respect to the doing of, anything referred to in subsection (1) except with the a pproval of the Board given either generally or in a particular case or class of cases.

(4) Anything done by a person ( the employee ) at the direction of some other person given in the course of the employee ' s employment is taken for the purposes of this se ction not to have been done by the employee and instead to have been done by that other person.

(5) It is a defence to a prosecution for an offence under this section for the defendant to establish that he or she did not know and had no reasonable cause t o suspect that the record was a State record.

(6) This section prevails over a provision of any other Act enacted before the commencement of this section.

(7) An Act enacted after the commencement of this section is not to be interpreted as prevailing over or otherwise altering the effect or operation of this section except in so far as that Act provides expressly for that Act to have effect despite this s e ction.

20 NK requested that the Tribunal order that the personal and health information contained in the Risk Assessment, Confidential Report and the email/memo from the Human Resources Manager of 2 September 2008 and other documents whose primary function is the dissemination of the personal and health information be removed completely from the Respondent's records and all other documents such as the Fact Finders Report have the inaccurate and defamatory information deleted. NK consents to the Respondent retaining one confidential file which contains all the information, accessible only by NK and a designated senior executive officer of the Respondent as a complete record of what occurred. NK would also like to be able to see the file upon its creation. He would also like the Tribunal's decision or a statement or letter setting out the findings be held within the file.

21 NK referred to orders made in Crewdson v Central Sydney Area Health Service [2000] NSWADT 184, where orders were made for the removal or obliteration of information in the Respondent's record and that the Respondent add, to each of the relevant records, an annotation containing the following words "The Administrative Decisions Tribunal of NSW has determined that some words formerly in this record be removed or obliterated."

22 The first instance decision in Crewdson, a decision under the Freedom of Information Act 1989, was set aside on appeal: Central Sydney Area Health Service v Crewdson (GD) [2001] NSWADTAP 44.

23 In the present case, the Tribunal's powers are set out in section 55 of the Privacy Act and section 54 of the Health Privacy Act . Section 55 relevantly provides:

(1) If a person who has made an application for internal review under section 53 is not satisfied with:

(a) the findings of the review, or

(b) the action taken by the public sector agency in relation to the application,

the person may apply to the Tribunal for a review of the conduct that was the subject of the application under section 53.

(1A) A person (the applicant) who is aggrieved by the conduct of a Minister (or a Minister's personal staff) constituting a contravention of section 15 (Alteration of personal information) may apply to the Tribunal for a review of the conduct.

(2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders:

(a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct,

(b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice,

(c) an order requiring the performance of an information protection principle or a privacy code of practice,

(d) an order requiring personal information that has been disclosed to be corrected by the public sector agency,

(e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant,

(f) an order requiring the public sector agency not to disclose personal information contained in a public register,

(g) such ancillary orders as the Tribunal thinks appropriate.

(3) Nothing in this section limits any other powers that the Tribunal has under Division 3 of Part 3 of Chapter 5 of the Administrative Decisions Tribunal Act 1997.

24 NK also seeks an order directing the Respondent to provide him with a complete and comprehensive access log of his Medical File.

25 With the exception of NK's request that the Tribunal order the conduct of an investigation, I agree that the orders that NK seeks should be made. In my view it is appropriate that the Respondent complete the investigation, counselling and education processes that have been commenced. It is open to NK to pursue the matter elsewhere if he is dissatisfied with the outcome of those processes.

26 In relation to NK's request that the Tribunal should make orders in relation to NK's Personnel Record I agree with the compromise that NK has proposed. This recognises that the records form a documentary record of the Respondent's actions. The Respondent is to remove the material that is the subject of the complaint from NK's personnel file and create a separate file for retention of that material. Any other copies of the material in the Respondent possession are to be either destroyed or transferred to that file. A copy of these reasons is be included in the file. Access to that file is to be restricted to the Area Director of Workforce Services and NK. The Respondent is to notify NK upon creation of the file and he is to be provided a reasonable opportunity to peruse it.

Damages

27 In the 2010 NK decision, I indicated that NK had suffered significant damage as a result of the Respondent's conduct warranting an order for damages. Section 55 of the Privacy Act provides:

(2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders:

(a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct,

(b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice,

(c) an order requiring the performance of an information protection principle or a privacy code of practice,

(d) an order requiring personal information that has been disclosed to be corrected by the public sector agency,

(e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant,

(f) an order requiring the public sector agency not to disclose personal information contained in a public register,

(g) such ancillary orders as the Tribunal thinks appropriate.

(3) Nothing in this section limits any other powers that the Tribunal has under Division 3 of Part 3 of Chapter 5 of the Administrative Decisions Tribunal Act 1997.

(4) The Tribunal may make an order under subsection (2) (a) only if:

(a) the application relates to conduct that occurs after the end of the 12 month period following the date on which Division 1 of Part 2 commences, and

(b) the Tribunal is satisfied that the applicant has suffered financial loss, or psychological or physical harm, because of the conduct of the public sector agency.

28 NK seeks an order requiring the Respondent to pay damages for the harm that he suffered as a result of these contraventions in the amount of $40,000. NK submitted that the Respondent cannot return the 18 months during which he was suspended from duty as a 'threat' due to breaches of his privacy and claims by staff which were not properly investigated. Nor can the Respondent take away the innuendo and rumour he has been forced to endure since his return to employment at the Hospital.

29 NK contends that the magnitude of the contraventions by the Respondent and the significant damage done to his mental health, his reputation and his personal freedom and liberty, warrant an order of damages at the maximum available to him.

30 The Respondent submitted that the principles relating to damages awards under anti-discrimination legislation are of guidance in determining awards for breaches of privacy: NZ v Department of Housing [2006] NSWADT 173 at paragraph [17]-[18]. In NZ at paragraph [25] the Tribunal stated that there is a need:

...for a restrained approach to awards of damages in relation to legislation of the kind that privacy laws represent - a type of human rights measure.

31 The Respondent points to the following decisions in which modest sums were awarded by way of financial compensation for privacy breaches:

• JD v NSW Dept of Health [2007] NSWADT 219 (where $4500 was awarded);
• JD v NSW Medical Health Board (No 2) (where $7500 was awarded);
• Re: Rummery and Federal Privacy Commissioner [2004] AATA 1221 (where $8000 was awarded for a "serious breach" of the Federal Privacy Act ); and
• NZ v Director General, Department of Housing [2006] NSWADT 173 (where $4000 was awarded).

32 The Respondent argues that in the present case a restrained award of damages should be awarded to NK, in line with these earlier decisions.

Exemplary damages

33 NK requests the ADT consider an award of exemplary damages. In NZ v Director General, Department of Housing at paragraph [47], the Tribunal's President accepted that the reaction of NZ to the disclosure was "a heightened or severe one". Having had regard to the various considerations canvassed in Rummery , he awarded NZ compensation of $4,000. He declined to award aggravated damages. The Tribunal said, at par 52:

"The applicant also seeks an award for 'aggravated damages' that involves a form of reproof or chastisement of the Department going beyond that which is effected by the making of an award of damages of the usual kind. This type of award is more usually referred to in tort law as an award of 'exemplary' or 'punitive' damages. Rummery is a good illustration of a case where the conduct of the agency in defence of the claim was so egregious that such an award might well have been made. But the award ultimately made was global, and there was no express reference by the AAT to the inclusion within it of a 'punitive' or 'exemplary' element. I should add that I do not see any difficulty in awarding aggravated or exemplary damages if the case justifies it."

34 The Tribunal's comments in NZ were obiter and no award of exemplary damages has been made in relation to privacy legislation.

35 The power to award damages in section 55 of the Privacy Act is limited to damages "by way of compensation for any loss or damage suffered because of the conduct". Damages "by way of compensation" include general damages and aggravated damages: Re Rummery and Federal Privacy Commissioner (2004) 85 ALD 368; Hall v A & A Sheiban Pty Ltd (1989) 20 FCR 217.

36 In Hall , Lockhart J said at 239-40:

The terms "compensation for any loss or damage" in s 81(1)(b)(iv) do not themselves restrict the scope of the damages which the Commission may determine should be paid to the complainant, since the categories of loss or damage will include such loss as the common law would recognise. The fact that s 81(1)(b)(iv) refers to damages by way of compensation would seem, however, to exclude the award of exemplary damages if such damages are properly characterised as punitive and not compensatory.

English authority supports the award of aggravated damages in discrimination cases in appropriate circumstances. In Alexander v Home Office (supra), May LJ (with whom Ewbank J agreed) observed that in cases of racial discrimination aggravated damages might be awarded where the defendant had behaved high-handedly, maliciously, insultingly or oppressively in committing the act of discrimination (at 975).

Assuming that the principles of tort are properly applicable to the assessment of damages by way of compensation for loss or damage suffered by the complainant under s 81(1)(b)(iv), then it is useful to refer to the circumstances in which aggravated damages are available in the Australian law of torts. It is fundamental that an award of a larger amount of damages by way of aggravated damages serves to compensate the victim for damage occasioned by the defendant's conduct where an element of aggravation is involved in that conduct, and not to punish the defendant: Bickel v John Fairfax & Sons Pty Ltd [1981] 2 NSWLR 474, per Hunt J (at 496); Taylor v Beere [1982] 1 NZLR 81, per Somers JA (at 93); F A Trindade and P Cane, Law of Torts in Australia (1985), p 242. In Lamb v Cotogno (1987) 164 CLR 1 at 8, the High Court observed in a joint judgment that "[a]ggravated damages, in contrast to exemplary damages, are compensatory in nature, being awarded for injury to the plaintiff's feelings caused by insult, humiliation and the like".

In so far as such damages offer compensation to the plaintiff, reflecting a recognition of the nature of the defendant's conduct and of its consequences for the plaintiff, then they appear to fall properly within the scope of s 81(1)(b)(iv) of the Act. Also, the circumstances in which the defendant's conduct takes place may themselves give rise to an element of aggravation. Sexual harassment in contravention of s 28 of the Act, occurring within the relationship of employer and employee where the employer has power or authority over the employee and commonly has an ability to adversely affect the interests of the employee, would by its nature appear to involve an element of aggravation so as to give rise to the possibility of aggravated damages.

37 In Rummery the Tribunal said:

[31] In Hall v A & A Sheiban Pty Ltd (1989) 20 FCR 217 ; 85 ALR 503 (Hall), the Federal Court gave detailed consideration to the determination of the entitlement to compensation, and the assessment of that compensation, under s 81 of the Sex Discrimination Act . We are of the view that these principles are applicable to the issues we have to decide in relation to s 52 of the Privacy Act .

[32] The principles which are relevant to this matter are:

(a) where a complaint is substantiated and loss or damage is suffered, the legislation contemplates some form of redress in the ordinary course;

(b) awards should be restrained but not minimal;

(c) in measuring compensation the principles of damages applied in tort law will assist, although the ultimate guide is the words of the statute;

(d) in an appropriate case, aggravated damages may be awarded;

(e) compensation should be assessed having regard to the complainant's reaction and not to the perceived reaction of the majority of the community or of a reasonable person in similar circumstances.

38 These authorities suggest that aggravated damages are compensatory and therefore permissible whereas exemplary damages are punitive and not compensatory. However the distinction between aggravated and punitive damages is difficult to draw. In New South Wales v Ibbett [2005] NSWCA 445 at paragraph [83], Spigelman CJ referred to the distinction between aggravated and exemplary damages in the following manner:

In this regard it is relevant to note that the matters to which I have referred as justifying an award of exemplary damages are also pertinent, as is often the case, to an award of aggravated damages. The difference is that in the case of aggravated damages the assessment is made from the point of view of the Plaintiff and in the case of exemplary damages the focus is on the conduct of the Defendant. Nevertheless, it is necessary, as I have noted above, to determine both heads of compensatory damages before deciding whether or not the quantum is such that a further award is necessary to serve the objectives of punishment or deterrence or, if it be a separate purpose, condemnation .

39 In Hehir v Smith [2002] QSC 92, Wilson J found that the Tribunal had erred in awarding aggravated damages because despite the Tribunal's reference to causing the Respondent "the extended stress of these hearings" these were findings of reprehensible conduct which might perhaps have warranted punishment, rather than findings of the infliction of hurt, insult and humiliation: at paragraph [42]. Wilson J said at paragraph [41]:

...Of course, aggravated damages may serve some punitive and deterrent functions at the same time as providing compensation: see Hunter Area Health Service v Marchlewski (2000) 51 NSWLR 268 at 285. As Mason P observed in Marchlewski , aggravated damages have been awarded in a range of torts including defamation, intimidation, trespass to the person and malicious prosecution, although it is unclear whether they may be awarded in a negligence action. It is arguable that an award of aggravated damages in anti-discrimination proceedings could amount to double compensation, since general damages are customarily awarded for such damage as humiliation and insult. However, the point was not argued before me, and so I have made no determination in relation to it.

40 In Spencer v Dowling [1997] 2 VR 127, Winneke P and Callaway JA held that damages under the Equal Opportunity Act must be compensatory rather than punitive in nature. Because damages under that Act would often comprehend an award for hurt, humiliation and injured feelings, such compensation might be aggravated where the conduct had been high-handed, malicious and oppressive and calculated to increase the hurt suffered by the complainant.

Compensatory Damages

41 In HP v Hunter New England Area Health Services [2009] NSWADT 186, the Tribunal set out the principles the Tribunal has developed with respect to damages awards in privacy cases:

41 The Tribunal has considered the question of compensation under the PPIP Act on a number of occasions: see WT v Auburn Council [2008] NSWADTAP 16, FM and FN v Department of Community Services [2008] NSWADT 288, JD v NSW Medical Board (No.2) [2006] NSWADT 345 ; NW v NSW Fire Brigade (No.2) [2006] NSWADT 61 , NZ v Director General Department of Housing [2006] NSWADT 173; GR v Department of Housing (No.2) [2005] NSWADT 301 and RD v Department of Education and Training [2005] NSWADT 195 . Cited with approval in some of these decisions is the decision of the Commonwealth Administrative Appeals Tribunal in Re Rummery & The Federal Privacy Commissioner & Anor [2004] AATA 1221.

42 The principles set out in the abovementioned decisions and which are relevant to this applicant are:

(a) that damages are compensatory in that the applicant should be awarded such sums of money so as that he/she may be restored to the position that he/she would have been in but for the breach: see GR (supra) at [26] and Rummery (supra) at [32]. However, this must also be viewed in the context of the $40,000 limit as provided for in the PPIP Act;

(b) in measuring compensation the principles of damages as apply in tort law are a guidance but the ultimate guide is the wording of the PPIP Act and its objectives: see NW (supra) at [22];

(c) compensation should be assessed having regard to the complainant's reaction and not to the perceived reaction of the majority of the community or of a reasonable person in similar circumstances: see Rummery (supra) at [46] as adopted in NZ (supra) at [35];

(d) 'psychological harm' in s.55(4) of the PPIP Act is intended to encompass situations where an individual suffered some impairment of the mental states and processes. These being conditions such as depression and anxiety: see JD v NSW Medical Board (No. 2) at [53]; and

(e) even where an applicant is able to substantiate loss or damage as a result of conduct that contravenes an 'information principle' under the PPIP Act, an award of damages under that Act remains a discretionary one: see NW (supra) at [23] and [24] and cf. Re Rummery (supra) at [32].

43 However, compensation for alleged financial loss and alleged psychological and physical harm can only be considered where the Tribunal finds that the alleged loss and harm was 'because of' or 'caused by' the contravening conduct of the Respondent : see paragraph 55(4)(b) above.

42 In WT v Auburn Council [2007] NSWADT 253 (upheld by the Appeal Panel in WT v Auburn Council [2008] NSWADTAP 16), the Tribunal said:

37 As mentioned above, the general principles in regard to the quantum of damages, is that they are compensatory in that the applicant be awarded such sums of money so that he may be restored to the position that he would have been in, but for the Respondent's contravention. However, in the case of damages under the PPIP Act regard is to be had to the upper limit that may be awarded.

38 The applicant's in GR v Department of Housing (No.2) (supra) and JD v NSW Medical Board (No 2) (supra) each made a claim for psychological damage as a result of a breach of the respective Respondent public sector agencies. In GR , and in JD the tribunal awarded an amount of $7,500 in damages. In a recent decision of Acting Deputy President R Handley in JD v NSW Department of Health [2007] NSWADT 219 the tribunal made an order for damages for the sum of $4,500 in respect to psychological harm suffered by JD as a result of a contravention of s.18 of the PPIP Act by the Respondent Department.

39 While each application must be considered in light of its own facts, in my opinion the abovementioned decisions provide some guidance.

40 In this application, having regard to the impact the disclosure has had on the applicant, the fact that the applicant has had to pay additional amounts for his medication and the upper limit of damages that the tribunal is able to award, I consider an amount of $5,000 is the appropriate amount of damages in the circumstances.

43 In JD v NSW Department of Health [2007] NSWADT 219, the Tribunal said:

59 Turning to what would constitute an appropriate award in JD's case, I am satisfied that JD did suffer psychological harm as a result of the disclosure, although there is a lack of evidence as the exact nature of that harm, and the extent of the additional harm over and above that for which JD was compensated in JD (No 2). However, I accept that JD felt "psychologically demonised, stigmatised and vilified" by the disclosure of the information to the Medical Board. Taking into account the considerations identified in Rummery and NZ , discussed above, and noting the lack of any detailed evidence as to the psychological harm suffered by JD as a result of the disclosure, in my view an appropriate award of compensation is $4,500. This encompasses the breaches under both the PPIP Act and the HRIP Act, since all the breaches relate to the same act - the disclosure of personal information to the NSW Medical Board.

60 There is no evidence before me to suggest that the disclosure was malicious as JD contends. I note that at the commencement of these proceedings, the Department conceded the breach of s 18 of the PPIP Act and offered JD an apology and compensation of $500. While such an amount of compensation is in my view inadequate, nevertheless, the Department's conduct in these proceedings has been conciliatory and I can see no justification for an award of aggravated damages.

44 In JD v NSW Medical Board (No.2) [2006] NSWADT 345, I said the following, in relation to damages after finding that the Board has contravened sections 18(1) and 19(1) of the Privacy Act in disclosing JD's personal information:

72 In determining the amount of the award I have already taken account of all the factors that have been raised by the parties, including the special impact of the disclosure on JD and the fact that several more senior psychiatrists have disagreed with the opinion expressed by Dr Samuels that was contained in the report forwarded to the PSB, and I have had regard to the various considerations canvassed in Rummery. In my view, an appropriate award for the financial loss and psychological harm caused to JD by the conduct of the Board is $7,500.

45 Earlier in that decision I said:

51 The Macquarie Dictionary Fourth edition Macquarie University NSW 2005 defines the relevant terms:

" harm " is defined as "injury; damage; hurt".

" damage " is defined as "injury or harm that impairs value or usefulness".

" injury " is defined as "wrong or injustice done or suffered" and "the infringement of a right".

" psychological " is defined as "of or relating to psychology" and "relating to the mind or to mental phenomena, especially as the subject matter of psychology".

" psychology " is defined as "the systematic study of the mind, or of mental states and processes; the study of human nature" and "the mental states and processes of a person or of a number of persons, especially as determining action".

52 JD has referred me to the NSW Court of Appeal decision in R v P [2001] NSWCA 473 where various provisions the Evidence Act 1995 were considered. Section 126A(1) provides that for the purposes of Division 1A - Professional confidential relationship privilege, "harm" includes actual physical bodily harm, financial loss, stress or shock, damage to reputation or emotional or psychological harm (such as shame, humiliation and fear). While I note that the definition is consistent with the Macquarie Dictionary definition, I do not consider that the definition in section 126A(1) of the Evidence Act 1995 is relevant to these proceedings.

53 The authorities suggest that the use of the expression 'psychological harm' in section 55(4) of the Privacy Act is intended to encompass a situation where an individual suffers some impairment of their mental states and processes. In this matter, JD has suffered from depression and anxiety. In my view, depression and anxiety fall within the scope of the expression.

54 It is therefore necessary to determine whether JD has suffered that 'psychological harm' because of the Board's conduct and if so whether an award of damages is warranted. It is also necessary to determine whether JD has suffered financial loss because of the Board's conduct and if so whether an award of damages is warranted for that loss.

Consideration

46 Section 55 of the Privacy Act and section 54 of the Health Privacy Act are in substantially the same terms.

47 Section 55(4)(b) of the Privacy Act restricts the Tribunal's ability to make damages orders under section 55(2)(a) to cases where the applicant has suffered financial loss, or psychological or physical harm. In addition, a damages order under section 55(2)(a) is conditioned upon an applicant showing that the harm suffered by an was "because of" the conduct of the agency. In the present case, NK seeks an award of damages for the psychological harm caused by the Respondent's conduct.

48 In the 2010 NK decision, after finding that the Respondent breached various HPPs and IPPs, I said:

188 As will be apparent from the discussion above, it is my view that the Respondent has acted in contravention of a number of HPPs and IPPs. On the evidence before me I am satisfied that NK has suffered significant loss or damage because of the Respondent's conduct.

189 I do not accept that NK's psychiatric condition cannot be attributed to the Respondent's conduct. In this regard I accept Dr Jenneke's evidence in regard to the state of NK's health prior to becoming aware of the conduct and in my view there is no question that the consequences of the conduct have been significant. That is the case nothwithstanding NK's existing condition and the other stressors affecting him.

190 The consequences have been exacerbated by the manner in which the Respondent has responded to his complaint both at the internal review stage and at the external review stage. At no stage of the process does the Respondent's response do it any credit. In my view it has fallen far short of its obligations to act as a model litigant. In regard to the standards of a 'model litigant' see the discussion in the Court of Appeal's judgment in Mahenthirarasa v SRA (No 2) (2008) 72 NSWLR 273; [2008] NSWCA 201.

191 In my view, an order that the Respondent is to pay NK damages is warranted. I also agree that other orders should be made in regard to NK's personal records.

49 I have referred above to the Respondent's assertion that the actions of its officers were taken in good faith and without malice, in a belief that he was a risk to other employees. However, I have also indicated the manner in which I consider that the Respondent has failed to comply with its privacy obligations towards NK as both a patient and an employee.

50 Until the 2010 NK decision the Respondent maintained that it had acted in compliance with its privacy obligations. It also asserted alternatively that any breach caused no damage to NK because NK already suffered from bi-polar.

51 In its damages submissions the Respondent has continued to assert that its officers acted in good faith and that NK has failed to show any damage. This is so in spite of the 2010 NK decision where I found a multiplicity of contraventions of NK's privacy, the finding that that NK has suffered "significant damage" that was attributable to the Respondent's conduct notwithstanding his existing condition (at paragraph [189]), and my finding that (at paragraph [190]) that

190 The consequences have been exacerbated by the manner in which the Respondent has responded to his complaint both at the internal review stage and at the external review stage. At no stage of the process does the Respondent's response do it any credit. In my view it has fallen far short of its obligations to act as a model litigant. In regard to the standards of a 'model litigant' see the discussion in the Court of Appeal's judgment in Mahenthirarasa v SRA (No 2) (2008) 72 NSWLR 273; [2008] NSWCA 201.

52 I note the Respondent has relied upon the relatively modest awards of damages made by the Tribunal for breaches of privacy laws to claim that NK should similarly receive only a small award of damages. However, none of those cases involved such a significant number of contraventions. The present case is also very different to those cases, because Dr Jenneke (whose evidence I have already accepted) has given very clear evidence of the damage NK has experienced as a result of the Respondent's conduct. None of those cases led to a suicide attempt by an applicant which happened as a direct consequence of the Respondent's conduct. I accept both NK and Dr Jennekes' evidence in this respect.

53 I refer in this regard to the decision in Rummery where the AAT held at paragraph [46] that "it is an applicant's account of his or her reaction to a breach of the legislation or the privacy legislation) which should guide the assessment of damages."

54 NK responded to the Respondent's submission by contending that the diversity and multitude of breaches and the significant psychological harm he has suffered, warrants a more significant award of damages. NK's case is supported by documentary evidence, statements and testimony, including that of his treating psychiatrist, Dr Jenneke, Dr Jenneke was consulted after NK's privacy was breached (although he had treated NK in the past).

55 In HP v Hunter New England Area Health Services [2009] NSWADT 186, the applicant claimed damages for the loss of trust in professionals she experienced. In that case she had no further dealings with the person who breached her privacy or the Hospital to which she was attached. The Respondent immediately took steps to remind staff of its privacy policy and the importance of retaining the confidentiality of personal information about patients and their family. The Tribunal said:

46 There is no evidence that because of the loss of alleged trust, HP has not sought assistance from other health professionals as and when she needed to. It is also noted that she remained with her general practitioner. Accordingly, I am not satisfied that HP suffered any measurable loss or damage as a result of her loss of trust.

56 This is in contradistinction to the present case, where NK had such a severe fear of seeking medical assistance for his distress which arose as a consequence of the Respondent's breach of his privacy that he attempted suicide.

57 The reaction NK experienced to the breach is not to be judged according to objective standards. If the Tribunal is of the view that there is a causal connection between an agency's conduct and an applicant's psychological damage, it is "not to the point that the applicant was particularly fragile, vulnerable or even that he was pre-disposed to injury of this kind": GR v Department of Housing [2005] NSWADT 301 at paragraph [23].

I agree with the applicant's submission that in awarding damages, the Tribunal should be guided by the impact on the applicant, a spectrum of events that eventuated as a result of a formal complaint on 26 August, relating to bullying and harassment within his workplace. In particular, the imposition of a 14 month exclusion from the applicant's workplace had a devastating impact upon the applicant, which almost led to him taking his own life.

58 The task of assessing damages for non-economic loss is notoriously difficult. This case is one in which the loss is intangible and difficult to measure. As acknowledged by Wilcox J in Hall v Sheiban (1985) ALR 503 at 543, the task of determining the appropriate level of damages in a case of unlawful discrimination is difficult:

....damages for such matters as injury to feelings, distress, humiliation and the effect on the complainant's relationships with other people are not susceptible to mathematical calculation...To ignore such items of damage simply because of the impossibility of demonstrating the correctness of any particular figure would be to visit an injustice upon the complainant by failing to grant relief in respect of a proved item of damage.

59 In Dell v Dalton (1991) 23 NSWLR 528, Handley JA (with whom Kirby P and Priestley JA agreed) said (at 533) that the assessment of non-economic loss involves 'questions of fact and degree, and matters of opinion, impression, speculation and estimation, calling for the exercise of commonsense and judgment'.

60 In my view, the Respondent's conduct amounted to an oppressive disregard of NK's rights and its own privacy duties. It has not only breached the privacy legislation, but punished NK for its own breaches, based on inaccurate information and without checking its validity. As both a patient and an employee, NK was in a position of vulnerability. The hospital has continued to deny that NK has experienced any damage in circumstances where findings have already been made against it.

It is my view that NK is entitled to the maximum amount that can be awarded under the applicable legislation . He is entitled to compensatory damages as a step towards restoring him to the position that he would have been in but for the breaches.

61 However, I also note my view NK can never be adequately compensated for the loss that he has suffered. I encourage the Respondent to consider other options that may be available to it to provide additional support to NK in that regard.

62 It is my view that the maximum amount that can be awarded to NK in this matter is $40,000. The Respondent is to pay that amount to NK.

63 In the circumstances, it is not necessary that I determine issues in relation to exemplary and aggravated damages as the amount that can be awarded is restricted to an amount that is lower than what might have otherwise been awarded.

Orders

1. Pursuant to s 55(2)(a) of the Privacy and Personal Information Protection Act 1997 and s 54(1)(a) of the Health Records and Information Privacy Act 2002, the Respondent is to pay the Applicant compensation totalling $40,000 in respect of breaches of both Acts.

2. The Respondent is to take all necessary steps to ensure that outcomes referred to in paragraphs 12 and 26 of these reasons are achieved.

**********

Decision last updated: 20 April 2011