|
Where am I now? Lawlink > privacynsw > NSW Privacy Laws > Privacy Cases in the Tribunal
|
Print page
|
Privacy Cases in the Tribunal
Privacy cases in the Tribunal
There are two ways in which a privacy case can go to the Administrative Decisions Tribunal (“the Tribunal”):
What can the Tribunal do?
The Tribunal will review whether or not the agency or organisation complied with its privacy obligations. It will look at the specific conduct complained about, and compare what happened with the relevant privacy standards that apply to that kind of conduct.
The different privacy standards are:
The Tribunal can make orders which are binding on the agency or organisation. For example the Tribunal may order the agency to change its practices, apologise, or take some steps to remedy any damage suffered. Compensation is only payable in limited circumstances.
When could compensation be ordered?
Compensation only applies if the applicant has suffered any loss or damage (financial loss, or psychological or physical harm) as a result of the conduct.
There are maximum limits for compensation:
- up to $40,000 for a breach of an IPP, the public register provisions or an HPP by a public sector agency
- up to $40,000 for a breach of an HPP (or the special access rules) by a private sector organisation (eg. a body corporate)
- up to $10,000 for a breach of an HPP (or the special access rules) by a private sector person (eg. a GP)
There are also time limits for the ordering of compensation:
- for a breach of an IPP, the public register provisions or an HPP by a public sector agency, the conduct must have occurred after 1 July 2001
- for a breach of an HPP by a private sector person or organisation, the conduct must have occurred after 1 September 2005
What is the role of Privacy NSW in the Tribunal?
Privacy NSW is notified of applications to the Tribunal and has a right to appear and be heard in privacy matters before the Tribunal. The Privacy Commissioner is usually represented by one of Privacy NSW’s legal officers. Our role in the Tribunal is primarily concerned with assisting the Tribunal in interpreting the PPIP Act and the HRIP Act. Our policy is to attend initial ‘planning meetings’ to determine whether it may be appropriate to appear in the matter during later proceedings.
In accordance with our various functions relating to the protection of privacy, we are concerned that the PPIP Act and the HRIP Act are interpreted in a way that promotes the purpose of the Acts to protect the privacy of individuals. Our role in the Tribunal is not about supporting or advocating for either the applicant or respondent. However we may provide limited assistance or information to parties in relation to substantive or procedural issues, such as questions about the interpretation of the law.
Are there any time limits to lodging a case in the Tribunal?
Yes. However the time limits are different, depending on who the complaint is against.
Complaints about the handling of health information by a private sector person or organisation can only be lodged in the Tribunal for review if Privacy NSW has first investigated the matter and issued a report to both parties, containing our findings and/or recommendations. The time limit for lodging a case in the Tribunal starts from the date that the applicant receives our report. For a complaint of this type, a time limit of 28 days applies, unless we set a later time limit in our report.
Complaints against NSW public sector agencies, whether about their handling of personal information or health information, can only be lodged in the Tribunal for review if the matter has first been the subject of an internal review application. The applicant can either:
- lodge their case in the Tribunal as soon as 60 days has expired since they lodged their request for an internal review with the agency (if the review wasn’t completed within 60 days), or
- wait for the internal review to be completed by the agency, and then lodge their case in the Tribunal.
Therefore time limits for lodging a case in the Tribunal start to ‘run’ from either:
- “day 61” (61 days after the applicant lodged their request for an internal review with the agency, but only if the review wasn’t completed within 60 days), or
- “completion date” (as soon as the internal review was finished).
We recommend that applicants lodge their case in the Tribunal within 28 days of the date that applies to them (“day 61” or “completion date”). The time limits in these circumstances are not clear, because the PPIP Act doesn’t set time limits, and refers instead to the Tribunal’s own rules. The Tribunal’s normal rules for a ‘review of a reviewable decision’ set a time limit of 28 days.
However there is some caselaw to suggest that these normal rules don’t apply to privacy cases, and that there may therefore be no time limits (see the case of Fitzpatrick v Ambulance Service). Nevertheless we urge applicants to err on the side of caution and lodge their case within 28 days, so that there can be no argument about the matter.
How should an applicant prepare their application for the Tribunal?
A case in the Tribunal is like a court hearing and may involve complex legal arguments. An applicant will need to represent themselves or arrange for legal representation.
There are resources on this web site which may assist applicants in deciding whether or not to apply to the Tribunal, and resources to assist both applicants and respondents determine how to run their case. The resources include:
Will the applicant's name be mentioned in the Tribunal case?
As well as the privacy cases reported on our web site, all cases heard and decided by the Administrative Decisions Tribunal are reported on the Lawlink and AustLII web sites. An applicant's name can be removed from the on-line version if they ask the Tribunal to do so. If an applicant doesn't want their name publicised at all (for example in the daily court lists), they should ask the Tribunal staff about whether their name can be suppressed when they lodge their application.
Where can I find more information about the Tribunal?
See the Tribunal website, or you can contact the Tribunal on 1800 060 410 for further information and application forms.
What privacy cases have been decided to date?
See our links to Case Law for all cases decided in the Tribunal so far.
|
|
