Case Notes

The following case notes report a selection of enquiries or complaints received by Privacy NSW and the internal reviews conducted by public sector agencies under the Privacy and Personal Information Protection Act ("PPIP Act") or the Health Records and Information Privacy Act 2002 ("HRIP Act").

The cases are considered to be of interest to the general public. They might illustrate the application of privacy principles to particular facts, the conciliation process undertaken between the parties or the outcome in a particular matter.

However, the case notes should not be relied upon as legal advice.

In order to maintain the parties' confidentiality, the case notes are "de-identified" so that names are not revealed and the background facts are described in general terms. Also, the publication date of a case note does not necessarily indicate the time at which a complaint or internal review was finalised.

Enquiries and complaints

Privacy NSW provides advice to members of the public, public sector agencies and other organisations. It does not provide legal advice, as this may conflict with its complaint-handling functions. However, general guidance may be given on privacy related matters.

If a person makes a formal complaint to Privacy NSW, we may try to conciliate an outcome if we consider that there has been a breach of the person's privacy.

You may find further information on making a complaint here.

Internal reviews

An internal review is an investigation conducted within a NSW public sector agency, in response to a formal complaint by an individual under Part 4 of the PPIP Act or Part 3 of the HRIP Act.

The NSW Privacy Commissioner has oversight of the internal reviews conducted under these Acts. All agencies must notify the Commissioner of any internal review applications received by it and the Commissioner may make submissions to agencies on any aspect of the internal review.

You may find further information on internal reviews here.

Case notes

Citation	Title	Summary	Privacy Principle
[2009] NSW PrivCmr1	Disclosure of personal information in industrial disputes	Disclosure — disclosure of party's name to industrial dispute — disclosure without consent — whether breach of Information Privacy Principle 11	IPP 11
[2009] NSW PrivCmr2	Publication of development applications on website	Collection — development applications lodged with local council — publication on council's website — whether breach of IPP 3 — failure to inform complainants that personal information will be disclosed to world at large Security — whether breach of IPP 5 — whether files published on website secure format of files sufficiently secure to prevent unauthorised access, use or disclosure — users required to agree only to view content Disclosure — whether breach of IPP 11 — disclosure where lawfully authorised or non-compliance otherwise permitted by law — public documents under Local Government Act 1993	IPPs 3, 5, 11
[2009] NSW PrivCmr 3	Access to deceased relative's medical records	Disclosure — request for medical records — Health Privacy Principle 11 — health information not to be disclosed unless exemption applies — exemption to immediate family member for compassionate reasons cl. 11(1)(g), Sch. 1	HPP 11(1)(g)
[2009] NSW PrivCmr4	Disclosure of student's email address to third persons	Disclosure — email address provided for student use — disclosure of email address without consent to unknown persons — disclosure by staff member of educational institution — whether breach of IPP 11	IPP 11