NSW ADT rules maximum $40000 for damage from serious privacy breach

The decision by Judicial Member Montgomery of the NSW Administrative Decisions Tribunal to award a privacy complainant $40,000 as compensation for loss or damage is the first instance since the commencement of privacy legislation in NSW in 2000 where the maximum amount has been awarded.( NK v Northern Sydney Central Coast Area Health Service (No 2) [2011] NSWADT 81.) The legislation provides for such an order up to the maximum "by way of compensation for any loss or damage suffered because of conduct" contrary to the relevant privacy principles.

The previous highest award  was $7500, although in another case in which it found it had no jurisdiction, the Tribunal said an award of $15000 would have been justified. Judicial Member Montgomery [52] distinguished other cases by reference to the significant number of breaches in the matter before him, and the seriousness of the damage suffered by the complainant as a consequence, involving as it did a suicide attempt. The decision includes discussion [32-45] of the law concerning compensatory and exemplary or aggravated damages. Judicial Montgomery left open the question of the full extent of Tribunal powers commenting that the maximum amount specified was lower than what might have otherwise been awarded [63].

In an earlier decision NK v Northern Sydney Central Coast Area Health Service [2010] NSWADT 258 Judicial Member Montgomery upheld NK's claim that the Service breached NK's privacy through failure to observe 11 privacy principles to which it was subject under the  NSW Health Records and Information Privacy Act 2002 (" Health Privacy Act ") and the NSW Privacy and Personal Information Protection Act 1998 (" Privacy Act ")

The brief facts [1-2] were that NK was both an employee and a patient at a hospital operated by the Respondent. NK suffers from bi-polar disorder. In August 2008, NK presented at the hospital seeking medical help in relation to anxiety and stress. At the time he was distressed by thoughts and feelings he was experiencing at that time in relation to his workplace. The hospital later disclosed his personal and health information contrary to various requirements of the Health Privacy Act and the Privacy Act . Various officers of the hospital failed to check the accuracy of NK's personal information before using it in various ways that had extremely serious consequences for NK's health and employment. NK was locked out from his workplace on the basis of information that was inaccurate or incomplete. The Human Resources Manager of the Hospital arranged to have NK's electronic ID card blocked so that he could not access the department and also advised that NK should only be on site for medical reasons or to attend matters relating to any investigations. As a result NK felt unable to seek further medical help from the hospital (which was also his local hospital) for reasons including fear that his personal information would be again used against him. This led to an attempted suicide by NK. 

After reviewing the conduct and the evidence regarding loss and damage particularly psychological harm suffered, Judicial Member Montgomery said [60]

In my view, the Respondent's conduct amounted to an oppressive disregard of NK's rights and its own privacy duties. It has not only breached the privacy legislation, but punished NK for its own breaches, based on inaccurate information and without checking its validity. As both a patient and an employee, NK was in a position of vulnerability. The hospital has continued to deny that NK has experienced any damage in circumstances where findings have already been made against it. It is my view that NK is entitled to the maximum amount that can be awarded under the applicable legislation . He is entitled to compensatory damages as a step towards restoring him to the position that he would have been in but for the breaches.

 Judicial Member Montgomery was unimpressed with the Respondent's conduct during proceedings [51]

 In its damages submissions the Respondent has continued to assert that its officers acted in good faith and that NK has failed to show any damage. This is so in spite of the 2010 NK decision where I found a multiplicity of contraventions of NK's privacy, the finding that NK has suffered "significant damage" that was attributable to the Respondent's conduct notwithstanding his existing condition (at paragraph [189]), and my finding that (at paragraph [190]) that

190 The consequences have been exacerbated by the manner in which the Respondent has responded to his complaint both at the internal review stage and at the external review stage. At no stage of the process does the Respondent's response do it any credit. In my view it has fallen far short of its obligations to act as a model litigant...