pany realised that a mistake had been made. It immediately contacted the Office of the Privacy Commissioner to say there had been a privacy breach. It also contacted all the people whose details had been inadvertently released, to let them know what had happened.
The man approached a newspaper which wrote a story about the company's mistake. One woman whose details had been included on the list was approached by a journalist. Although she was not featured in the story, she was embarrassed by the fact that details of her debt had ended up in the hands of the media.
She complained to Privacy Commissioner about the company's breach of her privacy. The company apologised to her and made a small payment in compensation for the embarrassment she had suffered. The woman accepted this as a settlement of her complaint.
The company provided specific training to the employee who made the mistake, and additional training for all staff responsible for handling requests for personal information. It also improved its internal documentation on handling requests for personal information.
A woman was being treated for a serious illness at her local hospital. Her doctor dictated a file note about the woman's illness and the proposed treatment. This was transcribed by a hospital employee.
The employee had been a close friend of the woman, and was able to identify her from the notes. The hospital employee then told a mutual friend about the woman’s illness. The friend made contact with the woman to express their concern.
The woman had not told anyone of her illness at that point, and was very upset that information about her had been disclosed.
Rule 11 of the Health Information Privacy Code 2004 prohibits a health agency from disclosing health information about an individual unless one of the specified exceptions applied.
The Office of the Privacy Commissioner did not consider that any of the exceptions applied and the hospital agreed. It accepted that its employee had breached rule 11, and caused emotional harm to the woman.
The woman and the hospital agreed to settle this complaint. The hospital provided an apology to the woman for the stress that had been caused to her, and also paid financial compensation.
Insights from agencies
“Do not treat the news media as an enemy. Adopt a cooperative and collegial approach. It works better than having an antagonistic stance, especially if your agency has stuffed up.”
“Change a blame culture if one exists. A better approach is to make people feel safe to come and admit what has happened, knowing there will be a fair and honest procedure to handle the error. Such a culture will allow more reporting of breaches and near-misses and lead to better management of organisational risk.”
An Australian government agency undertook a periodic audit of its records. The audit revealed an unusual pattern of client account enquiries in one branch of the agency over a 12 month period. The client records contained address information, financial information, and other details.
After some investigation, it was found that a staff member had been browsing the client accounts of his family and friends without any legitimate purpose or authorisation. There was no evidence that client information had been disclosed to a third party.
The agency recognised that some of the information was sensitive information that was not readily available. The agency considered there was a real risk of embarrassment or other harm from the release of that information. The staff member had a personal relationship with the affected people and could have combined the information with details about the people that he already knew.
The government agency decided to notify the individuals affected by the unauthorised access. It also took measures to prevent unauthorised access to client accounts by staff, and to ensure that all staff members were aware of their obligations to act appropriately.
The agency considered that, because of the sensitivity of the information and the context of the breach, the breach was sufficiently serious to warrant noti