The Human Rights Review Tribunal heard a case concerning a surgeon’s disclosure to ACC and other doctors that her patient’s mother had made a complaint to the Health and Disability Commissioner (HDC) about her.

The mother complained about this disclosure under the Privacy Act as she was anxious that the disclosure would prejudice her son’s care under his new physician. While the Tribunal found there was a breach of privacy principles 10 and 11, ultimately the Tribunal found this was not an interference with the mother’s privacy.

Corrective surgery had unexpected outcome

The mother’s son experienced pain and discomfort following surgery and his overall condition worsened.

During a follow up appointment, the mother asked for her son’s care to be transferred and made a complaint to the Health and Disability Commissioner (HDC).

When reviewing her file to respond to the HDC complaint, the surgeon wrote to his GP and the surgeon who was now treating him and completed the ACC form, referring to the fact that the mother had made an HDC complaint. The mother was unaware that ACC, the GP and the new surgeon had been informed about her HDC complaint and so made a complaint to OPC that this was an interference with her privacy and her son’s privacy.

Privacy Commissioner’s investigation

The Privacy Commissioner’s Office investigated the complaint but concluded this was not an interference with the mother’s privacy.

Tribunal finds privacy breach but no interference

The HRRT upheld the Privacy Commissioner’s finding, however notably the HRRT did find there had been a breach of principles 10 and 11. These principles require an agency not to use or disclose personal information unless it has reasonable grounds to believe that at least one of the exceptions applies. The Tribunal did not consider that the disclosure complied with the IPP 10 or 11 as the exceptions that the ADHB relied on, namely the authorisation exception (IPP 11) or the related purpose exception (IPP 10 and 11) did not apply.

The fact that the mother had made an HDC complaint was considered to be her personal information and her son’s health information (mixed information), and the privacy interests of both individuals needed to be considered before it could be used or disclosed. The surgeon subjectively believed that the mother had authorised the disclosure when signing patient registration forms, and that sharing the information was for one of the purposes it was collected for. However, the Tribunal did not have evidence that the disclosure was directly related to the purpose for which the information had been obtained, nor did the patient authorisation extend to the sharing of the mother’s personal information. The personal information relating to the HDC complaint was received by the surgeon for the purpose of responding to that complaint, it did not relate to ACC or another doctor, and there was no objective reason for sharing the existence of the HDC claim.

However, the Tribunal found this was not an interference with the mother’s privacy, despite the mother explaining the personal impact of the disclosure on her, which included stress, anxiety, despair and deep upset, and the Tribunal acknowledging that the realisation that the surgeon had told others about her HDC complaint had caused the mother stress.

While the Tribunal acknowledged that the consequences of the surgery had a profound impact on the mother and her son, the Tribunal had to be satisfied that the disclosure and use of the HDC complaint was a contributing or material cause, not just part of the overall background. The Tribunal did not have evidence that the son’s medical treatment was adversely affected by the ADHB disclosure and use of the mother's personal information. While the Tribunal acknowledged that disclosure or use of the HDC complaint could amount to an interference with privacy under s 66(1)(b)(iii) (injury to feelings), evidence was required that this was significant and causally linked to the breaches of the privacy principles.

R v ADHB [2021] NZHRRT 5  

Note: This case was heard in December 2019 and decided under the Privacy Act 1993. The Privacy Act 2020 came into force on 1 December 2020.