Under the Privacy Act, individuals have a right to get access to their personal information. When an agency receives such a request, a recent decision by the Human Rights Review Tribunal shows the agency, where possible, must provide the information in a way that is meaningful and understandable to the requester.

The Tribunal said the Royal Australasian College of Surgeons (RACS) breached the Privacy Act in how it responded to a doctor’s request for personal information. A central issue was that the information was provided to the requester in a form which he could not decipher. 

Background

The doctor had applied for a place in a training programme to become an orthopaedic surgeon. He had applied to the programme repeatedly but had been unsuccessful each time. After his last bid, he made a request to see the personal information held about him by the RACS to understand why he had been rejected yet again.

Twenty working days elapsed. Eleven days later, the RACS responded and emailed the doctor’s personal file to him. Some documents were withheld from him.

Based on the documents provided to him, the doctor believed his application had been unfairly judged. He lodged an appeal with the RACS Appeals Committee and filed a complaint to the Office of the Privacy Commissioner about the withheld documents.

The RACS extended the deadline for the appeal process until the Privacy Commissioner investigation was completed. After our investigation was completed, RACS provided the doctor with information it had initially withheld from him – namely a table of referee scores. The scores formed part of the basis for his failed application.

The doctor said the referee scores were inconsistent with the verbal feedback he had received and were well below his previously achieved scores. There was little meaningful information to contextualise the scores. No information was provided to indicate what the scores had been marked out of, or whether they had been weighted.

The doctor said it was impossible for him to interpret or decipher the referee scores and to see if they had been correctly calculated.

At this stage, we were unable to reach a satisfactory resolution to the complaint and the doctor exercised his right to seek a ruling from the Tribunal.

Tribunal’s view: provide meaningful access

The Tribunal said an important feature of the case was that the personal information the doctor received from RACS could not be deciphered. The doctor hadn’t been given the formula, mechanism or “key” to help him understand how his referee scores were calculated.

The Privacy Act provides that personal information must be given in a form that can be understood (see section 42(1)(c) and (d)). Without such steps, it cannot be said that access to personal information had been given and an agency’s obligations had been met.

The Tribunal ordered the RACS to give the doctor the necessary information to make meaningful the scoring and assessment of his referee scores, such as the scoring mechanism or available formula, as well as the weighting and total points available to the referees in making their scores. This information was to be transparent, intelligible and easily accessible to the doctor.

Image credit: Steel black and white via Pixabay under Creative Commons Licence.

IPP6 - access, Human Rights Review Tribunal