Privacy Law and Policy Reporter
Can Federal privacy cases cross the NSW state line?
Leif Gamertsfelder DEACONS
In C v Commonwealth Agency  PrivCmrA 1 (see (2003) 9(9) PLPR 171), the Federal Privacy Commissioner found that a Commonwealth agency unlawfully disclosed medical information regarding one of the agency’s employees because such disclosure was irrelevant in the circumstances. The Commonwealth agency in this case apologised to the complainant and paid $7000 in compensation.
While this case was decided under Information Privacy Principal (IIP) 11.1 of the Federal Privacy Act 1998, similar results could follow if analogous facts involving a State agency were to arise for determination under the Privacy and Personal Information Protection Act 1998 (NSW) (PPIPA).
On its face, it would appear that s 4(3)(j) of the PPIPA would pose a complete defence to the type of complaint in C v Commonwealth Agency. Section 4(3)(j) provides that ‘information or an opinion about an individual’s suitability for appointment or employment as a public sector official’ is not personal information for the purposes of the PPIPA. Accordingly, s 4(3)(j) excludes a wide range of personal information relating to agency employees from the operation of the PPIPA.
However, it is possible in light of statements by President O’Connor in Y v Director General, Department of Education & Training that the exclusion contained in s 4(3)(j) may not apply in circumstances similar to those which arose in C v Commonwealth Agency. President O’Connor gave clear indications in Y v DET that the employee exclusion in s 4(3)(j) may not apply where an agency disclosed personal information in circumstances where such disclosure was irrelevant or not suitable in the context in which disclosure is made.
In Y v DET, President O’Connor, in the course of discussing the application of s 4(3)(j), stated that:
The test, as I see it, must in each case be whether having regard to the content of the information in issue and the context in which it is found it can reasonably be said to be ‘about an individual’s suitability for appointment or employment’.
Later in the same case he develops this test by stating that:
As I see it, the protection against an over-reaching application of this exclusion is to be found in the word ‘suitability’. The information in issue must be able to be shown to be information ‘about ... suitability’. It must contain within it language which indicates to an objective observer that the information canvasses the aptitude and competence of the employee with respect to their current or prospective employment (and can embrace such matters as co-operativeness, ability to work effectively as part of a team and interpersonal skills). If this approach is adopted, then it would be an unusual case where the exclusion would apply outside what I have described as the routine personnel context (that of recruitment, promotion, discipline and involuntary retirement).
It would seem highly arguable that if the Federal Privacy Commissioner found that the employee’s medical condition was not within the implied consent to provide information relating to ‘skills, work experience and personal attributes relevant to the advertised position’ in the C v Commonwealth Agency case, then the same information is not information ‘about ... suitability’ for the purposes of s 4(3)(j).
It is also important to note that wherever disclosure involves sensitive information regarding an employee’s medical conditions, a privacy tribunal is likely to interpret the exclusion contained in s 4(3)(j) much more narrowly than may otherwise be the case.
In summary, the cases discussed above demonstrate that a test of relevance must be adopted by any agency when deciding whether to disclose any employee information. Further, when dealing with medical information, the ‘relevance’ test needs to be narrowly and conservatively applied.
In this context, State agencies should ensure, amongst other things, that:
• internal checklists, protocols and training relating to the giving of references take into account the above cases; and
• that consideration be given to including in materials relating to applications for promotion/transfer and the naming of referees a written consent authorising the giving of a broad range of information by a referee. l
Leif Gamertsfelder is a member of the Privacy Group, Deacons.
.  NSWADT 149 (12 September 2001).
. At .
. At .