DPD v Far West Local Health District
Industry: Hospital Services
Players in litigation
DPD – service provider
Far West Local Health District (FWLHD)
Summary of the facts
DPD provided services to hospitals and local health districts through an employment agency – DPD was not an employee of FWLHD. The FWLHD terminated DPD’s engagement and sent letters to DPD’s employment agency and the Professional Board criticising DPD’s professional conduct. The information contained in the letter to the employment agency was false, however the information in the letter to the Professional Board was accurate at the time it was sent.
Following these letters, DPD’s arrangement with its employment agency was terminated and DPD was no longer able to source further employment.
FWLHD had sent the letters with the intention of having DPD listed on the Service Check Register. Both the FWLHD and DPD were under the impression that DPD was listed on the Register, however this was not the case.
DPD argued that the FWLHD’s actions were in breach of the Privacy and Personal Information Protection Act 1998 (PIPP Act) and the Information Protection Principles (IPPs).
Findings
The FWLHD breached s 16 of the PPIP Act which states that a public sector agency must take reasonable steps to ensure that information it uses is accurate. The Court found that the information the FWLHD disclosed had the potential to severely damage DPD’s reputation and the FWLHD had not taken available steps to ensure its accuracy.
The FWLHD had not breached s 17 of the PPIP Act which states that a public sector agency must not use information other than for the purpose that it was collected. The Court found that the FWLHD had collected the information for the purpose of advising against DPD’s employment and had used the information for this purpose.
The FWLHD had not breached s 18 of the PPIP Act which states that a public sector agency cannot disclose information unless the disclosure relates to the purpose the information was collected for, the individual concerned is reasonably aware that info is likely to be disclosed, and the agency believes on reasonably grounds that disclosure is necessary. The letter to the Professional Board falls within the definition of a report under s 117A of the Health Services Act and therefore was exempt from complying with s 18 (1) of the PPIP Act. The FWLHD also successfully argued that they were exempt from complying with s18 of the PPIP Act in relation to the letter to the employment agency because they were fulfilling their common law duty of care to inform the employment agency of DPD’s incompetency.
No damages were awarded as the Court held that DPD did not establish any loss in relation to the FWLHD’s breach of s 16.
Take Outs
This case highlights that public sector agencies who are collecting data, should only use that data for the purpose that it was collected, otherwise they will be in breach of the PPIP Act. Agencies who use the data for the purpose it was collected should we aware that they cannot then subsequently use the data for an ulterior purpose, as the exemption in the PPIP Act will not apply.
In this case, it was held that when assessing whether a body has taken reasonable steps to ensure the accuracy of information, the Court will have regard to:
- How recently the information was collected;
- the experience and competence of the author of the information;
- the gravity of the information;
- the extent to which it is possible to check back the accuracy of the information with its authors and;
- the practicality of checking back the information.
Therefore, parties will have to go to greater lengths to ensure the accuracy of information when the information is likely to cause some sort of damage, as it was in this case. Furthermore, if there are steps that a party could take that are not too impractical to check the accuracy of information, a party should take those steps to avoid breaching the PPIP Act.
