Kitson v Avant Mutual Group Ltd [2017] VCAT 1305

4 mins  06.09.2017

Allegation that the respondent had interfered with the complainant's personal privacy as an individual

On 23 August 2016, the complainant, Dr Kitson sent a letter to the respondent pursuant to Health Privacy Principle 5 (HPP5) requesting 'access to all documentation referred to therein as well as all further specific information referred to therein' (request). Having received no response to the letter, on 21 September 2016 the complainant wrote to the Health Services Commissioner (Commissioner) alleging that the respondent, Avant Mutual Group Ltd had interfered with his privacy as defined in section 18 of the Health Records Act 2001 (Act).

The respondent replied to the Commission on 17 October 2016, providing a copy of the respondent's privacy policy and a series of statements to the effect that the respondent 'may' hold health information in relation to the complainant in connection with members/insureds of the respondent. The Commissioner informed the complainant that his complaint had been declined and on 8 December 2016 the complainant required that the Commissioner refer the complaint to the Victorian Civil and Administrative Tribunal (the Tribunal), which the Commissioner did.

The Tribunal summarised the complainants complaint as follows:

  1. the complainant argues that contrary to HPP5.1(b) the respondent's Privacy Policy fails to set out the steps that an individual must take in order to obtain access to their health information;
  2. the complainant argues that contrary to HPP5.2, the respondent, in its response, failed to respond in a manner required by that principle; and
  3. by virtue of the operation of section 18(a) of the Act, these two alleged failures constitute a breach of HPP5 and therefore constitute an interference by the respondent with the complainant's privacy as an individual.

Findings

The Tribunal noted that the respondent's privacy policy was not limited to merely providing a contact point for requests relating to personal information. It was found to provide material which reasonably sets out a process to obtain access and the processes that may be employed if a request for access is denied. The Tribunal was of the opinion that the complainant's reading of the privacy policy was unduly selective. HPP5.1 does not provide a time frame within which a privacy policy must be provided to a person requesting access to their personal information. The respondent provided their policy approximately 39 days after the request. The Tribunal was of the opinion that this was a reasonable time within which to provide the policy and accordingly did not constitute a breach of HPP5.1. The Tribunal was satisfied there was no breach of HPP5.1.

The complainant alleged that because the respondent's response to his initial request was equivocal (as opposed to a Yes/No answer) that the respondent breached HPP5.2. He asserted that the respondent was obliged to determine whether information was health information and to provide it accordingly. The respondent explained that the manner of the response was due to the differing views between the respondent and the complainant as to what constitutes 'health information' and the view of the respondent that they in fact did not hold health information for the complainant. The response was intended to avoid protracted argument in relation to what constitutes health information. The Tribunal determined that although the response of the respondent was somewhat obscure, dense and repetitive to an ordinary reader, the Tribunal accepted that the term 'reasonable steps' as required by HPP5.2 permitted an organisation drafting a response to take into account the circumstances of the individual making a request. Accordingly, the respondent was permitted to respond in a manner which anticipated that the request would result in litigation. The Tribunal held that HPP5.2 had not been breached.

Due to the above determination, the Tribunal was satisfied that there had been no interference by the respondent with the complainant's privacy as an individual.
The respondent submitted that the complaint made by the complainant was unmeritorious and vexatious. Usually a declaration in relation to this is to avoid a hearing of the complaint on the merits of the case. A hearing of this kind had already occurred (as outlined above) and accordingly, the Tribunal considered there was no benefit to making a declaration as to whether the complaint was vexatious.

Click here for full decision

Tags

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1laWQiOiIzYjdmMTIwNi1iMjM1LTQ5YTctYWE0Ny0xZTViNTZiYTZjMmMiLCJyb2xlIjoiQXBpVXNlciIsIm5iZiI6MTczOTA3NzQxMSwiZXhwIjoxNzM5MDc4NjExLCJpYXQiOjE3MzkwNzc0MTEsImlzcyI6Imh0dHBzOi8vd3d3Lm1pbnRlcmVsbGlzb24uY29tL2FydGljbGVzL2tpdHNvbi12LWF2YW50LW11dHVhbC1ncm91cC1sdGQtMjAxNy12Y2F0LTEzMDUiLCJhdWQiOiJodHRwczovL3d3dy5taW50ZXJlbGxpc29uLmNvbS9hcnRpY2xlcy9raXRzb24tdi1hdmFudC1tdXR1YWwtZ3JvdXAtbHRkLTIwMTctdmNhdC0xMzA1In0.tmzQB7TWYysIDRH9R7Wh_6eaJkzlYhEm02d3u1V0z0U
https://www.minterellison.com/articles/kitson-v-avant-mutual-group-ltd-2017-vcat-1305

Point of View: insights into key issues and challenges facing business today.

In this series of interviews with MinterEllison partners we hear their perspective on key areas of interest to our clients and the business community.