A Department of Defence employee was asked if he
consented to a medical report commissioned by the Department being
made available to his own doctor, in relation to a compensation
claim he'd made. He said no. Defence sent it to the doctor
anyway.
The employee was quite miffed and made a complaint to the
Privacy Commissioner, requesting an apology and some cash. The
Commissioner obliged, finding that Defence had breached its
obligation not to disclose personal information without consent,
and ordering that it say sorry and pay the complainant $5,000. The
Department also got some homework: to amend its personal
information handling procedures and report back in six months.
We don't think $5k will cause a blip on Defence's
financial radar, but the decision has us wondering what the
Commissioner will do about more serious breaches of privacy. In the
digital age, single data breaches can affect millions of people at
once (think the recent examples of 250,000 Aussie
