Case law summary: Why you must take care when handling employee information

By Jeff Salton on April 16th, 2018
  1. Workplace Policies
  2. Privacy & Data Protection


The case

Harrison v Department of Education and Training (Human Rights) (2017)

Ms Harrison commenced proceedings in the Victorian Civil and Administrative Tribunal (VCAT) after a note containing information about her health was found in the staff toilet. The then acting principal had made the note during a phone call with one the lawyers of the Victorian Department of Education and Training (the Department). The note, while not identifying Ms Harrison, contained sufficient information that she could be identified. It contained single-word prompts about Ms Harrison’s work history, her request for a compassionate transfer and her medical history.

Another staff member discovered the note and discussed it with a colleague. Determining the note was about Ms Harrison, they placed it in her pigeonhole. After finding the note, Ms Harrison was too distressed to return to work.

The verdict

In determining the matter in Ms Harrison’s favour, VCAT found the Department had failed to protect Ms Harrison’s personal information from loss and disclosure. In so doing, the Department had breached Health Privacy Principle 4 under the Health Records Act 2001 (Vic) and caused Ms Harrison to suffer damage in the form of distress, and a deterioration of her mental health, which meant she was unable to return to work.

VCAT ordered the Department to pay Ms Harrison $11,000 for compensation for the breach.

Lessons for you

While exemptions to employee records exist under some Commonwealth privacy laws, disclosure of employee information can have grave ramifications, and affect employee morale and engagement.

You should educate and train managers, especially those responsible for payroll and human resources, and take care when collecting, using and storing employees’ personal and sensitive information, particularly medical information.

Securing information in a locked cabinet, not leaving notes about sensitive issues on employees’ desks and taking calls about employees in a private room away from other staff are all sensible strategies to employ.

As this case demonstrates, the disclosure does not need to be intentional to cause damage to the employee or for a breach to be found and compensation ordered to be paid by the employer.

Need to know more?

Privacy is such a broad subject, that’s why it’s important that you read through the Privacy chapter in the Employment Law Practical Handbook as soon as possible. It explains in great detail this complex topic. With new privacy laws in place, you can’t afford to make a costly mistake when handling workers’ personal information.

For instance, the privacy principles set standards for how businesses may use personal information, including:

  • collecting personal information, including via:
    • surveillance;
    • email monitoring; and
    • tracking devices;
  • notifying individuals on whom personal information is held;
  • using and disclosing personal information, including tax file numbers;
  • accessing personal information; and
  • correcting personal information.

Don’t delay. Order your copy of the Employment Law Practical Handbook today and quickly see what you’ve been missing out on.


Related Articles: