By Jeff Salton

The case

Harrison v Department of Education and Training (Human Rights) (2017)

Ms Harrison commenced proceedings in the Victorian Civil and Administrative Tribunal (VCAT) after a note containing information about her health was found in the staff toilet. The then acting principal had made the note during a phone call with one the lawyers of the Victorian Department of Education and Training (the Department). The note, while not identifying Ms Harrison, contained sufficient information that she could be identified. It contained single-word prompts about Ms Harrison’s work history, her request for a compassionate transfer and her medical history.

Another staff member discovered the note and discussed it with a colleague. Determining the note was about Ms Harrison, they placed it in her pigeonhole. After finding the note, Ms Harrison was too distressed to return to work.

The verdict

In determining the matter in Ms Harrison’s favour, VCAT found the Department had failed to protect Ms Harrison’s personal information from loss and disclosure. In so doing, the Department had breached Health Privacy Principle 4 under the Health Records Act 2001 (Vic) and caused Ms Harrison to suffer damage in the form of distress, and a deterioration of her mental health, which meant she was unable to return to work.

VCAT ordered the Department to pay Ms Harrison $11,000 for compensation for the breach.

Lessons for you

While exemptions to employee records exist under some Commonwealth privacy laws, disclosure of employee information can have grave ramifications, and affect employee morale and engagement.

You should educate and train managers, especially those responsible for payroll and human resources, and take care when collecting, using and storing employees’ personal and sensitive information, particularly medical information.

Securing information in a locked cabinet, not leaving notes about sensitive issues on employees’ desks and taking calls about employees in a private room away from other staff are all sensible strategies to employ.

As this case demonstrates, the disclosure does not need to be intentional to cause damage to the employee or for a breach to be found and compensation ordered to be paid by the employer.