North Sydney Council to apologise for privacy breach over councillor medical information

A Sydney councillor called for the council’s general manager to be “stood down” over a “distressing” privacy breach involving their health information being published on a public website.

A legal tribunal has ordered North Sydney Council to issue an “unreserved formal written apology” to one of its own councillors after publishing their personal health information on its website.

The councillor – who cannot be named for legal reasons – took the council to the NSW Civil and Administrative Tribunal last year over a privacy breach they said caused them “significant distress” and “embarrassment”.

The case related to a council meeting report last year which stated the reason the councillor was seeking to attend meetings remotely was due to a “medical” reason.

North Sydney Council was referred to the tribunal last year.

The council also sent a copy of the councillor’s medical certificate to the nine other elected councillors at the time.

In their application to the tribunal, the councillor said the information was published without their consent and called for the council’s long-serving general manager to be “stood down”.

The tribunal heard the publication of the information came during last year’s Covid lockdowns when councils could approve requests for councillors to attend meetings remotely at their own discretion.

The guidelines for remote attendance requests were set by the Office of Local Government and stated councils must comply with health privacy laws relating to matters such as illness.

North Sydney Council general manager Ken Gouldthorp gave evidence during the tribunal hearings.

North Sydney Council, in response to the guidelines, sent a memo to all councillors asking for a brief statement of reasons to be included in any request to attend meetings remotely.

The councillor responded, writing: “I request to attend all meetings of council (council meetings, briefings, reference groups etc) remotely/by audio visual link for the next six months in accordance with medical advice. I ask that my reasoning and this information remain confidential and that my privacy is maintained”.

The next month, the council sent another email to councillors asking for remote attendance requests to include “sufficient substantiation to satisfy the council that attendance in person is prevented due to illness, disability, caring responsibilities or such other reasons”.

North Sydney Council has been ordered to issue an apology.

The councillor responded with a copy of their medical certificate, again writing: “I request to attend all meetings of council, including council meetings, briefings, reference groups etc remotely for the next five months in accordance with medical advice. I ask that my reasoning and this information remain confidential and that my privacy is maintained.” 

Six days later, a council meeting agenda was published online which included an agenda item listing the reason for the councillor’s request to attend meetings remotely as “medical”.

The council also sent a copy of the councillor’s medical certificate in a confidential email to the nine other elected councillors.

In their application to the tribunal, the councillor argued the publication of the information was a clear breach of Health Records and Information Privacy principles requiring organisations to “prevent unauthorised use or disclosure” of personal information.

The decision was handed down by the NSW Civil and Administrative Tribunal on Wednesday.

The councillor said the publication of their medical information had caused “significant distress” and that they had “no expectation” the medical certificate would be circulated to other councillors.

The tribunal heard the councillor had only disclosed their medical condition to their spouse at the time and had not wished to discuss it with anyone, including their children.

The councillor was further concerned it could have impacted their re-election prospects at last year’s local government election.

North Sydney Council disputed the matter breached health privacy legislation but conceded it had breached principles of separate Privacy and Personal Information Protection laws and subsequently “had taken some steps to seek to remedy those breaches.

Councillors had been able to attend meetings remotely during last year’s Covid lockdowns that left local streets including North Sydney (pictured) deserted.

The council’s general manager Ken Gouldthorp told the tribunal he was responsible for including the word “medical” in the council report as well as circulating the councillor’s medical certificate to other councillors.

In December, he wrote to the councillor “apologising for any distress and embarrassment caused” and instructed council staff to remove the word “medical” from the online versions of the council report.

The tribunal, in its decision on Wednesday, found the council breached two principles of Health Records and Information Privacy laws and the publishing of the word “medical” in the council report was non-public information of a councillor whose identity was “apparent” from the same report.

The tribunal said there was no evidence to suggest there to be any “systemic issues” within council in respect to compliance with privacy laws.

North Sydney Council must issue the apology within two weeks.

“It is clear that the information was disclosed both without the applicant’s consent and in circumstances where the applicant would not reasonably expect that information to be disclosed,” the tribunal added.

The councillor – in their application to the tribunal – called for Mr Gouldthorp to be “stood down” or that the breaches be referred to the NSW Police Force – a request the tribunal rejected as it was “not appropriate on the facts” and beyond its powers.

The councillor also argued the publication of their information has been used for a “political purpose” by the council however the tribunal rejected the claim, finding there was “no evidence to support the assertion”.

The tribunal instead ordered the council to issue an unreserved formal written apology to the councillor addressing and apologising for the privacy breaches including “all distress and embarrassment caused”.

The council was also ordered to publish an anonymous notice on the news section of its website carrying the headline: “Council found to have committed privacy breaches”.

The notice must include a reference to the formal apology and remain on the council’s website for at least three months.

In a statement, North Sydney Council said no specific health records were released or made public. The Tribunal found there was no “intentional breach” by the council.

“Council will apologise to the applicant directly,” a council spokeswoman said.

The council said its legal costs relating to the case were estimated to be “in the vicinity of $60,000”.