Northern Midlands Council: Confidential worker’s compensation documents found dumped

A Tasmanian council has been found to have breached the Personal Information Protection Act after confidential worker’s compensation documents, including medical records, were found.

Northern Midlands Council chambers, Smith St, Longford. Picture: Google Street View

A Tasmanian council has been found to have breached the Personal Information Protection (PIP) Act after an employee’s confidential documents, including medical records, were found dumped outside a post office.

According to an October 4 report by Ombudsman Richard Connock, not yet tabled in parliament but seen by the Mercury, Northern Midlands Council was found to have a number of deficient policies that allowed the breach to occur.

Its response to the complaint was also found to be subpar.

The complaint was made to the ombudsman on September 21, 2021, by a council employee who was in the process of lodging a worker’s compensation claim.

According to the report, on September 1, 2021, the employee was contacted by Launceston Post Office staff who informed them that “confidential documents pertaining to their... claim had been found in a bin outside the post office”.

Launceston Post Office. Picture: Alex Treacy

“It was noted the documents contained medical information,” Mr Connock said.

The employee contacted council to voice her concerns and was told by a staff member “the documents had been taken home for work purposes and were inadvertently disposed of by another person while cleaning the staff member’s home”.

According to correspondence with the employee, summarised in the ombudsman’s report, council acknowledged there had been a failure, for which it apologised.

Council stressed its expectation that when council staff were working from home, documents would be “securely stored”.

Council conducted an internal investigation, which Mr Connock found was “appropriate,” but it then failed to “advise the complainant that the investigation had concluded or its outcome”.

Tasmanian Ombudsman Richard Connock. Picture: File

“I am of the view that a more fulsome response by council at first instance may have resolved the complainant’s concerns and this view was provided to council,” Mr Connock said.

While the internal investigation was satisfactory, it failed to assess whether the PIP Act had been breached, as required under legislation.

The ombudsman delegated authority to council to conduct a secondary investigation as to whether the act had been breached, but it failed to follow instructions and again made no mention of the act.

“I could not be satisfied council understood its obligations in respect of the PIP Act or had adequate PIP processes in place to guide staff,” Mr Connock said.

“Council’s failure... resulted in unreasonable delay to the complainant and impacted the resources of my office.”

Follow @humidityreport

Mr Connock said that although the breach appeared to be an “isolated incident,” its investigation had “identified a number of areas for improved practice”.

He found that council does not have a working from home policy that sets out guidelines and procedures; that its policy, practice and training regarding the PIP Act is “currently insufficient”; and that council did not respond adequately to the complaint at first instance.

Mr Connock made four recommendations.

He recommended that council nominate a privacy officer to receive, investigate and report on suspected breaches of the PIP Act; provide PIP specific training to all staff; develop and implement a working from home policy; and review and update its Privacy Policy, Privacy Statement, Information Management Policy and Code of Conduct Policy.

Northern Midlands Council General Manager Des Jennings told the Mercury it accepted the report.

“This complaint arose out of an unusual incident, which was inadvertent and regrettable,” he said.

“The ombudsman acknowledged it was an isolated incident arising from a working from home situation.

“Council immediately undertook an investigation into the complaint received, and took action immediately, including reviewing its policies.”