AAB upheld the view of the Privacy Commissioner that since the hospitals in question could not control what information would be posted on their notice boards, the hospitals could not be taken to be "data user" within the meaning of the PD(P)O.
Open letter posted on notice boards of 3 hospitals by a staff - letter containing personal matter of complainant- letter subsequently removed - hospitals no control over what materials were posted up - anyone could access to the notice boards - definition of "data user" and DPP3
The Complaint
The complainant was an employee in a public hospital. He had previously made an accusation of indecent assault against a colleague. The case was reported to the Police, but no prosecution action was taken. The colleague wrote an open letter about the case, copies of which were posted on the notice boards of three public hospitals, including the one at which the complainant worked. The complainant complained against the three hospitals for allowing the letter containing his personal data to be posted in this manner.
Findings of the Privacy Commissioner
Upon receiving the complaint, the PCPD made enquiries with the hospitals concerned and was informed in each case that the copy of the letter had already been removed from the notice boards. The Privacy Commissioner was satisfied that the matter had already been satisfactorily resolved, and considered that a formal investigation would not yield a better result for the complaint. On that basis, he exercised his power under section 39(2)(d) of the PD(P)O to refuse to carry out an investigation, on the ground that any such investigation was in the circumstances of the case unnecessary.
The appeal
The complainant appealed. The AAB considered that there was insufficient evidence to indicate what role, if any, the hospitals had played in the posting up of the letters. Even if the hospitals had allowed or given consent to such posting, they could not be taken to be "data users" in relation to the letters as they had no control over the contents of or data contained in the letters.
The AAB noted that as a result of the PCPD's intervention, all copies of the letter had been removed from the notice boards. Also, in the one hospital in which the letter was posted up, a circular had subsequently been issued to remind individual units that the notice board should be used only for the display of notices related to work. Other remedial measures had also been adopted by the hospitals. This showed that the case had been resolved effectively by informal means. The AAB also noted that as a matter of law, the Privacy Commissioner had no power under the PD(P)O to demand an apology or compensation from a party in breach. Should a complainant wish to seek monetary compensation the proper channel was by way of a civil action under section 66 of the PD(P)O.
AAB's decision
The AAB upheld the Privacy Commissioner's decision and dismissed the appeal.