Employee's application of outside work refused by employer - employee complained to a statutory body - employer supplied the employee's sick leave certificates to the statutory body in support of the decision made - sick leave records collected for human resources purposes - disclosure to the statutory body consistent with the purpose of collection - DPP3
The Complaint
The complainant suffered past injuries in the course of his employment. He applied to his employer for permission to engage in two part-time jobs. His application was refused by the employer after considering his sick leave records and found that he had not fully recovered from his injuries. Dissatisfied with the refusal, the complainant lodged a complaint with a relevant statutory body ("the statutory body"). Enquiries were raised by the statutory body with the employer who in response furnished it with the sick leave records of the complainant covering periods prior to the alleged injuries. The complainant accused the employer of supplying more personal data than requested by the statutory body and that disclosure was contrary to the original purpose of collection. A complaint was filed with the Privacy Commissioner.
Findings of the Privacy Commissioner
The Privacy Commissioner found that personal data of the sick leave records of the complainant were collected by his employer for the purpose of human resources management. The use of such data in considering his application for part-time employment was for a purpose directly related to the purpose of collection in compliance with DPP3. Since the complainant lodged a complaint against his employer to the statutory body, the Commissioner decided that his employer was entitled to disclose the data considered by it in coming to the decision to the statutory body and refused to investigate this complaint pursuant to section 39(2)(d). Dissatisfied with the decision of the Privacy Commissioner, the complainant lodged an appeal to the AAB.
The Appeal
In his appeal, the complainant further alleged that since the sick leave records also contained the medication prescribed to him, the disclosure was not necessary. The Board emphasized that it was only concerned whether there was any contravention of DPP3. Having considered the purpose of collection of the personal data of the complainant contained in the sick leave certificates by his employer which was clearly for human resources management, the Board found no contravention of DPP3 in the using of his medical records in determining the application for part-time jobs and the subsequent disclosure to the statutory body in response to the complainant's complaint on the decision made by the employer. The Privacy Commissioner was found not to have erred in not asking for copies of the sick leave certificates before coming to his decision as the complainant did not complain about the disclosure of medication prescribed to him in his complaint nor did he supply the Privacy Commissioner with copies of the sick leave certificates in support of his complaint.
The AAB's Decision
The appeal was dismissed.