The NSW Supreme Court has accepted a $275,000 settlement for the class action brought against NSW Ambulance over the access and sale of personal data of 130 staff in 2013.
Laywers for the lead plaintiff, Tracy Evans, said the central question was if the settlement was fair and reasonable with the proposed value being based on the type of information disseminated and risks involved.
There were 108 participants in the class action with each person set to receive around $2400 each. Tracy Evans will receive approximately $10,000.
Centennial Lawyers first launched the action for Evans before it turned into a class action. They argued that Evans suffered acute distress due to the nature of the personal information disclosed, and she is likely to be in “high distress”.
“Data misuse is a serious problem and those who hold it and make money from our data need to take their responsibilities seriously,” solicitor George Newhouse said. “Tracy Evans’ case makes it clear that the law will intervene to protect us from the misuse and the theft of our data.
“This class action is an Australian first but it was a long and difficult road to travel. Our politicians need to intervene urgently and provide individuals with a satisfactory remedy for breaches of privacy and data breaches. If those who held our data were able to be held accountable for its misuse, then perhaps they would be more careful,” Newhouse added.
He said Australia has one of the weakest regulatory regimes compared to the US, the UK and Europe and the fact that this is the only class action "when there have been so many data breaches speaks loudly Scott Morrison must do more. Regulatory reform is urgently required," he concluded.
Centennial Lawyers had already advised that a settlement was expected to happen in court on 9 December.
Between 14 January 2013 and 1 February 2013, a contractor for NSW Ambulance Service was given access to its records and databases. Waqar Malik, who acted as an injury management coordinator, was found guilty of unlawfully disclosing the data in 2016.
As reported by the ABC, Malik sold the information to a third party "who paid thousands of dollars for the data" and was believed to be "a group of injury lawyers".
In November 2017, Centennial Lawyers filed a class action in the Supreme Court of NSW behalf of NSW Ambulance 130 employees and contractors whose sensitive health and personal information was inadvertently accessed. The information included workers compensation files, staff and medical records.
The class action requested the court to make a finding that the Health Administration Corporation, which operates NSW Ambulance, and Malik breached their obligations to the resulting in the unlawful access, downloading and/or disclosure of personal and health information.
In a opt out letter to those affected, Centennial Lawyers stated at the time that the Health Administration Corporation admitted that Malik improperly collated and disseminated information about the employees but denied that the Health Administration Corporation has any legal liability to the plaintiff or the other affected employees.
An amended statement of claim from 27 March 2018 stated Malik allegedly approached law firms to sell the information to solicitors who would use it to contact employees and procure potential litigation work.
Malik was one of the two defendants however he “has not taken part in the proceedings due to inability or failure to participate. The case against him was dropped under the condition that the NSW Ambulance staff can still pursue legal action against him.
Centennial Lawyers said they are not looking into pursuing a case against Malik at this stage.
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.