Google search puts NSW Medical Council on the wrong side of privacy laws

A NSW tribunal has ruled that the state’s Medical Council breached privacy laws when it published what it thought was a redacted PDF document on its website, but in doing so revealed the hidden identities of a doctor and her son to Google's web crawling bot.

In April, the NSW Civil and Administrative Tribunal (NCAT) will decide what penalties to apply to the NSW Medical Council for inadvertently publishing the names online, following a legal spat over the doctor's registration that had wound up in 2009.

The previous case had been settled between the parties and a non-publication order barred anyone involved from identifying the doctor and her sick son in the context of the litigation.

But in early 2011, the doctor discovered that a Google search of her name produced a link to the Medical Council website and PDF documents of the Medical Tribunal’s 2009 decision.

The Council had gone through and blacked out the names from the files, but had not done a particularly good job of it, meaning that the underlying data was still readable by Google as it collected web references for its search index.

The doctor continued to complain to the Medical Council about the breach for several months before the document was successfully removed from the website and all Google links were cleared.

The NCAT this week ruled that a reasonable person would be able to make the link between the name search and the linked case documents, and concluded that the NSW Medical Council had breached the NSW Privacy and Personal Information Protection Act.

Both parties to the case, plus NSW Privacy Commissioner Dr Elizabeth Coombs, will be invited to have their say on an appropriate penalty for the breach.

The case echoes an earlier saga triggered by the Department of Immigration, when it published PDF and Word documents containing asylum seeker statistics online, apparently unaware that the underlying data containing names, nationalities and birth dates of some 10,000 detained individuals remained embedded in the document.

The incident prompted an adverse ruling from the Privacy Commissioner, but he decided not to penalise the Department over the matter.