Aron's story

Aron raised a complaint with our office about the way his personal information had been used and disclosed by Ahpra. Aron was concerned that Ahpra and the Board had unfairly stored information about him on the student register and then inappropriately disclosed that information to a third party.

While our office also considered some of Aron’s concerns as an Ombudsman complaint, the details shared here relate to our consideration of his privacy complaint to the Commissioner.

What we found

Our office investigated Aron’s concerns and found that the information Ahpra held about Aron on the student register was not accurate, up-to-date or complete. This indicated that Ahpra was not complying with APP 10.

We also found that the disclosure of information from the student register to a third party on two occasions were inappropriate disclosures of Aron’s personal information. This breached the confidentiality provisions of the National Law, and was not consistent with APP 6.

In addition, we found that Ahpra could better satisfy the requirement under APP 5 in relation to how it notifies students about the collection of their personal information for the student register. Further, Ahpra was not providing students with appropriate mechanisms to seek access to, and correction of, the personal information it holds, contrary to the requirements of APP 12 and APP 13.

Complaint outcome

The Commissioner made a determination under the Privacy Act that Ahpra had engaged in conduct constituting an interference with Aron’s privacy, and that it must take steps to ensure that such conduct is not repeated or continued.

Ahpra provided Aron with a formal apology for the interference with his privacy. It also referred the matter for review through its serious incident reporting process. This will ensure that Ahpra identifies systemic issues that contributed to the disclosure of personal information and that these issues are addressed.

Ahpra also informed the Commissioner that it is implementing significant changes to address issues surrounding data sharing and data quality for student registrants. This will include ensuring better verification of data provided by education providers and streamlining communication and data sharing to reduce potential duplication. Ahpra advised that as part of its business transformation project, it will create new comprehensive work instructions for managing student registrations.

In addition, Ahpra updated its website to include a privacy collection statement that is specific to students. It also published information about how students can contact Ahpra to receive a copy of their personal information and request that it is amended if it is incorrect.