As you will see from my original post, I submitted FOI requests to CASA in the following terms on 18 August 2023:
All documents containing current CASA policy on and procedures for deidentification of originally sensitive medical information supplied by applicants for medical certificates, prior to disclosure or use by CASA for the purposes of research.
All documents containing information about the assessment of the effectiveness of CASA’s deidentification procedures, including the application of the ‘motivated intruder’ test, to mitigate the risks of reidentification of the individuals to whom the originally sensitive medical information relates.
All documents containing information about results of audits, conducted by auditors internal or external to CASA, of CASA’s compliance with CASA policy on and procedures for deidentification of originally sensitive medical information.
All documents containing information about the disclosure or use by CASA of deidentified originally sensitive medical information supplied by applicants for medical certificates, if the information in the documents includes any one or more or all of the following: The purpose of the disclosure or use of the deidentified information; the identity of the persons – natural or otherwise – to whom the deidentified information was disclosed; any description of the disclosed deidentified information; the results of the use to which the disclosed deidentified information was put.
The responses:
I have conducted a thorough search of CASAs registry files and liaised with several CASA
business units in conducting this search, I was unable to locate any documents relevant to
the scope of your request[s].
So there you have it.
Another manifestation of governance failures in CASA and the carefree contempt of Avmed for us guinea pigs.
I'll inform the OAIC accordingly.