Civil and Administrative Tribunal New South Wales Medium Neutral Citation: DVT v Commissioner of Police [2021] NSWCATAD 108 Hearing dates: 2 November 2020 Date of orders: 30 April 2021 Decision date: 30 April 2021 Jurisdiction: Administrative and Equal Opportunity Division Before: A Christie, Senior Member Decision: 1. The purported unilateral withdrawal of the undertaking made by the Respondent's solicitor is not valid and the undertaking remains in place and is effective as against the Respondent. 2. The Respondent has breached s14 PIPP Act/IPP 7 in respect of the Applicant's requests in Emails 1‑5 to access their personal information held by the Respondent. 3. The Respondent did not breach s14 PPIP Act/IPP 7 in respect of the Applicant's request in Email 6 to access their personal information held by the Respondent. 4. The Applicant is to file and serve submissions as to remedy, not exceeding five (5) pages, within 14 days of the date of these Reasons for Decision. 5. The Respondent is to file and serve submissions as to remedy, not exceeding five (5) pages, within 14 days after receipt of the Applicant's submissions as to remedy. 6. The matter is to be relisted for directions before Senior Member Christie as to remedy on 1 June 2021 at 9:30am. 7. I direct the Principal Registrar of the Tribunal to forward a copy of these Reasons for Decision to the NSW Legal Services Commissioner for such action as the Commissioner may consider appropriate. Catchwords: ADMINISTRATIVE LAW – privacy – request for access to personal information under s14 PPIP Act/IPP 7 – what constitutes excessive delay in the circumstances – inability to unilaterally withdraw an undertaking Legislation Cited: Administrative Decisions Review Act 1997 Civil and Administrative Tribunal Act 2013 Electronic Transactions Act 2000 Government Information (Public Access) Act 2009 Privacy and Personal Information Protection Act 1998 Cases Cited: AEC v Commissioner of Police (NSW) [2013] NSWADTAP 30 AFU v Sydney Local Health District [2012] NSWADT 197 AIN v Medical Council of New South Wales [2017] NSWCATAP 21 CEU v University of Technology Sydney [2018] NSWCATAD 13 Council of the Law Society of NSW v Jiao [2020] NSWCATOD 63 Department of Education and Training v GA (No 3) [2004] NSWADTAP 50 Department of Education and Training v ZR (No 2) [2009] NSWADTAP 44 DHU v Commissioner of Police, NSW Police Force [2018] NSWCATAD 126 DSG v Department of Education [2019] NSWCATAD 182 KT v Sydney South West Area Health Service [2010] NSWADT 94 LN v Sydney Local Health District (GD) [2012] NSWADTAP 9 QN v Commissioner of Fire Brigades (NSW) [2011] NSWADT 125 Category: Principal judgment Parties: DVT (Applicant) Commissioner of Police (Respondent) Representation: Counsel: M Seck (Respondent) Solicitors: DVT (Self Represented) Crown Solicitor (Respondent) File Number(s): 2019/00127295 and 2019/00230579 Publication restriction: Pursuant to sections 64(1)(a) and (c) of the Civil and Administrative Tribunal Act 2013 the disclosure of the name of the Applicant and publication of evidence given in the proceedings and of matters contained in documents lodged with the Tribunal which identify the Applicant is prohibited. REASONS FOR DECISIOn 1. These proceedings involve two applications made by the Applicant pursuant to s55 of the Privacy and Personal Information Protection Act 1998 (PPIP Act): 1. an application on 24 April 2019 (First AR Application) for administrative review of the Respondent's conduct which was the subject of an internal review decision under s53 PPIP Act, which decision is dated 26 March 2019 (First IR Decision). The Applicant's request for internal review was dated 15 January 2019 (First IR Request); and 2. an application on 23 July 2019 (Second AR Application) for administrative review of the Respondent's conduct which was the subject of an internal review decision under s53 PPIP Act, which decision is dated 26 June 2019 (Second IR Decision). The Applicant's request for internal review was dated 26 April 2019 (Second IR Request). 1. On 27 August 2019, with the consent of the parties, the proceedings for both the First AR Application and the Second AR Application were consolidated by the Tribunal. 2. Before the hearing of the substantive matter (or "breach stage") on 2 November 2020 (Hearing) to which these Reasons for Decision relate there were several directions hearings, interlocutory and interim matters raised on which submissions were made and, in some cases, on which the Tribunal made relevant orders, in particular in respect of a summons application by the Applicant (Summons Application). It is in relation to the Summons Application and during the related hearing that an oral undertaking was made by the Respondent's solicitor during that Summons Application hearing on 10 December 2019. In response to Senior Member Montgomery's question "So can you give an undertaking to [DVT] to not run the Deed argument at the breach stage?". The Respondent's solicitor responded "Yes. Yes, the respondent is in a position to do to so" (Undertaking). 3. Pursuant to the consent order of Senior Member Montgomery on 21 May 2020, the Hearing and these Reasons for Decision are limited to whether there has been a breach of s14 PPIP Act (IPP 7) by the Respondent (s14 PPIP Act breach issue) and were not to address remedies if any breach is found. 4. The Respondent sought to unilaterally withdraw from the Undertaking in writing by a letter dated 30 April 2020 to the Applicant (Withdrawal Letter). The validity of that withdrawal (and thus of whether the Undertaking remains in place) also must be determined by the Tribunal as part of the Hearing and these Reasons for Decision. Background 1. On 22 November 2011 a meeting was attended by the Applicant and the Applicant's legal representatives to negotiate and attempt to settle a number of workers compensation and other claims made by the Applicant against the New South Wales Police Force (NSWPF). As a result of that meeting a deed of release was executed on 22 November 2011 by the Applicant and the NSWPF (Deed). The ability or otherwise to "use" or rely on the terms of the Deed is the subject of the Undertaking, including the referencing of the Deed in the Respondent's submissions filed on 6 March 2020 prior to the Withdrawal Letter. 2. The First IR Request referred to (and attached) five email messages sent by the Applicant requesting access to their personal information under s14 PPIP Act (IPP 7) and requested an internal review by the Respondent on the basis that the Respondent had "failed to provide [the Applicant] with access to my personal information [as requested in those five emails] without excessive delay" (Conduct of Concern 1). The Applicant alleged that the Conduct of Concern 1 was in breach of s14 PPIP Act. 3. The five emails attached to the First IR Request were, in summary, as follows: 1. an email dated 11 May 2017 addressed and sent to iau@police.nsw.gov.au requesting access to "all information held about me on the SAP and RMS database" (Email 1); 2. an email sent on 21 May 2017 addressed and sent to iau@police.nsw.gov.au requesting access to "all documents constituting, evidencing, concerning or referring to the direction/s issued by on behalf of the [NSWPF] pursuant to clause 9(b) of the [Deed]" (Email 2); 3. an email dated 15 June 2017 addressed and sent to iau@police.nsw.gov.au requesting access to "all documents arising out of or in any way connected with the assessment and/or determination of the Medal Assessment and Review Panel in relation to my eligibility for the awarding of a National Police Service Medal on or about 16 May 2014" (Email 3); 4. an email dated 28 April 2018 addressed and sent to keat1ber@police.nsw.gov.au requesting access to a number of named documents referring to the Applicant (various emails and file notes of Ms Keating of the Respondent) between April 2017 and April 2018 (Email 4); and 5. an email dated 29 June 2018 addressed and sent to gipaapp@police.nsw.gov.au requesting access to "documents containing information about my entitlement to a refund of the advance deposit of $150.00 paid for application reference 128401 on or about 16 March 2015 pursuant to s71(2) of the Government Information (Public Access) Act 2019 (NSW)" (Email 5). 1. In the Second IR Request the Applicant referred to (and attached) an email dated 20 December 2018 addressed and sent to Ms Keating at keat1ber@police.nsw.gov.au (Email 6) requesting access to "copies of all emails, file notes and memorandums arising out of my application for ex-gratia legal assistance". The Applicant requested an internal review by the Respondent in relation to Email 6 on the basis that the Respondent failed to provide the Applicant with access to their personal information (as requested in Email 6) without excessive delay (Conduct of Concern 2) in breach of s14 PPIP Act/IPP 7. Internal review decisions 1. In the First IR Decision the Respondent's internal reviewer found, as regards each of Emails 1-5, in summary: 1. Emails 1-3: There was no breach of s14 PPIP Act (i.e. excessive delay by the Respondent) as the access requests were not directed and posted to the person/business unit and address specified in NSWPF's Privacy Management Plan (PMP) but were emailed to the incorrect business unit within NSWPF; 2. Email 4: The Respondent has not failed to comply with s14 PPIP Act (i.e. there was no excessive delay by the Respondent) because the Applicant's access request was not directed and posted to the person/business unit and address specified in the PMP but, instead, had been emailed directly to Ms Keating, then a Senior Lawyer in the Office of the General Counsel for NSWPF. At the time of this email, Ms Keating was on maternity leave and thus the Respondent was not aware of this request and the Applicant received an automated "out of office" response noting that Ms Keating was away until 30 June 2018, that emails to this address would not be actioned in her absence and provided the contact details of those persons to whom enquiries could be directed in the meantime; and 3. Email 5: The Respondent had not failed to comply with s14 PPAP Act (i.e. there was no excessive delay by the Respondent) because the Applicant's request had not been directed and posted to the person/business unit and address specified in the PMP but instead had been emailed directly to the "InfoLink Command of the NSWPF" and InfoLink Command did not have responsibility under the PMP for any function related to the PPIP Act. However, and in any event, the request had been appropriately actioned "without excessive delay" as evidenced by a series of email exchanges between the Applicant and the InfoLink Command between 4 and 13 July 2018 and because, ultimately, the amount in question was repaid to the Applicant in July 2018. 1. In the Second IR Decision the Respondent's internal reviewer found that the Respondent had not failed to comply with s14 PPIP Act (i.e. there was no excessive delay by the Respondent) as regards the personal information requested in Email 6 as this access request had not been directed and posted to the officer specified in the PMP but instead was directed to Ms Keating. Ms Keating remained on leave and, ultimately, resigned without returning to work and her email was not monitored and thus the Respondent did not receive and/or was not aware of the Applicant's access request in Email 6 until receipt of the Second IR Request. 2. The internal reviewer in the Second IR Decision also noted that, after receiving the Second IR Request, searches had been conducted for information falling within the scope of the Applicant's access request in Email 6 which searches located a large amount of information and the internal reviewer concluded that further searches would be necessary to identify the Applicant's personal information and such would be an unreasonable and substantial diversion of the Respondent's resources. Issues for determination 1. In summary the issues for determination, as at the time of the Hearing and in these Reasons for Decision, are: 1. whether the purported withdrawal of the Undertaking by the Withdrawal Letter is valid and thus whether the Undertaking is or is not in force as at the date of the Hearing; 2. the consequences of the decision in relation to (1) above on the scope of the Tribunal's inquiry in relation to the alleged breach by the Respondent of IPP 7 (i.e. can the Respondent rely on certain terms of the Deed to argue that IPP 7 has not been breached by the Conduct of Concern 1, the Conduct of Concern 2 or that any such breach is excused or are there any resulting limitations on which of the Respondent's submissions the Tribunal will consider); and 3. applying the decision in relation to (2) above, whether the Respondent's conduct of concern breached IPP 7/s14 PPIP Act. 1. In accordance with the prior consent order of the Tribunal, any remedies (if relevant) will be the subject of a separate hearing. Scope of the Tribunal's jurisdiction and its role in administrative reviews 1. Part 5 of the PPIP Act provides for the review of certain specified conduct of a public sector agency such as the Respondent. Most relevantly in this case, the conduct as set out in s52 PPIP Act is: (1) This Part applies to the following conduct - (a) the contravention by a public sector agency of an information protection principle that applies to the agency… 1. Section 53 PPIP Act, under which the Applicant made the First IR Request and the Second IR Request, most relevantly provides: (1) A person ("the applicant") who is aggrieved by the conduct of a public sector agency is entitled to a review of that conduct… 1. The purpose of an internal review by an agency (i.e. the Respondent in this case) is to determine whether any of the alleged conduct of concern of that agency raised in the First IR Request and the Second IR Request (i.e. the Conduct of Concern 1 and the Conduct of Concern 2) amounted to a contravention of one or more of the Information Privacy Principles (IPPs) or any applicable privacy codes: Department of Education and Training v GA (No 3) [2004] NSWADTAP 50. 2. Section 55(1) PPIP Act provides that a person dissatisfied with the findings of or actions proposed by an internal review (in this case the First IR Decision and Second IR Decision) may request the Tribunal to review that agency's conduct of concern which was the subject of the internal review(s). 3. Several decisions of the Appeal Panel have set out of some fundamental principles that govern the scope of a review of an agency's conduct under the PPIP Act by this Tribunal. In an application for administrative review of an agency's conduct under s55(1) PPIP Act (i.e. the First AR Application and Second AR Application in this case), where the Applicant is dissatisfied with the findings of or action proposed in the internal review decision(s), the Tribunal is limited to reviewing the scope of the conduct of concern the subject of the original application(s) for the internal review (i.e. in this case the First IR Request and the Second IR Request). The Tribunal does not have jurisdiction to review conduct of the agency allegedly breaching the IPPs that was not the subject of the application(s) for internal review to the agency: Department of Education and Training v GA (No 3) [2004] NSWADTAP 50 at [7]; Department of Education and Training v ZR (No 2) [2009] NSWADTAP 44 at [17] (also see CEU v University of Technology Sydney [2018] NSWCATAD 13 at [76]). 4. It is not in dispute that the Tribunal has jurisdiction to review the Conduct of Concern 1 and Conduct of Concern 2 pursuant to s55(1) PPIP Act, s30 Civil and Administrative Tribunal Act 2013 (CAT Act) and s63 Administrative Decisions Review Act 1997. 5. The Tribunal held in DSG v Department of Education [2019] NSWCATAD 182, at [73], that: When reviewing conduct that is the subject of an internal review under the PPIP Act, the Tribunal is exercising its administrative review jurisdiction. 1. In the case of an administrative review the Tribunal is not reviewing the First IR Decision and/or the Second IR Decision (in this case) but the original conduct of concern of the agency (in this case the Conduct of Concern 1 and the Conduct of Concern 2) which the Applicant complained about in the First IR Request and the Second IR Request (in this case): see AEC v Commissioner of Police (NSW) [2013] NSWADTAP 30 at [34]. The PPIP Act and IPP in question 1. The PPIP Act regulates the manner in which NSW Government agencies, including the Respondent, and certain other entities deal with and manage personal information. "Personal information" is defined in s4 PPIP Act as: (1) In this Act, "personal information" means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. (2) Personal information includes such things as an individual's fingerprints, retina prints, body samples or genetic characteristics. 1. Section 4(4) PPIP Act further provides: For the purposes of this Act, personal information is "held" by a public sector agency if- (a) the agency is in possession or control of the information, or (b) the information is in the possession or control of a person employed or engaged by the agency in the course of such employment or engagement, or (c) the information is contained in a State record in respect of which the agency is responsible under the State Records Act 1998. 1. It is not in dispute that the information in question (i.e. to which access was sought in Emails 1-6) is the personal information of the Applicant which is held by the Respondent. 2. Sections 8 to 19 PPIP Act set out the twelve IPPs that govern the way in which an agency (in this case the Respondent) must collect, store, access, use and disclose personal information. Relevantly, for the purposes of the present proceedings before the Tribunal, s14 PPIP Act (IPP 7) provides (in its entirety): 14 Access to personal information held by agencies A public sector agency that holds personal information must, at the request of the individual to whom the information relates and without excessive delay or expense, provide the individual with access to the information. 1. As explained by the Appeal Panel in AIN v Medical Council of New South Wales [2017] NSWCATAP 21: [23] Section 14 requires an agency, not only to provide personal information that it holds but to do so "without excessive delay or expense". The Tribunal should have addressed the question of whether the information was provided "without excessive delay or expense" at the liability stage. Even though the Medical Council had provided some of the documents by the time of the hearing, there was an outstanding issue as to whether it had provided that information "without excessive delay or expense". AIN was clearly submitting that there had been excessive delays and that she had been put to unnecessary expense. [24] If the Tribunal had found that access had been provided, but with excessive delay or expense, that would have constituted a breach of s14. AIN would then have had an opportunity to make submissions as to any appropriate remedy or relief. Instead, the Tribunal made no finding either way as to whether there had been a breach of s14 in relation to these items. [emphasis added] 1. As regards from when-to-when time runs in terms of calculating any alleged excessive delay, the predecessor of this Tribunal determined in AFU v Sydney Local Health District [2012] NSWADT 197 (AFU) at [21] that: … the correct approach … is to determine the timeframe between the date when the respondent received the applicant's request under s. 14 of the PPIP Act and the date when the respondent received the applicant's internal review application under s. 53. 1. In AFU at [26] the predecessor of this Tribunal noted that the term "excessive delay" should be given its ordinary meaning and at [31] that the volume of material to be extracted and assembled is relevant to whether there has been excessive delay in responding to an access request under s14 PPIP Act. 2. Certain sections of the PPIP Act may exempt or excuse non-compliance with certain of the IPPs in specified circumstances. Given the Respondent is the NSWPF, s27 PPIP Act is an example of such a provision of the PPIP Act raised by the Respondent in this case: 27 Specific exemptions (ICAC, ICAC Inspector and Inspector's staff, NSW Police Force, LECC, Inspector of LECC and Inspector's staff and NSW Crime Commission) (1) Despite any other provision of this Act, …, the NSW Police Force, … are not required to comply with the information protection principles. (2) However, the information protection principles do apply to …, the NSW Police Force, … in connection with the exercise of their administrative and educative functions. The Hearing and evidence 1. The Hearing was held on 2 November 2020 by telephone. 2. The evidence submitted and relied on by the Applicant is the Statement of DVT (and attached documents) filed on 11 September 2020 (DVTS). 3. The evidence submitted and relied on by the Respondent is: 1. the Affidavit of Senior Sergeant Mr Mark Philip Twyman filed on 6 March 2020 (TA); 2. the Second Affidavit of Senior Sergeant Mr Mark Philip Twyman filed on 2 November 2020 (TA2); and 3. the open and confidential bundles of s58 documents filed on 19 July 2019 and additional s58 documents filed on 6 March 2020. 1. Both parties (i) filed written submissions on or prior to the Hearing (Respondent: confidential Submissions of the Respondent filed on 6 March 2020 (RS) and Submissions of the Respondent in Reply filed on 2 November 2020 (RRS) and Applicant: Submissions of the Applicant filed on 17 September 2020 (AS)) and (ii) presented oral arguments and made further submissions during the Hearing. 2. Along with reserving the decision in respect of the s14 PPIP Act breach issue, the Tribunal reserved its decision on the validity of the purported withdrawal of the Undertaking by the Withdrawal Letter and requested the parties to submit written submissions of up to five (5) pages in relation to the impact of the Deed on the s14 PPIP Act breach issue given the possibility that the Undertaking may be found to have been validly withdrawn by the Respondent. Since the Hearing 1. The Applicant filed Supplementary Submissions on 12 November 2020 (SSA) and the Respondent filed Supplementary Submissions of the Respondent on 23 November 2020 (SSR) in respect of the impact of the Deed on the s14 PPIP Act breach issue should the Tribunal find that the Undertaking had validly been withdrawn by the Respondent. The Withdrawal Letter/Undertaking issue 1. Given the impact that my decision on the Withdrawal Letter/Undertaking issue will have as to whether the Tribunal considers: (i) the Respondent's submissions in the RS and RRS in relation to relevant terms and/or the existence of the Deed as regards the s14 PPIP Act breach issue; and/or (ii) the SSA and SSR, I deal with this issue first. 2. The Undertaking was "to not run the Deed argument at the breach stage". I have interpreted this to mean that, while the Undertaking remains effective, the Respondent cannot use or rely on the existence of the Deed or any of the terms of the Deed in relation to its submissions on or relating to the s14 PPIP Act breach issue (i.e. whether the Conduct of Concern 1 or the Conduct of Concern 2 breached IPP 7) which was the main issue before me at the Hearing and addressed in these Reasons for Decision. 3. The Undertaking was made during the Summons Application hearing in order to persuade the Applicant to drop the request in their Summons Application in relation to a number of documents which had originally been requested by the Applicant to be included in that summons, which the Applicant did. 4. On 6 March 2020, despite the Undertaking and prior to the purported withdrawal of it by the Respondent in the Withdrawal Letter on 30 April 2020, the Respondent made several written submissions in the RS in relation to the Deed and its provisions in relation to their impact on the s14 PPIP Act breach issue. In particular, without traversing all of the detail, the Respondent's relevant submissions in the RS went to the legal excuses for the Respondent not to comply (i.e. exempting the Respondent from complying) with IPP 7/s14 PPIP Act including: 1. pursuant to s25(a) or (b) PPIP Act and specific provisions of the Deed arguing that any such non-compliance in relation to Emails 1, 2 and 3 was "lawfully authorised" or permitted under "any other law" by reference to certain terms of the Deed; and 2. in the alternative, the existence of the Deed enlivened s24(1) PPIP Act and, as the Respondent is an "investigative agency", complying with s14 PPIP Act in respect of Emails 1, 2 and 3 would "detrimentally affect or prevent the proper exercise of the Respondent's complaint handling functions" in this case by undermining the Respondent's ability to resolve complaints via a private settlement (i.e. by way of the Deed). 1. The Respondent's position as to the Undertaking stated in the Withdrawal Letter, the RRS and SSR is, most relevantly in summary, as follows: 1. Since the Undertaking was not given to the Tribunal it is not necessary for the Respondent to seek to be released from the Undertaking by the Tribunal. 2. Since the time of the Undertaking the Respondent has filed written submissions dated 6 March 2020 which, in part, rely on the Deed as to discharging the Respondent's obligation to respond to three of the Applicant's access requests. "On reflection, the Respondent now considers that that is an issue which properly and necessarily goes to the question of breach, rather than remedy." 3. The Respondent should not remain bound by the Undertaking or otherwise refrain from relying on the relevant aspects of its submissions of 6 March 2020 (i.e. in the RS), for the following reasons: 1. an additional month was allowed in the timetable for the Applicant's evidence and submissions and any further issues under the summons, or issuing a new summons, as the Applicant considered necessary could have been raised by the Applicant during that time but no further issues were raised by the Applicant; 2. in any event, as part of other proceedings, the Applicant was subsequently provided with two of the three specific documents which they originally sought under the Applicant's proposed summons but which were not pushed by the Applicant in the Summons Application hearing in response to the Undertaking; and 3. on the basis of the matters set out above "the Respondent withdraws his undertaking given to [the Applicant] on 10 December 2019. The Respondent accordingly proposes to rely on the aspects of his submissions dated 6 March 2020 addressing the Deed". 1. In the AS the Applicant submitted, most relevantly in relation to the Withdrawal Letter/Undertaking issue, as follows: 1. The Applicant has conducted their case in reliance on the Undertaking given to them by the Respondent. 2. The Applicant has not released the Respondent from the Undertaking and wishes to have it enforced. 3. It is not open to the Respondent to now change its position after both the Respondent and Applicant have proceeded after the Summons Application hearing on 10 December 2019 on the basis that the Respondent will not run the Deed argument at the s14 PPIP Act breach issue stage. 4. The Respondent's change of position in breach of the Undertaking given to the Applicant is unconscionable and unbecoming of a model litigant. 5. The Tribunal is to act according to equity and good conscience (under 38(4) CAT Act). As such, the Tribunal ought not to give its imprimatur to such conduct by allowing the Respondent to run the Deed argument at the s14 PPIP Act breach issue stage. 1. In Council of the Law Society of NSW v Jiao [2020] NSWCATOD 63 (Jiao) the Tribunal, in different circumstances but relevant to the importance and consequences of a solicitor's undertaking, reviewed the failure of a solicitor to comply with the solicitor's undertaking to the Law Society of NSW and found, most relevantly: [22] Rule 6.1 of the Legal Profession Uniform Law Australian Solicitor's Conduct Rules 2015 provides: A solicitor who has given an undertaking in the course of legal practice must honour that undertaking and ensure the timely and effective performance of the undertaking, unless released by the recipient or by a court of competent jurisdiction. [23] The Law Society referred us to Riley's Solicitors Manual at [28,030.1]: "The Supreme Court's accreditation of a lawyer upon admission to practice impliedly represents that the lawyer is a person worthy of public trust and confidence ... Fidelity to undertakings given by a lawyer in the course of professional practice is thus an important component of the lawyer's professional responsibility and is directly relevant to the court's continuing accreditation of his or her fitness." [24] This Tribunal (and its predecessor) has, on many occasions, found that solicitors who failed to comply with an undertaking that they provided, were guilty of professional misconduct. Both Lewis and Powell involved undertakings to complete a Course. See also Law Society of New South Wales v Thompson [2018] NSWCATOD 57. [25] In Powell, the Tribunal held, at [20]: It is an everyday occurrence in all areas where lawyers practice that legal practitioners provide undertakings to fellow practitioners and to a wide range of commercial and statutory entities both on their own behalf and on behalf of clients. Other legal practitioners and commercial and statutory entities rely upon compliance with those undertakings in their everyday activities. Such reliance is integral to the efficient and effective functioning of a whole range of activities within our community. It is essential that undertakings given by legal practitioners be genuinely provided and that they be honoured. It is for these reasons that prima facie, a breach by a legal practitioner of an undertaking, whether given during legal practice or not, will arguably constitute a most serious matter, and may, in relevant circumstances, adversely impact upon the integrity of the profession in the eyes of the public. [26] The Tribunal was of a similar view in Lewis, at [55] and [56]. 1. Based on the submissions on this issue of the Respondent and the Applicant (whose submissions I preferred) and the Tribunal's discussion in Jiao, I am satisfied and find that the Respondent's solicitor cannot unilaterally withdraw from the Undertaking. Thus, given that the Applicant has not released the Respondent's solicitor from the Undertaking and wishes it enforced, the purposed withdrawal of the Undertaking by the Withdrawal Letter is not valid and the Undertaking remains effective as at the date of the Hearing. 2. As the Undertaking stands, I have not considered in coming to my decision on the s14 PPIP Act breach issue set out in these Reasons for Decision any of the Respondent's submissions in the RS (or elsewhere) relating to or referring to the Deed (or any provisions of the Deed). That is, for clarity, for the purposes of my current consideration of and my decision on the s14 PPIP Act breach issue I have not considered paragraphs [60(a), (b), (c), 61‑66 and 69‑91] of the RS and any like submissions made by the Respondent during the Hearing or in any other documents submitted by or on behalf of the Respondent. 3. As a result of the findings in paragraph [44] above, the SSA or SSR are redundant to the s14 PPIP Act breach issue. As such, I have not considered them in coming to my decision and in these Reasons for Decision in respect of the s14 PPIP Act breach issue. 4. Given the actions of the Respondent's solicitor in relation to the Undertaking and the RS noted above and my finding in paragraph [44] above that the purported unilateral withdrawal of the Undertaking is not valid, I am satisfied that this issue should be brought to the attention of the NSW Legal Services Commissioner for consideration and such action as the Commissioner determines is appropriate. The s14 PPIP Act breach issue Respondent's submissions 1. In the RS the Respondent accepted, in summary, that: 1. Emails 1-6 constituted requests by the Applicant for access to their personal information. 2. Other than for Email 5 the Applicant received no responses to their email requests (in Emails 1, 2, 3, 4 and 6) up to the date that the Applicant requested internal reviews alleging contravention of s14 PPIP Act (i.e. the First IR Request and the Second IR Request). 3. Emails 1-5 were sent to email addresses of the Respondent and were received by those addressees. 4. There is correspondence to indicate that two of the email access requests (Emails 1 and 2) were seen and handled to some degree by persons within the Respondent, without a response being provided to the Applicant. 5. The RMS database contains documents that include the Applicant's personal information and go to the Respondent's administrative and educative functions, in addition to documents connected with its official and public functions. 1. In the RS the Respondent submits, in summary, that s14 PPIP Act has not been contravened by the Respondent because: 1. In respect of Emails 1‑6: 1. any delay in addressing the Applicant's requests for personal information cannot be considered excessive in circumstances where the Respondent was either not aware or could not reasonably be expected to be aware of the Applicant's requests. That is, due to the Applicant's access requests being sent to and received by the Respondent by a person/business unit and sent by means other than as specified in the PMP; and 2. as regards Email 5, although incorrectly addressed, it was in any event substantively and appropriately actioned without excessive delay through separate and subsequent correspondence between the Respondent and the Applicant and repayment of the amount in question to the Applicant resolved the information access request in Email 5. That is, the making of the refund by the Respondent to the Applicant was an adequate substantive response to the Applicant's information access request in Email 5 and was made within two weeks of that access request being made. 1. The issues arising for consideration in respect of s14 PPIP Act should be considered by the Tribunal within the broader history of disputes and litigation between the Applicant and the Respondent. That history bears on what could reasonably be expected of the Applicant and the Respondent in sending and responding to these access requests. 2. The Tribunal has observed that the assessment of whether there has been excessive delay in responding to a request is context dependent and must take into account the facts and circumstances surrounding a request (KT v Sydney South West Area Health Service [2010] NSWADT 94 at [45]; QN v Commissioner of Fire Brigades (NSW) [2011] NSWADT 125 at [70]). 3. In respect of Emails 4 and 6 the Respondent could not be expected to have been aware of the existence of these access requests prior to the receipt of the Applicant's requests for internal review as Emails 4 and 6 were directed to a staff member who was on leave and who, ultimately, did not return to work at the Respondent. 4. An agency (i.e. the Respondent) cannot, as a general rule, be expected to unerringly be able to correctly identify and respond to requests which are inappropriately sent to its individual staff and/or miscellaneous addresses associated with an agency. 5. While the PPIP Act does not specify how access to personal information pursuant to s14 PPIP Act is to be requested, s33(1) PPIP Act requires that a public sector agency prepare and implement a privacy management plan (i.e. the PMP) which must include provisions relating to policies and practices for ensuring the Respondent's compliance with the PPIP Act. The PMP specifies the mechanism for making requests for personal information to the Respondent by posting a letter to the "Privacy Co‑ordinator, Employment Law Unit, Office of the General Counsel, NSW Police Force, Locked Bag 5102, Parramatta NSW 2124". 6. The Applicant is experienced in making PPIP Act access requests and therefore should have been aware that a request for personal information would need to be directed to an appropriate officer within the Respondent and sent by the specified means in order to be actioned appropriately. 7. The Applicant should have been on notice that their requests may not have been processed correctly within months of not receiving a response. The lack of any attempt by the Applicant to clarify the position with the Respondent in the lengthy period before seeking internal reviews is a factor that should be considered in determining whether the Respondent's delay in responding to those emails was excessive. 8. At the time Email 4 was sent to Ms Keating, a senior lawyer within the Office of the General Counsel, Ms Keating had commenced a period of leave which was not anticipated to conclude until 30 June 2018 and, in response to Email 4, the Applicant received an "out‑of‑office" automated reply from Ms Keating's email address noting this and providing contact details for Ms Keating's manager and secretary. 9. In respect of Email 1, the Respondent is not required to comply with this access request of the Applicant to the extent it seeks "all information held about me on the … RMS database(s)" as this would include material that is not in connection with the exercise of the Respondent's "administrative or educative functions". The Respondent is therefore exempt from compliance with the access request in Email 1 pursuant to s27 PPIP Act as the wording of Email 1 "does not allow for" the Respondent to readily draw the distinction between documents relating to its administrative and other functions in undertaking searches of the RMS database. Therefore, the Respondent considers that it is not obliged to comply with any of the Applicant's access request in Email 1 "as presently framed" pursuant to s27 of the PPIP Act 1. The Respondent reserved its position on appropriate remedies, should a breach of s14 PPIP Act be found by the Tribunal, pending further elaboration from the Applicant as to the specific remedies sought. Applicant's submissions 1. In the AS the Applicant, most relevantly and in summary, submits: 1. The PPIP Act is beneficial legislation and should be interpreted widely to ensure that applicants are not unnecessarily denied the right to have access to their personal information which is held by public sector agencies (DHU v Commissioner of Police, NSW Police Force [2018] NSWCATAD 126 at [13]). 2. A request for access to personal information under s14 PPIP Act is not invalid because it was made by email (citing s7(1) of the Electronic Transactions Act 2000). 3. At paragraph [22] of the RS the Respondent accepts that Emails 1‑6 constituted requests by the Applicant for access to their personal information. 4. The PMP is not mandatory as regards individuals whose personal information is held by the Respondent but provides guidance only and, accordingly, there is no statutory requirement for the Applicant to adhere to the guidance in the PMP (i.e. as to who to direct requests to and the means to send them) when submitting an access request under IPP 7 for the Applicant's personal information held by the Respondent. 5. The requests under s14 PPIP Act/IPP 7 were sent to the Information Access Unit (IAU) and the Office of the General Counsel. The Respondent's submission that access requests sent to those areas/email addresses within the Respondent might cause confusion is disingenuous. The IAU deals with access to information and the Office of General Counsel is where the Privacy Co‑ordinator is located. 6. The number of days between each of the relevant access requests (i.e. dates the emails were received by the Respondent) and the relevant internal review request for each email is as follows: 1. Email 1: 11 May 2017-15 January 2019 (615 days); 2. Email 2: 21 May 2017-15 January 2019 (605 days); 3. Email 3: 15 June 2017-15 January 2019 (580 days); 4. Email 4: 28 April 2018-15 January 2019 (263 days); 5. Email 5: 29 June 2018-15 January 2019 (201 days); and 6. Email 6: 20 December 2018-24 April 2019 (126 days). 1. The Respondent's delay (as set out in sub‑paragraph (6) above) in responding to each relevant access request under s14 PPIP Act is grossly excessive and beyond any justification. In the circumstances, the Respondent has contravened s14 PPIP Act by failing to provide access, without excessive delay, to the personal information of the Applicant held by the Respondent requested in each of the Applicant's email requests for access. Submissions of the Respondent in reply 1. In the RRS the Respondent submits, most relevantly in summary, that: 1. None of the Applicant's requests were sent to the address designated by the Respondent in the PMP for requests of that type. Indeed, no electronic address has been designated for that purpose in the PMP. 2. The issue to be addressed by the Tribunal in assessing whether there has been excessive delay is not simply the time at which the requests for personal information were "received" by members of the Respondent, but whether the delay in responding to those requests was in all circumstances reasonable. The Respondent submits that, due to the misdirection of those emails, particularly given the complex history between the Applicant and the Respondent, any delay cannot reasonably be regarded as excessive. 3. The Respondent has no record of receiving Email 6 sent to the email address of Ms Keating following her resignation from the Respondent effective on 9 May 2018 (and see the TA at [13]). 4. The Respondent is not submitting that an agency should not ultimately be obligated to deal with a misdirected requested for personal information after it comes or is brought to the agency's attention simply because the request did not use the address and means specified in the PMP. Rather, the Respondent submits that, when the mechanisms that the Respondent has provided to assist and avoid delay are ignored, this strongly militates against the conclusion that there has been any excessive delay. 5. The InfoLink Command does not deal with any "access to information" requests under the PPIP Act but with requests arising under the GIPA Act, a distinction the Applicant should have been well aware of due to the Applicant's experience in making requests to the Respondent under both the GIPA Act and the PPIP Act schemes. 6. The Applicant's indication that they sent some of the requests to the Office of General Counsel disguises the fact that those requests (Emails 4 and 6) were sent to a specific staff member within the Office of General Counsel (Ms Keating), a choice which led to the difficulties arising from her leave and subsequent resignation. The Respondent's evidence 1. In TA2 Mr Twyman, a Senior Sergeant with the Respondent, stated most relevantly and in summary that: 1. In my experience over 18 years of conducting such audits, I obtained a good understanding of how emails are processed by the [Respondent's] system. I have also consulted with relevant DTI staff, where necessary, to supplement my own knowledge of the [Respondent's] email system in preparation of this affidavit. 2. An email sent to the NSWPF undergoes several stages of processing. A simplified explanation of the process is as follows: 1. an email is sent to the NSWPF email system using a relevant domain name (e.g. "@police.nsw.gov.au"); 2. prior to entering the NSWPF email system, any incoming email undergoes a security check by the "Gateway" system to assess whether it contains a virus or spam. Logs of emails which have undergone the security check (successfully or not) are retained for a maximum of 18 months; 3. an email that passes the security check will enter the NSWPF email system for further processing. The system then checks whether the email address is valid. A valid email address is one that belongs to an active mailbox. Logs of emails which have undergone this check (successfully or not) are retained by the system for a maximum of one month; 4. if the email does not contain a valid address, the email is rejected and a "delivery failure" email will be sent to the sender. Those emails are not successfully received by the NSWPF email system; 5. if the email does contain a valid email address, it is directed to the mailbox associated with that address. Those emails are successfully received by the NSWPF email system. Simultaneously, a copy is saved to the Vault …; and 6. the email mailbox of Ms Keating is no longer available to be searched. However, on 1 October 2020 I conducted a search of the Vault in relation to emails received at Ms Keating's email address. That search demonstrated that no emails were received at that address after 9 May 2018. 1. In the TA Mr Twyman notes, in summary, that on his searching the IT systems of the Respondent, including the "Vault", he located (i.e. the Respondent received) the original email access requests of the Applicant, being Emails 1, 2, 3, 4 and 5. However, Mr Twyman did not locate (i.e. the Respondent did not receive) Email 6 sent to Ms Keating's email address on 20 December 2018. Consideration and findings Qualifications/conditions on IPP 7 right 1. IPP 7/s14 PPIP Act does not include in its wording any qualifications, requirements or conditions to (or contemplate the ability to impose such on) an individual's exercise of their right to access their personal information held by an agency. That is, one's history with the agency, experience or otherwise with PPIP Act access requests, how or to whom within the agency an access request is made or if some information within the ambit of the request is exempted from access do not generally limit the exercise of one's right under IPP 7/s14 PPIP Act to access one's personal information held by an agency which is not subject to a relevant exemption. As regards the equivalent HPP 7, the lack of legislative conditions or requirements imposed (and inability for an agency to impose such) on access was confirmed by the Appeal Panel in LN v Sydney Local Health District (GD) [2012] NSW AD7AP9 at [17]. 2. No specified means of contacting or person to contact in respect of a s14 PPIP Act/IPP 7 access request 'suggested' by the Respondent, whether in a privacy management plan, on a website or otherwise is binding on or otherwise restricts an individual (i.e. in this case the Applicant) in the exercise of their right under IPP 7 to seek access to their personal information held by the Respondent. There can be no fetter on the means of making or to whom or which part of an agency an individual may apply pursuant to IPP 7 for access to their personal information held by that agency. 3. As long as, as in this case, the email address is a valid email address of the Respondent or an employee, function or area of the Respondent and the email was received by that addressee (e.g. with no bounce back or delivery failure notice sent to the individual) then the Respondent has received the access request for the purposes of the PPIP Act. It is up to the Respondent to have in place appropriate measures to ensure that all such access requests are appropriately referred internally, dealt with and responded to (i.e. access is provided) in a timely manner and "without excessive delay". 4. Certain circumstances may come into play in determining whether there has been excessive delay in a specific case (i.e. the time permitted for an agency to provide access), which may allow a longer period than in other circumstances in which to provide access. However, those factors do not include the access request experience or otherwise of the individual requesting the information, the history of dealings with the Respondent (or any other agency), for example. While it may be in the circumstances that some additional small amount of time is allowed for granting of access (i.e. before it is considered excessive delay) where the request is made to other than the area/person specified in the PMP (in this case), this does not allow for either undue delay or an unlimited time for the Respondent to provide access (i.e. until an individual requests an internal review for example). In the Respondent's case, where the request is made in person to a police officer in a police station in remote New South Wales, for example, the additional time granted in which to comply with IPP 7 may likely be a little longer than if the request was emailed to an employee, area or function in a main or the head office of the Respondent. 5. It is the Respondent's (in this case) obligation to implement appropriate processes, escalation procedures and training of all its personnel to ensure that, no matter who of or how the Respondent receives a personal information access request under IPP 7, all requests so received will be directed by them to the appropriate person (as far as the Respondent is concerned) within the Respondent to deal with such access requests "without excessive delay". In addition, should a staff member whose out‑of‑office message indicates that they will return on a specified date not return to work, it is beholden on the agency at the time they know that the staff member will not be returning to work to check that staff member's email address/inbox to ensure that anyone who may otherwise have been happy to wait until that staff member's return to process their access request is not disadvantaged by that staff member, subsequent to the receipt of the access request, leaving the agency and their access request not being processed. 6. Further it is not required under IPP7/s14 PPIP Act for, or incumbent upon, an individual who has applied to an agency under IPP 7 to follow up or chase that agency in relation to their access request (in the absence of a delivery failure notice, for example) if the agency has not responded to that request within any specified time. It is the agency's obligation to comply with IPP 7, irrespective of any lack of follow‑up or additional action taken by the individual. 7. Of course, in complying with an IPP 7 access request the Respondent may apply any exemptions to access and thus limit the personal information to which the Applicant is provided access. However, simply because a broad access request is made under IPP 7 that may otherwise include some exempt information or information for which non-compliance by the Respondent (in this case) is excused, it is not sufficient grounds to deny access to all personal information the subject of the access request (i.e. to not provide the other personal information not exempted or excused from access). That is, the access request must be fulfilled by the Respondent by withholding only that personal information exempted from access. It is not acceptable for the Respondent to claim that the Applicant's access request (e.g. in Email 1) is too widely framed and therefore, because the Respondent would need to consider how to apply this request across its holdings of the Applicant's relevant personal information, it is excused/exempt from disclosing any of the Applicant's personal information the subject of the access request under IPP 7 in Email 1. 8. In conclusion, while subject to possible excuses or exemptions in other sections of the PPIP Act, the wording of s14 PPIP Act/IPP 7 is clear and unconditional. In this case access to personal information of the Applicant held by the Respondent must, at the request of the Applicant and without excessive delay or expense, be provided to the Applicant. In summary, unless non‑compliance is excused or compliance is otherwise exempted by other provisions of the PPIP Act (or other legislation) then providing access without excessive delay is a legislative obligation imposed on the Respondent which, apart from any such legislative exemptions or excuses, cannot be made subject to any qualifications imposed by the Respondent. 9. Where access is denied by an agency based on any lawful excuse or exemption then, in the spirit of IPP 7, that agency should notify the individual of this without excessive delay in order to enable that individual to pursue, if they wish, an internal review of that decision. Reasonable periods for providing access 1. In the absence of any submissions or evidence on the volume or difficulty of retrieving the personal information requested (other than in respect of Email 1), based on the submissions and evidence before me and in the circumstances, I am of the view that the following are the periods within which the Respondent should have provided access to the personal information requested for each of Emails 1-5 (and thus failure to meet these periods will be excessive delay in breach of IPP7): 1. Email 1 – 60 days given the potential volume and requirement of the Respondent to sort through relevant personal information on the RMS and SAP databases and determine which, if any personal information requested, is exempt from access under s27 PPIP Act plus an additional seven (7) days given the request was not sent to the area/person specified in the PMP, giving a total of 67 days from receipt of Email 1 on 11 May 2017. 2. Email 2 – 30 days plus seven (7) days given the request was not sent to the area/person specified in the PMP, giving a total of 37 days from the receipt of Email 2 on 21 May 2017. 3. Email 3 - 30 days plus seven (7) days given the request was not sent to the area/person specified in the PMP, giving a total of 37 days from the receipt of Email 2 on 21 May 2017. 4. Email 4 - 30 days plus seven (7) days given the request was not sent to the area/person specified in the PMP, giving a total of 37 days. However, given the out of office message received by the Applicant noting Ms Keating's absence from work until 30 June 2018, in this case the 37 day period commences on 1 July 2018. 5. Email 5 - 30 days plus seven (7) days given the request was not sent to the area/person specified in the PMP, giving a total of 37 days from the receipt of Email 2 on 21 May 2017. 1. Based on the considerations and findings above I find in respect of each of the emails that, having considered the submissions and evidence of both parties: 1. Email 1: This access request was received by the Respondent and the Respondent held the personal information of the Applicant which was the subject of this access request, some of which was not exempted from access and to which access should have been granted without excessive delay. The elapsing of some 615 days between the access request in Email 1 and the date of the First IR Request is, by reference to the period I have estimated in paragraph [64(1)] above, excessive delay in breach of IPP 7. 2. Email 2: This access request was received by the Respondent and the Respondent held the personal information of the Applicant which was the subject of the access request, which was not exempted from access and to which access should have been granted without excessive delay. The elapsing of some 605 days between the receipt of Email 2 and the First IR Request is, by reference to the period I have calculated in paragraph [64(2)] above, excessive delay in breach of IPP 7. 3. Email 3: This access request of the Applicant was received by the Respondent and the Respondent held the personal information of the Applicant which was the subject to the access request, which was not exempted from access and to which access should have been granted without excessive delay. The elapsing of 580 days between receipt of Email 3 and the First IR Request, is by reference to the period I have calculated in paragraph [64(3)] above, excessive delay in breach of IPP 7. 4. Email 4: This access request of the Applicant was received by the Respondent and the Respondent held the personal information of the Applicant which was the subject of the access request, which was not exempted from access. The elapsing of over 200 days from 1 July 2018 to the date of the First IR Request is, by reference to the period I have calculated in paragraph [64(4)] above, excessive delay in breach of IPP 7. 5. Email 5: This access request of the Applicant was received by the Respondent and the Respondent held the personal information of the Applicant which was the subject of the access request, which was not exempted from access. The refund of the deposit referred to in the correspondence and personal information the subject of the Applicant's access request in Email 5, in the absence of any evidence confirming a waiver by the Applicant of their access request, does not satisfy the Applicant's request to access their personal information in Email 5. While the Applicant's goal may or may not have been to obtain a refund, on its face it is clear that the Applicant's request to access personal information in Email 5 is seeking their personal information relating to their entitlement to a refund of an advance deposit made on or about 16 March 2015. The delay of some 201 days from the receipt of Email 5 until the First IR Request is, by reference to the period I have calculated in paragraph [64(5)] above, excessive delay in breach of IPP 7. 6. Email 6: The Respondent's submissions and the evidence of Senior Sergeant Twyman are compelling and I accept that the Respondent did not receive the Applicant's access request contained in Email 6 (i.e. the Respondent did not receive Email 6) until the date of the Second IR Request. Decision 1. The Respondent has breached s14 PIPP Act/IPP 7 in respect of the Applicant's access requests in Emails 1‑5 in that the Respondent held the Applicant's relevant personal information, received the Applicant's email access requests when they were emailed to and received at legitimate email addresses of the Respondent and the Respondent failed to provide the Applicant with access to that information without excessive delay. 2. The Respondent did not breach s14 PPIP Act/IPP 7 in respect of the Applicant's access request in Email 6 because the Respondent did not receive that email until the Applicant made the relevant internal review request on 26 April 2019. Orders 1. The purported unilateral withdrawal of the undertaking made by the Respondent's solicitor is not valid and the undertaking remains in place and is effective as against the Respondent. 2. The Respondent has breached s14 PIPP Act/IPP 7 in respect of the Applicant's requests in Emails 1‑5 to access their personal information held by the Respondent. 3. The Respondent did not breach s14 PPIP Act/IPP 7 in respect of the Applicant's request in Email 6 to access their personal information held by the Respondent. 4. The Applicant is to file and serve submissions as to remedy, not exceeding five (5) pages, within 14 days of the date of these Reasons for Decision. 5. The Respondent is to file and serve submissions as to remedy, not exceeding five (5) pages, within 14 days after receipt of the Applicant's submissions as to remedy. 6. The matter is to be relisted for directions before Senior Member Christie as to remedy on 1 June 2021 at 9:30am. 7. I direct the Principal Registrar of the Tribunal to forward a copy of these Reasons for Decision to the NSW Legal Services Commissioner for such action as the Commissioner may consider appropriate. ********** I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar Amendments 30 April 2021 - Incorrect version uploaded 30 April 2021 - Orders 1, 2 and 3 were not included in order. Order numbering changed. DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 30 April 2021