Civil and Administrative Tribunal New South Wales Medium Neutral Citation: DMP v Sydney Local Health District [2022] NSWCATAP 357 Hearing dates: 4 February 2022 Date of orders: 15 November 2022 Decision date: 15 November 2022 Jurisdiction: Appeal Panel Before: T Simon, Principal Member P H Molony, Senior Member Decision: 1. Time for lodgement of the Notice of Appeal is extended to 21 September 2021. 2. Leave to appeal is refused. 3. The appeal is dismissed. Catchwords: APPEALS — Privacy - leave to appeal– adequacy of reasons – delay in providing reasons - procedural fairness – failure to resolve a factual dispute – failure to consider submissions – fresh evidence – failure to make findings Legislation Cited: Administrative Decisions Review Act 1997 (NSW) Civil and Administrative Tribunal Act 2013 (NSW) Civil and Administrative Tribunal Rules 2014 (NSW) Government Information (Public Access) Act 2009 (GIPA) Health Records and Information Privacy Act 2002 (NSW) Privacy and Personal Information Protection Act 1998 (NSW) Cases Cited: Building Professionals Board v Hans (2008) NSWADTAP 13 Collins v Urban [2014] NSWCATAP 17 Dubois v R & B Bergin Pty Ltd [2011] NSWCA 309 DVH v South Eastern Sydney Local Health District [2021] NSWCATAD 212 Italiano v Carbone [2005] NSWCA 177 Jackson v NSW Land & Housing Corporation [2014] NSWCATAP 22 John Prendergast & Vanessa Prendergast v Western Murray Irrigation Ltd [2014] NSWCATAP 69 Meacham v Commissioner of Police [2020] NSWCATAP 107 Minister for Immigration and Multicultural Affairs v Bhardwaj (2002) 209 CLR 597 Monie v Commonwealth [2005] NSWCA 25; 63 NSWLR 729 MM Constructions (Aust) Pty Ltd v Port Stephens Council [2012] NSWCA 417; 191 LGERA 292 New South Wales Land and Housing Corporation v Orr [2019] NSWCA 231 NRM Corporation Pty Ltd v Australian Competition and Consumer Commission [2016] FCAFC 98 NZ v Commissioner of Police, NSW Police (GD) [2006] NSWADTAP 57 Office of Finance and Services v APV and APW [2014] NSWCATAP 88 Stoker v Adecco Gemuale Constructions Pty Ltd [2004] NSWCA 449 Texts Cited: None cited Category: Principal judgment Parties: DMP (Appellant) Sydney Local Health District (Respondent) Representation: Appellant (Self Represented) Crown Solicitor (Respondent) File Number(s): 2021/00269171 Publication restriction: Pursuant to s 64 of the Civil and Administrative Tribunal Act 2013 the name of the applicant is not to be disclosed. Decision under appeal Court or tribunal: Civil and Administrative Tribunal Jurisdiction: Administrative and Equal Opportunity Division Citation: N/A Date of Decision: 18 August 2021 Before: K Ransome, Senior Member File Number(s): 2018/00199878, 2018/00355100, 2019/00017318 Reasons for decsion 1. This is an appeal from a decision of the Administrative and Equal Opportunity Division of the New South Wales Civil and Administrative Tribunal (NCAT), made under the Privacy and Personal Information Protection Act 1998 (NSW) (PIPP Act) and the Health Records and Information Privacy Act 2002 (NSW) (HRIP Act). Background 1. DMP, the appellant in these proceedings, was a third-year medical student about to commence work at a hospital in the Sydney Local Health District (SLHD). In January 2018, DMP undertook training in how to use the electronic medical records known as eMR. 2. Prior to undertaking the training, DMP signed the "eMR User Access Request form and data security declaration" in which DMP acknowledged that he had read and understood his responsibilities and obligations. That included that DMP understood that he was not to access his own records unless in the presence of his medical practitioner and was not to access work colleagues, friends or family members' records. 3. During the training session, DMP accessed his own records. DMP suspects that others accessed his records during a training session. DMP also looked up the records of other people he knew, and states that someone else in the training session implied they did likewise. 4. DMP subsequently raised concerns about his privacy with SLHD and asked that they cease to use his health records, including in eMR training sessions. On 28 February 2018, SLHD proposed that DMP's name be changed to an alias and an electronic alert be placed indicating that access to the record was restricted. DMP responded on 7 March 2018 stating that he did not agree with the proposed restriction on his records and wished his records to be deleted. 5. On 23 May 2018, information about DMP was de-identified and his last name was changed to "UNKNOWN", and his first name was changed to "Male" wherever they appeared. DMP's patient record were deactivated in that it was made unsearchable by end-users. 6. DMP subsequently made three applications to NCAT seeking review of the conduct of SLHD in relation to breach of Health Privacy Principles (HPP). The HPP's are set out in Schedule 1 of the HRIP Act. On 18 August 2021, the Tribunal made orders not to take any actions in relation to each of those applications. DMP appeals the decision in relation to each of the three proceedings. Material before the Appeal Panel 1. The Appeal Panel received the following submissions and documents relating to the appeal from the parties. 1. Notice of Appeal received from DMP, lodged on 21 September 2021, together with documents and submissions. 2. Two further leaver arch folders containing documents received from the DMP on 6 October 2021. 3. A reply to the Appeal received from SLHD on 8 October 2021 4. Further bound submissions and documents received from the DMP on 6 January 2022, 18 January 2022, 20 January 2022, 24 January 2022 and submission and documents in reply. 5. Submissions and bundle of documents received from the SLHD on 25 January 2022. 6. Submissions and documents in reply received from the DMP on 3 February 2022. 7. Further submissions received from both parties on 21 February 2022. Those submissions were received after the appeal hearing. We made orders allowing the parties to provide us with further written submissions on whether the significant and lengthy delay in delivering the reasons by the Tribunal, has any influence on the expectation of the quality of reasons provided. The submissions received from DMP dealt with issues beyond that issue. The parties were told by the Tribunal that additional materials and submissions beyond the scope of that question would not be considered by us. Fresh Evidence 1. DMP confirmed at the appeal hearing that he had not provided to the Appeal Panel, all the material that had been provided to the Tribunal in the primary proceedings. 2. DMP has provided volumes of additional material that he seeks to adduce as fresh evidence. DMP seeks leave to rely on those documents as a matter of public importance. Leave to rely on new evidence is also raised by ground 17 of DMP's grounds of appeal. 3. A party seeking to adduce fresh evidence in an appeal may only do so with the leave of the Appeal Panel. To exercise the discretion, we must be "affirmatively satisfied" that, having regard to the findings of the Tribunal in the primary proceedings, the further evidence is "likely to have produced a different result": Building Professionals Board v Hans (2008) NSWADTAP 13 at [54]. 4. DMP seeks firstly to rely on an access application he made to the Ministry of Health under the Government Information (Public Access) Act 2009 (NSW) (GIPA Act). DMP submits there was an attempt to conceal policy document by Ministry of Health and that is relevant to his appeal because it demonstrates corrupt conduct by various employees of SLHD and the Minister of Health. He says the evidence only came into existence after the hearing. DMP submits that the evidence is reliable and that there is no innocent explanation for the concealment by the SLHD. He states that the material: … offers robust evidence of the existence of a government conspiracy. With the addition of this evidence DMP no longer appears as crazy as he initially did. There are three data points linking Hon Brad Hazzard (Minister for Health) to the NSW Health Crime Family.' 1. DMP also seeks to rely on further audit reports of records held within the non-production database of the eMR, called "eCERT". The documents include what DMP describes as a 'reconstruction of an audit report.' DMP asserts that an inference can be drawn from that reconstructed audit report that the eCERT was destroyed shortly after the commencement of the internal review on 1 June 2018. DMP submits that this reveals consciousness of guilt and further substantiates his allegation of widespread, unauthorised access and remote access and the repeated destruction of evidence is indicative of the obstruction of justice. DMP alleges that the reconstructed report would have challenged the hearsay evidence of Ms Wagstaff who gave evidence for SLHD in the proceedings. DMP says he did not previously file the documents because, although he alleged the eCERT was destroyed, he was not aware that he had been provided with a 'fake audit'. DMP submits that, not only should this evidence be admitted, but the conduct of the SLHD and various others should also be referred to the Supreme Court. He also says that the new evidence substantiates modification of the records for the secondary purpose of murdering him. In that regard, failure to allow the fresh evidence would allow the government to get "away with a conspiracy to commit murder." 2. Having considered those submissions, we do not grant leave for the consideration of the fresh evidence on appeal. The allegations being raised before the Appeal Panel, are not relevant to the issues that needed to be determined by the Tribunal in the primary proceedings. Some of the conduct being alleged occurred after the proceedings. The fresh material includes extracts from textbooks, journal articles, newspaper articles, blog posts, NSW Health guidelines, SLHD Annual Reports, and Tribunal fact sheets. We are not prepared to allow leave for voluminous documents based on the generalised allegations made by DMP, in the absence of particularisation of which documents would establish the appeal grounds raised. Leave to rely on fresh evidence is refused and ground 17 of the appeal fails. 3. As a consequence, we will not refer to or further consider the fresh evidence. The Tribunal's Reasons 1. The primary proceedings were heard over four days. The first day is referred to by DMP as a 'planning day'. The Tribunal dealt with all three applications in the reasons for the decisions (the Reasons). 2. The Tribunal set out at [17] of the Reasons, the allegation in relation to application 2018/00199878 (application 1) as follows: (a) that his health information has been unlawfully used by SLHD for eMR training in breach of HPP 10 as it does not have a training exemption to do so; (b) that there was no implied consent that his health information relating to his attendance at a methadone clinic on 14 October 2008 could be used for eMR training; (c) even in the absence of an authorised access to his information, his health information was exposed to an unreasonably high risk of unauthorised access through eCERT; (d) when access logs prior to 21 November 2014 were deleted, SLHD destroyed evidence; (e) even after being made aware of his express refusal to consent to secondary uses of his information, SLHD continued to retain his health information and used it for eMR training. 1. The Tribunal set out at [19] of the Reasons, that in application 2019/00199878 (application 2), DMP alleged similar breaches as contained in application 1 and raised the further issues as follows: (a) any eMR training sessions between 10 January 2018 and 15 March 2018 involving the use of the non-production environment eCERT and where his identifiable health information had been present within eCERT; (b) the presence of his identifiable health information within a non-production environment other than eCERT for any purpose between 10 January 2018 and 15 March 2018; (c) any eMR training sessions between 11 January 2018 and 15 March 2018 involving the use of the non-production environment eCERT and where identifiable health information relating to his prior attendance at a methadone clinic was present; (d) failure of SLHD between 1 January 2018 and 15 March 2018 to restrict access (within both the eMR and non-production environments) to health information relating to his attendance at a methadone clinic; (e) exposure of his health information to an unreasonably high risk of unauthorised access through the use of any non-production environment, including but not limited to eCERT even in the absence of any unauthorised access of his information from 11 January 2018 to 15 March 2018; (f) unlawful retention and use of his health information within eCERT and any other non-production environment for any secondary purposes following enforcement of his "express refusal notice" between 11 January 2018 and 15 March 2018; (g) the conduct of SLHD between 12 December 2017 and 15 March 2018 in not informing him whether use of his information was continuing in breach of HPP 6; (h) unlawful disclosure by SLHD of his health information to the NSW Information and Privacy Commissioner sometime between 7 March 2018 and 13 March 2018; (i) someone in SLHD unlawfully used his health information for the purposes of unlawfully de-identifying it on 23 May 2018; (j) failure to safeguard his health information by exposing it to the Chief Executive as well as the Clinical Governance Unit; (k) failure of SLHD to update his health information to reflect his Advance Care Directive and his requirement that 100 points of identification be collected prior to treatment of anyone claiming to be him; (l) the unlicensed retention, use and/or disclosure of the health information of Mr A, Mr B and Mr C (and possibly Mr D who DMP refers to in submissions) without consent to do so. 1. The Tribunal considered applications 1 and 2 together. 2. The Tribunal determined that DMP had not identified any "use" of his health information, in breach of HPP 10(1) in the eMR training session in January 2013, or in other training sessions before or after that training session. The Tribunal also determined that there was no evidence (other than the DMP's own statement) that there had been widespread access to his DMP's or others information. In relation to adequate safeguards, the Tribunal stated at [58] of the Reasons that: Overall, while there may be aspects of the security safeguards put in place by SLHD which might not meet best practice, I am satisfied that the system of safeguards put in place to protect the information against unauthorised access were reasonable in the circumstances and were not inadequate. It must be said that no system can guard entirely against wilful disregard and desire to circumvent the safeguards in place. 1. The Tribunal also found there was no breach regarding SLHD updating DMP's health information or disclosing certain information to the Information and Privacy Commissioner for the purposes of investigation. 2. In relation to application 2018/00355100 (application 3), the Tribunal set out at [89] of the Reasons, that DMP alleged the following contraventions which had resulted after he presented to a hospital in the SLHD with severe abdominal pain on 6 June 2018: (1) HPP 13 - by refusing to treat him anonymously when it was both lawful and practical for him to receive treatment under a pseudonym; (2) HPP 1 - by unlawfully collecting his name and/or Medicare number because it was not reasonably necessary, and HPP 2 - as the collection of that information was excessive and/or irrelevant for the purposes claimed; (3) HPP 1 - by coercing him into providing information (his Medicare details) that it knew was not required in breach of s 70 of the Act, rendering the collection of that information unlawful; (4) HPP 4 – even though DMP stated he would pay cash, he was told he needed to supply his Medicare card. This was a breach of HPP 4 because he was not told the purpose of collection and there could be no lawful reason to hand over his Medicare card in the circumstances; and (5) HPP 5 - by exposing his identifiable health information to an unreasonably high risk of unauthorised access and misuse by failing to protect it against those responsible for safeguarding it. (This alleged contravention relates to the retention of DMP's health information in the eMR non-production environment.) 1. The Tribunal also found no breach in relation to that incident. The Appeal 1. Decisions of the Tribunal are internally appealable decisions and an appeal can be made from them as of right on any question of law, or with the leave of the Appeal Panel on any other grounds: see, s 80(1) and (2)(b) of Civil and Administrative Tribunal Act 2013 (NSW) (NCAT Act). Extension of time 1. The Notice of Appeal was not lodged within 28 days as specified in cl 25(4)(b) of the Civil and Administrative Tribunal Rules 2014 (NSW) (NCAT Rules) and the appellant is seeking an extension of time for the lodging of the appeal. 2. The principles on which an extension of time would be granted to bring an appeal were set out by the Appeal Panel in Jackson v NSW Land & Housing Corporation [2014] NSWCATAP 22 at [21]-[22]. The matters to consider include the length of the delay, the reason for the delay and the prospects of success. 3. The appeal was lodged 6 days out of time. DMP seeks an extension of time and states that the delay was because he needed to provide a significant amount of documents to the Appeal Panel. We accept that six days is not a significant delay in time. For that reason, we allow the extension of time and have proceeded to consider the appeal. Appeal Grounds 1. DMP is self-represented. In those circumstances we will follow what was stated by an Appeal Panel in John Prendergast & Vanessa Prendergast v Western Murray Irrigation Ltd [2014] NSWCATAP 69 at [12]: 'In circumstances where the appellants are not legally represented, it is apposite for the Tribunal to approach the issue by looking at the grounds of appeal generally. It is necessary for the Appeal Panel to determine whether a question of law has in fact been raised, subject to any procedural fairness considerations that might arise to the respondent.' 1. DMP set out 17 grounds of appeal which he asserts raise questions of law and in addition, seeks leave to appeal. At the hearing several grounds were not pressed. Doing our best to understand the grounds of appeal, we have framed the issues to be decided as follows: 1. Adequacy of reasons 2. Procedural Fairness 3. No jurisdiction 4. Leave to Appeal 1. We shall deal with each of the issues in turn. Adequacy of Reasons 1. DMP raises as a ground of appeal that there has been substantial delay in providing the Reasons and a failure by the Tribunal to provide adequate reasons. The delay in providing the Reasons forms the basis for several other grounds raised by DMP. Legal Principles 1. A failure to give proper reasons may amount to an error of law: Stoker v Adecco Gemuale Constructions Pty Ltd [2004] NSWCA 449 per Santow JA at [41]; New South Wales Land and Housing Corporation v Orr [2019] NSWCA 231 (Orr) per Bell P (as His Honour then was) at [66]. 2. Regarding delay, in NRM Corporation Pty Ltd v Australian Competition and Consumer Commission [2016] FCAFC 98 the Court said at [134] It is thus to be accepted that the "circumstances in which delay, of itself, will vitiate proceedings, or a decision, are rare": NAIS v Minister for Immigration and Multicultural and Indigenous Affairs [2005] HCA 77 at [5], (2005) 228 CLR 470 at 473 per Gleeson CJ. The Chief Justice there went on to observe that a court "may conclude that delay in giving judgment has contributed to error, or made a decision unsafe" but that "the ground of appellate intervention is the error, or the infirmity of the decision, not the delay itself". 1. In Monie v Commonwealth [2005] NSWCA 25; 63 NSWLR 729 (Monie), the Court of Appeal dealt with an appeal in which the first instance decision was delivered more than seventeen months after judgment had been reserved. Each of the grounds raised by the appellant in the appeal were based on the delay of the judge in giving judgment and on the consequences that were said to have flowed from the delay. The appeal was allowed, and a new trial was ordered on all issues. Hunt AJA set out at [43] of the decision, principles from various cases regarding delay in the delivery of reasons and the proper approach of an appeal court. His Honour concluded at [44]: 44 It must, however, be emphasised that delay between taking evidence and the delivery of judgment does not, in itself, justify upholding an appeal against the judgment given. Error must still be established on the part of the trial judge warranting either a reversal of the judgment or the grant of a new trial. Delay may assist an appellant in establishing such error because, as the approach identified by the Full Federal Court demonstrates, the inference will more readily be drawn that a trial judge's failure to deal in a significantly delayed judgment with particular matters on which the appellant relied in contradiction of the findings made in that judgment resulted from those matters being overlooked by the judge — either because of the time which has passed or because of the pressure on the judge in the end to complete the judgment. In Boodhoo v Attorney General of Trinidad and Tobago [2004] 1 WLR 1689 at [11], the Privy Council acknowledged that the delay in giving the decision may adversely affect its quality to such an extent that it cannot be allowed to stand. That is what must be shown in order to demonstrate error resulting from delay which warrants either a reversal or a new trial. That is what I understand the judgment in Expectation Pty Ltd v PRD Realty Pty Ltd at [69] et seq to be saying. 1. Bryson JA agreed with Hunt AJA. Giles JA did also, subject to matters his Honour set out at [2] - [4] of his decision regarding the principles relating to delay. 2. Monie was discussed by Allsop P in MM Constructions (Aust) Pty Ltd v Port Stephens Council [2012] NSWCA 417; 191 LGERA 292. At [11] His Honour stated: Delay is regrettable. The "sorry tale" (to quote Giles JA) of the delay in Monie is set out in detail in the reasons of Hunt AJA at [36]-[42]. The delay was 17 months. The deep deficiencies of the judgment in that case in its grappling with the issues are recounted by Hunt AJA and need not be repeated here. Implicit in Hunt AJA's reasons and explicit in Giles JA's reasons is the importance of the quality of the work produced by the judge in assessing what may be seen to be the operative effect of the delay. 1. In Meacham v Commissioner of Police [2020] NSWCATAP 107 (Meacham), the NCAT Appeal Panel citing the decision in In New South Wales Land and Housing Corporation v Orr [2019] NSWCA 231, considered at [33] – [ 35], what is required by reasons and the quality and detail of reasoning process that must be exposed: … Bell P outlined the following requirements additional to those in s 62(3), drawing particularly on case authorities relating to judicial review (citations omitted) at [73]-[75] and [77]: - While a detailed exposition of every element of the evidence and arguments is not necessary, a basic explanation of the fundamental reasons which led the Tribunal to its conclusion is required; - It is not necessary to detail each factor found to be relevant or irrelevant, or to make an explicit finding on each disputed piece of evidence. It will be sufficient if the inference to what is found is appropriately clear, and the basis of the decision is made apparent; - The reasons must indicate to the parties why the decision was made, and allow them to exercise any rights that may be available to them in respect of the decision (including any avenue of appeal); - The reasons must provide an explanation connecting any findings of fact with the decision reached; - It is not necessary to decide each factual issue in isolation from the others, and expressing conclusions in a certain sequence does not indicate a failure to consider the evidence as a whole. 34 Further, in reviewing the adequacy of a decision maker's reasons, an appellate court (and, by extension, this Appeal Panel): - should not read passages from the reasons for decision in isolation from others to which they may be related; - must read the reasons fairly and as a whole; - should not inspect the reasons with a finetooth comb attuned to identifying error; and - should have a degree of tolerance for looseness in the language of the Tribunal, unhappy phrasing of the Tribunal's thoughts or verbal slips: Orr at [77]. 35 In line with the authorities referred to in Orr, it has also generally been accepted that, while not every submission or piece of evidence put forward by the parties must be referred to, "central controversies" put up for resolution by the parties must be dealt with, and the competing evidence relevant to those controversies analysed and resolved: Mitchell v Cullingral Pty Ltd [2012] NSWCA 389 ("Mitchell") at [2]. 1. With the principles raised by the above-mentioned cases in mind, we have considered each of the grounds raised by DMP in relation to the adequacy of reasons. Ground 16 – Delay in giving reasons 1. DMP submits that the Tribunal's delay in delivering reasons gives rise to a question of law. The decision was reserved for 756 days. DMP developed a script to scan the CaseLaw database and has provided a comparative table of time taken to complete decisions in these types of matters. He submits that this is the longest time a matter of this type was reserved and that the delay gives rise to a question of law. 2. SLHD submits that that the delay in providing reasons in this matter did not vitiate the decision and that there is no identifiable error on the part of the Tribunal in relation to the reasons. They submit that the quality of reasons provided meets the standard required and that no form of error has occurred. 3. In these proceedings, the Tribunal delayed in providing reasons for a period of just over two years. That is a substantial delay. There is nothing in the Reasons to explain that delay. At [4] – [5] of the Reasons the Tribunal stated: 4 A significant volume of material has been filed by both parties in relation to these applications. It has not been possible in these reasons to refer to every document filed, nor is it necessary to do so. 5 Unfortunately, much of DMP's submissions is difficult to understand, is circuitous, puts forward conjecture as evidence and contains hyperbole. His complaints also appear to have expanded over time and through his many submissions. The scope of the matters before the Tribunal is determined by the scope of his internal review applications in these matters (KO v Commissioner of Police (NSW) [2005] NSWADTAP 56 at [13]; Department of Education v ZR (No 2) [2009] NSWADTAP 44 at [16]). 1. Similarly, in this appeal, DMP produced volumes of materials which included submissions. Much of the material was repetitive and irrelevant. We also found it difficult at times to follow DMP's submissions. That does make determining a matter such as this difficult. 2. Whatever the cause of the delay, for the appeal to be allowed, DMP needs to demonstrate that the delay in providing the decision and had some 'operative effect' on the Reasons. 3. DMP has also made a general assertion that the Tribunal failed to give reasons. The Tribunal did give reasons for the decision and no question of law can arise in that regard. 4. We have understood from DMP's other grounds, that what he asserts by this ground, is that the delay has affected the quality of the Reasons and gives rise to errors by the Tribunal as illustrated by many of the claimed defects in the Reasons that he raises in his appeal. On that basis, we have considered the delay and its impact on those appeal points when determining whether a question of law arises. Ground 1 – Reasons in relation to the background of the matter 1. In relation to ground 1, DMP submits the Tribunal's Reasons at [10] – [16] are a 'cut-and-paste' of the SLHD's submissions and that the Tribunal failed to consider his submissions in reply. Those parts of the reasons are under the heading 'Background' and set out the following: 10 The uncontroverted background to DMP's applications is that, as a third year medical student about to commence work at a hospital in SLHD, in January 2013 he undertook training in how to use the eMR. DMP states that the purpose of the training was to learn how to search for and access health records, with a view that students would know how to navigate the system during clinical rotations. 11 Prior to undertaking the training DMP signed the "eMR User Access Request form and data security declaration" in which he acknowledged that he had read and understood the following responsibilities and obligations: You are aware of your responsibilities under the Health Records Information Privacy Act 2002 and the Privacy and Personal Information Protection Act 1998, as outlined in NSW Health, SLHD. SWSLHD and (where appropriate) SSWAHS policy documents. As such, you understand that you are not to access your own records unless in the presence of your medical practitioner. You are not to access work colleagues, friends or family members records. 12 On the day he attended the training, DMP completed a checklist which included the statement "I agree that I have attended formal training and I have been instructed in the above and I understand my responsibilities under Privacy and Security Legislation". 13 DMP states that during the training session he accessed his own records. He states that he also suspects that someone else accessed his records during a training session (not necessarily the session he took part in). He also states that he looked up the records of other people he knew and someone else in the training session implied they did likewise. 14 DMP first made contact with SLHD about any concerns in November 2016. On 3 November 2017 DMP wrote to SLHD in the following terms: I kindly ask that you cease all use of my health records for any secondary purposes. This includes use of my records for eMR training sessions, as well the inclusion of my records in a larger training dataset where its presence could result in it being accessed during training sessions. 15 There then followed a good deal of correspondence between DMP and SLHD about his concerns and an investigation was undertaken. On 28 February 2018 DMP was provided with a report on the investigation in which it was proposed that his name on eCERT be changed to an alias and that an electronic alert be placed on eCERT indicating that access to the record was restricted. DMP responded on 7 March 2018 stating that he did not agree with the proposed restriction on his records and indicated he wished his records to be deleted from eCERT. 16 SLHD advises that on 23 May 2018, following further correspondence with DMP, information about him on eCERT was de-identified in that his last name was changed to "UNKNOWN" and his first name was changed to "Male" wherever they appeared. DMP's patient record on eCERT was also deactivated in that it was made unsearchable by end-users. 1. DMP asserts he analysed the decision by running it though a plagiarism check, and he has highlighted sections in the Reasons which he believes are plagiarised from the submissions. We have considered the Reasons against the submissions and the Reasons do not demonstrate a blanket "cut and paste" of the background. It is not unusual or inappropriate that the Tribunal should repeat submissions in the Reasons that are uncontroversial. 2. DMP submits that the Tribunal's statement at [10] of the Reasons, that the background was an "uncontroverted background", was inaccurate because DMP had a different interpretation of events. A summary of events, under the heading 'facts', was contained in Part III of SLHD's submissions to the Tribunal dated 17 December 2018. In his Notice of Appeal, DMP refers to his submissions in reply, at 5.5 with the heading, 'Correction to timeline'. Those submission appear at page 1958 of part 5 of 5, of what is referred to as the applicants Court book. DMP states: It appears that SLHD and I are operating off a different timeline. Some events have been overlooked while for others, I have a significantly different interpretation of them. 1. In our view, consistent with the principles set out by Bell P in Orr, it was not necessary for the Tribunal in these proceedings to detail every factor raised by the parties in the background to make the relevant findings in relation to the breaches alleged by DMP. 2. DMP has failed to identify the relevance of any omission or alternative to the timeline, raised by his submissions, which would have been pertinent to the determination of the issues in dispute. On that basis there is no question of law that arises from ground 1. Ground 2 – Most serious allegations glossed over and Tribunal failed to give reasons for findings 1. DMP says that there was an error in the Tribunal's determination that there was nothing improper about SLHD providing a copy of a report of to the Information and Privacy Commissioner. DMP submits he was deceived by SLHD into withdrawing his internal review request to the Information and Privacy Commissioner. 2. At [71] – [75] of the reasons the Tribunal found that SLHD's disclosure of DMP's health information to the Information and Privacy Commissioner was not in breach of HPP 11. 3. HPP 11 relates to the limits on disclosure of health information and relevantly provides: (1) An organisation that holds health information must not disclose the information for a purpose (a secondary purpose) other than the purpose (the primary purpose) for which it was collected unless— (a) Consent the individual to whom the information relates has consented to the disclosure of the information for that secondary purpose, or (b) Direct relation the secondary purpose is directly related to the primary purpose and the individual would reasonably expect the organisation to disclose the information for the secondary purpose, or … (k) Investigative agencies the disclosure of the information for the secondary purpose is reasonably necessary for the exercise of complaint handling functions or investigative functions by investigative agencies, … 1. At [75] of the Reasons, the Tribunal found that the IPC was investigating or otherwise handling a complaint made by DMP and that the disclosure of his health information was reasonably necessary for the exercise of that function. HPP 11 (1)(k) allows such an exception, and in our view, it was open to the Tribunal to make that determination. 2. DMP also alleges that improper conduct and a 'fake internal review' was not considered by the Tribunal. Contrary to DMP's assertions, there was no evidence before the Tribunal which would demonstrate improper conduct or a 'fake internal review'. The Information and Privacy Commissioner was "investigating or otherwise handling" a complaint from DMP that "could be referred" to it, and the disclosure was reasonably necessary for the exercise of the Information and Privacy Commissioner's complaint handling functions. DMP went onto allege that he later withdrew his complaint to the IPC, because he was misled. This does not change the fact that disclosure of his personal and health information was necessary for the IPC to carry out its investigative functions following his complaint: see s 21 of HRIP Act and s 54 of the PPIP Act with respect to the IPC's role in internal reviews. 3. DMP also submits that the most serious allegations he made regarding this matter were 'glossed over' in the Reasons and no findings were made in relation to his serious allegations about the corrupt conduct of employees of SLHD and the Minister for Health regarding HPP 6. 4. HPP 6 relates to the holding of health information and relevantly provides: (1) An organisation that holds health information must take such steps as are, in the circumstances, reasonable to enable any individual to ascertain— (a) whether the organisation holds health information, and (b) whether the organisation holds health information relating to that individual, and (c) if the organisation holds health information relating to that individual— (i) the nature of that information, and (ii) the main purposes for which the information is used, and (iii) that person's entitlement to request access to the information. (2) An organisation is not required to comply with a provision of this clause if— (a) the organisation is lawfully authorised or required not to comply with the provision concerned, or (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998). 1. At [79] – [80] of the Reasons the Tribunal stated: 79 As I understand it, DMP alleges that SLHD did not respond to his requests about whether his health information was still being used for training after he withdrew his consent on 3 November 2017 for his health information to be used for training purposes. He states that SLHD's conduct was in breach of HPP 6 which relates to the obligation placed on agencies to enable an individual to obtain details about information held about them. 80 There was considerable correspondence between DMP and SLHD and an offer was made (which he rejected) to alias his information in response to his request. I am satisfied that SLHD took such steps as were reasonable in the circumstances to satisfy the requirements of HPP 6. 1. Consistent with the reasoning in Meacham and in line with the authorities referred to in Orr, not every submission or piece of evidence put forward by the parties must be referred to by the Tribunal. Only "central controversies" which are put up for resolution by the parties must be dealt with. In this case, the central controversy was whether there had been a breach of HPP 6. There was no basis for the Tribunal to make findings based on DMP's unsubstantiated and unsupported assertions about corrupt conduct by employees of SLHD and the Minister for Health. No question of law is raised regarding the Tribunal's findings about breach of HPP 6. Conclusion on Adequacy of Reasons 1. Having considered grounds 1, 2 and 16, we are not satisfied that the delay in providing the reasons has affected the quality of the decision. The reasons are adequate. Procedural Fairness 1. Section 36 of the NCAT Act sets out the guiding principle to be applied to practice and procedure of the Tribunal as follows: (1) The guiding principle for this Act and the procedural rules, in their application to proceedings in the Tribunal, is to facilitate the just, quick and cheap resolution of the real issues in the proceedings. (2) The Tribunal must seek to give effect to the guiding principle when it— (a) exercises any power given to it by this Act or the procedural rules, or (b) interprets any provision of this Act or the procedural rules. (3) Each of the following persons is under a duty to co-operate with the Tribunal to give effect to the guiding principle and, for that purpose, to participate in the processes of the Tribunal and to comply with directions and orders of the Tribunal— (a) a party to proceedings in the Tribunal, (b) an Australian legal practitioner or other person who is representing a party in proceedings in the Tribunal. (4) In addition, the practice and procedure of the Tribunal should be implemented so as to facilitate the resolution of the issues between the parties in such a way that the cost to the parties and the Tribunal is proportionate to the importance and complexity of the subject-matter of the proceedings. 1. Section 38(2) of the NCAT Act provides that: [t]he Tribunal is not bound by the rules of evidence and may inquire into and inform itself on any matter in such manner as it thinks fit, subject to the rules of natural justice. 1. Section 38(5) of the NCAT Act provides: The Tribunal is to take such measures as are reasonably practicable: (a) to ensure that the parties to the proceedings before it understand the nature of the proceedings, and (b) if requested to do so-to explain to the parties any aspect of the procedure of the Tribunal, or any decision or ruling made by the Tribunal, that relates to the proceedings, and (c) to ensure that the parties have a reasonable opportunity to be heard or otherwise have their submissions considered in the proceedings. 1. DMP raises several grounds that he says amount to a denial of procedural fairness. A failure to afford procedural fairness can give rise to a question of law: Italiano v Carbone [2005] NSWCA 177. We have dealt with each ground in turn. It should be noted that DMP had initially raised apprehended bias as a ground. That was not pressed at the appeal hearing. Ground 12 – Refusal of adjournment 1. DMP refers to a request for an adjournment that he says he made at the "planning meeting" on 3 July 2019. He states that in the context of the Tribunal taking 756 days to provide the Reasons, the refusal demonstrates a failure of discretion. DMP submits that the reason he sought the adjournment was because of 'evidence tampering and forged documents' that he was given by the Crowns Solicitors Office in the lead up to the hearing, including audit reports and evidence about modifying his eMR data. He submits: If I had been granted an adjournment, I would have been able to examine the audit report more thoroughly and file it into evidence. These public sector gangsters attempted to murder me. 1. SLHD denies that any application for an adjournment was in fact made by DMP on 3 July 2019. 2. On review of the transcript of the hearing, we can find no formal application made by DMP for an adjournment. DMP referred to a summons he wished to be issued. In that regard the following relevant exchange occurred between the Tribunal and DMP (pg. 1684 -1685 of SLHD's appeal bundle): DMP: I've got a summons application. I'd like to submit that. Senior Member: This matter is listed for hearing. It's been before the tribunal for quite some time. So, we're not going to prolong it. We're going to proceed. … Senior Member: This is the hearing DMP: I thought this was the planning hearing Mr King (Counsel for SLHD): It may have been described that way on a previous occasion. Senior Member: was it? Ms Langford (Solicitor for SLHD): Yeah. That's my understanding also. As in in today, 3 July. We had understood that 10 July would be the hearing --- …. Senior Member: Right. That's not what I was told, but that's fine. I'm happy to treat it that way. So, what have you been able to do? 1. The Tribunal then proceeded. It allowed DMP an opportunity to provide further documents by 8 July 2019 and advised the parties that the hearing would proceed on 10 July 2019, including for the filing of any summons. 2. A refusal of an adjournment may amount to a denial of procedural fairness if it is likely to deny a party a reasonable opportunity to present their case. See Minister for Immigration and Multicultural Affairs v Bhardwaj (2002) 209 CLR 597 at [40]. 3. In the matter of Dubois v R & B Bergin Pty Ltd [2011] NSWCA 309, Young JA, with whom Giles JA agreed, stated at [43] – [46] 43. As the Full Federal Court said in Petrovic at 460, it is not sufficient that the Court of Appeal considers that an adjournment should have been granted, the applicant must show that refusal of the adjournment produced, in the circumstances, an injustice. It must be remembered too, that the decision is a discretionary judgment. 44. "Injustice" is a coloured word with pejorative overtones. What is meant is that the refusal of the adjournment must not set up a situation where there is a likelihood that there cannot be a fair trial unless that factor is outweighed by prejudice to the opposing party. 45. In making the balanced judgment required, a judge must also take into account the public interest that the judicial process must be just, cheap and quick. 46. Again this matter must be considered in a balanced way. Mr Romaniuk relied on what the plurality said in Aon Risk Services Australia v National Australia University [2009] HCA 27; 239 CLR 175, 214 at [102], that the objectives of modern court rules do not require that every application for amendment (and by analogy, adjournment) should be refused just because it wastes costs and causes some delay. Whilst these are significant matters, they are not necessarily overriding considerations. I accept that submission 1. We are not satisfied that DMP sought an adjournment. Even if the Tribunal was under some apprehension about what the matter was listed for on 3 July 2019, that was corrected. The transcript reveals that the Tribunal proceeded to treat the matter like it would a direction's hearing and attempted to identify the issues in dispute. The Tribunal also allowed the applicant an opportunity to provide further material. There is no suggestion on any of the other days that an adjournment was sought. On that basis this ground must fail. Grounds 6 and 7 - Failure to consider submissions 1. In relation to ground 6, DMP says that at an earlier hearing of an interim application, he was told to provide a 'summary of legal argument' and that he interpreted that to mean that he should not write as much and so he wrote in his submissions the 'bare minimum' he thought he needed to win his case. After receiving SLHD's submissions of 17 December 2018, he decided that in his reply submissions he needed to deal with the matter in more detail. DMP submits, that the Tribunal failed to consider his reply submissions and the events of 6 June 2016, which are referred to in those submissions. DMP refers to [34] of the Reasons, in which the Tribunal sets out the particulars of the conduct in connection with the eMR training sessions that was alleged by DMP to amount to breach of HPP 5. 34 DMP submits that SLHD did not employ reasonable safeguards to protect his health information within eCERT. He alleges the following conduct amounts to a breach of HPP 5: - the use of throwaway login credentials by students during eMR training e.g. User101; - failure to implement user access controls so that records of real patients, including his, were accessible to those being trained; - failure to log user access; and - failure to audit access logs. DMP also argues that even if his health information has not been used in eMR training, SLHD has retained his information unlawfully in breach of HPP 5 as information must not be kept any longer than is required for lawful use. This is particularly the case as eCERT is a duplicate of the eMR. 1. Those points were taken from DMP's written submissions in chief dated 16 October 2018. However, DMP says that the Tribunal made no further mention of the further failures particularised by DMP in his reply submissions dated 16 January 2019 and in particular section 9 of those reply submissions. Those failures are summarised at the outset of DMP's reply submissions as follows: One way to make sense of what SLHD has done is to frame this as a cascade of failures that have all lined up: 1. Non-production environment was populated with 20% of state's health records 2. Non-production environment was used for eMR training 3. End users were given user privileges not even required for eMR training 4. Generic or throwaway login credentials were shared and not registered to end users 5. Non-production environment was remotely accessible with an insecure connection 6. Access logs of non-production environment were not retained 7. Access logs were never audited for unauthorised access 8. No privacy training given prior to undertaking introductory eMR training 9. Privacy Officer who was completely unfit to safeguard health information 10. Slow and inadequate response to readily identifiable security concerns 1. HPP 5 relates to retention and security of information held and sets out: (1) An organisation that holds health information must ensure that— (a) the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and (b) the information is disposed of securely and in accordance with any requirements for the retention and disposal of health information, and (c) the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and (d) if it is necessary for the information to be given to a person in connection with the provision of a service to the organisation, everything reasonably within the power of the organisation is done to prevent unauthorised use or disclosure of the information. Note— Division 2 (Retention of health information) of Part 4 contains provisions applicable to private sector persons in connection with the matters dealt with in this clause. (2) An organisation is not required to comply with a requirement of this clause if— (a) the organisation is lawfully authorised or required not to comply with it, or (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998). (3) An investigative agency is not required to comply with subclause (1) (a). 1. DMP alleged that SLHD failed to employ reasonable safeguards to protect his health information held within eCERT. 2. The alleged breach was addressed by the Tribunal at [34] - [58] of the Reasons and it is helpful to set out the reasons at [55] to [58]: 55 Importantly, trainees are required to complete the data security declaration before undertaking the training and are required to acknowledge at the end of the training that they understand the security and privacy requirements. Trainers are also required to advise students of their obligations. If DMP's account is accepted, it does appear that the trainer in his session was somewhat perfunctory in this regard, but that does not mean that they system itself was lacking. The introduction of a standard pre-prepared script, as is now in place, is obviously a step forward. The fact that DMP ignored his obligations with respect to privacy and data security, knowing that it was wrong to do so, also does not indicate a general systemic issue or lack of safeguards. 56 I am satisfied on the evidence that has been provided that it is possible to audit the non-production environment to obtain records of access. While it does appear that there is a period prior to November 2014 when access records are now incomplete, that position was remedied and a sophisticated auditing tool now runs continuously. I also accept the evidence that audits were undertaken, albeit on an ad hoc basis prior to the introduction of quarterly reports. 57 As noted above, contrary to DMP's belief that there has been widespread access to his and others information held in the non-production environment, there is simply no evidence, other than his statement that he accessed his own records and believes that someone else did as well, that there has been any such access. 58 Overall, while there may be aspects of the security safeguards put in place by SLHD which might not meet best practice, I am satisfied that the system of safeguards put in place to protect the information against unauthorised access were reasonable in the circumstances and were not inadequate. It must be said that no system can guard entirely against wilful disregard and desire to circumvent the safeguards in place. 1. Those paragraphs demonstrate the Tribunal did consider the issues that the applicant made submissions about in the reply submissions. Again, it is not necessary for the Tribunal, to repeat in the reasons, every submission raised by a party. The Reasons demonstrate that the Tribunal dealt with the issues that arose out of DMP's submissions relating to the way in which non-production environment was used for eMR training and the issues that arose from that, including the generic credentials, remote access to the non-production environment and auditing of the non-production environment. The fact that the Tribunal did not, in summarising the complaint, list the failures as reframed in DMP's reply submissions does not establish that the Tribunal failed to have regard to those submissions. This ground fails to raise a question of law. 2. DMP makes a similar complaint in ground 7. He submits that the Tribunal failed to make express reference to the contents of DMP's written submissions. Again, the fact that the Tribunal did not make express reference to the submissions does not raise a question of law and we find no question arises in relation to ground 7. We have dealt with ground 7 in more detail under 'leave to appeal' below. Ground 3 – Failed to provide an opportunity to make submissions and decided a matter when the Tribunal did not have jurisdiction. 1. DMP alleges that the Tribunal reviewed conduct for which he made no submissions. He also says that the Tribunal reached the incorrect decision in finding that there was no jurisdiction to review the alleged conduct. 2. DMP refers to the Tribunal's reasons at [81] - [86]. Those parts of the Reasons appear under the heading 'Complaints made as "health information broker" in relation to third parties' and state: 81 DMP alleges that SLHD breached HPPs 5, 10 and 11 in relation to its handling of the health information of third parties including Mr A, Mr B and Mr C. Copies of letters signed by Mr B and Mr C have been provided to the Tribunal. These letters relate to the alleged unlawful use by SLHD of their personal health information for eMR training. There is also a letter of authority from Mr C authorising DMP to act as his agent as his health information broker. DMP, acting as agent, submitted an internal review application on behalf of Mr C to SLHD. 82 DMP states that he is a person aggrieved by the conduct as he is "the state's premiere consent-based health information broker" and SLHD's "failure to comply with the express refusal notices that I prepared for them" gives him standing as this has interfered with his commercial and ideological interests. In one of his submissions DMP states he will be seeking to recover $40,000 in "lost brokerage fees". 83 Review of a breach of an HPP by a public sector agency is conduct to which Part 5 (Review of certain conduct) of the PPIP Act applies. Section 53(1) the PPIP Act provides that a person is entitled to review of an agency's conduct if the person is "aggrieved" by that conduct. SLHD submits that DMP is not a person "aggrieved" by the conduct alleged against it and therefore the Tribunal does not have jurisdiction to review the alleged conduct. 84 In Altaranesi v Administrative Decisions Tribunal [2004] NSWCA 19 it was suggested that a person can fall within the definition of an "aggrieved" person for the purposes of s 53(1) if they can demonstrate that the alleged conduct has had a prejudicial effect on them. In certain circumstances the Tribunal has found a person to be a person "aggrieved" even if their personal information was not the subject of the conduct (see for example KO & Anor v Commissioner of Police, NSW Police [2004] NSWADT 3; NR and NP v Roads and Traffic Authority [2004] NSWADT 276). 85 It is possible that interference with financial interests could give a person standing to seek review of conduct. However, in this case, there is no evidence of any prejudicial effect upon DMP of the alleged conduct in relation to the named persons. There is certainly no evidence that there has been any interference with his financial interests or that indeed there was any commercial relationship between DMP and the other men. 86 To the extent that DMP complains about SLHD's dealings with the health information of Messrs A, B and C, there is no evidence that would establish that he is a person "aggrieved" by the alleged conduct of SLHD. Simply having a similar interest is insufficient. The Tribunal therefore does not have jurisdiction to review the alleged conduct. 1. At [19] of the Tribunal Reasons (reproduced at [18] above), the issue of unlicensed retention, use and/or disclosure of information relating to Mr A, Mr B and (and possibly Mr D) without consent, was identified by the Tribunal as a breach alleged by DMP. 2. The transcript of the hearing reveals that DMP made submissions about the issue on the 3 July 2019 (contained at pages 1738 – 1740 of SLHD's appeal bundle). DMP did not advise the Tribunal that he wished to withdraw that complaint, and, in our view, it was proper for the Tribunal to consider the matter as raised by the applicant. DMP has not demonstrated that he sought to make further submissions in relation to the issue or was denied that opportunity. The Senior Member dealt with the issue based on the material that was before the Tribunal. 3. In our view, the Tribunal's determination that DMP was not a person aggrieved was correct and it was correct for the Tribunal to find that there was no jurisdiction to review that conduct. 4. Accordingly, there has been no denial of procedural fairness in relation to grounds 3, 6, 7 or 12. This ground raises no question of law. No Jurisdiction Ground 4 – Conduct for which there was no jurisdiction was reviewed 1. By ground 4 of the appeal, DMP submits that the Tribunal reviewed conduct for which there was no jurisdiction. In the notice of appeal, DMP states: The reason why there was no jurisdiction was because the internal review in question was completed as a birthday gift, then its delivery was coordinated to act as some 'tactical ramming device' to rattle me. 1. At the hearing before us, DMP stated that the Tribunal wrongly concluded that it had jurisdiction and that there was no breach of HPP 8. SLHD noted that lack of jurisdiction was not raised before the Tribunal by DMP. 2. DMP refers to [66] – [70] of the Reasons under the heading, "Failure to update health information". The Tribunal determined: 66 The terms of the "Advance Care Directive" supplied by DMP to SLHD on 29 July 2018 had an enforcement date of 1 July 2019. In it he asked that SLHD confirm whether or not it would accept the document as lawful and valid, and if so ensure that it was attached to his records. Under the terms of the document, DMP stated "I refuse all treatment under all circumstances". The document, however, then went on to say that, if he was registered anonymously as UNKNOWN and, in effect, there was no cross-referencing between the records in his own name and those of UNKNOWN, then he consented to treatment. 67 SLHD states that the document was not attached to DMP's record at the time because it had a start date of 1 July 2019 and because it was concerned that to attach the document to DMP's patient record would be inconsistent with its general law duty of care to him. 68 SLHD submits that it was not required to comply with the request in circumstances where HPP 8(4)(b) provides that "non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law". The phrase "any other law" has been held in relation to the equivalent Information Privacy Principle under the PPIP Act to include the common law of Australia (Director General, Department of Education and Training v MT [2005] NSWADTAP 77 at [83] CCM v Western Sydney University [2019] NSWCATAP 103 at [65]). 69 It is certainly arguable that SLHD has a general duty of care to those who present seeking its services. In addition, the Health Services Act 1997 in section 10 gives it a number of functions including to promote, protect and maintain the health of the residents of its area and to achieve and maintain adequate standards of patient care and services. This it is difficult to envisage how complying with DMP's request would be in keeping with SLHD's legislated functions. 70 In my view there is no breach of HPP 8. 1. The conduct alleged by DMP was that SLHD failed to update DMP's health information. The Tribunal found at [70] of the Reasons that the conduct did not amount to a breach of HPP 8. DMP says he submitted his application for internal review on 11 July 2018, then submitted an addendum to that application on 15 November 2018 relating to SLHD's conduct that had occurred after 11 July 2018 (failing to amend his health information). 2. Section 21 of the HRIP Act provides that: (1) The following conduct by a public sector agency is conduct to which Part 5 (Review of certain conduct) of the PPIP Act applies— (a) the contravention of a Health Privacy Principle that applies to the agency, (b) the contravention of a health privacy code of practice that applies to the agency. 1. Part 5 of the PPIP Act consists of s 51 to s 55. Section 53 of the PPIPA provides for internal reviews to be conducted by the agency concerned on application by a person aggrieved. Section 53(6) requires that internal reviews "be completed as soon as is reasonably practicable in the circumstances" with the applicant being entitled to administrative review of the conduct from the Tribunal if it is not completed within 60 days. Section 55 of the PPIPA provides persons not satisfied with the outcome of an internal review to seek administrative review under the ADR Act of the conduct that was the subject of the application under section 53. Such an administrative review application is to be made within 28 days of notification of the outcome of the internal review, or, if an internal review has not been completed, within 28 days of the 60-day period: see r. 24(4) of the NCAT Rules. 2. The internal review had not been completed by SLHD within 60 days and it was open to DMP to make his applications to the Tribunal. Even if we are wrong, these were DMP's applications, and he sought review of the conduct. It is now trite for DMP to submit that the Tribunal did not have jurisdiction to review conduct which he had raised and he alleged breached the HPPs. In any case, the Tribunal found that there was no breach of HPP8. The alleged error, even if it did occur, would make no material difference to the outcome of the decision, as the Tribunal found not breach. Leave to Appeal 1. The remaining grounds of appeal raised by DMP require leave as they do not raise questions of law. Some of them are also matters that DMP relies on as demonstrating errors caused by the delay in giving the Decision. We will first consider whether they are matters for which leave should be granted, and, secondly, explain how we assess the impact of the delay on them. 2. In Collins v Urban [2014] NSWCATAP 17, the Appeal Panel stated at [84], that ordinarily it is appropriate to grant leave to appeal, except for matters that involve: (a) issues of principle; (b) questions of public importance or matters of administration or policy which might have general application; or (c) an injustice which is reasonably clear, in the sense of going beyond merely what is arguable, or an error that is plain and readily apparent which is central to the Tribunal's decision and not merely peripheral, so that it would be unjust to allow the finding to stand; (d) a factual error that was unreasonably arrived at and clearly mistaken; or (e) the Tribunal having gone about the fact finding process in such an unorthodox manner or in such a way that it was likely to produce an unfair result so that it would be in the interests of justice for it to be reviewed. 1. The Appeal Panel must also consider whether it should exercise its discretion to grant leave to appeal under s 80(2)(b). 2. We have briefly considered each of the remaining grounds raised by DMP and would not grant leave to appeal. Ground 5 1. By ground 5, DMP alleges that the Tribunal did not review the conduct, for which he made submissions, regarding his withdrawal of consent to all secondary uses of his personal health information. At [14] of the reasons, in the discussion of the background, the Tribunal referred to DMP's communication on 3 November 2017, in which he asked that SLHD cease using his records for any secondary purpose. The Tribunal was clearly on notice of that communication. At [33] of the Reasons, the Tribunal determined that: … DMP's health information was not used in the eMR training session he attended extends to his allegations that his information was used in other training sessions before or after the date of that training. I also note that DMP's information was de-identified in May 2018 and is no longer accessible in the non-production environment 1. Having made that determination, it was not necessary for the Tribunal to consider the effect of DMP having withdrawn his consent for his health information to be used for training purposes, as no use had occurred. Similarly, there is no basis for the argument that the Tribunal failed to consider these matters due to the delay in reaching the Decision. Ground 7 1. In relation to ground 7, DMP submits that a summary of allegations was copied and pasted from the respondent's submissions and passed off as the DMP's submissions in the Reasons. In later submissions, DMP says, that the Tribunal erred by failing to have regard to his written submissions, and instead considered what was argued by him in his internal review application. The Tribunal was confined to a consideration of the conduct complained of in DMP's internal review requests, not as modified and evolved in submissions: NZ v Commissioner of Police, NSW Police (GD) [2006] NSWADTAP 57); Office of Finance and Services v APV and APW [2014] NSWCATAP 88 at [42]. As the Tribunal observed in DVH v South Eastern Sydney Local Health District [2021] NSWCATAD 212 at [20]: "It is not the function of this Tribunal to sift through the vast amounts of material provided by the Applicant to determine whether a breach can be identified. It is not the function of the Tribunal to decipher what conduct could possibly be inferred or which possible breaches the Applicant is alleging". 1. There is no suggestion that that the Tribunal incorrectly identified the conduct complained of in the internal review requests, or that any error in this regard resulted from the delay. Grounds 8 and 15 1. Grounds 8 and 15 assert that findings of fact were incorrectly made by the Tribunal. DMP asserts that the Tribunal's findings are riddled with errors, contrary to the weight of the evidence and that the Tribunal failed to engage with over 90% of his case, including his evidence and submissions. 2. The grounds are not particularised. DMP purports to provide five "examples" of findings that are said to be incorrect and made without regard to his evidence. The submissions in relation to these grounds are generalised and circuitous, and in large part a repeat of the submissions that were made before the Tribunal. We are not satisfied that the Tribunal was clearly mistaken in relation to the findings, or that DMP has demonstrated factual errors which would warrant leave to appeal be granted. Ground 9 1. In relation to ground 9, DMP asserts that too much weight was given to the evidence of Ms Wagstaff, who was the Acting Chief Information Officer of the SLHD. He also submits that a large part of Ms Wagstaff s evidence was hearsay and should have been given less weight by the Tribunal. Section 38 of the NCAT Act states that the Tribunal is not bound by the rules of evidence. DMP has not demonstrated why it is that a grant of leave to raise this ground of appeal would be justified, or why the Tribunal should not have given Ms Wagstaff's evidence the weight it did. Ground 11 1. In relation ground 11, DMP alleges that the that the Court Book prepared by SLHD in the primary proceedings was tampered with and prepared in black and white, rather than in colour and that amounts to 'evidence tampering'. This is an allegation without foundation, and we find no basis to grant leave in relation to this ground. Conclusion on leave to appeal 1. In essence, DMP states in his application that leave to appeal should be granted because he believes he has uncovered a conspiracy involving various government agencies and that a health care worker conspired to murder him. There is nothing before us that would substantiate those assertions. 2. Leave to appeal should not be granted. The grounds raise no issues of principle, no questions of public importance, or matters of administration or policy. The grounds do not demonstrate an injustice which is reasonably clear or an error that is plain, readily apparent, or concerning. Many of the submissions made by DMP are unsupported and amount to no more than assertions: many others are irrelevant and riddled with unsubstantiated allegations of conspiracy. Leave to appeal is therefore refused. 3. Similarly, we are not persuaded that delay in delivering the Decision has played a causative role in leading the Tribunal into error. While the unexplained delay is egregious, we have been unable to identify any errors of law, or grounds that demonstrate an injustice, that arises from the delay. 4. For completeness grounds 10, 13 and 14 were not pressed by DMP. Orders 1. Accordingly, we make the following orders: 1. Time for lodgement of the Notice of Appeal is extended to 21 September 2021. 2. Leave to appeal is refused. 3. The appeal is dismissed. ********** I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 15 November 2022