Civil and Administrative Tribunal New South Wales Medium Neutral Citation: EJX v University of Newcastle [2023] NSWCATAD 228 Hearing dates: 8 March 2023 Date of orders: 25 August 2023 Decision date: 25 August 2023 Jurisdiction: Administrative and Equal Opportunity Division Before: E Bishop SC, Senior Member Decision: 1. No further action is to be taken in this matter. 2. The Applicant's application is dismissed. Catchwords: PRIVACY AND PERSONAL INFORMATION — whether use for purpose collected — whether contravention of information privacy principle Legislation Cited: Administrative Decisions Review Act 1997 (NSW), s 58 Civil and Administrative Tribunal Act 2013 (NSW), ss 29, 72 Privacy and Personal Information Protection Act 1998 (NSW), ss 4, 9, 10, 11, 12, 13, 14, 16, 17, 18, 19, 52, 53, 55 Cases Cited: ALZ v WorkCover NSW [2015] NSWCATAP 138 Director General Department of Education and Training v MT (GD) [2005] NSWADTAP 77 EPT v The Sydney Children's Hospital Network [2022] NSWCATAD 137 GA v Department of Education & Training and NSW Police [2004] NSWADT 2 JD v NSW Department of Health [2006] NSWADT 353 KP v Narrandera Shire Council [2011] NSWADTAP 15 Nasr v State of New South Wales [2007] NSWCA 101 OD v Department of Education and Training (GD) [2005] NSWADTAP 74 Texts Cited: None cited Category: Principal judgment Parties: EJX (Applicant) University of Newcastle (Respondent) Representation: Counsel: Applicant (Self-represented) L Meagher (Respondent) Solicitors: Hicksons Lawyers (Respondent) File Number(s): 2021/00219950 Publication restriction: Pursuant to the Civil and Administrative Tribunal Act 2013 (NSW), s 64(1)(a) by order of the Tribunal previously made, the publication or broadcast of the name of any person mentioned in these proceedings is prohibited. REASONS FOR DECISION 1. This application concerns the conduct of the University of Newcastle "(the respondent") in connection with use of the personal information of the applicant ("EJX") (a pseudonym). 2. By her application filed in this Tribunal on 1 August 2021 ("the application"), EJX is seeking a review of conduct of Professor 1 (a pseudonym) which she says amounts to a breach of her privacy. 3. The application was made following an internal review by a third party internal reviewer on behalf of the respondent under s 53 of the Privacy and Personal Information Protection Act 1998 (NSW) ("PPIP Act"). The conduct EJX complained of and which formed the basis of that internal review application, was: "Use of my personal information without my consent by [Professor 1], failure to protect my personal information, rejection on resolving the matter." 1. The internal review decision was made on 5 July 2021. The complaint by EJX on the internal review application and correspondence which accompanied it, was limited to "use" of personal information including her "name, student ID and signature". 2. The internal reviewer found that the conduct which was complained of had occurred but that it did not constitute a breach of the information privacy principles ("IPPs") contained in ss 10, 16 or 17 of the PPIP Act. 3. It is from this decision that EJX lodged an application with the Tribunal for administrative review. The internal review decision is the reviewable decision before me under s 55(1) of the PPIP Act. 4. The names of private individuals, and other information which might identify them, have been anonymised in conformity with orders previously made under s 64(1) of the Civil and Administrative Tribunal Act 2013 (NSW) ("CAT Act"). Issues 1. The issues for determination are: 1. Whether the conduct of the University that is the subject of EJX's complaint was in breach of the IPPs as set out in the PPIP Act; and 2. if so, what action, if any, should be taken in regard to any breaches including whether damages should be awarded. 1. For the reasons set out below, I am not satisfied that the respondent's conduct was in breach of the IPPs in the PPIP Act. I have decided that no further action is to be taken in this matter and have dismissed EJX's application to this Tribunal. Materials relied on 1. In conducting a review, the Tribunal is required to determine the correct and preferable decision having regard to the materials before it and the applicable law: Administrative Decisions Review Act 1997 (NSW), s 63 ("ADR Act"). 2. The material before the Tribunal comprises that relied on by EJX and the respondent. 3. EJX relied on: 1. Affidavit of EJX dated 20 December 2022; 2. Points of claim filed 13 January 2023; 3. Outlines of submissions filed 20 December 2022, 13 January 2023, 10 February 2023; 4. Letter from Hickson Lawyers dated 3 June 2022 with table of documents not originally produced by the respondent as subject to legal professional privilege; 5. Affidavit of EJX dated 10 February 2023. 1. The respondent relied on: 1. Affidavit of the internal reviewer (Ms W) of 19 January 2023 including the internal review decision of 5 July 2021; 2. Affidavit of Ms W dated 7 March 2023; 3. Points of Defence dated 20 January 2023; 4. Submissions dated 27 February 2023; 5. Section 58 documents pursuant to the Administrative Decisions Review Act 1997 (NSW); and 6. Affidavit of the respondent's solicitor dated 7 March 2023. Background 1. EJX was a student at the respondent between August 2015 and August 2021 and was a PhD candidate. 2. In late 2017, EJX alleged she was subjected to sexual harassment by the primary supervisor of her PhD, Professor X. Consequently, EJX wanted a replacement principal supervisor approved by the respondent. 3. On 15 January 2018, EJX emailed Professor 1 with an enquiry regarding her PhD studies being placed under his supervision as a replacement for Professor X. There was numerous correspondence between EJX and Professor 1 as to projects she could work on under his supervision. The precise research topics had not yet been decided upon at this stage. 4. On 1 February 2018, EJX emailed a Variation to Candidate Supervisory Changes Form (the "change form") to Professor 1 which she had completed and signed. The form indicated a change of principal supervisor from Professor X to Professor 1 with a supervision load of 60%. The other 40% supervisory load was stated to be maintained by the existing two co-supervisors (Professor 2 and Professor 3, both from universities overseas) in the same previously allocated load (30% and 10% respectively). 5. On 5 February 2018, Professor 1 electronically signed and emailed back the change form to EJX. On the same day EJX had an exchange of emails with the relevant Dean of Graduate Research ("Dean") regarding the change and the required approval from both the Head of School of Professor X and approval from the Head of School of Professor 1 ("HoS"). 6. On 13 February 2018, Professor 1 emailed HoS to advise that Professor S would take on 10% of his supervisory load for EJX, and he would manage the balance. In this email Professor 1 stated: "I've heard from [the Dean], and spoken with [Professor S] and [EJX], I think it's okay from my end [and Professor S] for supervisory changes to go ahead. [Professor S] will go on for 10% [supervision], I'll take the rest. I've also had a few conversations with [EJX] and she is making progress around accessing the data … and structuring a timetable to write 3 good papers.…" 1. On 14 February 2018, the HoS emailed other staff members the change form, being the one which had been signed by EJX and Professor 1. 2. On 16 February 2018, the HoS emailed a Faculty Research Training Officer an amended version of the change form, which now had two other signatures and an amendment to reduce Professor 1's load to 50% and to add Professor S as a co-supervisor with a supervisory load of 10%. 3. On 22 February 2018, the respondent confirmed changes made to EJX's supervision arrangements in an email to EJX (sent to both EJX's Hotmail account and an email account with the respondent) which stated: "I am writing to advise that changes have been made to your supervisory arrangements which are now listed as follows: Principal Supervisor: [Professor 1] – 50% Co-Supervisors: [Professor S] – 10% [Professor 2] – 30% [Professor 3] – 10% This change has been made effective from 1 February 2018." 1. From at least 13 April 2018, EJX started to engage with Professor S both via email and in person as one of her supervisors for the purposes of her PhD. The email correspondence demonstrates EJX acting in a way consistent with Professor S being a co-supervisor of her studies. EJX accepted in cross-examination at the hearing that Professor S had the underlying data which was required for the project EJX was working on for her PhD and so her involvement was necessary. 2. On 23 April 2018, EJX had met with Professor S; shared her Dropbox folder with Professor S (which in an email she stated that she shared with "all of her supervisors"); and also an "own-cloud folder" shared only with Professor S and Professor 1. 3. By August 2019, in email correspondence from EJX to the respondent, she complained about the quality of supervision she was receiving from Professor S as a "co-supervisor". She stated: "[Professor S] is on maternity leave and has been occasionally responding to my emails since April 2019. I was not advised of this expected absence for such long time and this correspondences limitation. The alternative arrangements have not been implemented for supervision during her absence … The co-supervisor should be the co-author of our journal papers and she has been involved in this project of my PhD (MA). So, I do need to receive her feedback on my work to make good progress and is required for her to contribute in the papers as co-author based on policy." 1. In email correspondence in November 2019, Professor S communicated to EJX that she did not agree to EJX using certain data in the publication of a journal paper prepared by EJX as it required consent, belonged to the respondent and required further work prior to publication. 2. EJX subsequently made numerous other complaints to the respondent concerning the quality of the supervision provided by Professor 1 and Professor S including that they did not respond to correspondence, attend meetings or assist her generally in the completion of her PhD. She also alleged that Professor 1 left her unsupervised from July 2019. 3. On 2 December 2019, EJX arranged for Professor S to be removed as a co-supervisor. 4. Ultimately, EJX submitted her thesis in January 2020 but was required to re-submit it within 12 months. She did not do so and did not complete the thesis. 5. In about late 2020 or early 2021, EJX says she became aware of her privacy rights and sought assistance from the Information Privacy Commissioner. The internal review application was eventually lodged in May 2021. Application in this Tribunal 1. Although the internal review application was focused solely on breaches concerning the use of information (ss 16 and 17 PPIP Act), in the application before this Tribunal, EJX expanded the alleged breaches of the PPIP Act to include ss 10(b), 11, and 18. These were then further expanded upon in her Points of Claim filed on 13 January 2023 as follows: "i. Collection of EJX's personal information (sections 9 to 11 of the PPIPA); ii. Protection of EJX's personal information (section 12 of the PPIPA) iii. access information in relation to material including EJX's personal information (section 14 of the PPIPA) iv. Accuracy of EJX's personal information (section 16 of the PPIPA) v. Use of EJX's personal information (sections 13 to 17 of the PPIPA) vi. Disclosure of EJX's personal information (section 18 of the PPIPA). 1. As a result of these alleged breaches, EJX contended her study was impaired because Professor S was on leave for a year and did not make any contribution to her candidacy which significantly disadvantaged EJX and postponed her study. Relevant law 1. The PPIP Act is an Act to provide for the protection of personal information and for the protection of the privacy of individuals generally (see the Long Title to the Act). 2. The Tribunal has jurisdiction under the PPIP Act, s 55 to administratively review conduct that was the subject of an application for review under PPIP Act, s 53(1). The Tribunal's task is to review the conduct which has been complained of, and to then determine whether or not that conduct was conduct which amounted to a breach. 3. Under PPIP Act, s 52 the conduct must relate to the contravention of an IPP (as contained in ss 8 to 19 of the PPIP Act) by a public sector agency. There is no dispute in this matter that the respondent is a public sector agency for the purpose of the PPIP Act. 4. The expression "personal information" is set out in s 4 of the PPIP Act as follows: …personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. 1. There is also no dispute that EJX's name, student ID and signature are her "personal information" for the purposes of the PPIP Act. Information Privacy principles 1. The Points of Claim specifically allege breaches of IPPs contained in ss 9, 10, 11, 12, 13, 14, 16, 17 and 18 of the PPIP Act. Those provisions are as follows: 2. Section 9 of the PPIP Act provides: 9 Collection of personal information directly from individual A public sector agency must, in collecting personal information, collect the information directly from the individual to whom the information relates unless: (a) the individual has authorised collection of the information from someone else, or (b) in the case of information relating to a person who is under the age of 16 years—the information has been provided by a parent or guardian of the person. 1. Section 10 of the PPIP Act provides: 10 Requirements when collecting personal information If a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances to ensure that, before the information is collected or as soon as practicable after collection, the individual to whom the information relates is made aware of the following: (a) the fact that the information is being collected, (b) the purposes for which the information is being collected, (c) the intended recipients of the information, (d) whether the supply of the information by the individual is required by law or is voluntary, and any consequences for the individual if the information (or any part of it) is not provided, (e) the existence of any right of access to, and correction of, the information, (f) the name and address of the agency that is collecting the information and the agency that is to hold the information. 1. Section 11 of the PPIP Act provides: 11 Other requirements relating to collection of personal information If a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances (having regard to the purposes for which the information is collected) to ensure that: (a) the information collected is relevant to that purpose, is not excessive, and is accurate, up to date and complete, and (b) the collection of the information does not intrude to an unreasonable extent on the personal affairs of the individual to whom the information relates. 1. Section 12 of the PPIP Act provides: 12 Retention and security of personal information A public sector agency that holds personal information must ensure: (a) that the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and (b) that the information is disposed of securely and in accordance with any requirements for the retention and disposal of personal information, and (c) that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and (d) that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or disclosure of the information. 1. Section 13 of the PPIP Act provides: 13 Information about personal information held by agencies A public sector agency that holds personal information must take such steps as are, in the circumstances, reasonable to enable any person to ascertain: (a) whether the agency holds personal information, and (b) whether the agency holds personal information relating to that person, and (c) if the agency holds personal information relating to that person: (i) the nature of that information, and (ii) the main purposes for which the information is used, and (iii) that person's entitlement to gain access to the information. 1. Section 14 of the PPIP Act provides: 14 Access to personal information held by agencies A public sector agency that holds personal information must, at the request of the individual to whom the information relates and without excessive delay or expense, provide the individual with access to the information. 1. Section 16 of the PPIP Act provides: 16 Agency must check accuracy of personal information before use A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading. 1. Section 17 of the PPIP Act provides: 17 Limits on use of personal information A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless: (a) the individual to whom the information relates has consented to the use of the information for that other purpose, or (b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or (c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person. 1. Section 18 of the PPIP Act provides: 18 Limits on disclosure of personal information (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless: (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. (2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it. 1. The Tribunal must make findings as to whether or not a privacy principle has been breached even if the evidence is uncertain: KP v Narrandera Shire Council [2011] NSWADTAP 15 at [26] and [31]. 2. The scope of the review proceeding in the Tribunal is limited by the scope of the application for internal review: OD v Department of Education and Training (GD) [2005] NSWADTAP 74 at [13]-[14]. It is preferable in all cases for the agency to have the ability to undertake an internal review prior to any matter coming to the Tribunal: GA v Department of Education & Training and NSW Police [2004] NSWADT 2 at [21]-[22]. EJX submissions 1. EJX submits that her name, student ID and signature are personal information as defined by PPIP Act, s 4(1). 2. EJX contends that the change form (which contained her personal information) as submitted was only intended for the purpose of adding Professor 1 as the principal supervisor and she did not expect or give consent to it being used for any other purpose. She stated that she believed Professor 1 used her name, student ID and signature to process the form he amended for EJX's supervisory change without her consent, and for the benefit of Professor S. 3. I have addressed each of EJX's submissions in respect of each alleged breach of the PPIP Act further below. Consideration 1. I have had regard to all of the evidence including the oral evidence of EJX and the internal reviewer in cross-examination, as well as the extensive documentary evidence. 2. I note that Professor 1 did not give evidence. However, there were contemporaneous emails in evidence including emails to and from Professor 1, other employees of the respondent and EJX. 3. I find that EJX provided her personal information (her name, student ID and signature) to the respondent in the change form. 4. In determining the purpose for which information is proposed to be used, regard must be had to the purpose for which the information was collected: JD v NSW Department of Health [2006] NSWADT 353 at [52]. The test to be applied is the purpose of the agency: ALZ v WorkCover NSW [2015] NSWCATAP 138 at [100]-[101]. 5. The word "use" in regard to personal information has been considered in EPT v The Sydney Children's Hospital Network [2022] NSWCATAD 137 at [49] as follows: "[49] It is evident that the application of the 'use' when examining IPPs requires a 'use' of personal information by the public sector agency. 'Use' was considered in Director-General Department of Education and Training v MT [2005] NSWADTAP 77 at [44] to mean 'which involves some administrative action or consequence'. The Tribunal in Jackson v University of NSW [2018] NSWCATAD 12 at [102] said: 'Mere accessing or viewing information will not constitute a "use", unless the information is also "employed" for some purpose.'" 1. I am satisfied that the purpose of the respondent in collecting EJX's personal information on the change form was to obtain the requisite approvals from supervisors, the Dean and HoSs to implement changes to the supervision arrangements for EJX's PhD candidacy. 2. While EJX's purpose in providing the personal information was to ensure Professor X was removed and have Professor 1 replace him as her principal supervisor and to get approval from the respondent for this to occur, this is not the focus of the question about use. 3. While some of the documentary evidence (in particular emails from Professor 1) suggests that EJX consented to the inclusion of Professor S on the change form, EJX denied that she gave consent to the amendments to the change form. She denied any discussions with Professor 1 or any other employee of the respondent to the effect that an amendment needed to be made to the change form. I accepted this evidence particularly in the face of the absence of evidence about this issue from the respondent and/or in particular Professor 1. 4. EJX gave inconsistent evidence about whether she knew about the change to the supervisory role from 22 February 2018. In some of the documentary material before the Tribunal, EJX contended she never received the 22 February 2018 email with the amendments to the change form. In cross-examination however she said when she received the email she was surprised to see the name of Professor S on it but did not respond to the email at that time because she had multiple complaints with the respondent which they never responded to (some of which are the subject of other proceedings before the Tribunal). 5. I am satisfied on the balance of probabilities that EJX did not in the period 5 February to 21 February 2018, have a specific or detailed conversation with Professor 1 or another employee of the respondent about the need for a further alteration to the change form to include Professor S as a co-supervisor. I am satisfied that EJX did not expressly consent to the further changes being made to the change form to add Professor S as a co-supervisor after she had already signed it and submitted the change form. 6. However, I find that EJX was aware that Professor S was to be a co-supervisor of her PhD and that by 22 February 2018, Professor S had in fact been included in the change form with EJX's knowledge. EJX did not complain about the amendment expressly brought to her attention in the 22 February 2018 email. EJX required Professor S to be a co-supervisor in order to use the data of Professor S and by at least April 2018, EJX was corresponding with Professor S about the data and the work on her thesis. This indicates that EJX had consented to Professor S being her co-supervisor whether or not she had consented to the physical changes on the change form to reflect the co-supervision. 7. I am satisfied that EJX's personal information was used to bring about a change of supervision for EJX's PhD and that as part of that process, her personal information as contained on the change form was shared with Professor S and other employees of the respondent such as the Dean and the HoS. 8. Consequently, I find that the conduct complained of by EJX, that the respondent used her personal information making changes to the change form without her consent, occurred. Whether that conduct constitutes a use of her personal information in breach of the PPIP Act is a separate question. 9. I do not however consider that the respondent failed to protect her information. There was insufficient evidence before me to support that complaint. Consequently, I do not find that this aspect of the complaint occurred. Potential Breaches of IPPs 1. As the internal reviewer considered the conduct as it related to ss 16 and 17 PPIP Act and did not specifically consider whether the conduct constituted breaches of ss 9, 10, 11, 12, 13, 14 and 18 or make findings in respect of these purported breaches, the respondent contended it is unnecessary for me to determine them for myself. However, while I accept EJX's original complaint did not specify particular sections and a broad reading of the complaint led the reviewer to consider that the only relevant sections to the conduct complained of were ss 16 and 17, the reviewer effectively determined that the other sections did not apply. Consequently, I consider it is open to me to consider afresh on this review, whether the conduct complained of breaches the additional sections relied upon by EJX in this application. 2. I am not satisfied that the conduct gives rise to breaches of any of the sections specified by EJX for the reasons that follow. Section 9 (IPP2) and Section 11 (IPP 4) 1. EJX contends that the respondent did not collect EJX's personal information directly from her to make changes to the change form and therefore breached ss 9 and 11. 2. As EJX's personal information was collected directly from EJX to enable Professor X to be removed and a change to her supervision to be considered and approved, ss 9 and 11 do not apply. Section 10 (IPP 3) 1. EJX submitted that she was not notified about the use of her personal information for another purpose (she contended the purpose was solely to add Professor S to the list of supervisors) and therefore a breach of s 10 arises. 2. I am not satisfied that the use of EJX's information was for another purpose or that she was not notified. I have already found that the respondent's purpose for collection of EJX's personal information was to process a change of supervision for EJX. The respondent's form specifically indicates the purpose for which the personal information is collected – to bring about a change to the supervisory details. Further, EJX was notified on 22 February 2018 that the change of form processed included Professor S. 3. There is no breach of s 10 PPIP Act. Section 12 (IPP 5) 1. EJX says that as the respondent did not have her consent to make amendments to the change form, the use of her personal information to make alterations on the change form was an unauthorised disclosure. EJX also said that her personal information collected by the respondent was not complete, up to date, excessive and false. 2. There is no allegation that the respondent kept EJX's personal information longer than necessary or than was needed to process a change to the supervision; that it was not disposed of securely or not protected by security safeguards; nor that the respondent failed to do everything reasonably necessary to prevent unauthorised disclosure. 3. I am not satisfied that s 12 has been breached. The sharing of EJX's personal information among the employees of the respondent to bring about a change of supervision (critically the removal of Professor X as the principal supervisor and installation of Professor 1 as the new principal supervisor) was not in breach of s 12 and was in fact necessary for the processing of a change of supervision that had been agreed by the relevant Professors, Dean and HoS. 4. As noted above, I do not accept that EJX did not know that Professor S was to be her co-supervisor. The steps taken by EJX following receipt of the 22 February 2018 email (notably, not making any complaint about it at that time and subsequently corresponding with Professor S and sharing with Professor S her thesis materials) indicate she had consented to the change even if she did not realise that meant a form would be completed to note that change. The further amendment to include Professor S in respect of a 10% supervisory load was required in order for EJX to be granted approval to have Professor S as a co-supervisor and to enable EJX to use the data of Professor S. EJX conceded in cross-examination that she required that data and it is clear on the evidence that EJX knew Professor S was her co-supervisor. Section 13 (IPP 6) use 1. EJX repeated her allegation that the respondent used and shared her personal information without her consent but also that the respondent did not notify her of the main purpose for which her information would be used until EJX made the internal review application. This she contended was in breach of s 13 PPIP Act. 2. For the same reasons in respect of s 12, I find that the conduct complained of does not breach s 13. Further, I am satisfied that EJX was notified of the main purpose for which the information was used. EJX was aware that her personal information was required to process and get approval for the change of supervision for her PhD. That is what it was in fact used for and she was notified of this on 22 February 2018. Section 14 (IPP 7) access 1. I reject EJX's contention that the respondent did not give her access to the amended change form. There is no evidence to support this contention and, in any event, by 22 February 2018, EJX was aware of the amendments. 2. I am not satisfied that s 14 has been breached. Section 16 (IPP 9) 1. EJX contends that the respondent should have contacted her to check the accuracy of her personal information on the amended change form. However, this was unnecessary given EJX provided her personal information to the respondent. Further, to the extent there was any error, it was open to EJX to raise this issue on 22 February 2018 when she received the email from the respondent confirming the changes. 2. I am not satisfied that there is a breach of s 16. Section 17 (IPP 10) 1. EJX contends that the respondent used her information for a purpose other than that for which it was collected. I disagree. 2. I have already found that EJX was not aware prior to 22 February that the change form had been altered to include Professor S nor did she provide express consent to the change to the form. However, she did know Professor S was to be a co-supervisor. 3. I have also found that the purpose for the respondent collecting EJX's personal information was to bring about a change of supervision, specifically to remove Professor X as primary supervisor with Professor 1 as the replacement primary supervisor. This would enable EJX to continue her PhD work with the respondent. 4. The respondent's primary purpose for collecting the personal information did not change. 5. Even if this is not correct, s 17 contains an exception for a purpose which is directly related to the primary purpose. If the amendment to the change form constituted a different purpose, it was directly related to the respondent's primary purpose of ensuring a change of the supervisory arrangements for EJX's PhD was to be approved and implemented. 6. Consequently, s 17 is not breached. Section 18 (IPP 11) 1. Section 18 deals with external disclosure of the personal information by an agency: Director General Department of Education and Training v MT (GD) [2005] NSWADTAP 77 at [39]. 2. The essence of disclosure is "making known to a person information that the person to whom the disclosure is made did not previously know": Nasr v State of New South Wales [2007] NSWCA 101 at [127]. 3. EJX contends that the respondent did not protect her personal information, disclosing it to other staff, including Professor S, without her consent in breach of s 18 PPIP Act. There is no allegation that it was disclosed outside the agency. 4. While the information was disclosed to Professor S and other staff in order to process the change of supervision, and EJX's consent was not expressly sought to make the change on the form, the failure to obtain her consent does not constitute a breach of s 18. 5. I am not satisfied on the evidence that the respondent disclosed the information to a third party or that the information was not already known to the respondent or that the respondent failed to protect EJX's personal information. Consequently s 18 is not breached. Conclusions on complaint 1. On the evidence before me, for all the reasons set out above, I have not found that the respondent's conduct breaches of any of ss 9, 10, 11, 12, 13, 14, 16, 17 or 18 PPIP Act. Additional complaints 1. At the internal review stage, EJX also complained that the respondent had rejected resolving the issue about the alterations to the change form. At the hearing EJX submitted that after she made a complaint about the conduct of Professor X, the respondent refused to help her generally and also to supervise her adequately. While in my view, the documentary evidence tended to demonstrate that the respondent did in fact assist EJX, the complaint does not raise any breach of the PPIP Act. 2. EJX also contended on the application before me that the internal reviewer and findings of the respondent failed to make an impartial determination of her privacy concerns. This was said to be in breach of ss 55(1), 53(4) and 53(5). As I understood this complaint, it was on the basis of her belief that the individual who dealt with the internal review was also substantially involved in a matter relating to the conduct the subject of the application. EJX informed me this complaint was the subject of separate proceedings before the Tribunal. This is not a matter that raises any breach of the PPIP Act and is not in any event the subject of my review, given I am to review the conduct the subject of the complaint before the internal reviewer. Damages 1. As I have not found any breaches by the respondent, the issue concerning damages does not arise. In any event, there was no medical evidence or other evidence that would have enabled me to make a finding as to damages. The mere assertions of EJX to the effect that as a result of the respondent's alleged breaches she has suffered damage including loss of expected income she would have earned if she had successful completed her PhD, is not sufficient evidence. Additional matters 1. EJX was self-represented at the hearing. 2. At the commencement of the hearing EJX notified me that she had requested a female interpreter but one was not present at the Tribunal. I offered to adjourn the hearing to have the registry follow up on the interpreter but EJX requested that her partner who was in attendance with her be permitted to interpret should the need arise. The respondent did not object and so I granted EJX's application and permitted her partner to provide interpretative assistance if required. On a few occasions during the hearing EJX appeared unsure of a word or sentence that had been used, we would stop briefly so that she could check with her partner. 3. EJX appeared to me to have very good command of the English language and was articulate. I did not perceive any difficulty with her understanding of what was occurring or being said during the course of the hearing. 4. Also at the commencement of the hearing, EJX complained that her two previous applications to adjourn the hearing, made in the week prior to the hearing, had been rejected. EJX contended that she remained prejudiced by the late filing by the respondent of its submissions which she said she had not had adequate time to review (despite having been filed two weeks prior). I noted her complaint and gave her a short adjournment to consider whether she wanted to reagitate an application for an adjournment or alternatively spend some time reviewing the submissions with her partner. After a short adjournment, EJX informed me that she intended to continue with the hearing. Section 58 documents 1. Before the hearing, the respondent located a document being email correspondence between the HoS, Dean and Professor 1 which had not previously been produced to the Tribunal under s 58 ADR Act. An affidavit explaining why it had not been provided earlier was relied upon by the respondent. 2. EJX contended that the respondent was in breach of its obligations under s 58 of the ADR Act. EJX directed me to one of her previous matters before the Tribunal where the Tribunal member had found that the respondent had failed to fulfil its obligation under s 58 but the Tribunal had not made any orders concerning the non-compliance. EJX requested that I make orders about their non-compliance. She did not articulate what type of order should be made. 3. The respondent submitted that I had no jurisdiction in this proceeding to make declarations about a breach of s 58 and that while the document had some discernible connection to the issues in dispute, there was no prejudice to EJX by its late production. 4. Under s 58 ADR Act, an agency is obliged to furnish to the Tribunal all material in its possession that it considers relevant to the proceedings not, as EJX contended, every document in its possession that relates to the matter. 5. I accept the respondent's evidence that despite a search being undertaken of relevant materials held by the respondent, this email was not previously located and therefore not previously provided to the Tribunal. In my view, its non-production was inadvertent. The email correspondence is relevant to when the amendment to the change form occurred but does not shed any further light on whether or not EJX consented to or knew about that amendment at that time (ie 16 February 2018) or whether there was a breach of any IPP. It generally provides little to no assistance in the resolution of the issues. 6. While the respondent failed to produce this document under s 58 at the time originally directed by the Tribunal, it has done so now. Further, EJX did not contend its late production had any prejudicial effect on the preparation of her case (nor could it have given its content). 7. EJX did not direct me to any statutory provision which provides the jurisdiction to exercise the power to make a declaration as sought by her, nor, in this review proceeding, is there jurisdiction for me to make any orders about non-compliance with s 58. The general jurisdiction in s 29 CAT Act enables the Tribunal to make decisions or exercise functions given to it by legislation in respect of the matter. On this issue, that is the ADR Act. However, there is no power under the ADR Act for the Tribunal to make declarations for non-compliance for non-compliance with s 58. The Tribunal can make orders under s 58(4) for an agency to produce documents which have not been produced, but here they were provided with an explanation as to the reason they were not produced earlier. In effect, the respondent was compliant as the document was put before the Tribunal albeit after the date originally ordered for the production of materials under s 58. 8. I agree with the respondent that the Tribunal does not have the jurisdiction to make a declaration within the CAT Act or ADR Act to the effect sought by EJX and I reject her application for me to do so. 9. To the extent EJX was requesting I make orders under s 72(3) CAT Act, that the respondent contravened an order of the Tribunal to produce all materials under s 58 by a particular date (although not expressly stated or requested), I would not grant such a request as I consider the respondent was ultimately compliant with its obligation to produce and I accept that the non-disclosure at an earlier time was inadvertent. Order 1. The orders of the Tribunal are: 1. No further action is to be taken in this matter. 2. The Applicant's application is dismissed. ********* I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 25 August 2023