Civil and Administrative Tribunal New South Wales Medium Neutral Citation: Insurance and Care NSW v FMM [2024] NSWCATAP 43 Hearing dates: 6 October 2023 Date of orders: 25 March 2024 Decision date: 25 March 2024 Jurisdiction: Appeal Panel Before: Hennessy ADCJ, Deputy President J Lucy, Senior Member Decision: 1. The appeal is allowed. 2. Orders 2, 3 and 4 of the Tribunal are set aside. In substitution for those orders, the following order is made: The correct respondent is Insurance and Care NSW. 3. Insurance and Care NSW is substituted for Nominal Insurer as the proper name of the respondent in FMM v Nominal Insurer [2023] NSWCATAD 114. 4. Order 3 takes effect from the commencement of proceedings in FMM v Nominal Insurer [2023] NSWCATAD 114. 5. Orders 5 and 6 of the Tribunal are set aside. In substitution for those orders, the following order is made: The internal review findings that the agency contravened information protection principle 11 and health privacy principle 11 are set aside and in substitution for those findings it is determined that the conduct of the agency contravened s 12(c) of the Privacy and Personal Information Protection Act 1998 and clause 5(1)(c) of Schedule 1 to the Health Records and Information Privacy Act 2002. 6. Order 7 is varied so as to delete the words "Nominal Insurer" and substitute the words "the respondent". 7. Order 8 is varied so as to delete the words "the Nominal Insurer must ensure that its agent Insurance and Care NSW t/a iCare designs and implements" and substitute the words "the respondent must design and implement". 8. Order 9 is varied so as to delete the words "the Nominal Insurer must ensure that its agent Insurance and Care NSW t/a iCare institutes" and substitute the words "the respondent must institute". Catchwords: ADMINISTRATIVE LAW – privacy – whether Appeal Panel has jurisdiction to hear an appeal from an order that agency has contravened an Information Privacy Principle and a Health Privacy Principle – whether appeal is moot ADMINISTRATIVE LAW – privacy – meaning of "disclose" in section 18(1) of the Privacy and Personal Information Protection Act 1998 (NSW) – meaning of "disclose" in clause 11 to Schedule 1 of the Health Records and Information Privacy Act 2002 (NSW) Legislation Cited: Civil and Administrative Tribunal Act 2013 (NSW) Criminal Records Act 1991 (NSW) Health Records and Information Privacy Act 2002 (NSW) Privacy and Personal Information Protection Act 1998 (NSW) Government Information (Public Access) Act 2009 (NSW) Public Interest Disclosures Act 2022 (NSW) Privacy Act 1988 (Cth) State Insurance and Care Governance Act 2015 (NSW) Workers Compensation Act 1987 (NSW) Cases Cited: Austin Australia Pty Ltd (in liq) v A & G Scaffolding and Rigging Service Pty Ltd [2007] NSWSC 1077; (2007) 25 ACLC 1363 Australian Broadcasting Tribunal v Bond (1990) 170 CLR 321 Australian Press Council Inc v Southey [2022] NSWCATAP 127 Brennan v Comcare (1994) 50 FCR 555 Commissioner of Police, NSW Police Force v Cseszko [2016] NSWCATAP 194 Drake v Minister for Immigration and Ethnic Affairs (1979) 24 ALR 577; (1979) 2 ALD 60 East West Airlines Ltd v Turner (2010) 78 NSWLR 1; [2010] NSWCA 53 Hunter Douglas Australia Pty Ltd v Perma Blinds (1970) 122 CLR 49 Industrial Relations Secretary v Fire Brigade Employees' Union of New South Wales [2020] NSWCA 46 Jardin and Jardim Investments Pty Ltd v Metcash Ltd [2011] NSWCA 409 KP v Narrandera Shire Council (GD) [2011] NSWADTAP 15 Nasr v State of New South Wales [2007] NSWCA 101 PC v University of New South Wales [2005] NSWADTAP 72 People with Disability Australia Incorporated v Minister for Disability Services [2011] NSWCA 253 Pratt Consolidated Holdings Pty Ltd v Commissioner of Taxation [2011] AATA 907 Secretary, Department of Communities and Justice v Feeney [2021] NSWCATAP 139 Shi v Migration Agents Registration Authority (2008) 235 CLR 286 Wojciechowska v Secretary, Department of Communities and Justice; Wojciechowska v Registrar, Civil and Administrative Tribunal [2023] NSWCA 191 Category: Principal judgment Parties: Insurance and Care NSW (Appellant) FMM (Respondent) Also heard: Privacy Commissioner Representation: Counsel: P Lin (Respondent) Solicitors: Crown Solicitor (Appellant) Pinnacle Lawyers (Respondent) Privacy Commissioner File Number(s): 2023/00196894 Publication restriction: The publication or broadcast of the name of the respondent is prohibited pursuant to s 64(1)(a) of the Civil and Administrative Tribunal Act 2013 (NSW). Decision under appeal Court or tribunal: Civil and Administrative Tribunal Jurisdiction: Administrative and Equal Opportunity Division Citation: FMM v Nominal Insurer [2023] NSWCATAD 114 Date of Decision: 23 May 2023 Before: P French, Senior Member File Number(s): 2022/00242083 REASONS FOR DECISION Background 1. Insurance and Care NSW, which we will refer to as "the agency," has appealed from the Tribunal's decision that it disclosed FMM's personal and health information to a person in breach of s 18 of the Privacy and Personal Information Protection Act 1998 (NSW) (PPIP Act) and clause 11 of Schedule 1 to the Health Records Information Privacy Act 2002 (NSW) (HRIP Act). Those provisions state that an agency that holds personal or health information must not disclose the information unless certain exceptions apply. 2. The Tribunal found that the agency had disclosed FMM's personal and health information to Mr Howes, an insurance broker, by mistakenly sending him certain information in an attachment to an email. Mr Howes opened the email but deleted it before opening the attachment containing FMM's personal and health information. As none of the exceptions in the legislative provisions applied, the Tribunal made several orders including that the agency pay FMM $20,000 in compensation. 3. The appeal by the agency is on a "question of law": Civil and Administrative Tribunal Act 2013 (NSW) (NCAT Act), s 80(2). The agency's ground of appeal is that the Tribunal misconstrued and misapplied s 18 of the PPIP Act and clause 11 of Schedule 1 to the HRIP Act. The agency submits that the essence of the word "disclose" in those provisions is "making known to a person information that the person to whom the disclosure is made did not previously know": Nasr v State of New South Wales [2007] NSWCA 101 ("Nasr") at [127]. According to the agency, because the information was not "made known" to Mr Howes, it has not been "disclosed". FMM submits that the fact that he did not read the attachment to the email does not mean the information was not disclosed. 4. The Privacy Commissioner exercised a right to appear and be heard in the appeal (PPIP Act, s 55(6)). The Privacy Commissioner made submissions about the proper construction of the term "disclosure" in the privacy legislation. The Commissioner did not make submissions about the preliminary issues. Preliminary issues 1. The preliminary issues on which the Appeal Panel requested written submissions were as follows: 1. Is the correct name of the appellant "Insurance and Care NSW" rather than "Workers Compensation Nominal Insurer"? 2. Does the Appeal Panel have jurisdiction to entertain this appeal? That issue involves determining: 1. whether the Tribunal had power to make Order 6; and 2. whether the decision recorded in Order 6 is an "internally appealable decision"? 1. If so, is the appeal moot because it has no practical consequences for the parties? 1. One of the issues before the Tribunal was the correct name for the agency. The agency was the respondent in the Tribunal proceedings and is the appellant in these Appeal Panel proceedings. The Tribunal made orders removing iCare NSW as respondent and substituting Workers Compensation Nominal Insurer as respondent. 2. The jurisdictional issue concerns the agency's appeal from the Tribunal's order 6. The agency appealed from the Tribunal's orders 5 and 6 which were as follows: 5. The decision under review is varied. 6. In variation of that decision the Tribunal determines that the conduct of the agency constituted a contravention of Information Privacy Principles 5 and 11 (ss 12(c) and 18 of the Privacy and Personal Information Protection Act 1998) and HPP 5 and 11 (clauses 5(1)(c) and 11 of Schedule 1 of the Health Records and Information Privacy Act 2002). 1. The agency only challenges Order 6 to the extent that the determination concerns its contravention of the disclosure principles (information privacy principle 11 and health privacy principle 11); it does not challenge the determination that its conduct constituted a contravention of the security principles (information privacy principle 5 and health privacy principle 5). 2. There is an issue as to whether Order 6 is an "internally appealable decision" as defined in s 32(4) of the NCAT Act. Not all determinations on legal questions come within that definition. 3. The agency did not appeal from the Tribunal's order that it pay FMM $20,000 in compensation. The agency's failure to appeal from that order raises a further preliminary question as to whether the appeal should be dismissed under s 55(1)(b) of the NCAT Act as being misconceived or lacking in substance. The basis for dismissing the appeal on that ground would be that the appeal is moot because the Appeal Panel's decision would have no practical outcome for either party. 4. If the Tribunal does have jurisdiction, and the appeal is not moot, the substantive issue on appeal is whether the Tribunal misconstrued or misapplied s 18 of the PPIP Act and clause 11 of Schedule 1 to the HRIP Act. Correct name of the appellant 1. For the reasons we give below, Insurance and Care NSW is the proper respondent in the proceedings before the Tribunal below and is the proper appellant in these proceedings. 2. FMM had named the respondent as "iCare NSW" in her application for administrative review. The Tribunal formed the preliminary view that the proper description of iCare NSW was "Insurance and Care NSW t/a iCare" and that the proper respondent to the application was the Workers Compensation Nominal Insurer. The Tribunal sought submissions from the parties on this matter. Ultimately, the Tribunal removed Insurance and Care NSW as the respondent to the application and "amended" the name of the respondent to Workers Compensation Nominal Insurer. 3. FMM submitted that the agency should be identified as iCare NSW because that is the name of the agency with which she dealt. The agency submitted that that the respondent should be named Insurance and Care NSW. It expressed concern that substitution of the Workers Compensation Nominal Insurer may give rise to a jurisdictional issue because the applicant did not make an application for internal review to the Workers Compensation Nominal Insurer and a pre-requisite to the Tribunal's jurisdiction to conduct administrative review is that there has been an internal review by the relevant agency. 4. The obligations under s 18 of the PPIP Act apply to a "public sector agency". That term is defined in s 3 of the PPIP Act. Insurance and Care NSW is a body corporate established under s 4 of the State Insurance and Care Governance Act 2015 (NSW). It is, for the purposes of any Act, a NSW government agency: s 4(2). The Workers Compensation Nominal Insurer is also a 'public sector agency' and is a separate legal entity from Insurance and Care NSW. 5. The Tribunal's jurisdiction is dependent on a valid internal review application having been made in respect of conduct by the respondent: PPIP Act, s 55 and PC v University of New South Wales [2005] NSWADTAP 72 [20]-[21], [29]. FMM has not applied for an internal review of the conduct of the Nominal Insurer. She applied for an internal review of the conduct of Insurance and Care NSW. No reference was made to the Workers Compensation Nominal Insurer in FMM's internal review application. 6. The Tribunal below referred to s 154C(1) and (3) of the Workers Compensation Act 1987 (NSW) and found that Insurance and Care NSW, trading as iCare NSW was the proper respondent because it acted as agent for the Workers Compensation Nominal Insurer. Section 154C states that: 154C Authority to act for Nominal Insurer (1) ICNSW acts for the Nominal Insurer and anything done or omitted to be done by ICNSW on behalf of or in the name of the Nominal Insurer is taken to have been done or omitted by the Nominal Insurer. (2) In acting for the Nominal Insurer, ICNSW has and may exercise all the functions of ICNSW under this Act, the 1998 Act or any other Act or law. (3) A liability incurred by ICNSW when acting for the Nominal Insurer is a liability of the Nominal Insurer and not a liability of ICNSW or the State. (4) To remove doubt, it is declared that the provisions of Division 2A of Part 3 of the Government Sector Audit Act 1983 extend to authorise a performance audit by the Auditor-General under that Division in respect of any activities of ICNSW when acting for the Nominal Insurer. 1. ICNSW is defined in s 3 of the Workers Compensation Act to be Insurance and Care NSW. 2. The deeming provision in s 154C(1) requires the adoption of a "statutory fiction" for the limited purpose prescribed by the Workers Compensation Act, namely that anything done or omitted to be done by ICNSW on behalf of or in the name of the Nominal Insurer is taken to have been done or omitted by the Nominal Insurer: Hunter Douglas Australia Pty Ltd v Perma Blinds (1970) 122 CLR 49 at 65. Accordingly, the conduct complained of in the internal review application may be taken to have been done by the Nominal Insurer. However, it remains the case that FMM made the application to Insurance and Care NSW, not to the Nominal Insurer. Section 154C(1) does not deem any complaint made in respect of conduct by Insurance and Care NSW to be a complaint made in respect of conduct by the Nominal Insurer. 3. The effect of s 154C(3) is that if the Tribunal finds against Insurance and Care NSW, any liability will be deemed to be a liability of the Nominal Insurer. That deeming provision does not mean that the Nominal Insurer is the proper party in these proceedings. 4. For these reasons, we agree with the agency that the correct appellant is Insurance and Care NSW. A proper description of the agency's legal entity does not require the inclusion of its business name, "iCare". 5. The Tribunal's error was to remove the proper respondent as a party and to substitute an entity (the Nominal Insurer) who is not the proper party. This is not a case of misnaming the proper party in which case a correction would be relatively straightforward: Industrial Relations Secretary v Fire Brigade Employees' Union of New South Wales [2020] NSWCA 46 at [58]-[60]. However, the misjoinder of a party does not necessarily defeat the proceedings and we have proceeded to determine the issues notwithstanding the fact that the correct respondent was not named in the proceedings below. We do not understand either the Nominal Insurer or Insurance and Care NSW to oppose that course: Finance Corp of Australia v Bentley (1991) 5 BPR 11,883. In particular, Insurance and Care NSW does not seek to set aside the Tribunal's orders on the basis that it was not a party to those proceedings. 6. Consequently, we exercise the power under s 44 of the NCAT Act to remove the Nominal Insurer as a party to these proceedings and the proceedings below, and to substitute Insurance and Care NSW as the proper party. The order takes effect from the commencement of the proceedings in the Tribunal below: East West Airlines Ltd v Turner (2010) 78 NSWLR 1; [2010] NSWCA 53; Austin Australia Pty Ltd (in liq) v A & G Scaffolding and Rigging Service Pty Ltd [2007] NSWSC 1077; (2007) 25 ACLC 1363 at [21]-[33]). Does the Appeal Panel have jurisdiction to entertain this appeal? 1. The resolution of the jurisdictional issue involves interpreting various provisions in several statutes: the NCAT Act, the Administrative Decisions Review Act 1997 (NSW) (ADR Act), the PPIP Act and the HRIP Act. 2. The Appeal Panel has "internal appeal jurisdiction" over "any decision made by the Tribunal in proceedings for a general decision or administrative review decision": NCAT Act, s 32(1)(a). The proceedings before the Tribunal were proceedings for an administrative review decision. An "internally appealable decision" is defined in s 32(4) of the NCAT Act to be "a decision of the Tribunal or a registrar over which the Tribunal has internal appeal jurisdiction". 3. The ADR Act sets out the circumstances in which the Tribunal has administrative review jurisdiction over a decision of an administrator: NCAT Act, s 30(1). An "administratively reviewable decision" is defined in s 7 of the ADR Act: Meaning of "administratively reviewable decision" (1) An administratively reviewable decision is a decision of an administrator over which the Tribunal has administrative review jurisdiction. (2) For the avoidance of doubt (and without limiting subsection (1) or section 6): (a) the conduct of an administrator (or a refusal by an administrator to engage in conduct) is an administratively reviewable decision if enabling legislation identifies that conduct or refusal as conduct or refusal over which the Tribunal has administrative review jurisdiction, and (b) in its application to any such conduct or refusal by an administrator, any reference in this Act (However expressed) to an administrator making an administratively reviewable decision includes a reference to an administrator engaging or refusing to engage in the conduct. Note— The jurisdiction conferred on the Tribunal by section 55 of the Privacy and Personal Information Protection Act 1998 is an example of administrative review jurisdiction of the Tribunal over conduct. 1. In this case the "enabling legislation" referred to in s 7(2)(a) of the ADR Act is s 55 of the PPIP Act. As the note to s 7(2)(a) of the ADR Act states, s 55(1) of the PPIP Act is an example of administrative review jurisdiction of the Tribunal over conduct, as distinct from a decision. Consequently, in proceedings under s 55 of the PPIP Act, the administratively reviewable decision is, or at least includes the alleged conduct of an administrator: ADR Act, s 7(2) and PPIP Act, s 55. 2. Section 55(1) of the PPIP Act allows a person to apply to the Tribunal for administrative review of the agency's conduct in certain circumstances, including when that person is not satisfied with the findings of the agency on internal review. Section 55(2) sets out the Tribunal's powers on review. Those provisions are as follows: 55 Administrative review of conduct by Tribunal (1) If a person who has made an application for internal review under section 53 is not satisfied with— (a) the findings of the review, or (b) the action taken by the public sector agency in relation to the application, the person may apply to the Civil and Administrative Tribunal for an administrative review under the Administrative Decisions Review Act 1997 of the conduct that was the subject of the application under section 53. …. (2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders— (a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct, (b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice, (c) an order requiring the performance of an information protection principle or a privacy code of practice, (d) an order requiring personal information that has been disclosed to be corrected by the public sector agency, (e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant, (f) an order requiring the public sector agency not to disclose personal information contained in a public register, (g) such ancillary orders as the Tribunal thinks appropriate. 1. Under s 52 of the PPIP Act, the "conduct" to which Part 5 of the PPIP Act applies, and which is the subject of the Tribunal's review on an application for administrative review, is identified as follows: 52 Application of Part (1) This Part applies to the following conduct— (a) the contravention by a public sector agency of an information protection principle that applies to the agency, (b) the contravention by a public sector agency of a privacy code of practice that applies to the agency, (c) the disclosure by a public sector agency of personal information kept in a public register. (2) A reference in this Part to conduct includes a reference to alleged conduct. 1. The contravention of a health privacy principle that applies to an agency is also conduct to which Part 5 of the PPIP Act applies (HRIP Act, s 21(1)(a)). 2. Provision for the internal review of conduct is made in s 53 of the PPIP Act. After the completion of an internal review, the agency must notify the applicant in writing of— 1. the findings of the review (and the reasons for those findings), and 2. the action proposed to be taken by the agency (and the reasons for taking that action), and 3. the right of the person to have those findings, and the agency's proposed action, administratively reviewed by the Tribunal (PPIP Act, s 53(8)). 1. The agency's conduct in this case is sending an email with an attachment containing FMM's personal and health information to an insurance broker, Mr Howes, in circumstances where he opened the email but deleted it before reading the attachment ("the conduct"). It follows from the definitions of "conduct" in s 52 of the PPIP Act and s 21(1)(a) of the HRIP Act that both the agency on internal review under s 53 of the PPIP Act, and the Tribunal when conducting an administrative review, must determine whether the conduct or alleged conduct comes within any of the definitions in s 52(1) of the PPIP Act or s 21(1) of the HRIP Act. I n this case, among other things, FMM alleged that the conduct was in breach of s 18 of the PPIP Act and clause 11 of Schedule 1 of the HRIP Act. That is, FMM identified an alleged contravention by a public sector agency of an information protection principle that applies to the agency within s 52(1)(a) of the PPIP Act and an alleged contravention of a health privacy principle that applies to the agency within s 21(1)(a) of the HRIP Act. 2. Whilst the internal review provision in the ADR Act (s 53) is disapplied by s 52(4) of the PPIP Act, s 55(3) of the PPIP Act makes it clear that certain provisions of the ADR Act still apply: (3) Nothing in this section limits any other powers that the Tribunal has under Division 3 of Part 3 of Chapter 3 of the Administrative Decisions Review Act 1997. 1. Section 63 of the ADR Act is in Division 3 of Part 3 of Chapter 3. Section 63(1) empowers the Tribunal, when determining an application for an administrative review, to decide what the "correct and preferable decision is" and to affirm, vary or set aside the decision. 63 Determination of administrative review by Tribunal (1) In determining an application for an administrative review under this Act of an administratively reviewable decision, the Tribunal is to decide what the correct and preferable decision is having regard to the material then before it, including the following: (a) any relevant factual material, (b) any applicable written or unwritten law. (2) For this purpose, the Tribunal may exercise all of the functions that are conferred or imposed by any relevant legislation on the administrator who made the decision. (3) In determining an application for the administrative review of an administratively reviewable decision, the Tribunal may decide: (a) to affirm the administratively reviewable decision, or (b) to vary the administratively reviewable decision, or (c) to set aside the administratively reviewable decision and make a decision in substitution for the administratively reviewable decision it set aside, or (d) to set aside the administratively reviewable decision and remit the matter for reconsideration by the administrator in accordance with any directions or recommendations of the Tribunal. 1. The effect of an administrative review decision is set out in s 66 of the ADR Act: 66 Effect of administrative review decision (1) A decision determining an application for an administrative review under this Act of an administratively reviewable decision takes effect on the date on which it is given or such later date as may be specified in the decision. (2) If any such decision varies, or is made in substitution for, an administrator's decision, the decision of the Tribunal is taken: (a) to be the decision of the administrator (other than for the purposes of an administrative review under this Act), and (b) to have had effect as the decision of the administrator on and from the date of the administrator's actual decision, unless the Tribunal orders otherwise. 1. The meaning of "correct and preferable" in s 63(1) of the ADR Act is that if there is only one possible decision open on the facts as found, and applying the law, the Tribunal must make the "correct" decision. If the relevant statutory provision requires the exercise of discretion, the decision must also be the preferable decision from a range of possible decisions. The phrase "correct and preferable" appears to be derived from jurisprudence concerning the functions of the Administrative Appeals Tribunal (the AAT), in particular the comments of Bowen CJ and Deane J in Drake v Minister for Immigration and Ethnic Affairs (1979) 24 ALR 577; (1979) 2 ALD 60 at ALR 589 and 591. Their Honours indicated in that case that, when engaging in merits review, the AAT was required to ask itself whether the decision under review was the correct or preferable one on the material before it. Referring to that decision, Kiefel J (as her Honour then was) commented in Shi v Migration Agents Registration Authority (2008) 235 CLR 286 at 327 [140]: "Preferable" is apt to refer to a decision which involves discretionary considerations. A "correct" decision, in the context of review, might be taken to be one rightly made, in the proper sense. (footnotes omitted) 1. Those observations are useful guides to the meaning of the statutory language used in s 63(1) of the ADR Act. 2. The administratively reviewable decision in this case is (or includes) the alleged conduct of the agency. Applying s 7 of the ADR Act (definition of administratively reviewable decision) and s 63(1) of that Act, the Tribunal must decide what the "correct and preferable" decision is based on the relevant facts and the applicable law. There is some complexity in applying the word "decision" in the context of the privacy legislation. As Kirk JA observed in Wojciechowska v Secretary, Department of Communities and Justice [2023] NSWCA 191 (Wojciechowska) at [119] (Mitchelmore JA and Griffiths AJA agreeing), "there are tensions at play here." His Honour observed (at [119]-[120]): "119 . . . As explained above at [63]-[64], under s 63(3), within that division of the ADR Act, the Tribunal may decide to affirm, vary or set aside the decision under review. If it varies or makes a substitute decision then that decision is taken to be the decision of the administrator and, unless otherwise ordered by the Tribunal, with effect on and from the date of the administrator's actual decision: s 66. It follows from s 55(3) of the PPIP Act that the Tribunal can choose simply to vary, substitute or affirm a decision made by the agency, in which case it is standing in the shoes of the administrator. If it limits itself in that way, then the provision in s 66(2) of the ADR Act that such a decision is taken to be that of the administrator is apposite. 120 However, s 55(2) of the PPIP Act goes further than s 63(3) of the ADR Act. When exercising those powers the Tribunal is not merely standing in the shoes of the agency. The powers of the Tribunal set out in s 55(2) of the PPIP Act are distinct powers, expressed differently to the powers given to the agency itself in s 53(7) of that Act. Further, the orders it may make under s 55(2) are not ones made in the voice of the agency; rather, they are orders directed to the agency requiring it to take the identified action. The characterisation in s 66(2) of the ADR Act is inapposite for such an order." 1. As the Court of Appeal observed in Wojciechowska at [120], the Tribunal has powers under s 55(2) of the PPIP Act to make "orders directed to the agency requiring it to take the identified action." Those are not "decisions" which the agency could make (other than on or following an internal review). On the other hand, s 63(3) of the ADR Act authorises the Tribunal to set aside the "administratively reviewable decision" and substitute its own "decision" for "the administratively reviewable decision it set aside." We need to consider whether the Tribunal's "decision," for the purposes of s 63(3) of the ADR Act, may include a determination about the agency's contravention of a privacy principle (as it did here). 2. We doubt whether the word "decision" in s 63(3) of the ADR Act should be construed as being limited to the conduct under review when the enabling legislation is (as here) the PPIP Act. It is not possible for the Tribunal to "set aside" a collection, use or disclosure of information (which are all forms of conduct under the PPIP Act and HRIP Act) once that conduct has occurred. It is possible for the Tribunal, if reviewing an alleged refusal to provide access to, or to amend, personal or health information under s 14 or 15 of the PPIP Act or clause 7 or 8 of Sch 1 to the HRIP Act, to set aside that decision and to substitute a decision to provide access to the information. In those contexts, "decision" in s 63(3) of the ADR Act could refer to conduct. 3. We consider that the term "administratively reviewable decision" in s 63(3) of the ADR Act, in its application to a review of conduct under the PPIP Act, extends to the findings made on internal review and the decision as to the proposed action to be taken. Each of those findings and decisions as to proposed action is "a decision of an administrator over which the Tribunal has administrative review jurisdiction" within s 7(1) of the ADR Act. That is because the enabling legislation, the PPIP Act, provides that applications may be made to the Tribunal for an administrative review under the ADR Act of those findings or decisions as to the proposed action to be taken by the agency (see ADR Act, s 9(1)). 4. Subsection 53(8) of the PPIP Act requires a public sector agency, after the completion of an internal review, to notify the applicant in writing of the findings of the review, the proposed action to be taken, the reasons for those findings and proposed action, and the applicant's right to have those findings and proposed action administratively reviewed by the Tribunal. Section 55(1) of the PPIP Act provides that a person who is not satisfied with the findings of the internal review or the action taken by the agency may apply to the Tribunal for an administrative review of the relevant conduct. Whilst the review is specified to be of "conduct," it is implicit in s 53(8)(c) and 55(1) of the PPIP Act that the Tribunal is also required to review the internal review findings and the agency's subsequent decision about what action it will take: see PPIP Act, ss 53(7) to (8) and 55(1)(b)). It must do so in order to make any of the orders specified in s 55(2) of the PPIP Act and to determine what the correct or preferable decision is under s 63(1) of the ADR Act. 5. Support for the proposition that the findings on internal review constitute an administratively reviewable decision within the ADR Act, and an internally appealable decision within the NCAT Act, can be found in the way the Court of Appeal has interpreted the damages remedy in s 55(2)(a) of the PPIP Act. A finding that the agency has contravened an information protection principle or a privacy code must be made before an order for compensation can be made under that provision: Wojciechowska at [129] per Kirk JA (Mitchelmore JA and Griffiths AJA agreeing). This is consistent with the approach taken by the Appeal Panel of the former Administrative Decisions Tribunal in KP v Narrandera Shire Council (GD) [2011] NSWADTAP 15 at [24] where the Tribunal decided that s 55 of the PPIP Act requires the Tribunal to review the conduct and make a finding as to whether or not there has been a contravention of an information protection principle (or other contravention or disclosure as defined in s 52(1)) before deciding to take no action. 6. Further support for the conclusions that a determination as to whether conduct contravenes a privacy principle is an administratively reviewable decision within the ADR Act, and that Orders 5 and 6 are internally appealable decisions within the NCAT Act, can be drawn from the near-identical definitions of the word "decision" in s 6(1) of the ADR Act and s 5(1) of the NCAT Act. Section 5(1) of the NCAT Act provides: (1) In this Act, decision includes any of the following— (a) making, suspending, revoking or refusing to make an order or determination, (b) giving, suspending, revoking or refusing to give a certificate, direction, approval, consent or permission, (c) issuing, suspending, revoking or refusing to issue a licence, authority or other instrument, (d) imposing a condition or restriction, (e) making a declaration, demand or requirement, (f) retaining, or refusing to deliver up, an article, (g) doing or refusing to do any other act or thing. 1. The definitions in s 6(1)(a) of the ADR Act and s 5(1)(a) of the NCAT Act (making an order or determination) and s 6(1)(e) of the ADR Act and s 5(1)(e) of the NCAT Act (making a declaration) are relevant in the context of the facts of this case. Order 6 is, at least, the making of a determination or declaration, if not the making of an order. In People with Disability Incorporated v Minister for Disability Services [2011] NSWCA 253, the Court of Appeal considered the relevantly identical definition of "decision" in s 6(1) of the Administrative Decisions Tribunal Act 1997 (NSW). Beazley JA (Allsop P and Handley AJA agreeing) noted at [114]-[115] that the use of "include" in a definition is generally a "non-exhaustive word of enlargement" and that a "definition should be read down only if that is clearly required … [and] especially so when a definitional provision is relevant to jurisdiction". 2. For these reasons, s 63(1) of the ADR Act empowers the Tribunal to determine the correctness (or otherwise) of an internal review finding that the agency engaged in a contravention of an information protection principle or a health privacy principle (PPIP Act, s 52(1)(a), HRIP Act, s 21(1)(a)), being an administratively reviewable decision. The Tribunal's Orders 5 and 6 varied the "decision under review" and made a decision in substitution about the agency's contravention of the privacy principles. The "decision under review" was, in this context, presumably intended to be a reference to the internal review finding (being that the agency had breached IPP 11 and HPP 11), because the conduct under review was not capable of variation. Orders 5 and 6 constitute a finding or determination that the agency's conduct constituted a breach of s 18 of the PPIP Act and clause 11 of Schedule 1 of the HRIP Act. The orders were, in effect, decisions of the Tribunal that the agency's conduct was not the "correct and preferable" conduct because that conduct contravened an information protection principle and a health privacy principle that applied to the agency; they were also decisions that the internal review findings were not correct and preferable and that they should be varied. 3. The Tribunal's Orders 5 and 6 were also internally appealable decisions. 4. The Appeal Panel noted in Australian Press Council Inc v Southey [2022] NSWCATAP 127 at [31], that the meaning of "decision" may be more confined when used in relation to decisions of the Tribunal as compared with decisions by administrators in agencies. In the Appeal Panel's view, it seemed unlikely that every finding of law made in the course of the Tribunal's written reasons constitutes a "decision". At [32]–[33] of Southey, the Appeal Panel applied the distinction drawn by Mason CJ in Australian Broadcasting Tribunal v Bond (1990) 170 CLR 321 between an "ultimate or operative determination" and a conclusion reached as a step along the way in a course of reasoning leading to an ultimate decision. 5. If the Tribunal had been exercising administrative review jurisdiction in relation to a "decision" as that word is commonly understood (as distinct from conduct), there could be no doubt that a finding or determination that the decision was not the correct and preferable decision and should be varied would constitute a "any decision made by the Tribunal in proceedings for ... (an) administrative review decision" and thus come within the definition of an "internally appealable decision": NCAT Act, s 32(1)(a) and s 32(4). Similarly, the findings or determinations in Orders 5 and 6 were "decisions" made by the Tribunal in "proceedings for … (an) administrative review decision": NCAT Act, s 32(1)(a) (word in brackets added.) 6. For the reasons we have given, the Tribunal's determination in Orders 5 and 6 were not steps along the way in the reasoning process. They were ultimate or operative decisions made in the exercise of the Tribunal's powers in s 63(1) of the ADR Act to decide what the correct and preferable decision is and to affirm, vary or set aside that decision. Order 6 constituted a substitution of the Tribunal's findings as to the agency's contravention of the privacy principles for those of the internal reviewer. Is the appeal moot? Background 1. The agency appeals from the Tribunal's decision that it has breached the non-disclosure principles in the PPIP Act and the HRIP Act, but not from the Tribunal's order that the Nominal Insurer pay FMM $20,000. (For the reasons we have given, we have amended the name of the respondent in the proceedings below to Insurance and Care NSW.) That omission raises the question as to whether the appeal should be dismissed as moot because any decision made by the Appeal Panel would have no practical outcome for either party. 2. The Tribunal has power under s 55(1)(b) of the NCAT Act to dismiss an appeal if it considers that the proceedings are misconceived or lacking in substance. That power includes dismissing an appeal because it is moot. The Appeal Panel set out the relevant legal principles applicable to moot appeals in Secretary, Department of Communities and Justice v Feeney [2021] NSWCATAP 139 at [10]-[11]: 10 The most recent and authoritative discussion of the relevant principles can be found in Hunter Development Corporation v Save our Rail NSW Incorporated (No 2) [2016] NSWCA 375; 93 NSWLR 704 (Hunter Corporation). At [34], Beazley P (as her Excellency then was) quoted the High Court's explanation for the general rule in Bass v Permanent Trustee Company Ltd (1999) 198 CLR 334; [1999] HCA 9 at [47]: Because the object of the judicial process is the final determination of the rights of the parties to an action, courts have traditionally refused to provide answers to hypothetical questions or to give advisory opinions. 11 In Jardin v Metcash Ltd [2011] NSWCA 409 (Jardin) at [35], Campbell JA (Young JA and Meagher JA agreeing) went so far as to say that: "[I]t could only be in rare circumstances, if ever, that a court was justified in reaching a decision on legal question that had no practical consequences for either of the parties": Gardner v Dairy Industry Authority of New South Wales [1977] 18 ALR 55 at 60, 69. (Underlining added.) 1. FMM submits that the appeal is moot because neither party will be required to take any action regardless of what the Appeal Panel decides. The agency will still have to pay FMM $20,000. However, FMM submits that the Appeal Panel should not dismiss the appeal because the factors in favour of determining the appeal outweigh the factors against doing so. The factors in favour are said to include that the appeal raises a question of general importance to all public sector agencies and it has been argued to its conclusion. Those factors are said to outweigh the fact that there is no question of costs remaining, that the subject matter of the appeal is not likely to affect others and that the appeal did not become moot during the course of the proceedings: People with Disability Australia Inc v Minister for Disability Services [2011] NSWCA 253 at [11]-[15]. 2. The agency submits that the appeal is not moot as it resolves a real controversy between the parties. Alternatively, if the appeal is moot, the agency submits that the Appeal Panel should nevertheless determine the appeal or give the agency leave to amend the Notice of Appeal to appeal from the order that it pay FMM $20,000. Such an amendment would mean that the appeal is no longer moot. Consideration 1. In our view, the appeal is not moot. There is a live controversy between the parties, namely whether the alleged conduct contravenes a privacy principle that applies to the agency. We agree with the agency's submission that if the Tribunal below resolved that controversy, there is no reason in principle why an appeal should be rendered moot because the appellant did not also appeal from the decision about the action to be taken by the agency. 2. Beazley JA described the question of whether the Appeal Panel of the former Administrative Decisions Tribunal had erred in holding that there was no reviewable decision in respect of two accommodation centres as being "a real dispute between the parties" in People with Disability Australia Incorporated v Minister for Disability Services [2011] NSWCA 253 at [12]. That only became "moot" in respect of those centres when the centres closed down. That question is comparable to the question here, being whether the agency contravened the non-disclosure privacy principles in respect of FMM; it is a legal question giving rise to a real dispute between the parties. The question of whether the agency breached the privacy legislation has non-monetary significance for both parties. 3. We are not persuaded by the agency's further submission that the appeal is not moot because the issue as to whether there has been a breach of the PPIP Act or the HRIP Act has two real consequences for the parties. Those consequences are said to be that: 1. If the Appeal Panel sets aside Order 6, that would go some way to restoring the agency's reputation; and 2. FMM has made another application for internal review of the agency's conduct in prosecuting the proceedings before the Tribunal at first instance. The Appeal Panel's determination of whether the agency has breached the PPIP Act or the HRIP Act could inform what action, if any, the agency will consider taking on completion of its internal review. 1. These possible consequences are not the kind of practical or foreseeable consequences that would lead us to conclude that an appeal is not moot. There is no evidence that the agency's reputation has been damaged and the proposition that the outcome of this appeal could affect further action the agency may take in relation to another review is speculative. It is likely that the agency has already had to decide what action to take in the other matter. 2. Even if the appeal is moot in the sense that it has no practical or foreseeable consequences for the parties, it should not be dismissed. The Tribunal retains a discretion to hear and determine a moot appeal: People with Disability Australia Incorporated v Minister for Disability Services [2011] NSWCA 253 at [13]; Jardin and Jardim Investments Pty Ltd v Metcash Ltd [2011] NSWCA 409 at [32]. 3. Order 6 raises a matter of general importance and is likely to affect other cases as it concerns novel facts and the application of the Court of Appeal's judgment in Nasr. The Appeal Panel's determination will clarify whether an agency has disclosed personal or health information when an unintended recipient of an email has not read the personal or health information in that email. For that reason, even if the appeal is moot, we exercise our discretion to hear and determine the appeal. Did the Tribunal misconstrue the meaning of "disclose"? Provisions about disclosure of personal and health information 1. An agency that holds personal information (or health information) must not disclose the information to a person unless certain exceptions apply. None of the exceptions apply in this case. We have underlined the word "disclose" in each relevant provision. Section 18 of the PPIP Act states: 18 Limits on disclosure of personal information (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless— (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. (2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it. 1. Clause 11(1) of Schedule 1 to the HRIP Act is in similar terms, although it contains a greater number of exceptions in paragraphs (a) to (l). Clause 11(1)(a) and (b) provide: (1) An organisation that holds health information must not disclose the information for a purpose (a secondary purpose) other than the purpose (the primary purpose) for which it was collected unless— (a) Consent the individual to whom the information relates has consented to the disclosure of the information for that secondary purpose, or (b) Direct relation the secondary purpose is directly related to the primary purpose and the individual would reasonably expect the organisation to disclose the information for the secondary purpose, or Note— For example, if information is collected in order to provide a health service to the individual, the disclosure of the information to provide a further health service to the individual is a secondary purpose directly related to the primary purpose. Tribunal's reasoning 1. The Tribunal concluded that the agency had disclosed FMM's personal and health information to an insurance broker by mistakenly sending him certain information in an attachment to an email. The insurance broker opened the email but deleted it before opening the attachment. 2. The Tribunal's reasoning on the meaning of the word "disclose" focused on the Court of Appeal's decision in Nasr. In that case the Court was interpreting s 18 of the PPIP Act and s 13 of the Criminal Records Act 1991 (NSW). Section 13 provides that: 13 Unlawful disclosure of information concerning spent convictions (1) A person who has access to records of convictions kept by or on behalf of a public authority and who, without lawful authority, discloses to any other person any information concerning a spent conviction is guilty of an offence. Maximum penalty—50 penalty units or imprisonment for 6 months, or both. 1. In Nasr, the allegation was that the keeper of the records of Waverley Court provided charge sheets containing personal information relating to a spent conviction to a solicitor at the Crown Solicitor's Office. At [127] Campbell JA held (Beazley JA and Hodgson JA agreeing) that in the absence of any "proof or concession" concerning how much the solicitor knew about the convictions before obtaining the charge sheets, the Court was not satisfied that there was any contravention of s 13 of the Criminal Records Act. At [127], the legal principle was stated to be that: The essence of disclosure of information is making known to a person information that the person to whom the disclosure is made did not previously know. (Emphasis added.) 1. The Court cited the following authorities in support of that interpretation: R v Skeen & Freeman (1859) Bell 97; 169 ER 1182 ("uncovering … discovering … revealing … imparting of what was secret … [or] telling that which had been concealed"); Foster v Federal Commissioner of Taxation (1951) 82 CLR 606 at 614-5 ("... a statement of fact by way of disclosure so as to reveal or make apparent that which (so far as the "discloser" knows) was previously unknown to the person to whom the statement was made"); R v Gidlow [1983] 2 Qd R 557 at 559 ("telling that which has been kept concealed"); Dun & Bradstreet (Australia) Pty Ltd v Lyle (1977) 15 SASR 297 at 299; A-G v Associated Newspapers Ltd [1994] 2 AC 238 at 248 ("to open up to the knowledge of others"); Real Estate Opportunities Limited v Aberdeen Asset Managers Jersey Limited [2007] EWCA Civ 197 at [78] ("the revelation of information for the first time"). 1. Nasr was argued in the alternative as an alleged breach of s 18 of the PPIP Act. At paragraph [132] Campbell JA (Beazley JA and Hodgson JA agreeing) held that, for the same reasons as apply in relation to the alleged breach of s 13 of the Criminal Records Act, making the charge sheets available did not involve any disclosure of information under s 18 of the PPIP Act. The information had been "made known" to the solicitor but the Court was not satisfied that the solicitor did not previously know the information. 2. While the words in a judgment are not to be read as if they are provisions in legislation, those words assist in "gaining an understanding of the concepts to which expression was sought to be given": Brennan v Comcare (1994) 50 FCR 555 at 572. The Court of Appeal's decision is binding authority for the concept or general principle that the information must be "made known" to the person for it to be disclosed. The only qualification to that general principle is that making information known to a person will not amount to disclosure where the person to whom the disclosure is made already knew the information. We will refer to these concepts as the "general principle" and the "qualification". 3. The Tribunal below concluded at [88] that Nasr "offers no assistance to the agency having regard to the facts in this case". The Tribunal then made the following five observations, which it described as "findings of fact," seeking to distinguish those circumstances from the circumstances in Nasr: 1. - Unlike the solicitor who obtained charge sheets from the Court related to the Nasrs' spent convictions, Mr Howes had no prior knowledge whatsoever of the applicant's personal and health information contained in the Cost of Claims report, 2. - the email containing the Costs of Claims report did make this information known to Mr Howes. The fact that he did not read it (which I accept) does not mean it was not disclosed to him. The applicant's personal and health information was put in Mr Howes' possession and placed under his control. He could have done anything with it, even if he did not. 3. - Mr Howell was not authorised by the applicant's former employer to receive a Costs of Claims report containing the applicant's personal and health information on its behalf. He had not signed and submitted a Letter of Appointment to the agency certifying that this was the case. He was a stranger to the applicant's workers compensation claim, 4. - The agency 'knew' that the applicant's personal and health information must not be disclosed to Mr Howes. It did so because of 'human error' and inadequate security safeguards protecting this information (as to which see following). The agency does not assert in these proceedings that there is any basis upon which this disclosure was permitted by the PPIP Act or the HRIP Act or any other law. 5. - The fact that Mr Howes acted ethically by deleting the applicant's personal and health information without reading it does not 'cure' its unlawful disclosure to him. 1. For the following reasons, none of these reasons for distinguishing Nasr is persuasive. Meaning of the general principle that information must be "made known" to a person 1. The authorities cited in Nasr contain other words which describe the general principle of making known the information to the person. Those words include "uncovering", "discovering", "revealing", "imparting", "making apparent" and "telling". Each of those words requires that the information be made known to the person, not just that the information is made available. Contrary to the Tribunal's conclusion, placing information in a person's possession or under the person's control (point 2 above) does not make that information known to the person in the sense conveyed by the Court in Nasr. Having access to information is different from knowing the information. FMM's personal and health information was made available to the insurance broker and there was a possibility that the information would be made known to him. But the possibility of knowing information is different from actually knowing the information. 2. It is irrelevant to the question of whether information has been disclosed that the agency knew that the information should not be disclosed (point 4 above), that Mr Howes acted ethically by deleting the information before reading it (point 5 above) or that Mr Howes was not authorised to receive the information (point 3 above). Meaning of the qualification to the general principle 1. To constitute disclosure under s 18 of the PPIP Act, the person to whom the information is "made known" must not have previously known that information. That is the qualification to the general principle that to constitute disclosure the information must be "made known" to the person. The Tribunal purported to distinguish Nasr (point 1 above) on the basis that, unlike the solicitor who obtained charge sheets from the Local Court, Mr Howes had no prior knowledge of FMM's personal and health information. The only significance of that observation is that the qualification to the general principle does not apply in the present case. Just because the facts were different in Nasr does not mean that the general principle does not apply. Concept of "disclose" in Nasr is consistent with principles of statutory interpretation. 1. The ordinary grammatical meaning of the words in s 18 of the PPIP and clause 11 of Sch 1 to the HRIP Act is consistent with the concept of disclosure set out in Nasr. We agree with the agency's analysis that those provisions contemplate a specific interaction between a discloser and a recipient of information. Section 18 of the PPIP Act provides that an agency (the subject) must not disclose (verb) information (direct object) to a person or other body (indirect object). Clause 11 of Sch 1 to the HRIP Act makes similar provision, except that it does not specify the indirect object (the person or body to whom information must not be disclosed); this is implicit. The verb "disclose" refers to an action performed by or on behalf of the agency but it is a transitive verb. It has a direct object, "information", which in turn is received by the indirect object, "a person or other body". Section 18 of the PPIP Act and clause 11 of Sch 1 to the HRIP Act do not contemplate a unilateral action by the agency, but an interaction between the agency and the person to whom the disclosure is made. The person to whom the disclosure is made must receive the information before the information can be said to have been disclosed. 2. It follows that we do not accept the Privacy Commissioner's submission that the "conduct" of disclosing information is confined to actions of the agency. The submission was made that the question of whether a third party becomes aware of information should only be considered when assessing whether loss has occurred. While the conduct is that of the agency, the issue is whether that conduct contravenes the relevant legislation. For the reasons we have given, in this case the alleged contravention is disclosing the information to a person in the sense of making that information known to the person. The assessment of loss is informed by the effect that the disclosure to a third party has on the applicant. 3. The Court of Appeal's interpretation of the word "disclose" in Nasr is also consistent with a purposive construction of the relevant provisions. Where no personal information has been made known to a person, even if that person could have accessed the information, the privacy of the individual to whom the information relates will not have been compromised. 4. A separate question may arise, as it did in this case, as to whether reasonable security safeguards were in place to protect the information against unauthorised disclosure under s 12(c) of the PPIP Act or clause 5 of Sch 1 to the HRIP Act. If there are reasonable safeguards in place, and the information has not been made known to any person, there is no purpose served in finding that the agency has disclosed the information. 5. We are not assisted by the meaning given to the word "disclose" in other legislation including the Government Information (Public Access) Act 2009 (NSW) (GIPA Act), the Public Interest Disclosures Act 2022 (NSW) (PID Act) or the Privacy Act 1988 (Cth). Section 18 of the PPIP Act and clause 11 of Sch 1 to the HRIP Act were enacted before the GIPA Act and the PID Act. Parliament could not have had those statutes in mind when enacting s 18 of the PPIP Act. Furthermore, the term "disclose" is a defined term in both the GIPA Act and the PID Act, but not in the PPIP Act. 6. The Privacy Act 1988 (Cth) is federal legislation. While the AAT has found that "disclose" in the context of that legislation "is not limited only to the revelation of what is not known to the would be recipient of the information", that is not the case for s 18 of the PPIP Act: Pratt Consolidated Holdings Pty Ltd v Commissioner of Taxation [2011] AATA 907 at [112]–[119] and Nasr. 7. Finally, for the reasons we have given, we do not accept FMM's submission that the interpretation of "disclose" put forward by the agency is repugnant to public policy. That interpretation is consistent with the ordinary grammatical meaning of the word "disclose" in s 18 of the PPIP Act and clause 11 of Sch 1 to the HRIP Act, and with the purpose of that legislation. It is also consistent with binding authority (Nasr). Given our conclusion, it is not necessary to address the further submissions as to the proper construction of those provisions. Tribunal's Orders below 1. The Tribunal's orders, in full, were as follows: (1) A further oral hearing in relation to the description of iCare NSW and the proper respondent to the application is dispensed with in accordance with s 55(1)(c) of the Civil and Administrative Tribunal Act 2013 (NSW). (2) The name "iCare NSW" is amended to "Insurance and Care NSW t/a iCare NSW". (3) Insurance and Care NSW t/a iCare NSW is removed as the respondent to the application. (4) The name of the respondent is amended to Workers Compensation Nominal Insurer. (5) The decision under review is varied. (6) In variation of that decision the Tribunal determines that the conduct of the agency constituted a contravention of Information Privacy Principles 5 and 11 (ss 12(c) and 18 of the Privacy and Personal Information Protection Act 1998) and HPP 5 and 11 (clauses 5(1)(c) and 11 of Schedule 1 of the Health Records and Information Privacy Act 2002). (7) The Nominal Insurer must pay FMM $20,000.00 immediately. (8) By 30 June 2024 the Nominal Insurer must ensure that its agent Insurance and Care NSW t/a iCare designs and implements a secure on-line portal for the making available of Cost of Claims reports pursuant to s 147 of the Workers Compensation Regulation 2016 (NSW). Access to Costs of Claims reports via the portal must only be available to persons who authenticate their identity and entitlement to access the report by a unique electronic password or key. (9) By 30 September 2023 the Nominal Insurer must ensure that its agent Insurance and Care NSW t/a iCare institutes the following security safeguards in relation to the present broadcast method of distribution of Cost of Claims reports: - Distribution lists must be cross-checked against Costs of Claims reports by two senior officers with this designated responsibility each of whom must certify in writing the accuracy of the distribution before any email containing Costs of Claims reports is released, - Emails containing Cost of Claims reports must be encrypted such that they are only capable of being opened and read by the person for whom they are intended upon submission of a unique electronic password or key, - Each Cost of Claims data file must also be password protected such that it is only capable of being opened by the person for whom it is intended upon submission of a unique electronic password or key. (10) The application is otherwise dismissed. (11) The publication or broadcast of the name of the applicant is prohibited pursuant to s 64(1)(a) of the Civil and Administrative Tribunal Act 2013 (NSW). (12) The publication or broadcast of the names of the persons other than the applicant listed in column G under the heading "Worker Name" of the spreadsheet contained in the confidential supplementary bundle of documents filed by the agency pursuant to s 58 of the Administrative Decisions Review Act 1997 (NSW) on 25 November 2022 is prohibited pursuant to s 64(1)(a) of the Civil and Administrative Review Act 2013 (NSW). Note: A reference to the name of a person includes a reference to any information, picture or other material that identifies the person or is likely to lead to the identification of the person. (13) The publication of the spreadsheet contained in the confidential supplementary bundle of documents filed by the agency pursuant to s 58 of the Administrative Decisions Review Act 1997 (NSW) on 25 November is prohibited pursuant to s 64(1)(c) of the Civil and Administrative Tribunal Act 2013 (NSW). (14) Disclosure to the applicant of the spreadsheet contained in the confidential supplementary bundle of documents filed by the agency pursuant to s 58 of the Administrative Decisions Review Act 1997 (NSW) on 25 November 2022 is prohibited pursuant to s 64(1)(d) of the Civil and Administrative Review Act 2013 (NSW). Orders 1. The Appeal Panel makes the following orders: 1. The appeal is allowed. 2. Orders 2, 3 and 4 of the Tribunal are set aside. In substitution for those orders, the following order is made: The correct respondent is Insurance and Care NSW. 3. Insurance and Care NSW is substituted for Nominal Insurer as the proper name of the respondent in FMM v Nominal Insurer [2023] NSWCATAD 114. 4. Order 3 takes effect from the commencement of proceedings in FMM v Nominal Insurer [2023] NSWCATAD 114. 5. Orders 5 and 6 of the Tribunal are set aside. In substitution for those orders, the following order is made: The internal review findings that the agency contravened information protection principle 11 and health privacy principle 11 are set aside and in substitution for those findings it is determined that the conduct of the agency contravened s 12(c) of the Privacy and Personal Information Protection Act 1998 and clause 5(1)(c) of Schedule 1 to the Health Records and Information Privacy Act 2002. 6. Order 7 is varied so as to delete the words "Nominal Insurer" and substitute the words "the respondent". 7. Order 8 is varied so as to delete the words "the Nominal Insurer must ensure that its agent Insurance and Care NSW t/a iCare designs and implements" and substitute the words "the respondent must design and implement". 8. Order 9 is varied so as to delete the words "the Nominal Insurer must ensure that its agent Insurance and Care NSW t/a iCare institutes" and substitute the words "the respondent must institute". ********** I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar Amendments 24 May 2024 - paragraph 68 of the decision in Insurance and Care NSW v FMM [2024] NSWCATAP 43 "did not previously know the information" changed to "already knew the information". DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 24 May 2024